« Data Backups | Main | eMail Security »
June 04, 2006
Fighting Spam
PC Security - Fighting Spam, Part I: User Strategies
Fighting spam - like countering any illegitimate activity - is a never-ending battle. You devise a strategy and there's a counter-response. But taking low-effort steps that make spammers actions ineffective or difficult puts you at an advantage.
Two can play at that game.
Since spam is made possible by programs, programs can fight it - and, fortunately, there are many already available. Before learning how to use them, it's helpful to know how spammers do their dirty deeds and what simple actions a user can take to counter them.
One of the most effective tools spammers have are spambots - programs that automatically browses websites looking for e-mail addresses, which it then "harvests" and stores into large lists. The lists are then either used directly for marketing purposes or sold, often as CDs listing millions of addresses.
There aren't yet perfect mechanisms for foiling spambots, but there are several effective techniques.
MISDIRECT
If you don't expose an e-mail address to harvest, you can't get harvested. But in a time when blogs, forums and other public sites are heavily used - and most require providing an e-mail address to post if not to read - it's difficult to avoid.
So for those public venues, define and use an address where you intend to get no personal e-mail. After responding to the sign-up confirmation you don't have to care what goes there. Keep another for personal use and give it only to trusted individuals and vendors.
A word of caution: Hotmail, Yahoo and other large providers have often been used for this purpose. Some sites are wise to this and won't allow addresses with @hotmail.com, for example. Fortunately, there are dozens of free e-mail providers and you don't have to use the same one every time.
CAMOUFLAGE
Spambots are clever, but they're not human. They can't make subtle distinctions or inferences unless they're programmed to do so. Often, disguising a publicly visible e-mail address is enough to cause the spambot to bypass you. They're frequently programmed to look for character strings like John_Example@somecleverdomainname.com. Programs only do what they're instructed, so even so simple a change as John_Example_at_NOSPAMsomecleverdomainname.com is enough to fool them.
Even if your disguised e-mail address is still harvested, at minimum the address has to be 'scrubbed' in order to be used. Scrubbing routines are even harder to write than spambots, because there are so many possible variations. (NO_SPAM, NOSPAM, no*spam and many that are much more clever. Be creative!) Those variations are usually simple for humans to decipher, but again programs only do what they're instructed.
The method does have potential drawbacks. Humans have to strip out the extra letters and insert the @-sign (in the above example) - something they sometimes fail to do out of failure to understand the need to, or because they simply hit Reply To. Also, since many e-mail confirmation systems are themselves automated (by software, naturally), they too will fail to deliver to the desired address.
A variation on the technique can be used not only by web site designers but (to an extent) users. You can usually configure your e-mail account to make the receiver see your e-mail address as anything you wish, regardless of the actual address. After all, that's how spammers often disguise themselves, too.
FILTERS
Once you make the effort to create an e-mail account and 'advertise' it to your friends, business associates and trusted vendors changing (or even disguising) it can be undesirable. That puts you in the position of making high cost efforts for low reward - exactly the role you want the spammer to be in, not you.
Spam or Junk Mail filters to the rescue.
Filters examine every e-mail before it's delivered and apply complex algorithms to determine whether one is junk or not. They're configurable so that e-mail from senders listed in your address book pass through to your Inbox, with others directed to a Junk folder.
Though imperfect, those algorithms are reviewed often by e-mail providers and evolve to capture more junk and fewer valid messages. And, when reviewing the junk mail folder, some allow you to specify whether they 'guessed' correctly. Your answers allow the algorithms to make better guesses.
RAISE THE PRICE - Eventually, even determined spammers get tired of programming variations to bypass the hurdles thrown in their way, deciding the effort isn't worth the reward. The trick is to make the cost of their effort much higher than the reward, while making the cost to you low and the reward high.
Spammers haven't surrendered, but progress to date has been impressive.
Posted by SpywareSolutions at June 4, 2006 10:04 PM


