(continued) part 2
Sabotage! Coping With The Joe Job
Step 2 - Look for an unsubscribe link in the email, and use it to your advantage!
Would a Joe Job-er really use an unsubscribe link in the spam he sends? In the case of the first Joe Job we experienced, that's exactly what happened. A non-existent unsubscribe link was plucked from thin air with the intention of generating a 404 error on our company's server, and further frustrating the recipients.
If this is done, be sure to set up a copy of your spam information page at this URL, or at least redirect this URL to your spam information page. It's a lot more beneficial to provide these email recipients with information that can help them end the spam, than to have them reach a dead page and further infuriate them.
Step 3 - Give up the fight to save your email account!
When the first Joe Job hit our site, we tried for several days to respond to every unsubscribe request and hate email, and to delete every bounce and mail bomb that came in -- we were literally replying to tens of thousands of emails every day. We spent entire days replying to recipients, so we could save our email account and keep up "business as normal" while informing all the misfortunate victims on the other side of our spam assault what was happening. But, spending all our time in front of Outlook Express in a vain attempt to save our email account, we accomplished anything but "business as usual".
Your best bet is to let the account go, and set up an auto-responder that can handle the incoming load. Procmail is a good choice for this. It's capable of deleting the incoming mail as it arrives, and delivering an automatic message in response to all the email that comes in. Your auto-response should address the spam problem, apologize for it, and provide two URLs. The first URL should be to the spam information URL; the second should be the address of a contact form from which your business and personal contacts can still reach you.
Avoid simply providing a new email address, as the spammers may decide to switch the spoofed email address to use that new address. You may get a few complaints via the contact form you provide, but it will be only a trickle compared to the ocean of irate email you'll avoid.
Step 4 - Accept the fact that not everybody will believe you!
No matter how heart-felt and convincing your apologies and explanations are, you will always encounter cynics and critics who will not believe you are the victim of an attack. Rather, they will continue to believe that you're the true spammer, and that these actions are somehow of benefit to you.
When this happens, do not let their disbelief annoy you, or affect the tone of your responses to them. Even if they are rude and use profanity, you must remain polite. Eventually, you will have to give up trying to convince certain individuals, and accept that there is nothing you can do to prove to them that you're not involved in the spam.
Step 5 - Contact your providers!
Now that you've spent a few minutes setting up an automatic system to deal with the incoming complaints, and to provide important information to slow down or end the spam assault, you need to take steps to ensure that your services are not interrupted. The complaints sent by the spam recipients will not only be sent to you, but to your hosting provider, domain name provider, merchant providers, and the providers of any other services you use on your Website.
You should immediately send pre-emptive emails to these organizations to explain that you are the victim of a Joe Job. Don't forget to include a link to your spam information page! Follow up the emails with a phone call to your providers to ensure that they receive your message in a timely fashion.
Step 6 - Utilize a privacy service with your domain registration service, and remove phone numbers from your Website!
Unless you have mentally prepared yourself to handle angry phone calls at all hours of the day and night from spammed users, implement a privacy service at your domain name registrar. It's against Internic's Terms Of Service to provide fraudulent contact information, but many registrars, such as godaddy.com, provide a privacy service that will allow you to hide your details. The name of godaddy's privacy service is titled "Domains by Proxy", and it costs only several dollars per year. If your registrar does not provide a similar privacy option to you, it may be in your interest to make a quick change to one that does.
Additionally, if you provide a contact phone number on your Website, it would be equally in your interest to remove it until the crisis has ended, or replace it with a number for a voice mail service only. There are several free Internet voice mail services that can provide a phone number that will send you messages via email only.
Step 7 - Post the Joe Job details on usenet!
By now, it's likely that your Joe Job may have already hit the radar of many of the popular spam abuse services on the Internet; however, there are methods you can use to inform them of the situation.
If your Internet Service provides you with usenet access, or you have a usenet subscription, now's the time to take advantage of this service. If you're not sure whether your ISP offers usenet access, make a quick phone call to find out; if they do, ask how you can access it using your email client. Once you have signed in to usenet, search for a group named news.admin.net-abuse.email (commonly called N.A.N.A.E). Leave a post at the N.A.N.A.E. newsgroup with the name of your site, explain that it's under attack by a Joe Job, and be sure to leave a link to your spam information page. Your message will likely be met with skepticism by many of the avid anti-spam fanatics that frequent this group, but your message is not meant for them. Your message will also be read by the people that run the spam services such as spews.org. These individuals will not reply, but they will read your story, and take it into consideration before placing you on a blacklist from which you may never be removed.
If you're confronted by one of the "regulars" at the N.A.N.A.E., don't be combative or defensive; each response you make to their questions may result in additional queries, and may end up finding yourself repeating the same answers to a callous mob. The best advice is to simply post your situation so that it's there for the spam list operators you intended to reach.
Step 8 - Contact the authorities!
Even if you sustain substantial financial losses as a result of your attack, there is little the authorities will be able to do for you, so don't hold your breath waiting for a resolution from them. However, there is one benefit that they can provide you, which is to create an official record of your attack. This can be very handy in the event that you need it for your defense, or prosecution becomes an option at a later date.
The agencies you should contact include:
The Federal Bureau of Investigation
Publicly listed phone number: (202) 324-3000
This phone number will connect you to the FBI's Washington DC office. You will need to ask them for an FBI office in your area, or you can check your local phone book for a local phone number. In some cases, the FBI may want to set up a face to face meeting with you if your losses warrant it.
The Federal Trade Commission
Publicly listed email: UCE@FTC.GOV
The FTC is a common resources to report spam email, and your Joe Job may have been complained about to this organization. You should send them a similar email that was sent to your service providers, including your spam information page, informing them of the Joe Job attack. This will also establish a record with this organization in case it is needed at a later date.
Conclusion: There are many types of attacks and exploits that are preventable; unfortunately, a Joe Job is not one of them. Typically, such attacks involve numerous servers that you won't have any direct control over, and there are no real precautions you can take against falling victim to a Joe Job.
Fortunately, though, there are methods of surviving them when they do happen. If you carefully follow the steps above, you can drastically reduce the duration and severity of damage caused by the Joe Job, in a seemingly more and more lawless cyber age.
Reprinted with permission from:
Dillian Thomas, Security Advisor for
Boxart.com
ALSO SEE:
Wikipedia "Joe job"
Boxart attack
|