SpamRV
The Spam RetroVirus Project
- Introduction
If there's one thing a spammer cannot resist, it's free email addresses. SpamRV exploits this fact to infect spammer lists with addresses they cannot distinguish from real ones, leaving them tainted with marker email addresses. As the spammers share their address lists around your marker email addresses infect others as well, eventually, you'll be literally immune to all current spammer address lists all thanks to the very nature of spammers.
- Making it work for you
One thing that should be pointed out right from the start, by adding your SpamRV addresses into spammer lists, you are in fact inviting more spam to your mailboxes. Once the spammers have your SpamRV address, it's unlikely they'll let it go for a very long time. Make sure you use addresses which you can dispose of (if required) and that no one else should ever need to use (ie, don't use things like fred.jones@yourdomain.com.xx if you already use firstname.lastname@ formats).
- Isn't this just another honeypot exercise
Yes, except that it's different ;-). Seriously though, there's a lot of code editors, a lot of IRC clients, quite a few OS's - so, no harm in having multiple honeypot systems.
- So, it's different - how?
SpamRV works on multiple aspects of the email, including
- Source IP blacklisting
- Return URL blacklisting
- Body text search space mapping (fuzzy matching)
- Trusted List Sharing
- Why use this when I have SpamAssassin/DSPAM/CRM114 ?
Speed and Accuracy. Heuristics, pattern matching, scoring and 3rd party blacklists all suffer from false-positive issues. A false positive, when a good email is blocked can render an antispam system more dangerous than spam itself. Consider the situation where you're waiting on a vital email - your email server rejects/consumes/discards it - you could lose a multi million dollar contract, ooops. As a trade off, in order to reduce the false positive blockings, spam filters tend to throw more CPU power at the problem, this works for a while until you find that your server is now falling over trying to handle more than two or three emails per second, not good either.
- Why don't you plan to use greylists, Baysian filtering or other such methods?
The trouble with most techniques used these days to combat spam is that they have a relatively short effective lifetime. It will only be a matter of time before spammers adapt their software to counteract the defensive abilities of greylisting. For Baysian filtering, already spammers are throwing the statistical analysis into turmoil with their poison words.
What SpamRV aims to do is to use unchanging, inherent properties of spam, specifically so that the technique does not have to be adapted every few weeks or months
|