Security Incidents mailing list archives

RE: A question for the list...


From: Russell Harding <hardingr () cunap com>
Date: Fri, 30 May 2003 09:44:05 -0600 (MDT)

Just a great followup to the effectiveness of spam filtering...

  I recieved quite a few bounces from the original messaeg due to my use
of the actual brand name of the drug listed below.

   There, you can now add a few percentage points for false positives.

 -Russell

On Thu, 29 May 2003, Russell Harding wrote:

Hello all,

<snip, comments below>
You're missing a critical problem here; evidence.  Collecting evidence from
foreign companies (the biggest spammer may be American, but he uses foreign
servers and ISPs) is a lot harder than it is from companies based here.
Lack of feet on the ground aside, subpoenas have no force, and god knows
what other possible obstacles (like payoffs) could come into play also.
Ultimately, it would be simple to make it nightmarishly hard to trace an
email back to the server, from the server to the ISP, from the ISP to the
customer/spammer.


While the above point is quite true, (we live in a litigious society,
however, _very_ few cases of purely technical nature ever go to
trial... When I say purely techinical, I mean cases involving only hacking
/ spamming.  Most cases tried contain other fraudulent / destructive /
espionage senarios).  The courts are not equipped for this sort of thing.

  Regardless, most spam is selling something.  You can always find the
source if you look to the people the spam is advertising for.  If there
was a crackdown on illegal V1agra sales by the FDA in the US, I'm sure
that V1agra spam would slow.

  After all, there is no better way to get the feds paying attention to
your illegal business than sending out 10,000,000 emails.

     -Russell Harding



----------------------------------------------------------------------------
----------------------------------------------------------------------------




----------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: