|
Author: M.Prince (16 Jan 05 5:47pm)
I'm not too worried about filtering on the name of the script since it's randomized for every installation. S.Wehner's question is a bit trickier and something I do worry about. I think a limited number of IPs for our mail servers and a limited number of places where we have our users point their MX records is potentially our Achilles heel. On the other hand, we're thinking about how to solve this problem and may actually be able to turn it into a feature.
What do I mean by that? Part of the power spammers have is their ability to send indiscriminately. Filter developers have a much trickier challenge. They must differentiate between legitimate and illegitimate mail messages. Spammers get to play offense all the time, we're stuck playing defense.
Project Honey Pot turns the tables somewhat. While there may be ways for spammers to recognize and filter out our addresses and honey pot pages, it means that they will have to question and eliminate some addresses from their database. The minute we've got spammers doing that is the minute we begin to take the strong position in the arms race.
For example, imagine that every Project Honey Pot spamtrap address contained the following string of characters:
HPOT
While it would be easy for spammers to filter out the spamtrap email addresses, it would also introduce a potential way for regular addresses to avoid spam: simply include "HPOT" somewhere in them. Translated to your specific question, imagine spammers begin filtering on the domains we tell people to point their donated MXs to. Maybe then we'll allow our members to pass their legitimate mail through the same MX records.
The limited number of IP addresses we have access to for our mail servers also presents a problem, and again, potentially, an opportunity. For example, we could approach a company like Akamai, which maintains a HUGE private network and wide variety of what are, essentially, relay servers. Most of Akamai's traffic comes downstream. Maybe they'd be willing to obscrure the location of our mail servers by hiding them within their private network, and suddently create what would appear like a virtually unlimited number of mail server IPs.
What could we provide them in exchange? Maybe our list of known harvester IPs so they can prevent them from ever accessing their customer's websites. I don't know if they'd go for it, but if anyone knows anyone at Akamai or any of the other large proxy network operators, please don't hesitate to put them in contact with us.
There are a number of other potential solutions to this problem we're exploring. You might want to check out another thread discussing this same issue on our boards:
http://www.projecthoneypot.org/board/read.php?f=4&i=4&t=4
I think we have at least a few months where we're safe because spammers will simply ignore us. But the day that the FBI breaks down a spammer's door based on information gathered from our system is the day we'll need to have our plan to foil the defensive techniques spammers try to thwart our system. We welcome ANY suggestions.
|
