honeypots

[Robert Menschel <Ro...@Menschel.net>]

I'd like to run an idea past the group, and see if there's value to it.

Except when running mass-checks, or checking for FPs, I ignore emails
that are flagged as spam.  I pay attention to the FNs.

When an FN includes a URI like
> If you wish to discontinue receiving messages from the mailerfeatured
> in this email, please visit our webpage.
> http://rmvs.com/r.asp?123456&useradr@bigfoot.com&H
I add that domain to my personal BigEvil list, and send them to BigEvil
to share.

These are the spams that get through my current SA filters, which are
blocking spam at 99.8% efficiency. Therefore these are the spammers that
are either lucky, or good at what they do.

I'm thinking that I should take that URI, cut and paste and modify it in
my browser, and go to something like:
> http://rmvs.com/r.asp?123456&honeypot@example.com&H
Note that I modified the email address so it no longer points at the
original destination address, but instead to a honeypot (which actually
won't be named anything so obvious). The domain would be one from which I
can retrieve the honeypot.

I then plan to
a) watch for a confirmation of the unsubscribe. That email can be
   ignored. The only reason to watch for it is to avoid generating
   garbage for the following actions.
b) autoforward all emails after any confirmation notice to
   someaddress@spamtraps.taint.org (my own someaddress) as documented at
   http://wiki.apache.org/spamassassin/SpamTrapping so this spammer's
   spam is automatically included in the future development corpus
c) autoforward all such emails to honeypot2@example.com, which is a POP3
   mbox that is automatically fed into sa-learn as spam.
d) dump those emails into my own spam corpus.

Since honeypot@example.com is an address never used for any other
purpose, and since the only time this address is placed into a website's
system is to *unsubscribe*, any emails sent to that address will by
definition be spam (with the possible exception of a first
"confirmation").

This provides a method of dumping "lucky" and/or "smart" spammer spams
directly into Bayes and the development corpus and my corpus, without any
additional manpower requirement.

Does anyone have experience with this type of honeypot, and is it worth
while?

Bob Menschel

Re: honeypots

[Kelson Vibber <ke...@speed.net>]

At 10:32 PM 5/6/2004, Jeff Chan wrote:
>This sounds ok to me except that a legitimate mailing list server
>would also usually respond with a confirmation, etc.

Which is why he's ignoring the confirmation.  But *after* the confirmation, 
a legitimate list server shouldn't send anything else to that address.

I've done this occasionally, when I've had the time, and it's worked quite 
well for filling our spamtraps.

Kelson Vibber
SpeedGate Communications <www.speed.net> 

Re: honeypots

[David B Funk <db...@engineering.uiowa.edu>]

On Thu, 6 May 2004, Jeff Chan wrote:

> On Thursday, May 6, 2004, 9:39:09 PM, Robert Menschel wrote:
> > I'm thinking that I should take that URI, cut and paste and modify it in
> > my browser, and go to something like:
> >> http://rmvs.com/r.asp?123456&honeypot@example.com&H
> > Note that I modified the email address so it no longer points at the
> > original destination address, but instead to a honeypot (which actually
> > won't be named anything so obvious). The domain would be one from which I
> > can retrieve the honeypot.
[snip..]
> > Since honeypot@example.com is an address never used for any other
> > purpose, and since the only time this address is placed into a website's
> > system is to *unsubscribe*, any emails sent to that address will by
> > definition be spam (with the possible exception of a first
> > "confirmation").
>
> This sounds ok to me except that a legitimate mailing list server
> would also usually respond with a confirmation, etc.

No, a truely legitimate mailing list server would know what its
membership is and would tell you "name not found on our list" when
you attempt to 'unsubscrbe' that made up honeypot address.
Even if the unsubscribe is a batch, they still should know the
honeypot address is not valid and not "confirm" its removal. Maybe
sent an error note but nothing more.

I do almost exactly the same thing as Bob Menschel, and once in a
blue moon do get a "name not found" when trying to 'unsubscrbe' the
tagged honeypot address.

The interesting thing is to see where those tagged addresses show up.
It's clearly the case that spammers sell address lists to each other.
So spammer 'A' may truely honor his unsubscribe requests and never
send you another spam, but they'll sell your name to others so it
will then start getting spam from 'B', 'C',...
My current record is 2 hours from unsubscribe to spam from others. ;)

-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{

Re: honeypots

[Jeff Chan <je...@surbl.org>]

On Thursday, May 6, 2004, 9:39:09 PM, Robert Menschel wrote:
> I'm thinking that I should take that URI, cut and paste and modify it in
> my browser, and go to something like:
>> http://rmvs.com/r.asp?123456&honeypot@example.com&H
> Note that I modified the email address so it no longer points at the
> original destination address, but instead to a honeypot (which actually
> won't be named anything so obvious). The domain would be one from which I
> can retrieve the honeypot.

> I then plan to
> a) watch for a confirmation of the unsubscribe. That email can be
>    ignored. The only reason to watch for it is to avoid generating
>    garbage for the following actions.
> b) autoforward all emails after any confirmation notice to
>    someaddress@spamtraps.taint.org (my own someaddress) as documented at
>    http://wiki.apache.org/spamassassin/SpamTrapping so this spammer's
>    spam is automatically included in the future development corpus
> c) autoforward all such emails to honeypot2@example.com, which is a POP3
>    mbox that is automatically fed into sa-learn as spam.
> d) dump those emails into my own spam corpus.

> Since honeypot@example.com is an address never used for any other
> purpose, and since the only time this address is placed into a website's
> system is to *unsubscribe*, any emails sent to that address will by
> definition be spam (with the possible exception of a first
> "confirmation").

This sounds ok to me except that a legitimate mailing list server
would also usually respond with a confirmation, etc.

But most of the spams are so obviously spams, that my comment above
is probably not a practical concern.

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/

Re[2]: honeypots

[Robert Menschel <Ro...@Menschel.net>]

Hello Justin,

Thursday, May 6, 2004, 9:53:37 PM, you wrote:

JM> It would definitely be worthwhile, IMO.   There's still a bit of an
JM> open question as to how much of these remove links *work* and how
JM> much confirm the addr -- it's not 100% either way -- but it'd catch
JM> the ones that do keep confirmed addrs...

Interestingly, those that "honor" this faked unsubscribe will avoid the
spamtrap. Those that insist on sending email to the faked unsubscriber
will get what they deserve.

JM> BTW the spamtraps.taint.org traps report to Pyzor, DCC, and a few
JM> proxy testing systems too ;)

Thanks for that information. It'll therefore not only benefit my systems'
Bayes, but will also benefit the network checks within SA.

JM> (However, we don't use them for mass-checks any more, because we
JM> nowadays have more than enough hand-verified spam from the various
JM> people's corpora.)

Understood.  My corpus is nearing 100k spam, and I trim it to 4 months
each month.

Bob Menschel