University Computing Services

Frequently Asked Questions - Spam @FSU

1. How has SPAM become such a growing problem?

Spam is a very cheap way to advertise your service or product to millions of people at once. So, even if you only make a sale to 2 or 3 people, the advertising costs are covered.

Also, it is very expensive to prevent. Since spammers use fake email addresses and change them frequently, they are hard to trace and block.

2. What are some of the problems people deal with SPAM? For example, the over abundence of annoying emails, identity theft, SPAM emails sent repeatedly.

Email clutter - many times people have told me that their email boxes are so filled with spam, that when trying to delete the spam, they accidentally delete important messages. Or their legitimate mail is accidentally deleted by spam
filter programs.

Rising server and bandwith costs - Delivering spam mail to inboxes takes resources that could be used for delivering legitimate mail.

There are some email scams that request receipients to send personal
information, such as the well-known Nigeria scam or scams asking you to send your AOL username and password. The best thing to remember in these cases, is to be careful about who you give your personal information to. No legitimate companies will ask for your password or SSN through email without the use of encryption.

3. What are some of the technology programs people can use to filter and quarantine the SPAM? And how do they work?

There are several approaches to stopping spam. Spam blocking or filtering software analyses the headers and text of mail looking for common spam characteristics.

We have installed a spam blocking program called SpamAssassin on FSU's main email servers, garnet and mailer. Right now we are running it as a pilot program, so users can go to the UCS webpage for instructions on how to set it up for their account. A variety of other free and commercial software products are available, that people can install on their desktop computers.

Another filtering method is "whitelist" filtering. The way this works is: you create a list of addresses of people you expect to receive mail from, and filter anything that is not from them into a separate low-priority mailbox that you check once in a while. If any legitimate mail is dropped into your "junk" box, you can retrieve it and add the sender's address onto your whitelist. When we set this up on FSU accounts, we usually include any "fsu.edu" addresses in the whitelist.

Another common spam-prevention method is using "Blacklists" or RBL's. These lists contain internet domains where spam has been known to originate from, which are then blocked from sending mail to anyone on your network.

The difference between these methods is that spam blocking software and whitelists are something that each user can opt-in to, while blacklists effect every user on the network. And occasionally legitimate networks are added to Blacklist, and legitimate email is blocked. This has happened to some servers here at FSU before.

In the past, we have recommended that people forward their spam mail with headers expanded to the email address abuse(at)fsu.edu, in order to help us create our own blacklist. However, this has proved to be a resource-consuming and inefficient process, so we are now considering subscribing to a blacklist service managed by spam-specific organizations. For people who still want to forward their spam mail to abuse(at)fsu.edu, we will consider the possibility of forwarding these mails on to organizations who deal with specifically with spam.

FSU has a team, called CSIRT, dedicated to dealing with computer security issues, including spam. They resolve incidents and develop strategies for dealing with spam. They also give presentations on how to deal with spam and other security issues to student orientation and to academic and administrative departments. You can contact Joseph Lazor at jlazor(at)admin.fsu.edu or 644-0062 to set up a presentation for your department.

4. Does the "Click on Unsubscribe button" really help stop SPAM?

No, In most cases this will cause you to receive more spam. Spammers use this trick to get you to respond. Then your email address is verified as being valid and you end up on more spam mailing lists. Unless the mail is from a mailing list that you subscribed to in the first place, do not respond.

5. What are some other tips people need to know to help prevent SPAM?

Use two email addresses, one for business mail and one for other things. Never open attachments from people you don't know, or even suspicious ones from people you do know.

Avoid publishing email addresses on your website in plain-form.

Email headers can be forged, and email is not always sent the person listed in the 'From' line.

And lastly, the delete key is your most powerful weapon against spam.

If you would like to get more information about spam, visit these websites.
UCS.fsu.edu or spam.abuse.net.