Spam King Got Mail!

[HeyAgain]

'Spam king' got mail


TYLER HAMILTON

They call him the spam king. And late last year, Alan Ralsky of Detroit got a taste of his own medicine.

He made the mistake in December of giving an interview to the Detroit Free Press, during which he bragged about his spamming activities and a new home he had purchased in West Bloomfield, Mich.

Ralsky proudly wears his spam crown. He reportedly has 190 servers in his basement that send about 650,000 bulk spams each hour. People like Ralsky are the reason 80 per cent of e-mail sent to Hotmail accounts is unsolicited junk mail, or that the number of spam messages circulating the Internet has increased 25-fold in less than two years.

According to technology research firm International Data Corp., a firm with 14,000 employees can expect to pay about $400,000 a year fighting these unwanted messages, which steal network broadband and overload e-mail in-boxes.

After the Detroit article appeared, it was quickly posted on "News for Nerds" site Slashdot.org. Readers were furious, and within no time, the backlash had begun. In a co-ordinated effort, anti-spam activists dug up Ralsky's home address, his telephone number, even pictures of his extravagant home, and the information was posted online.

That, however, wasn't the end of it. Again, in a fine example of online co-ordination, these same activists combed the Internet for Web sites that let people subscribe to free catalogues, brochures and other "paper-based" information.

They signed Ralsky up, and a few weeks later, the spam king's home mailbox — heck, his front doorstep — was full of unwanted, physical mail.

To this day, and to the delight of all those who hate spam, Ralsky is still getting this junk. And the tactic has spread to other notorious online marketers, including George Moore Jr., who has received hundreds of unwanted magazines and packages.

Guerrilla tactics such as this are nothing new. You may recall John Lieberman and Jim McKenna, who in late 2001 launched a Web site requesting people to send them the unsolicited CD-ROMs that American Online distributes through snail mail. Their goal is to collect a million of these CDs.

At which point they plan to rent a truck and dump them on the front doorstep of AOL's corporate headquarters in Virginia.

So far, the tally is 170,000 — they've still got a fair way to go. But the effort is noble. Unfortunately, Canadians have been laggards, only sending in a measly 413 CDs to date. The French have sent 1,600, while the Germans, who evidently have a hate-on for AOL, have contributed nearly 50,000.

On a more personal level, I find myself partaking in my own little guerrilla tactics. Ever received those letters from MBNA, the world's second-largest credit card issuer, telling you you've been pre-approved for a MasterCard? They drive me nuts, as do similar mailings from Capital One or Citigroup — part of the U.S. credit-card drive into Canada.

Here's a little trick. Each piece of mail you receive includes a postage-paid envelope you can use to send back their application form. I collect these postage-paid envelopes for every company that sends them to me. At the end of each month, when I've gathered about a dozen of them, I stuff them full of my other junk mail — pizza coupons, duct-cleaning services, other credit-card offers — and mail them back.

This accomplishes two things. I get rid of some of the junk mail that overloads my recycling bin, plus I send a strong message to the company, at their expense, that I don't want their services or direct mail. In other words, stop bugging me!

All's fair in marketing and war, right?

Still, you can see how these guerrilla tactics, while an understandable response, can grow out control and create more chaos than perhaps was intended. Harassment is illegal, after all.

Network security expert Bruce Schneier, founder and chief technical officer of Cupertino, Calif.-based Counterpane Internet Security Inc., brought to my attention last week a research paper from John Hopkins University that highlights this concern.

Researchers Aviel Rubin, Simon Byers and Dave Kormann discussed, coincidently, how incidents such as the Slashdot backlash could be automated, making the impact on a guy like Ralsky — or any other target — much more overwhelming.

It's their view that a small program could be written, such as an easy-to-execute "script kiddie," that could effortlessly scan millions of sites on the Internet, detect which ones have free online subscription or information request forms, and fill out the forms with a victim's name and address.

Finding these sites is easy. Schneier discovered that by typing "request catalog name address city state zip" into Google, a person gets links to more than 250,000 sites containing subscription and request Web forms.

New York Times reporter John Schwartz cleverly called this tactic the "cyberspace equivalent of the old order-50-pizzas-for-your-enemies trick."

