Back in the good old days, you could count on spam to help you through those dark months in the bomb shelter, to add humor to a dull birthday gift or, in a pinch, to serve as the main course to a gang of uninvited in-laws. Nowadays, spam has mutated into an electronic scourge — a vile strain of unsolicited, often fraudulent e-mail that clogs inboxes more readily than its meatier namesake clogs arteries.
Unfortunately, there are no foolproof solutions, but a number of anti-spam tools offer a ray of hope. Apply the right tool under the right circumstances, and you’ll stem the tide.
Desktop Protection
From Outlook to Entourage, most e-mail programs come with built-in spam filters that send messages containing user-defined keywords and phrases (e.g., “free”, “Viagra” and “third cousin of the late president of Nigeria”) into a junk-mail folder or straight to the trash. While the price is right for cash-crunched companies, desktop filters have trouble keeping up with the slippery ways of the modern spammer. Slight alterations to well-used subject lines or intentional spelling errors within the message can throw the filter off track. “You really need broader-based filtering software that can look at the entire message and pull out data patterns,” says Stephen Smith, senior developer at Burlington, Ont.-based Align Software Inc., a custom software shop and Internet service provider. Reliance on e-mail programs as the only line of defence may prove cost-effective in a small workplace, but they generally lack efficacy.
Stopping spam at the server
Off-the-shelf spam fighters are inexpensive: freeware options such as MailWasher cost zip, while more sophisticated utilities such as Spamfire or Norton Antispam go for $40 to $50. They beef up your e-mail’s filtering system by adding heuristic testing (i.e., learning as it goes) to the process. “The utility might look at a message,” says Smith, “see that it doesn’t have XXX in the subject line, but that it does have ‘money’, ‘fast’ and ‘penis’ in it, and drop it in the spambox.” Users can view this folder and identify legitimate correspondence, which prompts the software to incorporate the characteristics of these “false positives” in its future judgments.
The software used at the server level is similar to that used on the desktop. “The only difference is that the rules are actually on the server, and once put in place, will affect the incoming mail of everyone in the company,” says Peter Koitsopoulos, a tech specialist with World Connect Inc., a corporate consulting firm in Thornhill, Ont. Companies with more than a handful of employees often place filtering software on an in-house server, thus paying for just one piece of software rather than shelling out for each PC.
When Smith applies filters to an in-house server, he even uses the same software program, Spam Assassin, that he’d install as a desktop filtering option. “The best solution,” he says, “is to have some loose filters at the server, so that messages that are undeniably junk mail get punted, but the bulk of the e-mail still gets through to the user and can be managed on their end.” Companies that opt for tighter filtering at the server level need to have an employee or tech service regularly go through the server’s spam folder to check for false positives, as you would with a desktop utility.
ISPs and antispam services
Many ISPs offer antispam services to their business clients. For instance, for $100 a month, Toronto-based Pathway Communications will eliminate or separate suspected spam before you ever see it. The advantage here is simply out of sight, out of mind. “We give people two choices with our TrueMail service,” says Pathway president Ashok Kalle. “You can get your spam tagged and sent to you, and a local filter installed on your machine will put it in a separate mailbox. Or you can choose to have it quarantined in a separate area at Pathway’s service itself.” Users of the service are able to log in to check their quarantined mail for false positives at any time. And if they’re too busy to do that, the TrueMail service includes an optional feature called LastLook — a manual scan of the quarantine box for legitimate e-mail by a Pathway employee. “ISPs want to give the users the control,” says Koitsopoulos, to avoid the risk of being held liable for costly business-related false positives. “It’s important for them to let the client monitor their own quarantine and set up their own filtering rules.”
Blacklists
Of course, not all spam jamming is foolproof. Last summer’s hot technique, “blacklisting”, whereby e-mail originating from the Internet addresses of known spammers or rogue ISPs are bounced back by your own ISP, backfired miserably. “The approach worked really well until that last round of Windows viruses came around and infected, like, every Windows-based computer on the planet,” says Smith. The problem? Suddenly, huge ISPs such as Sympatico and AT&T were shanghaied, sending out huge volumes of junk mail and, ironically, finding themselves on blacklists everywhere.
The e-mail challenge
“Challenge response” tools are the latest weapon in the spam wars. With names such as iPermitMail and SpamArrest, these third-party services bounce incoming e-mails back to their sender, challenging them to prove they’re not spammers by clicking on a link or entering a code word at a specified website. When a sender responds to such a request, their e-mail address is added to a “whitelist” and the message and all subsequent transmissions are allowed through (unless the user manually blacklists the sender). If the sender fails to respond, their message is never seen by the addressee. Because spam is generated by automated systems, such challenges are never seen, and the e-mail never gets through.
It’s a cost-effective solution — corporate subscribers pay just $2.50 to $4.50 per user per month — but it’s not without problems. Senders often mistake the challenge messages for spam and don’t respond, or bristle at the implication they’re a spammer. “This seems to be the latest craze in fighting spam,” says Koitsopoulos. “But it makes you wonder how long it’ll take for spammers to find a way around it.”
© 2003 Pat Lynch
