A Visual History of Spam 180
Cristiano writes "Microsoft employee Raymond Chen has saved every spam message and virus-laden e-mail he's received at work since 1997 and graphed the spams and viruses to create a cool visual representation of one man's malicious traffic."
"one man's malicious traffic" (Score:4, Funny)
Sounds like a cool title for a future book about Gill Bates.
Re:"one man's malicious traffic" (Score:2, Interesting)
I'm waiting until Monday (Score:2)
Re:I'm waiting until Monday (Score:2)
Heh, you obviously don't know who Raymond Chen is.
Obvious (Score:2, Funny)
Re:Obvious (Score:5, Insightful)
Re:Obvious (Score:1)
RTFB (Score:5, Informative)
Read this article [joelonsoftware.com] which is all about his quest for windows and developer backwards compatiblity.
He give this story about Sim City: It deallocated memory, and then used it right after deallocation. It was a bug that windows 95 allowed. So his code make a special check that you were running sim city and if you were, you could use memory right after you deallocated it. It's pretty amazing to see all the hoops that he and his team jump through. But he's a MSFT ledgend.
PS. That blog entry I linked to sent Shockwaves through Microsoft. It's changed the new XML api design, and resulted in the backporting of Avalon to Windows XP.
Re:Obvious (Score:2)
...it was a slow day on slashdot... (Score:5, Funny)
Re:...it was a slow day on slashdot... (Score:2)
Was it a giant bee guy stepping on a penguin?
Re:...it was a slow day on slashdot... (Score:4, Funny)
Re:...it was a slow day on slashdot... (Score:2)
Re:...it was a slow day on slashdot... (Score:2)
Stuart
Insert random amounts of stuff to evade the lameness filter. Yes, I know it's like yelling, that's the whole point.
Re:...it was a slow day on slashdot... (Score:3, Funny)
Re:...it was a slow day on slashdot... (Score:3, Funny)
A schooner IS a sailboat, stupidhead.
Re:...it was a slow day on slashdot... (Score:2)
Wait! Something is wrong here!
I used to work with this guy (Score:1)
Raymond Chen in Linux source CREDITS (Score:5, Interesting)
N: Raymond Chen
E: raymondc@microsoft.com
D: Author of Configure script
S: 14509 NE 39th Street #1096
S: Bellevue, Washington 98007
S: USA
Good work (Score:4, Funny)
Re:Raymond Chen in Linux source CREDITS (Score:5, Interesting)
Re:Raymond Chen in Linux source CREDITS (Score:2)
Yes, it's confirmed [msdn.com].
Re:Give me a break on how good this guy seems (Score:2)
In the end, I think his point is that that email is probably less likely to have been picked up by all the more recent spam-related worms and the like, so it shouldn't be viewed in the same light as currently used addresses that potential
Re:Raymond Chen in Linux source CREDITS (Score:2, Insightful)
What does this figure represent? (Score:1)
Re:What does this figure represent? (Score:2)
Re:What does this figure represent? (Score:1)
I agree that this chart doesn't visually represent the amount of spam as much as I would like, it would be simpler (and more informative) if it was broken up into two graphs: Total size over time, and number of messages over time.
Of course the author doesn't intend this to be any kind of serious study. I think he just wanted something
Only 19000 spam messages?? That's nothing. (Score:3, Interesting)
Re:Only 19000 spam messages?? That's nothing. (Score:1)
Re:Only 19000 spam messages?? That's nothing. (Score:4, Insightful)
Umm.. so your the average? Have you ever thought that maybe you are on the high-end of the bell curve.
Raymond Chen is less then you in the amount of spam received, who knows maybe he is exactly the average.
Why don't you poll people and find out.
I would but I dodn't care.
Re:Only 19000 spam messages?? That's nothing. (Score:2)
Re:Only 19000 spam messages?? That's nothing. (Score:2)
Only 500 spam messages? (Score:2)
500 per day? (Score:2)
(As an aside, the article on Raymond's site says that this is the e-mail he receives after it passes through the corporate filters).
Re:500 per day? (Score:2)
I agree with most of your observations. For instance, the gap in the graph could indeed be a change in technique more than anything else.
