I am so sad that this spammer as**ole had to get over on Blue Frog. I had been a member almost since they came out and I lloved it! My spam was down to a trickle at the end. I did get all the threats and spams but took it with a grain of salt.
What ever I can do to help. i will. I am not a programmer but will be happy to test.
Thanks for helping us out!! Together, we can conquer SPAM
Comments
Clarification
One of my email addresses is still being used as a fake from address by one (or more) of the spammers as well -- and I am certain that the e-mail addresses I had registered with Blue Frog are NOW on attack lists. One of my addresses is being assaulted with tons of Japanese spam (dozens when I check the spam trap on the server weekly). That same address barely received 5 spam a week previously.
Strength in Numbers
I 've been reading postings from other members who have monitored SpecialHam forums. The spammers seem to think that we need upwards of 1m users to provide any meaningful anti-spam capability. To this end I have informed PCFormat, one of the UK's leading PC magazines (let's be honest, the UK's best PC Magazine) about okopipi. I don't know how many people bother their arses to correspond with PCF, but I would fully expect this article to be published in their 13.07.06 issue. For those intersted in circulation figures, Jul-Dec 2005 36,320 according to the Audit Bureau of Circulations.
Maybe this will help.
Unfortunately, yes people DO
Unfortunately, yes people DO buy stuff from spammers. Otherwise spammers wouldn't do it.
It isn't surprising that you don't know any because the percentage is so small. If you can send 2 million spams per day at practically zero cost you only need 0.0001% of them to buy anything to make a MASSIVE profit. It is the fact that there is virtually no cost to sending spam that makes them so unconcerned about who they target. They just target every email address they can get hold of.
Blue Frogs success
There seem to be a lot of people questioning whether BF was a success or not. For my money, I say YES! they were. definitely successful enough to scare the pants off of spammers. Their problem was that once a well financed, immoral, criminal scumbag went after them, no one in the security world came to help at all!
We left them twisting in the wind while the criminals beat the shit out of them. I was disgusted by the security community's inaction!
If more people would get their heads out of the sand and look at the serious spam issues out there, we can beat them!! We ALL have to get involved in any way we can. fight fire with fire.
I'll try ANYTHING to get rid of these scumbags.
Of course, if all the morons would quit BUYING stuff from them, the problem would go away overnight.
Blue Frog worked
The "Frog" worked. Up till it was shut down I only received 3 - 5 spams a day (down from 15 - 20 per day). After Blue Frog shut down I started ceceiving about 15 per day. I now receive about 30 - 40 per day mostly 'pharm' spam.
"the powers thatbe"
peeers to me that if the frog (by any color) put there "package" together and took it to "Bill gates" and that other fella "buffet" wif all the money they through in the pot to do "good things" and maybe got some publicity and a dab of money from those 2 fella then maybe just maybe the spmmer community which is reading this right now might say oops they got the big dogs in this fight now and maybe our days are numbered . . . .Oh well its just a thought :) (but a good one)
Scrapiron
Digital postage stamps are the real answer.
The real, legal, Garanteed-To-Work answer to the spam problem is to change the economics of it.
I've long advocated reusable digital postage stamps - a cryptographic stamp with some nominal value ($0.02) could easily be attached to emails. This would make it easy for me to reject all mail which doesn't have a stamp.
If the stamps are 100% reusable then most mail is still free, you receive a mail, you send a mail. No cost.
Even if nobody ever sends you any email I'm sure there will be no end of people willing to give you stamps for free, eg. for watching adverts. Digital stamps might even lead to a new era of legitimate advertising via email where users get to keep the stamps sent to them by advertisers who run a real "opt-out" list.
The *only* people who'd be badly affected would be those who send a lot more mail than they receive and aren't willing to absorb the cost, ie. spammers.
Getting back to the subject: Yes, Microsoft could easily implement this, get a few big ISPs involved to give away free books of stamps to their users then solve the spam problem overnight via Windows update. With an open protocol/discussion then AOL, Mozilla, etc. would probably be finished coding before Microsoft is.
If anybody knows a good reason why this isn't being done, I'd like to hear it.
Digital Postage Stamps?
It seems to me that, if a little pipsqueak country like North Korea can counterfeit virtually perfect $100 bills, it would probably be a trivial exercise for the worlds @#$%^& spammers to counterfeit their own version of Internet email postage to get around it. Guess that's a pretty good reason in itself. Then, there's many of the poor and underprivileged folk that are just holding on by the skin of their teeth, with their computers being the only window into the outside world. Would we deny them the use of the Internet?
