What we can do to stop cybercriminals

In Superbugs and Cybercriminals I said that I was going to figure out how to send my rejected emails to Knujon automatically. I did, and I’ll tell you how. But first, why is it important?

According to Bruen, Knujon has now taken down over 50,000 of the sites that are using unsolicited emails to drive traffic to their sales of knock-off products, drugs of questionable origin and purity, and dangerous hormone-based products. Unfortunately, there are another 3-400,000 similar sites still active that Knujon knows of, and there may be as many as 6-700,000 more such sites that Knujon doesn’t yet know about. This is despite the fact that Knujon has processed millions of junk emails.

“We don’t have enough people forwarding us their junk emails to get good worldwide coverage of the problem,” Bruen told me. “We currently have about 2,000 active members. If we had 10,000 active members sending us their junk emails, we might come to know about most of the sites behind them.

“Cybercriminals are like roaches: they don’t like being exposed to the light. The more of them we can expose, the less they’ll be able to do business.”

So here’s the pitch: forward your filtered junk email stream to knujon@coldrain.net. You don’t have to register with knujon.com, but if you want to have a private reporting address and get status reports about progress processing the emails and exposing the people who are trying to prey on you, it’s only $27/year for a personal client account.

Now, how do I forward junk email automatically? So far, I have two methods, one on my client, and one on my server.

Microsoft Outlook’s filtering mechanism doesn’t have enough flexibility for this, so I worked around it. I use K9 as my email proxy filter, and I wrote a rule in Outlook to forward emails flagged by K9 to knujon@coldrain.net and then move them to my junk folder.

On my IMail server, I wrote two rules to process emails flagged as junk by the fairly loose filter on the server. The first one forwards the messages to knujon@coldrain.net, and the second one deletes the message. These rules process the bulk of the junk; the bad messages that make it through the server filters to my client are processed by the finely-tuned (99.8% accurate) Bayesian filter I’ve got in K9.

What if everybody did this? What if GMail and Yahoo! Mail and Hotmail all automatically forwarded their filtered junk to Knujon for processing? What if the next security patches to Outlook and Exchange fixed them so that by default all filtered junk was forwarded? Knujon would have the volume it needed, but could the servers handle it?

I asked Bruen that question. “Well, it might overwhelm us if it all turned on right away, but we could easily scale up our servers and handle anything people could send us. We’d welcome that. The more we understand about the world of Internet criminals, the less room they’ll have in which to operate.”