Are Spammers Giving Up? 327
sfjoe writes "Are spammers giving up the game? Google seems to think so. In an article at Wired, Google, '... says that spam attempts, as a percentage of e-mail that's transmitted through its Gmail system, have waned over the last year'. They think their own filters are so good that spammers aren't even trying anymore. 'Other experts disagree with Google, pointing out that overall spam attempts continue to rise. By most estimates, tens of billions of spam messages are sent daily. Yet for most users, the amount of spam arriving in their inboxes has remained relatively flat, thanks to improved filtering.'"
For Serious? (Score:5, Insightful)
Re:For Serious? (Score:5, Funny)
If they give up (Score:5, Funny)
Re:If they give up (Score:3, Informative)
Re:If they give up (Score:4, Funny)
Re:For Serious? (Score:4, Funny)
Re:For Serious? (Score:5, Interesting)
Re:For Serious? (Score:5, Insightful)
Re:For Serious? (Score:4, Insightful)
Re:For Serious? (Score:3, Interesting)
Billrocks? What kind of business plan is that? Do they ever pay?
Re:For Serious? (Score:2)
Re:For Serious? (Score:5, Interesting)
If the volume of spam grew at X.2% compared to last year's growth of X.9%, that doesn't mean the volume of spam is going down. Hell, one way or another, the volume of spam as a percentage has to go down. It's hard to keep up a healthy growth rate once you've 10 billion a year.
Lies, damn lies and statistics.
Re:For Serious? (Score:3, Interesting)
Yes, their conclusion depends on some assumptions, but I can believe that those assumptions are at least partly true.
Re:For Serious? (Score:2)
Re:For Serious? (Score:4, Interesting)
Official Google Blog (Score:5, Informative)
Re:For Serious? (Score:3, Funny)
Re:Hmm, the spammers still like me. (Score:5, Insightful)
No, I don't think spammers are doing that. First, it's probably been guessed by dictionary attacks. Botnets should have the CPU time they need to exhaust the search space up to a dozen characters. (Remember: email is case insensitive and restricted to standard english alphanumeric characters plus a handful others. This is no NSA-safe keyspace.) And second, they probably obtained a list from somewhere. Some inbox on some PC that was rootkitted or an entry in a not-negative list that some other spammer sold them. (Remember: all adresses that do not bounce are valid mailboxes.)
Re:gmail spam (Score:4, Informative)
It could also be that a relay between your mail server and gmail may be snooping on e-mail packets looking for active addresses @gmail and selling them to spammers.
Hopefully they're finally getting... (Score:5, Funny)
Well..... Not really. (Score:2)
Re:Well..... Not really. (Score:2)
But that isn't "giving up". (Score:5, Insightful)
But the filters are getting good enough to filter most of it so the users do not have to see it.
But the spammers are still sending it.
Re: The money is disconnected (Score:3, Insightful)
Maybe the correct method to work toward eliminating spam isn't to block it, but rather let it all through. I think folks would be truly disturbed if the ISPs could coordinate a day where everybody disabled spam filtering for 24 hours. You wanna motivate a congresscritter? Irritate everyone in his district, all at once (including him and his peers.)
Re:Well..... Not really. (Score:5, Funny)
Re:Well..... Not really. (Score:5, Insightful)
Seriously, betting on the opposite of whatever he says has been a fairly profitable route for at least 10 years.
My Experience (Score:4, Interesting)
Spam detection has got to be something like 99.999% accurate
I sometimes get the occasional Nigerian scam letters - but thats it
Re:My Experience (Score:3, Funny)
So given the volume of spam what do you get, 200 or 300 a day?
Re:My Experience (Score:3, Funny)
Google is wrong both about spammers giving up and about the awsomeness of their filters.
I'm not sure what my company uses, but Google should invest in that product... My corporate email has been listed on the interwebs for 10 years, and I MAY get a spam once a week, and usually that only gets to the blackberry for some reason, my outlook client catches the rest.
Google is tooting their own horn way too much here. They have a lot they need to improve, they are clearly not the best in this area.