The Old Guy
Stamps for all
So the entire might of a government can produce passable copies of the least secure money in the world? Big deal.
it would probably be a trivial exercise for the worlds @#$%^& spammers to counterfeit their own version of Internet email postage to get around it.
Nope. Cryptographics signatures actually work.
a) Nobody's forcing you to use them. You can choose to accept mail without stamps, no problem.
b) I'll be able to whitelist people so they don't need stamps to get into my inbox.
c) You'll be able to get free stamps with little effort (see above), just not by the million.
d) In the developed world there'll be an excess of stamps. Expect charities to collect excess stamps and donate them to third world projects.
A DDOS attack is illegal!
Does anyone actually know someone that has ever bought something from a spam email?
As I quoted to you before there is an american law that makes it a crime to perform a DDOS attack. It doesn't matter where you do it from because it was made an act of terrorism after 9/11. Further more the spammers are doing joe jobs and sending spam from old bluefrog members to other old bluefrog members advertising the sites discovered to be in the DNIR. They have been doing this for awhile as well as advertising other websites that they have no affiliation with in the hopes that the bluefrog would attack them. So if we DDOS a site how are you going to be certain that you are not attacking an american based website, which makes you an international terrorist, or a legitimate website that has no affiliation with spammers, like mine which was protected by the DNIR?
Yeah, actually I do
"Does anyone actually know someone that has ever bought something from a spam email?"
Yes. A lady whose neighborhood I used to live in actually called me up and paid me (I'm a consultant) to hook up a "mini digital camera" to her computer. She paid $40 for it, it was worth maybe $3. Held 12 pictures, excruciatingly low resolution. When I asked her where she got it from: "Oh I got this email, let me show you."
This is a lady who, while a tad on the nutty side, is middle class and works the back end of her husband's business - a business which allowed them to live in the house they live in, which is pretty nice.
On a similar note, when we were at closing for our house, our agent was asking me about spyware something or other. She had got hit with Winfixer (I think that's the name), paid the $40 to some company for removal software, which of course didn't remove the thing which prompted her to pay out in the first place. Again, middle-class, not stupid.
People do these things all the time.
A DDOS attack is illegal!
So is homicide, but it happens !
Exitus acta probat
Laws again...
Does anyone actually know someone that has ever bought something from a spam email?
No, but I can easily imagine the sort of person who would...
As I quoted to you before there is an american law that makes it a crime to perform a DDOS attack.
Yes, but there's a BIG difference between a law existing and actually being prosecuted.
Sites like Fark and Slashdot take down websites every single day of the week. None of the people who run them are in jail.
Downloading a few hundred images off a site you've got a written invitation to go visit isn't "terrorism" by any stretch of the imagination.
Even if we assume that both the site/spammer fall under American law (unlikely) then how exactly would a spammer bring charges? Is he going to go to the police and say "Hey, some people are attacking my site which sells illegal stuff"?
I'm sure spammers will make a LOT of noise about how DDOS attacks are illegal and how all Black Frog users are going to jail, but it's not going to happen in practice.
So if we DDOS a site how are you going to be certain that you are not attacking an american based website
Um, look at the IP address? Most spam sites seems to have adverts which say "find nymphos in " these days, we can do the same.
...or a legitimate website that has no affiliation with spammers, like mine which was protected by the DNIR?
This is also a problem even if you do "one spam, one complaint". A Spammer could use the network against you by spamming people with the web page of a legitimate site. If Black Frog then attacks the site it could generate a lot of bad publicity even though it's demonstrably the spammers' fault.
Creating a network of machines which can attack a web site needs to be done carefully and with strong safeguards.
Google it
If you google 18 U.S.C. 1030. 2006 you'll see that it has been prosecuted.
IANAL but....
If you google 18 U.S.C. 1030. 2006 you'll see that it has been prosecuted.
You have no idea how the legal system works.
Google it
Hmmm... not sure what thats supposed to mean but if you knew how google works you would know that I'm right.
I did...
Hmmm... not sure what thats supposed to mean but if you knew how google works you would know that I'm right.
Are you saying that a law exists and has been used a couple of times? Well, duh! That's what it's for.
I fail to see your point though - the road from attacking a spammer's web site to being successfully prosecuted in a court is so long and twisty that I don't think anyone will ever travel it.
