{"id":4310,"date":"2013-08-16T10:30:52","date_gmt":"2013-08-16T08:30:52","guid":{"rendered":"http:\/\/blogs.sun.ac.za\/it\/?p=4310"},"modified":"2016-01-18T15:33:28","modified_gmt":"2016-01-18T13:33:28","slug":"how-do-spammers-get-your-e-mail-address-part-1-rumplestiltskin-attack","status":"publish","type":"post","link":"https:\/\/blogs.sun.ac.za\/it\/2013\/08\/how-do-spammers-get-your-e-mail-address-part-1-rumplestiltskin-attack\/","title":{"rendered":"What does Rumplestiltskin and spam have in common?Wat het Repelsteeltjie en gemorspos in gemeen?"},"content":{"rendered":"

<\/p>\n

\"\"Once of the most common questions we get asked by users is “How do these spammers get my e-mail address?”\u00a0<\/em><\/p>\n

There are a number or methods that these spammers use, but today we will focus on one of the methods, \u00a0The \u201cRumplestiltskin\u201d attack.<\/p>\n

\n

A dictionary or Rumplestiltskin attack is an attack where the spammer floods e-mail servers with usernames selected from a dictionary. The name of course, comes from the old Grimm\u2019s fairytale.<\/p>\n

Long, long ago when the university\u2019s e-mail system was still very primitive and e-mail addresses were limited to 8 characters, most personnel at the university had simple names like\u00a0ab@sun.ac.za<\/em>,\u00a0aa1@sun.ac.za, bv@sun.ac.za<\/em>. It is relatively easy to make up a list of common letter combinations and just add\u00a0@sun.ac.za<\/em>\u00a0onto it to create a e-mail list. Add to that common\u00a0 role-based accounts, such as\u00a0admin<\/em>,\u00a0help<\/em>\u00a0and\u00a0support<\/em>, as well as adding the latest Baby Names list and you have a list that can be used to launch a Rumplestiltskin attack.<\/p>\n

If you send\u00a0 E-mail to Unknown Users or address that do not exist, Why bother?<\/em><\/p>\n

Firstly rather than spammers buying a list from other spammers, they can just spam to any possible name they can generate. It might seem rather inefficient but sending email is cheap.<\/p>\n

The second reason \u2013 which is far more sinister \u2013 is that spammers use these techniques to generate lists of\u00a0valid<\/em>\u00a0email accounts. They first send to a generated list and when they do get a response or the receiving mail server doesn\u2019t answer back and say\u201cunknown e-mail address\u201d, t<\/em>his allows them to either sell these lists of \u201cverified\u201d emails or be more accurate in their other spamming activities.<\/p>\n

With this second reason in mind, you should be able to see the danger of replying to these mails or filling in the \u201copt-out\u201d option, that is commonly included in such mails, or by setting your \u201cSend delivery receipt\u201d to automatic on your e-mail. As soon as these spammers realize that there is a real person at the other end of the e-mail, they will increase their spam. They get paid to send out the mail, not for how many people respond to them.<\/p>\n

In our next edition we will focus on a second way spammers harvest e-mail addresses in –\u00a0Part 2 \u2013 Trojan Horses, Bots and Zombies<\/p>\n

[ARTICLE BY DAVID WILES]<\/p>\n<\/div>\n

<\/p>\n

\"\"Een van die algemeenste vrae wat gebruikers vir ons vra is: Hoe kry hierdie gemorsposversenders my adres?!\u00a0<\/em><\/p>\n

Daar is `n hele paar metodes, maar die keer fokus ons op die “Repelsteeltjie”-aanval. \u00a0<\/p>\n

`n Woordeboek of Repelsteeltjie-aanval is `n aanval waar die gemorspos-versender e-pos bedieners oorval met gebruikersname uit `n woordeboek. Die naam is natuurlik afkomstig van die ou Grimm sprokiesverhaal.<\/p>\n

Lank, lank gelede toe die universiteit se e-pos sisteeem nog primitief was en e-posadresse beperk tot 8 karakters, het die meeste personeel eenvoudige adresse gehad soos\u00a0ab@sun.ac.za<\/em>,\u00a0aa1@sun.ac.za, bv@sun.ac.za<\/em>. \u00a0<\/p>\n

Dis redelik eenvoudig om `n lys van algemene letterkombinasies saam te stel en @sun.ac.za<\/em>\u00a0by te las en `n e-pos adreslys saam te stel. Voeg daarby algemene rolgebaseerde rekeninge soos\u00a0admin<\/em>,\u00a0help<\/em>\u00a0en\u00a0support<\/em>, sowel as die nuuste babaname lys en jy het `n lys waarmee jy jou aanval kan loods.\u00a0<\/p>\n

Hoekom sal jy `n e-pos stuur na onbekende gebruikers of `n adres wat nie bestaan nie?<\/em><\/p>\n

Eerder as om `n lys te koop by ander gemorsposverspreiders, is dit makliker en natuurlik goedkoper om net gemorspos te stuur na enige moontlike naam wat gegenereer kan word.\u00a0<\/p>\n

Die tweede rede – en `n meer oneerlike een – is dat versenders dit gebruik om juis `n lys van geldige adresse op te bou. Eers word `n gegenereerde lys gestuur en wanneer hulle `n antwoord kry of die e-pos bediener aan die ontvangkant nie terugantwoord en bevestig dat die adres ongeldig is nie, kry hulle die geleentheid om die lys te verkoop as “bevestigde” adresse of om meer akkuraat te wees met hul aktiwiteite.<\/em><\/p>\n

\n

Hiermee in gedagte, kan jy jouself indink hoe gevaarlik dit is om op hierdie e-posse te antwoord of te kliek op die “teken uit” opsie wat algemeen by die tipe e-posse ingesluit word. Selfs om\u00a0\u201cSend delivery receipt\u201d op outomaties te stel hou `n gevaar in.<\/p>\n

Sodra die skuldiges besef dat daar `n regte, lewendige persoon aan die ander kant van die e-pos is, sal die gemorspos net eenvoudig toeneem. Hulle word betaal om die e-posse suksesvol uit te stuur, nie noodwendig vir hoeveel mense daarop reageer nie. \u00a0<\/p>\n

Volgende keer kyk ons na nog `n metode wat gebruik word om adresse te oes in Deel 2 \u2013 Trojaanse perde, Robotte en Zombies<\/p>\n

[ARTIKEL DEUR DAVID WILES]<\/p>\n<\/div>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Once of the most common questions we get asked by users is “How do these spammers get my e-mail address?”\u00a0 There are a number or methods that these spammers use, but today we will focus on one of the methods, \u00a0The \u201cRumplestiltskin\u201d attack. A dictionary or Rumplestiltskin attack is an attack where the spammer floods […]<\/p>\n","protected":false},"author":259,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1103,29187],"tags":[],"class_list":["post-4310","post","type-post","status-publish","format-standard","hentry","category-communication","category-security-2"],"publishpress_future_action":{"enabled":false,"date":"2026-05-22 04:59:20","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/posts\/4310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/users\/259"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/comments?post=4310"}],"version-history":[{"count":12,"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/posts\/4310\/revisions"}],"predecessor-version":[{"id":9346,"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/posts\/4310\/revisions\/9346"}],"wp:attachment":[{"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/media?parent=4310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/categories?post=4310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.sun.ac.za\/it\/wp-json\/wp\/v2\/tags?post=4310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}