Re:My Experience (Score:3, Funny)
Re:My Experience (Score:2)
Think about this. If GMail is really effective and blocks essentially all SPAM, why send them SPAM? Answer none, since it does cost something to send spam these days. Thus to optimize you avoid sending to gmail.
I know I have noticed with my email server that there is a rotation. The spammers have stopped sending to many addresses and then try other addresses.
Thus the SPAM solution is to make SPAM detectors as effective as Gmail. This then leads to the question if google doesn't have a new business model. I know if Google could cut down the spam to an effective zero I would be one happy camper.
Re:My Experience (Score:5, Insightful)
All they ask is one thing: that you not spell it in ALL-CAPS when referencing the email variety of spam. That's still their trademark. And I don't think it's too much to ask.
Re:My Experience (Score:2, Interesting)
Re:My Experience (Score:5, Interesting)
Re:My Experience (Score:2)
I would PAY MONEY for something like a spamassasin plugin with subscription. Currently SA still has a worse record than Gmail but it's about the only thing I can use on my own. I may end up going back to forwarding to G-mail just because of how awesome their detection is.
Re:My Experience (Score:2)
Re:My Experience (Score:2)
I can't even remember the last time one got through (on gmail--on Yahoo it happens frequently).
Re:My Experience (Score:3, Insightful)
Nonsense. 99.999% is one error in 100,000 emails. Have you even received 100,000 emails? Have you checked every one to see if the filter made at most one mistake? Have you repeated the measurement several dozen times, as would be necessary to make such a claim? Of course not.
I would be surprised if the filter you are using (including Gmail) is 99% accurate.
Here are some accuracy figures under ideal conditions [nist.gov]. From side-by-side comparisons I can assure you that spam filters in the field do considerably worse. You just don't notice.
I've noticed... (Score:4, Interesting)
It seems that have it figured out pretty good to me.
Re:I've noticed... (Score:3, Informative)
Re:I've noticed... (Score:3, Interesting)
Does this sound like a person who will buy your crap? Why try so hard to get around filters in order to reach people who are obviously not going to buy anything from you?
Re:I've noticed... (Score:3, Insightful)
Re:I've noticed... (Score:4, Funny)
But, again, it's obvious that 'granny' doesn't want the spam if she specifically signed up with an ISP that uses Bayesian Filters.
How do you know that granny chose one ISP over another based on their spam filtering policies. Perhaps she chose the ISP that was listed first in the Yellow Pages, or the one that Carlos, the Cuban pool boy, recommended. And maybe those 'm@k3 Ur M3mBer B1gg3r' spams do catch granny's eye, and she forwards them on to Carlos.
Yahoo (Score:5, Interesting)
Let me tell you, Yahoo!'s spam rate has not improved. I am not sure if their filter isn't as good, or they are just taking money from the wrong people, but I get at least one spam message make it into my inbox per day, maybe 2-3. Oftentimes, the spamming links back to a geocities.com page. Coincidence? I don't know.
With Gmail, I get one spam message per month (maybe) make it into my inbox. They are so rare, its comforting. And since they are so few and far between, I actually use the 'Report Spam' option, because it looks like get this that their filters are actually updated with my input, and I don't see spam of that same type ever again.
This is different from Yahoo, I report spam all the time and yet the same exact message types make it past the filters into my inbox. I even report phishing there, but that doesnt' seem to help.
Can anyone with internal Yahoo webmail operation shed some light into what they actually do with user input? It would be nice to know that someone, somewhere (or at least a script) is using my button clicking for input.
Re:Yahoo (Score:2)
Everybody knows Yahoo tech support had been replaced with brain-eating zombies since a while ago. It's useless to report.
Re:Yahoo (Score:2)
I have an old Yahoo! account that I check on every so often. It's nothing but a spam magnet now, and no matter how many times I've reported all the spam, it's still getting through. I guess they're trying to be a spam lightning rod by letting it all through.
Re:Yahoo (Score:2)
Re:Yahoo (Score:3, Informative)
Rule #1: Every user has the ability to set their own antispam sensitivity. Mine is set to 1.5 on SpamAssassin.
Rule #2: Every user has two folders: "Spam-Bin" and "False-Positives". SA learns them every day at 3am. If you get a spam, just move it to that folder. If you have a false positive, move it to the right folder.