Summing up:
a) People involved in illegal activities don't tend to call the police when they get burgled
b) Most/all spam sites are outside American jurisdiction so a spammer coun't file a complaint even if he wanted to.
c) Even if both (a) and (b) happen, the spammer would have an impossible time *proving* anything at all. Web server logs will be inadmissible in court because he could just be making them up. What else has he got? Nothing. Look at all the trouble the RIAA has geeting access to ISP logs, etc. You think a spammer (who doesn't want to attract the law to himself) is going to go those lengths...? Get real.
If you're not comfortable attacking a web site then fine, don't do it, but please stay out of the way of those who can see that it's the only way to beat spam.
Case in point...
The RIAA has a lot of lawyers, planty of motivation, and most definitely *wants* every bit of publicity/police intervention possible... yet still their cases are being dismissed. In this case they might even end up losing money:
http://yro.slashdot.org/article.pl?sid=06/07/13/2218259
You honestly think a spammer would take you to court?
Do you even read..
Do you even read what I post? I'm not concerned about spammers pressing charges. What is a spammer going to do, tell the authorities that we are attacking their illegal organization and that we should be prosecuted? I'm concerned about a legitimate company that does have money and lawyers to prosecute people who shut down their servers. Like the case in Canada where a hacker DDoS'ed CNN and Ebay and was sentenced in an american court to prison and a big fat fine. They weren't an american citizen but that didn't stop American authorities from prosecuting, and getting a conviction. Not only is their a law in America concerning DDoS attacks but countries in Europe also have similar laws. I think I'm done trying to hammer that point into your skull. I guess you'll just keep making useless points no matter what I say. Go ahead and launch DDoS attacks and we'll see how far you get. Fortunately you aren't in control of this project and the people who are can see that my point is valid.
P.S. This is not copryright infringment we're talking about, DDoS attacks are at a whole different level of crime, so your point about the RIAA has no merit.
Attacking legitimate sites
Do you even read what I post?
I'm trying...
Nope, but that seemed to be what you were saying (and it's certainly what a lot of other people seem to be worried about).
So let's try to avoid attacking "legitimate" companies then.
Should we attack a site which spams fake watches? Selling watches isn't illegal....
Creating a network which is designed to DDOS something is very risky. I don't believe that the decision of whether or not so attack a site can be automated, if it is then a spammer could use the network to attack legitimate sites.
Failure
We left them twisting in the wind while the criminals beat the shit out of them.
I think the real problem was that Blue Frog surrendered instantly on moral grounds - "the users didn't sign up for this fight" or something like that.
Excuse me? I most certainly *DID* sign up for this fight! If I'd known that Blue Frog would curl up his toes at the first hint of trouble I wouldn't have bothered.
I doubt that the web sites which the spammers shut down would have stayed down for long, and if they did then then important people (eg. governments) might have paid attention to what was happening.
I think Black Frog will fail in one of two ways:
a) I seems to be run by do-gooders who don't understand the meaning of the word "fight". In a real fight you don't use the Marquis Of Queensbury rules, you do whatever's in your abilities to hit the other guy as hard as possible, the reason being to end the fight as fast as possible. If you dance around jabbing at him then chances are he's also going to get a few punches in so you'll suffer as well.
When SpammiKing starts shutting down sections of the Internet, what will the do-gooders do? Will they fold or will they fight?
[And if you're prepared to fight, why pussy around? FIGHT!]
b) All this "one spam one complaint" is very nice but all a spammer needs is a good captcha on his web site and your careful planning and months of coding are in ruins, you can't submit *anything* that will really annoy him.
What then? The only remaining option is to DDOS the spam sites....
I say we accept this fact and don't waste time writing fancy code which will be useless in the long term.
Black Frog will not fail
I am willing to try ANYTHING at this point to get back at these scumbag spamers. I really am disgusted that the govt will not help. The big security companies make $$$ with their haf assed spam protection.
We,the poor user, have no recourse to protect ourselves.
I'll take any hot i can get!
Exactly.
Forget the Marquis Of Queensbury rules. I want Atilla the Hun. That's the only way to decimate the parasites.
I agree with this compleatly!
There is no way that the spammers will comply with this system as it is currently being planned... we have no teeth... its like the United Nations. It tries to maintain pease and "Advize" countries how to interact about issues... but it can't do a thing except get support from someone who *Might* do something...
We should make a system that is does not have a sole puprose of a DOS, but it needs more teeth then just "Please stop"
Worried
OK I'm not a programmer or anything but let me raise this one question as my two cents and you guys take it for what its worth.
