www.investors.com Printer-Ready Version

Article Title: "Buried In Spam? Simple Tricks Could Help You Dig Out "
Author: MIKE ANGELL  Section: Internet & Technology		Date: 7/11/2002
Dealing with junk e-mail, or "spam," seems to be easy enough. Just hit the delete button when it appears in your e-mail inbox. But what if the spam just keeps coming and coming? "Some people are so offended, they don't want to deal with it," said Forrester Research analyst Laura Koetzle. "They ask their (information technology) department to get rid of it for them." Ways to prevent junk e-mail from reaching an inbox are emerging as technology improves. But spammers are getting more sophisticated, and often can thwart the roadblocks. (See related story on A8.) "It's an arms race," said Eytan Urbas, vice president of spam-blocking service Mailshell.com. How do spammers find addresses to begin with? In the old days, Internet service providers and online retailers used to sell e-mail address lists freely. Most, but not all, online firms have since stopped such practices. Urbas says people should be careful about giving out e-mail addresses. An e-mail address given to attend a trade show, for example, can wind up with all the companies at that show. And that list can be easily resold. Urbas advises people to keep two e-mail accounts. Use one account just for those people or groups you know can be trusted not to share e-mail addresses. Use the other account for dealing with online retailers or others that just might sell your address. "The No. 1 thing is to not give out an e-mail address freely," Urbas said. "Once someone has your e-mail, they can send you anything. Treat your e-mail address like an unlisted phone number." Even when people are careful, spammers have ways to get addresses. One method is called a "dictionary harvest attack." Spammers send e-mails to Internet service providers with thousands of combinations of first and last names. For businesses, they often only need one e-mail address to learn how a company sets up e-mail accounts. For example, a company might use a first name.last name@company name.com. Spammers will try inserting different name combinations into that pattern. The spammers' e-mail servers send back error alerts for messages that don't get through. They can assume, usually correctly, that all other addresses are valid. Some spam messages have an option that states recipients can opt out of getting further e-mails from the sender. Alas, Urbas says some spammers use those replies to verify a "good" address. "Spammers are direct marketers who are trying to improve the quality of their lists," Urbas said. Hitting the opt-out button "confirms that the address is hot," he said. Microsoft's e-mail program Outlook has a variety of ways to filter out junk e-mail. The filters use a sender's address and keywords in the messages sent. On Outlook's tool bar, click on the "Organize" option. Then, turn on the "Junk E-Mail" feature. That will guide you in setting up a folder to automatically screen and dump junk e-mail. Yahoo Inc. and Microsoft Corp.'s Hotmail e-mail unit offer users the same options for filtering certain addresses or messages with keywords. But spammers can get around those filters. "Part of the problem of doing filters and the like is that the spammers are already working on ways to thwart them," Urbas said. For example, spammers try to never use the same "sent from" address twice. Urbas says a good spammer can easily fake different addresses so that Outlook won't catch them. Smart spammers can also hijack what is known as an "open relay," which is a computer for forwarding e-mail. The spammer will send junk e-mail to the open relay. The relay sends it on with its address, not the spammer's. As for keyword filtering, spammers get around it by techniques like random number generation or changing the text of a message. Some ISPs rely on databases of spam messages for deciding which ones to filter. The database doesn't contain the whole spam message, just a summary of its key features. That database can be thrown off, though, by inserting a randomly generated number in the message, usually at the bottom. Spammers also set up programs to randomly change the subject lines in junk e-mail as well as the order of the text. At this point, there are few options to thwart spam legally, though Congress has talked of enacting anti-spam laws. Some states have such laws, but often they can't be enforced because much spam comes from other countries. Said Urbas, "It's the Wild West, a town without a sheriff."