Rule #3: GREYLISTING. Implementing Greylisting cut the daily spam hits from over 15,000 to less than 1,000. That's more than 90% reduction in spam, simply by using the "service temporarily unavailable" feature in the SMTP protocol.
I don't know what's wrong with Yahoo's filters. Or what it is that makes GMail filters work. But I can tell you that having a competent sysadmin makes a *huge* difference in how effective the spam filters are. I can also tell you from the logs that spam is going up, not down, lately.
As Much Spam As There Ever Was (Score:2, Interesting)
You can complain about the privacy aspects all day (Score:2)
Friend of mine was laughing the other day when a plea to help a Nigerian came through.
Nothing like a holiday note from a dear, old, !friend.
<tangent>
Anybody else have fun with mail servers configured to drop attachments? Forwarded something from Gmail to another organizational account (AOA) with a
AOA's utterly brilliant configuration dropped the
I love the smell of bogus security in the morning: it smells like crapola.
</tangent>
Dropping .zip, but leaving .tar.gz, not bad (Score:2)
I have gotten craploads of spam/attempted malware that contains zip files, but nobody has ever attempted to send me a
SirWired
Re:Dropping .zip, but leaving .tar.gz, not bad (Score:2)
Re:You can complain about the privacy aspects all (Score:2)
Better filters != less spam (Score:2)
I do wish there was an option for egrep -i -f blacklist where instead of returning the line that matched a rule in the blacklist file, it would return the rule in the blacklist file that matched the line. It would make it a lot easier to diagnose problem rules. The closest I can get to that is the -o option.
Re:Better filters != less spam (Score:2)
Spammers give up? Not likely (Score:5, Insightful)
So no, in the end, nothing that most people are doing will do squat to bring about the end of spam. You can filter until you're blue in the face, and spam will still be sent. You can shut down all your mailboxes and open a new gmail address every week, and you'll still get spammed.
Spam is sent because spammers can make money by sending it. Period.
Re:Spammers give up? Not likely (Score:2)
Right. And the hope is that once we make it sufficiently expensive to get a significant amount of spam delivered, it'll no longer be financially worthwhile. I think we're probably approaching that point. I wrote a spam-filtering recipe [freesoftwaremagazine.com] and now see maybe 1% of all the crap thrown at it. That means it's now 100 times more costly per delivered message than it used to be. We all know that spammers pay for only a fraction of the highjacked resources they use, but even then they still have to pay something. Well, that something costs a lot more than it did 5 years ago.
Re:Spammers give up? Not likely (Score:3, Interesting)
Among the many useful techniques which have been brought to bear against spam from the field of Artificial Intelligence (AI) is the notion of spam as an adversarial game between an intelligent agent (i.e. the filter) and the spammer(s). When this is combined with other AI techniques, such as Bayesian [slashdot.org] or Neural [wikipedia.org] network machine learning type algorithms, the filters become very powerful indeed and not only that but they become automatically adaptable, constantly looking to improve their "score" in the game (i.e. percentage of spams that make it past the filter vs number of false positives) against the spammers. It is important to understand that the creators of this filter do not program the rules but rather the system is designed to perform critical analysis and determine its own rules...this is the power of Artificial Intelligence at work.
Consider that in the past, when serious efforts have been made to bring such intelligent agents up to a high level of play in adversarial games, the programs have advanced to the point where even the very best human players are barely able to win and only with great effort (as in Chess) or, even worse, they cannot win in the face of such tremendously strong play from the AI which never gets tired, never gets psyched out, never panics, but rather constantly and inexorably grinds on to victory with a very high probability.
The spammers are at a distinct disadvantage against such systems for two primary reasons: (1) It is difficult to tell, from the endpoint of the spammer, precisely which message made it through the filter and how and (2) even if they do figure out which messages made it through the filter the filter is learning and training, like the human immune system, for the next time it sees a similar message which will then not make it through. Or in other words the AI filter has full visibility of the game board, but the spammer can only see his pieces and few or none of the pieces of his opponent.