But as Rubin and his colleagues point out, there's a real danger in this ploy, one that few people have likely thought about. "A scenario could be imagined where an attacker would do this to delay the arrival of an important letter, to wreak havoc on the postal system for political reasons, or even worse, to serve as a diversion for a terrorist act, such as the mailing of a contaminated letter," they wrote.

The study is fascinating. If you want to read it yourself, go to http://www.aviru bin.com/scripted.attacks.pdf.

Schneier, through e-mail, told me there's no easy defence against such an attack, largely because companies want to make it easy for consumers to get their promotional information.

"Subscribing someone to magazines and signing them up for embarrassing catalogs is an old trick, but it has limitations because it's physically difficult to do it on a large scale," wrote Schneier.

"But this attack exploits the automation properties of the Internet, the Web availability of catalog request forms, and the paper world of the post office and catalog mailings. All the pieces (that) are required for the attack to work."

Great — another way to waste the time and money of businesses, and clog the arteries of our postal service. Let's hope anti-spam, anti-marketing guerrillas can keep their perspective and priorities in order. There's a way of getting a message across without crippling the system and hurting everybody.

That said, this potential for havoc represents another wake-up call for consumers, businesses, and governments alike.


--------------------------------------------------------------------------------
Tyler Hamilton writes about technology and the Internet Mondays in @Biz. Reach him at thamilt@thestar.ca

[GremlinDelirium]

Thats right... stick it to the companies... I am sick of 60 junk emails a day!

[Zello]

It does get kinda ridiculous when people have seperate email addresses that they use for signing up to stuff.

It's even worse when trying to get rid of spam e-mail by unsubscribing just lets the spammer know that your an active user.

[SaltPork]

I have about 6 email addresses that I use for signing for things online that require an email. My favorite is 123@123.com. I only use my real one for important things.

[snowy]

That's hilarious. I have a guerilla tactic for dealing with telemarketers. I tell them I'm interested and then put the phone down and walk away while they rattle on and on about their product. Since the company pays for the call, you end up costing them money. They rarely call back afterwards

[Macheath]

Ah, vigilante justice. Deep down you know it'll backfire, but you can't help being satisfied.

[Fly]

Originally posted by onesnowyowl
That's hilarious. I have a guerilla tactic for dealing with telemarketers. I tell them I'm interested and then put the phone down and walk away while they rattle on and on about their product. Since the company pays for the call, you end up costing them money. They rarely call back afterwards

no shit.that is exactly what i do.drop the phone and go do something.

or let the little girl talk to them and that ends it quick too.

[Lebell]

Man, I've always wanted to do something like that.

I chaps my ass that if I don't empty my hotmail junk folder DAILY, it fill up and my account is unusable. If I set the folder to empty automatically, then it filters out mail that I want, even if I am the only addressee.

My alternative is to gather email accounts, one for real, one for junk, one for professional correspondence.

ARGH!

[Peetster]

Blame Congress. The Netizens Act of '01 made Spam legal as long as there are "unsubscribe instructions' on the Spam. It doesn't have to work, and they are not required to actually remove you from any lists, but the instructions are there.

[troit]

Originally posted by GremlinDelirium
Thats right... stick it to the companies... I am sick of 60 junk emails a day!

60! -- Consider yourself one of the lucky ones. At one point I was receiving over 300 spam emails a day....such a waste of time.

I'm down to about 30 a day and got there but wasting more of my time and unsubscribing to every unwanted email -- but it worked.

I will say that I think a law needs to be passed because spam now is not just the nuisance it used to be. Think of all the man-hours lost every day with employees scanning through the email and deleting spam...

[zizdog69]

I have respect for people that go after large companies. I am so sick of the BS I get in the snail mail and e-mail.

[BoCo]

Why doesn't someone just burn that asshole's house down, and the servers with it?

...that's not a suggestion, I'm just surprised no one has done it yet.

[Ciall]

I do the MBNA thing myself, have done for years.

I smile everytime I post shredded junk mail back to those asshats in their own envelope.

[TaLoN]

i am an enemy of spam even though (i don't know how) i don't get spam. any kind of soliciting is horrible whether it be spammers, telemarketers, or door2door salesmen/women.

[kreskin]

Ahhh, behold the power of angry geeks.