From the NY Times


May 1, 2003

Tools of the Trade Shown at Forum on Junk E-Mail

By SAUL HANSELL

       ASHINGTON, April 30 — The craft of spammers, the usually shadowy
group that sends e-mail come-ons of cheap
       mortgages and clean septic tanks, was on rare public display here
today.

The highlight of the first day of a three-day forum on junk e-mail, or
spam, that was sponsored by the Federal Trade Commission
and attended by hundreds of Internet executives, e-mail marketers and
anti-spam activists, was a series of demonstrations of the
tools and techniques used by spammers to reach the broadest audience while
evading detection.

The conference comes as federal and state officials are seeking ways to
curb spam, which is seen as a public nuisance and a threat
that could cripple the Internet's most popular application, e-mail. 

The most prevalent spam technology takes advantage of weaknesses in
innocent computers attached to the Internet, which can be
made to act as relays. The spammers use programs that investigate the
millions of computers connected to the Internet to find those
that have improperly configured software. Spammers can make their messages
appear to come from these unprotected computers,
often without their owners being aware their machines have been tapped. 

Many of these vulnerable computers are owned by businesses, but
increasingly spammers are taking advantage of home computers
that are permanently connected to the Internet by high-speed, or broadband,
access services. Now more than half of the spam
received exploits flawed software called open proxies. They use a sort of
software known as a proxy server — which,
paradoxically, is often installed as a way to enhance computer security. 

Spam tools of other sorts were demonstrated too. There was some software,
for example, that combs the Internet for e-mail
addresses on Web pages to be added to the mailing lists of spammers. Rob
Courtney, a policy analyst for the Center for Democracy
and Technology, discussed the results of a recent study that showed how
effective the software can be. The center placed six
decoy e-mail addresses on Web pages available to the public, and they
received 8,500 spam messages in six months.

The F.T.C. forum included a number of people who run companies in the
e-mail business, none of whom describe themselves as
spammers. 

Some panelists demonstrated how spammers use much more old-fashioned
techniques of the pitchman — like lying. Margot
Koschier, manager of the anti-spam analysis and prevention team at America
Online, demonstrated how easy it was to send e-mail
messages with a forged return address. 

Timothy J. Muris, the chairman of the F.T.C., introduced the day's
proceedings by discussing a recent commission study that found
that in fact two-thirds of spam messages contain one or more fraudulent
elements. And some 18 percent of all the spam the F.T.C.
studied involved pornography or other sexually related products. 

The several legislators who addressed the forum all said that Congress
would probably take action on spam this year.

"The toxic sea of spam has begun to engulf the very medium of e-mail," said
Senator Conrad Burns, Republican of Montana, the
co-author of the proposed Can Spam Act, whose measures would include civil
fines for senders of commercial e-mail that did not
include valid return addresses. But that bill does not go far enough for
many of the participants. 

Christine O. Gregoire, the attorney general of Washington, said a group of
44 state attorneys general have objected to provisions in
the Can Spam Act that they contend would pre-empt tougher state laws.

"Why would we pre-empt state laws when we don't have a tough enough federal
law," she said.

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *