Backscatter spam via the "-request" address
Recently I've noticed spammers have started spamming the "-request" address on a couple of mailing lists I host. I don't know if this is deliberate or just they've somehow picked up the -request addresses via address collection mechanisms.
Anyway the result is "The results of your email commands" mails going to people who never sent a message to the list with a copy of the original spam attached. From looking at the code I see that newer versions of mailman than the one I'm running don't include the original message in the response to help the backscatter problem (so I've hacked the code on the copy I've got to do the same).
The lists I run aren't open to people subscribing themselves - they have to be added by the list administrator. To that end there's no need on my server for the "-request" auto responder to reply to non-members. So to my mind the following two options on a per-list basis would be useful to me:
- Be able to configure the "-request" auto responder to not reply if there were no valid commands included in the message (the spammers aren't spamming with valid commands at the moment)
- Be able to configure the "-request" auto responder to not reply to non-members
There may be reasons why both those options are a bad idea or are unworkable, but I thought I'd punt them out there in case anyone else found them useful :).
Regards, Matt
Matt Hoskins wrote:
Recently I've noticed spammers have started spamming the "-request" address on a couple of mailing lists I host. I don't know if this is deliberate or just they've somehow picked up the -request addresses via address collection mechanisms.
They send lots of spam ot *-owner, *-request, postmaster, webmaster, etc.... They know that these addresses exist on most sites, and will accept mail from most any address. This drives up their deliverability numbers, so that they can claim that they deliver to billions of addresses per second, and sell their services to people than want to send spam.
It's a known problem, and it's never going to go away. It's only ever going to get worse.
- Be able to configure the "-request" auto responder to not reply if there were no valid commands included in the message (the spammers aren't spamming with valid commands at the moment)
That sounds like a really good idea.
- Be able to configure the "-request" auto responder to not reply to non-members
Not so sure about this one, but it might also be an idea to consider.
However, I'm not a Mailman developer, so I can't really speak to how easy it would be to add such features. That might be a discussion to have over on the mailman-developers list.
-- Brad Knowles <brad@shub-internet.org> If you like Jazz/R&B guitar, check out LinkedIn Profile: my friend bigsbytracks on YouTube at <http://tinyurl.com/y8kpxu> http://preview.tinyurl.com/bigsbytracks
Brad Knowles wrote:
Matt Hoskins wrote:
- Be able to configure the "-request" auto responder to not reply if there were no valid commands included in the message (the spammers aren't spamming with valid commands at the moment)
That sounds like a really good idea.
- Be able to configure the "-request" auto responder to not reply to non-members
Not so sure about this one, but it might also be an idea to consider.
However, I'm not a Mailman developer, so I can't really speak to how easy it would be to add such features. That might be a discussion to have over on the mailman-developers list.
Speaking as a developer, we are aware of the spam reflection/backscatter issues with Mailman, and we want to address them. Steps will be taken in Mailman 2.2 to at least reduce this problem.
Thanks for your ideas, and as Brad suggests, if you want to follow up on mailman-developers@python.org or submit further suggestions, we'd be happy to get them.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
On Wed, 2009-02-25 at 15:01 -0800, Mark Sapiro wrote:
Brad Knowles wrote:
Matt Hoskins wrote:
- Be able to configure the "-request" auto responder to not reply if there were no valid commands included in the message (the spammers aren't spamming with valid commands at the moment)
That sounds like a really good idea.
- Be able to configure the "-request" auto responder to not reply to non-members
Not so sure about this one, but it might also be an idea to consider.
Speaking as a developer, we are aware of the spam reflection/backscatter issues with Mailman, and we want to address them. Steps will be taken in Mailman 2.2 to at least reduce this problem.
Thanks for your ideas, and as Brad suggests, if you want to follow up on mailman-developers@python.org or submit further suggestions, we'd be happy to get them.
Thanks for the reply - reassuring to know 2.2 is going to improve the situation :). If any further ideas spring to mind I'll be sure to post 'em.
Matt
participants (3)
-
Brad Knowles -
Mark Sapiro -
Matt Hoskins