<HTML><FONT FACE=arial,helvetica><HTML><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2">><BR>
</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2">><BR>
</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><B>>Cameron Spitzer<BR>
></B></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><BR>
><BR>
</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><B>>Secrets of Spam: Where it Comes from and How to Stop it</B></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><BR>
><BR>
><BR>
>The public email system we have known for twenty years is in crisis.<BR>
>Junk email now accounts for more than nine tenths of all email and<BR>
>it's the most common way for Americans to have their identities stolen.<BR>
>Cameron Spitzer set up his first email server in 1985 and has been<BR>
>running email systems for hundreds of friends since 1991. He also<BR>
>publishes a list of spam sources for administrators of email systems<BR>
>to use to protect their servers from incoming junk email.<BR>
><BR>
>Cameron will explain the strange crisis that currently faces the public<BR>
>email system. We'll examine some junk email messages, showing<BR>
>where spam comes from and how to report it. Finally, we'll talk about<BR>
>how to get less spam, what the media aren't telling you about it, and<BR>
>what to do about the problem.<BR>
<BR>
</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><BR>
We spent too much time on why the email system is in crisis<BR>
and who the bad guys are and not enough on what to do.<BR>
<BR>
Spam defense strategy.<BR>
There no super spam filter. You have to do it in layers.<BR>
<BR>
Layer 1, protect your mailbox. For consumers and<BR>
home business people this means choose a real<BR>
email expert to operate the system that receives<BR>
your email from the Internet. If you are trying to<BR>
do real work from home, the email service that comes<BR>
with your phone or cable company high speed link<BR>
probably isn't good enough. A competent commercial<BR>
ISP will not let much malware into your mailbox, and will<BR>
stop 90% of the junk.<BR>
<BR>
If you're running an<BR>
email server, subscribe it to a few of the more conservative<BR>
Domain Name Service-based Block Lists (DNSBLs).<BR>
I like the sbl-xbl.spamhaus.org and njabl.org lists.<BR>
Your email server software has a place where you can<BR>
tell it which DNSBLs to use. If you use the programs<BR>
</FONT><FONT COLOR="#000000" FACE="Courier" FAMILY="FIXED" SIZE="2">tcpserver</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> and</FONT><FONT COLOR="#000000" FACE="Courier" FAMILY="FIXED" SIZE="2"> rblsmtpd</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2">, feel free to copy my list from<BR>
</FONT><FONT COLOR="#0000FF" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><A HREF="http://greens.org/etc/r.txt">http://greens.org/etc/r.txt</A></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> every few weeks.<BR>
<BR>
Layer 2, protect your workstation from malware that arrives<BR>
in email. Do not use email programs like MS Outlook Express<BR>
or Qualcomm Eudora that are based on or part of web browsers.<BR>
Use something reliable like Mozilla</FONT><FONT COLOR="#0000FF" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><A HREF="http://www.mozilla.org/products/thunderbird/"> Thunderbird</A></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> or PC Pine<BR>
instead.<BR>
<BR>
Layer 3, backups. Often, spam will contain image files<BR>
or "screen saver" programs containing hostile code.<BR>
As long as you're using MS-Windows, you're<BR>
going to get malware: viruses, trojans, and worms.<BR>
<BR>
Use a backup program to take a snapshot<BR>
of your hard drive after you configure or install software<BR>
and things look okay.<BR>
Take a snapshot of your</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><I> work</I></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> files every night. Be able to<BR>
restore your system from the two most recent snapshots.<BR>
Your MS-Windows installation is</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><I> expected</I></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> to get file system<BR>
problems and malware any old time. That's just how<BR>
MS-Windows is. But if you can just roll it<BR>
back to the last time it was happy, that doesn't matter.<BR>
This is far more effective than commercial "anti virus"<BR>
or "personal firewall" software. If you make your living<BR>
with this computer, invest in a high speed tape drive<BR>
or a second hard drive to "mirror" the first.<BR>
<BR>
Layer 4. Filtering at the workstation. If you are in business you<BR>
cannot afford to miss a single email from a customer, even if the<BR>
customer lives on</FONT><FONT COLOR="#0000FF" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><A HREF="http://www.spamhaus.org/sbl/listings.lasso?isp=theplanet.com"> The Planet of Spam</A></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2">. So the best anybody can<BR>
do is give you a high value mailbox and a low value mailbox.<BR>
Even if they block 90% of the junk before it gets to your desk,<BR>
you're still going to get half junk and half legit, and you need<BR>
something to try to sort it into high value and low.<BR>
<BR>
The most effective kind of filter in wide use is called "Baysian."<BR>
When you look at your two mailboxes, the filter marks each message<BR>
as "probably junk" or not. It's usually right. When it's wrong,<BR>
you tell it, and it gets smarter for next time. If you go to the trouble<BR>
of correcting it for the first few weeks it will learn your mail habits<BR>
and be right almost all the time. You'll always have to glance through<BR>
the trash before throwing it out, but there will be hardly anything<BR>
to fish out. Most popular email programs have Baysian<BR>
filters now. Get one and use it. Get Thunderbird for that feature alone.<BR>
<BR>
<BR>
Layer 5. Return fire. How to report spam.<BR>
<BR>
You can't get "removed" from the spammer lists. You can't convince<BR>
spammers to stop. (Spammers have mental problems. Spamming<BR>
is an addictive compulsion, as gambling can be. Don't bother to try<BR>
to communicate with them.) You can't get the government to do anything.<BR>
<BR>
But you</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><I> can</I></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> complain to the various ISPs that somehow support<BR>
the spammers. They support spammers because not enough people<BR>
are complaining. Now and then you can</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><I> get something taken<BR>
away</I></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> from a spammer: his web hosting, his zombies, his<BR>
mailbox at Hotmail, sometimes his domain name.<BR>
<BR>
Open a few email messages with the "View -> Message source"<BR>
feature in your email program. Or save them as files and open them<BR>
with a text editor. Notice the blob of stuff at the top where the To:<BR>
and From: and Subject: lines are. That blob is called "the headers."<BR>
<BR>
Notice there are a few lines in the blob that begin "Received:",<BR>
that are almost the same in all your messages. Those are the<BR>
things you trust. Then there is one Received: line that varies<BR>
a little among the messages. Most of it is the same, but there<BR>
is an IP address and maybe some names that are different in<BR>
each message. That is the magical Received line that shows<BR>
where on the Internet the message came from.<BR>
<BR>
Look at the magical Received line carefully.<BR>
If it's a spam, you get the temporary IP address of a malware<BR>
victim someplace, who doesn't even know his computer is<BR>
being misused, or maybe a giant spam server in Korea or Russia.<BR>
You also get whatever name the spamware is pretending<BR>
to be. Often they will pretend to be you. The "Received from"<BR>
IP address is reliable. Ignore the "HELO=" name, that's the lie<BR>
the spamware told to your server. Sometimes he will<BR>
try to fool you by HELO announcing himself as an IP number<BR>
instead of a name. Ignore it.<BR>
<BR>
Then there may be a few more Received lines. In a legitimate<BR>
message, they tell you boring things about the sender's<BR>
network environment. In a spam or malware, they are almost<BR>
always fake. Ignore them. In a spam, the rule is to ignore<BR>
everything the spammer created.<BR>
<BR>
Get a whois program or use</FONT><FONT COLOR="#000000" FACE="Courier" FAMILY="FIXED" SIZE="2"> Geektools.com</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2">'s whois form.<BR>
Plug the sender's IP address into whois. forward it<BR>
to</FONT><FONT COLOR="#0000FF" FACE="Courier" FAMILY="FIXED" SIZE="2"><A HREF="mailto:abuse@SBC.com"> abuse@SBC.com</A></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> or whatever the appropriate domain is.<BR>
(You can look up abuse reporting addresses by domain at<BR>
</FONT><FONT COLOR="#0000FF" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><A HREF="http://abuse.net/lookup.phtml">http://abuse.net/lookup.phtml</A></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><BR>
or go</FONT><FONT COLOR="#000000" FACE="Courier" FAMILY="FIXED" SIZE="2"> whois -h whois.abuse.net</FONT><FONT COLOR="#000000" FACE="Courier" FAMILY="FIXED" SIZE="2"><I> example.net</I></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2">)<BR>
<BR>
Did the spammer want you to visit his Web site?<BR>
Get a traceroute program or use Samspade.org<BR>
or DNSstuff.com. Trace the route to the hostname<BR>
in his URL. Or just grab the IP address out of the<BR>
beginning of the traceroute and plug it into Whois.<BR>
If it's China or Korea, complain to the US-based<BR>
corporation that maintains a link to the Chinese carrier.<BR>
You can see who it is, it's where the names stop in the trace.<BR>
</FONT><FONT COLOR="#0000FF" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"><A HREF="mailto:abuse@Savvis.net">abuse@Savvis.net</A></FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"> or ATT.net or MCI.com or whatever.<BR>
<BR>
Just forward the junk message. Put the offending<BR>
IP address (sender or Web host) in your Subject line.<BR>
There is no need for an essay on why spam is bad.<BR>
<BR>
Cameron Spitzer<BR>
</FONT><FONT COLOR="#000000" FACE="Geneva" FAMILY="SANSSERIF" SIZE="2"></FONT></HTML>