I also think the graphs are misleading and are simply measuring the effectiveness of Microsoft's corporate filters rather than actual spam. Since we are not looking at t
Single worst spam day by number of messages: Augus (Score:5, Informative)
Re: (Score:2)
Re:Single worst spam day by number of messages: Au (Score:2, Funny)
I'm a mere minnow in comparison to your good self: Just 57 per day, on average.
Me off to stuff a pair of socks into my pants...
Re:Single worst spam day by number of messages: Au (Score:2)
My mail-account is online since 1998. I didnt keep it secret, just didnt do stupid things with it (like sign up adult sites or so).
get 3-7 spams per day. annoying, but thunderbirds only lets 1 or 2 per week slip, so its ignorable.
The only ways people get 500 per day must be in their own stupidity.
(btw: this email-address is also in the whois database. IN fact i only started to get spam regularly after i registred my domain. coincidence?)
I don't think so (Score:2)
I probably get 500 spams a day, but I don't think it's because I'm stupid.
I have an email address (MyFullName@MyCompanyName.com) that I've been using for well over a decade for a personal business. I don't plan to change either my name or my company name.
When I would be a speaker at some event or teach a seminar, the organizers would always include my email address as part of the speaker bio, which started going up on the Web when the W
Re:Single worst spam day by number of messages: Au (Score:2)
I thank God for Bayesian filtering every day, I usually only see 1 or two spam every few days.
It's the Visual part that scares me (Score:5, Funny)
Jose nazario might have more spam graphs (Score:5, Interesting)
One of several talks of his on spam (complete with more graphs): http://www.linuxchile.cl/docs.php?op=verVersion&do c=64&id=1 [linuxchile.cl]
And he's even done generated some really really horribly insane spam collages, but I'll let those interested dig around for them on their own.
Re:Jose nazario might have more spam graphs (Score:3, Interesting)
Sorry for posting off-topic, but it's a slow news days, anyway - none of the stories today has gotten more than 250 comments.
Not exactly "reader friendly" (Score:4, Insightful)
Single worst day was only 67? (Score:3, Interesting)
This guy needs to get out more. I set up monitoring of all my spam and total message traffic for the last couple years. My current average is around 350-450 spams per day. Check out the spam report I run every night [homeport.org].
Virii? That's a different report. I seperate my virii out of the entire mail feed for the 3-4 domains I run (yay amavisd and postfix). The virii report [homeport.org] is a lot more variable, with as many as 1600 viruses a day, and as few as 10, though that's pretty rare.
Spam filtering here is done via amavisd + postfix + spamassassin + some custom rules.
Re:Single worst day was only 67? (Score:3, Insightful)
OTOH, he could just be a man with low span suseptibility :)
Re:Single worst day was only 67? (Score:2)
It looks like you need to get out more!
Re:Obligatory virii correction (Score:2)
Weak! (Score:2)
RTFA instead of looking at the pretty picture (Score:2, Interesting)
Note that this chart is not scientific. Only mail which makes it past the corporate spam and virus filters show up on the chart.
*DOH*
Re:RTFA instead of looking at the pretty picture (Score:3, Insightful)
Eh? Care to explain that statement? Microsoft didn't write the first spam, didn't create the open protocol that enables spam to be sent so easily, and doesn't run the biggest ISPs where spam is sent from, though its Hotmail users seem to be quite susceptible to receiving it. So how is Microsoft responsible for virtually al
How I avoid spam. (Score:3, Interesting)
When I was back in school I never had spam in my university account, but that was before the 2002 spike shown on his graph. I wonder if school email accounts are still off limits. When I was in school, I did not get spam there, it was my "free" email accounts that had spam.
Mailinator (Score:2, Informative)
Have you head of Mailinator [mailinator.com]?
Basically, you can make up any e-mail address, say foobar2004@mailinator.com and go and check it later. All you have to do is type in your chosen name and check for mail. It's useful for websites you don't really trust (but not for those you might continually receive useful mail from). And, of course, it's incredibly unsuitable for any personal information, since anyone can check any "account" if they can guess its name. And e-mails only stay for a certain number of hours/days.
School accounts off limit? Hah. (Score:2)
More likely your school has a kick-ass spam filter or something like that. My school account got hundreds of spams a day, and my classmates seemed to think that was about average.