If the game can be made difficult and frustrating enough for the spammer(s) by consistently strong play on the part of the AI filters, then the cost benefit ratio can be reduced asymptotically to zero against the spammer to the point were even the most dogged and determined spammer is tempted to throw in the towel. The cost of sending spam is close to zero but it is not absolutely zero, so the AI should begin discouraging spammers at the point where the AI filter pushes the returns close enough to zero to make spamming unattractive compared to alternative (and potentially more lucrative) activities for the spammer.
Still not quite right (Score:3, Interesting)
Allow me to correct your correction.
Should be:
"As long as some sucker thinks he might be able to sell something through spam..."
It isn't the general perception of the effectiveness of spam that matters, it's the perception of idiots with dreams of getting rich quick that matter and the supply of said idiots is endless.
Silly question (Score:2)
Re:Silly question (Score:4, Informative)
Permit me to break it down for you:
The Phishers will phish usernames and passwords for brokerage accounts, or they will collect the information from personal users by means of a trojan. The criminals log into these accounts and schedule sell orders for whatever stocks they are holding, and schedule buy orders for the penny stock they are going to pump-n-dump. Then they walk away.
They execute the spam, eager traders read the spam, look at the account and see that volume of shares purchased have been bought up in the past n-hours and they jump in. The pumpers have bought their stock before hand and once the volume peaks, they dump. The account holders whose accounts were compromised are left holding the pumped-dumped stock...
The criminals are getting GOOD! They don't need to worry about transferring money out of the compromised brokerage accounts, they are stealing the money and laundering it all in the same step.
And it should be no big surprise that the criminal organizations behind the whole operations is the Russians.
Welcome to professional bank robbery in the 21st century.
I have certainly seen less (Score:5, Informative)
I have NOT seen less (Score:5, Interesting)
2 months ago we received 20 million messages pr week and passed about 800,000 as legitimate mail
Last week we saw 41 million and the same 800,000 passed as legitimate messages.. that's 98% spam!!!
to break it down more..
41 million recieved
32 million rejections on RBL lists
9 million passed onto the spam filters.. 10% of that gets through.
This is for 1 week.
We keep seeing spam double every 2 months.. It's gota stop growing at some point right??
not likely (Score:5, Insightful)
It's hard to imagine that spam filters have gotten to the point where spamming doesn't make economic sense. After all, the business model is something like
Even adding a couple zeroes to the recipient number (which improved spam filters should be doing) doesn't make much of a dent in the total expenses, if I understand correctly. Lawsuits under the CAN SPAM law, however, could make it too costly to get past step 1. Unfortunately, it seems like the judicial system still needs a little help here [slashdot.org].
Don't Filter, Greylist (Score:2, Interesting)
Try http://en.wikipedia.org/wiki/Greylisting [wikipedia.org]
or
http://projects.puremagic.com/greylisting/whitepaper.html [puremagic.com]
Our own office only has about 150 mailboxes but we don't do any filtering at all because of our greylisting as implemented by http://www.openbsd.org/spamd [openbsd.org]
Even better we can greylist at the perimeter instead of letting all of that pointless traffic onto our own network.
And if you're feeling particularily vindictive start posting trapped email address on your own publicly available webpages. Make them invisible or hidden under other content but still harvestable by bots. And soon enough a significant percentage of email addresses out there will point to tarpits. Making botnet spamming a much slower proposition, and should therefore decrease the total ammount of spam.
Not giving up, just changing methods (Score:2)
Of course they've given up (Score:5, Funny)
Spammer 1: We can't get anything past Google's filter.
Spammer 2: Agreed. [sighs]
Spammer 1: I guess we'll have to give up spamming.
Spammer 2: Seems that way.
Spammer 1: Unless...
Spammer 2: You have an idea?
Spammer 1: Why don't we keep spamming everyone else!
Spammer 2: Rapture! You're so smart!
Spam? What Spam? (Score:2, Funny)
No. (Score:2)
Quality over Quantity? (Score:3, Insightful)
It's all about the zombies (Score:2)
It's all about the zombies, of course. There really aren't that many different spammers left. Look at how little diversity there is in incoming spam. That's why GMail works so well. If you filter a large number of mailboxes in a coordinated way, the basic characteristic of spam, many messages sent from one source, just pops out at you.