I am all for a DDos attack or anything else to stop spammers I believe if your gonna fight you pull hair bite kick and scratch in the end you must WIN!!
But here is my concern what if your creation can be taken by someone else and morphed into some tool to do evil against innocents? What I mean is how do you guys make something that cant be abused or used by the spammers themselves? Who sits as God and decides who should be attacked and who shouldn't and how do you prevent someone from attacking just someone they don't like just because they had a arguement on IRC with them?
Doesn't open source mean that anyone can edit the program, Aquire the source code and turn this program into something else or make it do something else it wasn't intended for?
Maybe you guys have already thought of all this and have the answer I do not know I just thought I'd raise the question just in case it hasn't been thrown out there already. If you believe it can be done and controlled then great I can't wait for a beta we need it bad.
All good questions!
I have been thinking some of the same things. Thanks for phrasing it so well. I would also like to know: What's to stop this project from becoming a total fiasco like Blue Frog was? I was completely dumbstruck when they suddenly folded up shop (See ya! Wouldn't wanna be-ya!!) and I was suddenly faced with a DELUGE of spam, a humongous amount of returned mail from the spammer's having used MY address as a spoofed from address FOR MONTHS. Sure I want to fight back and slam them out of business BUT I don't want to set myself up for another assault. This better be done right this time.
Another Assault???
Why do you say *another* assault? One of my email addresses is _still_ being used as a fake from address by one or more of the spammers. I'd say that the assault hasn't stopped.
This might Help
I found the following on the net not sure if it will work but if it does maybe it can be implemented in the Beta of Okopipi
ITS REALLY SIMPLE TO PRACTICALLY KILL THEIR SERVERS WITH THEIR OWN CRAP..
>
> JUST TAKE THE REPLY ADDRESS (EMAIL) THAT
>
>>YOU WOULD CLICK ON IN A SPAM ADD.. AND COPY IT TO A TEXT DOCUMENT AND
>
> CONTINUE TO DO THIS..UNTILL YOU HAVE A GOOD LIST OF THEM.. THEN START USING
> THEM AS YOU RETURN OR REPLY ADDRESS IN THE PERSONAL INFORMATION FORM THEY
> WILL GET YOU TO EVENTUALLY.. WHAT THIS DOES IS START THEM FEEDING UPON EACH
> OTHER IN MASSIVE AMOUNTS... I STARTED DOING THIS
>
>>6 MONTHS AGO.. AND THE SIMPLY HUGE AMOUNT OF MESS I HAVE CAUSED IN THEIR
>
> SYSTEMS HAS WIPED OUT SEVERAL OF THEIR SERVERS..IT CREATES REGENERATING SELF
> PRO CREATING SPAMS
>
>>UPON EACH OTHER IN THEIR SYSTEMS.. BOGGING THEM DOWN TILL THEY JUST
>
> DIE....
That is such a bad idea.
That is such a bad idea. All you would be doing is adding all the spoofed email addresses to more spam databases. How is that going to help? The addresses in the spam are not really the addresses that sent the spam. They are just people like you and me that are getting their addresses spoofed. So why do you want to add your spoofed address to more spam databases?
I said I found it on the net and wasn't sure it would work
It sounded good in theory so I posted it here for you all to look at if it worked then we could use it. It sounds like it would work if it wasnt spoofed adressess but I see your point.
What about spamitback
Has anyone tried this out yet? Maybe it can give the programers some good ideas.
http://www.spamitback.com/index.php
Well I downloaded it and I'm using it I like it alot. Can't get the proxy to work yet but it may not be Blue Frog but at least it lets me fight back. Eventoully I will be able to add to the global database of spammers. Let me know what you guys think of this if you try it out
Why not ...
Hi Buddy,
I downloaded the program yesterday and started it ... the program is cool and I like the idea of feeding the spamvertized sites and email addresses with garbage (Defense 1-4 enabled) ...
But still I'm not sure if this is somethow "illegal". My PC at home is currently on the net and I'm running this program and I hope I don't get into trouble with that.
Regards
Oliver
SpamItBack program
I just downloaded the SpamitBack progra, I'll try it out
Heres another thought
Why not create a client like SETI using Boinc to fight back? Heres the link to read up on it.
http://boinc.berkeley.edu/
This is a awesome tool
Check this out great idea.
http://www.spamgourmet.com/