Kept all his spam!?! (Score:2)
Re:Kept all his spam!?! (Score:2)
Problem with deleting on servers (Score:2)
Only my whitelist ( which runs before the spam filter ) saves me on this..
1997? (Score:1)
Let's get this message out! (Score:2, Funny)
I think we should all email it out to everyone we know.
In case of /.ing (Score:2)
Missing graph (Score:2)
another graph (Score:3, Funny)
I'd like to have saved every BSOD that I've received since 1997 and make a cool visual representation, too, but the system crashes each time I get one... so much for data retention.
DT
Re:another graph (Score:2)
This has been done before (Score:5, Funny)
Irony (Score:4, Funny)
Aargh! My irony meter has gone off the scale!!
Should we rewrite SMTP (Score:2)
It boggles the mind to think about how much bandwidth is wasted on the useless trash that spam is. Not to mention just time spent with dealing with that. How much money is lost each year overall due to spam... the number must be huge. This is an unnecessary loss of money and time.
I think this problem will just escalate for as long as we have SMTP in use. So maybe SMTP as a protocol needs a rehaul, or a revision to rewrite it completely (and call it something different). I think it wouldn't be impossible to
Re:Should we rewrite SMTP (Score:2, Insightful)
OK, I'll go first (Score:2)
Sure. In the meanwhile, why don't you have a look at how X.400 mail was done, for some perspective. At the protocol level, SMTP works but only if everyone plays nice, I'm sorry to say. The protocol state machine is also too complex, it could be much simpler: 1. here's the recipient, 2. here's the mail. The server could disconnect the sender in either 1 or 2. Sender and other stuff is matter of the message representation (if you need signatures to prove the identity, or what ever).
HELO/EHLO is a hack in SMT
Re:Should we rewrite SMTP (Score:2)
Waste of time.
Every month someone suggests that there's a technological solution to this problem. But there isn't. This isn't a tech problem. It's a law-enforcement/sociological problem.
You can only go so far technologically as long as spammers are allowed to compr
Re:Should we rewrite SMTP (Score:2)
You can only go so far technologically as long as spammers are allowed to compromise peoples' computers and use them for improper activities.
So, rewrite the mail system in such a way that each mail sent requires the sender's computer to crack a small computational puzzle, which takes e.g. 10 seconds. That's a technological solution. It restricts you so that you can only send 6 mails per minute. For normal use, this is more than enough: in 10 minutes you can send 60 mails. However, you cannot achieve thro
Re:Should we rewrite SMTP (Score:2)
How is this any form of improvement? Penalize everyo
Doesn't work (Score:2)
How is this any form of improvement? Penalize everyone on the planet because of spammers? Force an entire worldwide network systems upgrade? Slow down mail service exponentially?
How many times do you send more than 100 mails per day? How many times do you send more than 5 mails per minute? A normal user doesn't. And those who legitimately do, are so few that a new kind of system could be worked out for them.
Make it impossible to send large numbers of mail. That's a solution which works. Systems upgrade,
Re:Doesn't work (Score:2)
This doesn't work. Think zombie machines in some ISP's network.. Windoze machines which the ISP considers trusted, most likely, since it's their customers we're talking about. The mail server is licensed, all right, but the zombie client can pump out a million messages through that licensed server.
It does work. Like you said earlier, smart relays should trigger an alarm if any single client starts to send out too much mail, but that should be
Re:Doesn't work (Score:2)
If the ISP can't control their internal clients, then they deserve to lose their SMTP license.
How the hell do you expect some ISP to control what's being run and downloaded in some Windows box of a home user who has no clue of security? It's impossible. The ISPs can't even keep each Windows box in their network up-to-date with security patches! So it's just not going to happen. The ISP can shut the box down, but that is after the damage has been done.
You obviously don't have much experience in this are
Re:Doesn't work (Score:2)
Telnet was not replaced with SSH. That's an invalid analogy. SSH was an *alternative* to Telnet th
Re:Doesn't work (Score:2)
Take a deep breath and this time please READ at least the following three paragraphs before answering, since what you answered to was definitely not the reasons why I consider SMTP to be obsolete.