The only reason we still have a spam problem is zombies running on Microsoft Windows desktop machines. These are sources for the last few incoming spams:
Those just have to be botnets.
So, as usual, it's all Microsoft's fault, shipping an OS that encourages users to download executables that operate with the user's full privileges.
In Gmail, false positives = whole threads junked (Score:5, Informative)
So if you want someone using Gmail to delete an email exchange they had with you, send them an additional message in the same thread offering to sell them Viagra. They will never see the message, but the whole thread will be deleted in one month. Disclaimer: I have not tried this (but I have lost email due to the above problem, and I know I did, as I keep a separate backup of my mail via pop, where the missing messages were still present).
Re:In Gmail, false positives = whole threads junke (Score:2, Informative)
Maybe I've been lucky.
Some are giving up (Score:3, Funny)
Re:Some are giving up (Score:2)
Not giving up, not getting any worse (Score:2)
Note to spammers (Score:5, Funny)
Re:Note to spammers (Score:2)
Oversized penis ruining your posture?
Act now to take advantage of Hacky Jack's new penis reduction kit.
* No doctor authorization required
* Endorsed by Lorena Bobbit
They ought to give up (Score:3, Insightful)
I agree (Score:3, Informative)
Yeah, right (Score:2)
I want some of what those boys are smoking.
Two Different Truths, But Not In Conflict (Score:3, Interesting)
Well yes, they can easily both be true.
If, for example, spammers are learning that sending spam to @gmail addresses is a pointless exercise in futility. So they further concentrate their efforts on non-gmail addresses.
Google sees a significant drop of spam arriving at gmail (though via accounts which POP3 mail from external addresses, there'll always be some spam).
Everyone else (not Google) sees their inbound spam increasing/strong.
Why give up? (Score:5, Insightful)
There's no incentive to stop spamming unless it becomes arduous to do so. Nether technology nor litigation are close enough to make that happen.
Comment removed (Score:2)
What about user education (Score:2, Insightful)
Re:What about user education (Score:2)
The problem is that people do buy certain products or make certain actions based on spam.
This is slashdot, so I'm not going to bother giving a reference, but some reporters did find that once you click on the link, the transaction progresses in a fairly normal fashion.
The reason why drug spam is so popular is because people are actually buying it. And because the herbal viagra has been reported to contain real viagra, it'll even work.
Bandwidth (Score:5, Interesting)
Comment removed (Score:3, Informative)
Perhaps in email... (Score:2, Informative)
Anyone else see a drop last week? (Score:2)
I did set them up with a box to drop in spams that would be nightly fed into sa-learn to help with future scans, but there's no way that would've kicked in such a change in one run, not to mention it updates per-user bayes files, not system-wide ones.
My first thought was, "hey, spammers take vacation too," but it has stayed down this week as well. So far anyway.
How ironic, Gmail is a big SOURCE of spam (Score:2)
Webmail providers suck ass.
Re:Not giving up, just more Macs and Linux (Score:2)
Re:Not giving up, just more Macs and Linux (Score:2)
Re:Not giving up, just more Macs and Linux (Score:2)
If it's about the Winboxen, then the story is more about old 'Doze versions collapsing under their sheer craptacularity, or that the network headz are gaining ground against the botnets (maybe).
Re:Not giving up, just more Macs and Linux (Score:2)
Not to mention that spam email usually isn't meant to spread viruses.
Although you might indeed be joking, in which case hehehehe yeah. I also like the "decreases exponentially" bit you added in.
Altogether this is a lot like Dennis Rodman's "chemistry is that class you take in high school or college, where you learn that two plus two is 10 or something." There's so much wrong in it I can't figure out whether it's the highest level of idiocy or genius.
Re:Not giving up, just more Macs and Linux (Score:3, Interesting)
Re:Not giving up, just more Macs and Linux (Score:2)
Re:Not giving up, just more Macs and Linux (Score:5, Funny)
Re:gmail / spam (Score:2)
Re:Spam Rates Slowing (Score:2)
Please post corroborating links so we can judge for ourselves.