Dissection of Unfilterable Spam
A friend got an unusual message and asked that I help dissect it. We both have thrown away the original message, but here are some parts of it along with my analysis why it is spam. The key thing to notice is that I do not think there is any way to positively identify this as spam. The email was sent as text (not an HTML message) in a very simple style that is indistinguishable from a genuine message from a stranger.
The original recipient's email address was altered to be emailaddr@yahoo.com
X-Apparently-To: emailaddr@yahoo.com via 216.136.129.39; Wed, 12 Nov 2003 00:28:53 -0800
X-YahooFilteredBulk: 64.191.40.250
Hmm, don't know what X-YahooFilteredBulk indicates Yahoo is doing, but it obviously didn't catch this as junk.
Return-Path: <markthompsoni@fresco-mail.com>
Received: from 64.191.40.250 (EHLO localhost.localdomain) (64.191.40.250) by mta121.mail.scd.yahoo.com with SMTP; Wed, 12 Nov 2003 00:28:53 -0800
This is the first indicator that this message is Spam. The Received headers should trace the message from sender to recipient through each server en-route. This message only had one such header. Yahoo got the message directly from a machine with IP address 64.191.40.250. If I lookup the domain name associated with that IP address, I get server2.technicaldepot.com. So, the mail was sent from technicaldepot.com with a return-address at fresco-mail.com. This isn't always a problem (e.g. I may want to send mail from my work account with my personal address as the From/return-address), but it is a definite warning flag. It could be that technicaldepot.com had a compromised server that allowed a spammer to sent mail from there.
I visited http://technicaldepot.com/ . The page reports "We DO NOT send unsolicited e-mail (spam)! Recently, we have become a target/victim of a malicious spammer, ... "
It goes on to call itself " We are an 'innocent bystander', or rather an 'innocent victim' of the spam, much the same as you ... " however this may not be completely true. Everyone does have a practical responsibility to try and ensure that their systems do not become compromised and thus allow spammers to send untraceable spam.
Practical responsibility: like locking your car doors. No, you shouldn't have to. If someone takes something, perhaps stealing the car itself, it is entirely the thief's fault. However, if you report a theft to police and insurance company and mention how you never lock you doors, they'll roll their eyes, say you should have expected this, and put your case in the round file -- you have a responsibility to lock your car doors to deter theft. This is analogous to the responsibilities people need to respect when they attach computers to the Internet.
The analogy has limits though. Locking a car is generally considered a reasonable exercise of caution by most people. It's very easy for the person locking the car to see that it is locked and also be aware of the weakness of this deterrent. A thief can just break a window. A thief may be able to use a special tool to slide into the car door and unlock the car, like the police and locksmiths do. A car owner can take extra precautions, adding "The Club" for instance. This obviously increases the security by increasing the deterrence. It also clearly does not render the car theft-proof.
Computer network security is both more powerful and harder to deal with. It's more powerful because users can actually have practical systems that can prevent intrusion rather than just deter it. However, it is hard to know what level of security has actually been reached. Seeing a club on a steering wheel and all the locks pushed down in a car is easy to do. Investigating a computer system to look for security holes is usually much more difficult.
I am new to this area and looking for new friends. I just moved near Fort from Colorado about a ...
"Fort" -- generic identifier. Lots of people, if they don't have a town named "Fort" nearby will just assume he meant to say the closest known place with Fort in the name, e.g.
Texans might think "Fort Hood" or "Fort Worth",
Mainers might think "Fort Kent",
Indianans might think "Fort Wayne".
My roomate James thinks I should email you and he showed me how to send it but now I can't figure out how to attach my picture here.
Generic paraphrase: "I couldn't attach my picture here, so come visit some website."
I've gotten email like this (without the unique identifier I mention next; this spam appears a bit more sophisticated) where I could visit the website "for my friends only" with reasonable anonymity, so I did, and there are a few pictures of this "new to the area school teacher" in provocative poses wearing a tight tee-shirt and underwear and an invitation to sign on with a credit card "just for age verification" to see the more private collection "just for her friends." Needless to say, I didn't follow up.
He put it at (friendlymatch)com where he's at. You can locate my number 2912282.
Ah, by looking up a unique identifier, they can tell that the email to emailaddr was successfully read by a sympathetic person who may be responsive to the types of things spam offer -- if not this offer, they know to try the address for future offers.
If it interests you, you can call me on my cell phone tomorrow at 61258468 I am fairly ...
Incomplete phone number. You can't use it. Guess you'll have to visit the website, which is what they really want.
I don't know if we'll be using this email address anymore so call me and let's see where it goes. Did you get my last email?
Of course you didn't get a last email. So maybe you'll think this is mis-addressed. You can't call, so you'll visit the website looking for an email address to let this person know of his or her mistake --- and then they've gotcha: they know a sympathetic person reads the email who they might be able to manipulate out of some cash.