1. By redefining the protocol I want the protocol to be simpler, and utilize a hashcash-like system in its very core. (If you don't know what hashcash is, Google it up now or read paragraph 2)
2. By using a hashcash-like computational puzzles, it just is PHYSICALLY IMPOSSIBLE for anyone to send large numbers of ma
Re:Doesn't work (Score:2)
Re:Doesn't work (Score:2)
That's like creating a web site that can only handle one visitor every seven seconds. What's the point? Why even bother?
If you have a web server running on a Gameboy with 10 bits per second bandwidth, you might want to do this. In other words, if the bandwidth resource or server resource is very scarce, you might want to limit the usage.
Also, I don't see how the mail service would be slowed down beyond usage. People poll their mail (POP/IMAP/web interface/whatever) with intervals being in minutes, so as
Re:Doesn't work (Score:2)
Yes, a normal person doesn't send 100s of mail an hour, BUT a normal mail server DOES handle 100s of legitimate mail an hour. And if you impose a stupid computational hash routine on each connection, you cut down on the effici
Re:Doesn't work (Score:2)
Yes, a normal person doesn't send 100s of mail an hour, BUT a normal mail server DOES handle 100s of legitimate mail an hour. And if you impose a stupid computational hash routine on each connection, you cut down on the efficiency of the mail server exponentially.
Yes, relaying would be problematic, and that's why the protocol itself would have to undergo some changes. Or the "exchangeable hashcash" could be utilized as a Proof-of-Work in the receiving end (still can't remember the author!!).
But you did
Re:Doesn't work (Score:2)
Whoever does the cpu work is irrelevant. It would be reasonable to assume that during the process of the client calculating the proper response, a socket would remain open
Re:Doesn't work (Score:2)
Whoever does the cpu work is irrelevant. It would be reasonable to assume that during the process of the client calculating the proper response, a socket would remain open to the server, thus wasting precious resources.
No, it is not quite irrelevant. The client has to do it - it has to be done by the one who is sending. It would also not be reasonable to keep the socket open due to the DoS possibility, as you mentioned.
And in the stateless environment of the Internet, how does the server allow the clien
I wonder how many Raymond Chens are out there ... (Score:2)
Quite the troublemaker he was, but he was fun too :)
He saved copies (Score:2, Funny)
2002 was a big year for spam (Score:4, Funny)
Cry Me a River (Score:2)
I want to know why this guy has only received 3,500 spams since 1997?
1-800-WAA-AAAH!
Cheez!
My own plots.... (Score:2)
Re:My own plots.... (Score:2)
Also, I notice you're plotting daily stats, so of course you're going to see a huge randomness to it. Try binning your stats a week at a time (to improve the statistics and eliminate the "weekly cycle") and you may find it easier to pick out a trend.
It's good to see that spam plots are be
Re:My own plots.... (Score:2)
Not sure why you say that. The account was in use 5.5 years before the analysis started. And it gets mail forwarded from my previous account. I don't see how 5+ years can be considered "new", considering how the internet has changed during that time.
Only 67 spams on his *worst* day? Wow! (Score:3, Interesting)
I think it was before 2000 that I last had that few spams in a day. <wry grin> That's what happens when you have an old email address and like to post to Usenet....
Engineers. Gotta Love 'Em (Score:2, Funny)
O-o-kay. Step away from the keyboard.
19000? (Score:2)
Since 1997?
I've gotten 16000 spams and viruses since *APRIL*. That doesn't count the accounts I've cut off because I was getting nothing but spam.
Graph could have been better (Score:3, Insightful)
I'm not dissing the work--just saying how it could have been better...
Spam archive (Score:2)
Internet Archive version [archive.org].
Rich.
Re:I just don't understand (Score:1)
Invasion of the penguins.
Re:I just don't understand (Score:4, Insightful)
Beause contrary to the popular opinion on Slashdot, you actually have to open and run the attachment yourself in Outlook in order for it to do anything. None of the big e-mail viruses have been able to spread without active help from the user. I have been running Outlook for 6 years by now and never had any problems.
Re:I just don't understand (Score:2)
Well, or completely mornic trash which has somehow gotten moderated interesting anyway.
I guess what I am saying is that no matter how you look at it, that moderation is insane.
Re:MS employee rotation (Score:2)
Re:Graphed or plotted ? (Score:2)
What exactly do you want to know from it that you can't discern?