University of Central Florida

Information Security

 
Quick Links
Home
IT Security Policy
IT Resource Policy
Security Tips for everyone
Security Tips for IT
Rules of the Road
Server Security Standards
Computer Security Standards
Legal Matters
 
Network Operations Center
ResNet
Service Desk

 

Security Sites
CERT
CIS
INCIDENTS
LINUX SECURITY
DHS
SANS
SARC
SECURITY FOCUS
US-CERT
 

 

 

Anti-Spam

Unsolicited emails (spam) are prevalent on the internet and are not showing any signs of diminishing in the foreseeable future. Having said that, there are measures we can all take to minimize the impact of spam on our daily computing experience at UCF.

I. How to keep spam from starting?

II. How do I protect myself from existing spam?

III. How do I respond to spam email?

IV. If all the above fails...

 

I.  How to keep spam from starting?

  • When subscribing, purchasing, or signing up for services on the internet, do not provide your GroupWise or Pegasus email address. 
    • Many sites share or sell blocks of addresses to people that are willing to pay for them and have no issues with sending you ads. Also, a site may not necessarily honor your request to not to send you ads or share your email address. 
  • Do not click on links in an email advertisement or links to "Remove" your address
    • This can be dangerous because these links can be tricky, unreliable, or can even link to a site which can contain malicious code. One thing is certain, by clicking on a link you may be informing the advertiser that your email address is valid. Thus, this will encourage them to send more ads.
    • If you see an ad or a site you'd like to explore in one of these messages, instead of clicking on the links included, open a browser, manually find the company on the web, and explore the website anonymously. In this way, you can decide if they are worthy of your knowing your e-mail address.

 

II. How do I protect myself from existing spam?

  • When you receive unsolicited email without removal information, just delete these messages unread
    • Most of the time, the subject line will give you enough information to determine if you have received legitimate email. By simply deleting it, you can save yourself the hardship of having to view any advertisement or objectionable content. We recommend, also for security reasons, to turn off "Quickview" in GroupWise (From the "View" menu click on "Quickview"). In this way, you can audit your unread messages without being exposed to their content.
    • This type of illegal SPAM (legitimate companies must provide removal information) often arrives from free email servers such as @hotmail.com, @yahoo.com, @excite, etc. It is very likely that the mailbox was setup just for the purpose of spamming.
 
  • SPAM with extremely objectionable content. 
    • Anyone with an email address is bound to receive objectionable email at one point. If you receive one of these offensive emails, try not to take it personally. Many of these spammers are unscrupulous even to the extent that often they provide links claiming to be for removal, but rather put you on more email lists.
    • If possible contact the e-mail provider and have the offending mailbox shutdown (see below.)
 

 

III. How do I respond to spam email?

To complain about an unsolicited email, the first thing you should do is find out where the email came from and determine from that where to send your complaint.

  • View full email headers to determine where the email came from
    • In GroupWise: From the "Action" menu click on "View". Click on "Mime" icon.
    • In Netscape Messenger: From the "View" menu click on "Headers" and then "All"
    • In Outlook: Double click the message to open it up, from the "View" menu, and select "Options"
    • Pine: Press "h" to view full headers when viewing the message

Sample fictitious email header:

  1. From 1234@1234.com Wed, 29 May 2002 11:51:42 -0700

  2. Received: from [10.10.15.15] by 5678.com (3.2) with ESMTP id ...; Wed, 29 May 2002 11:51:38 -0700

  3. Received: from 10.10.16.16  ([10.10.16.16]) by 5678.com with esmtp; Wed, 29 May 2002 09:57:21 +0600

  4. Received: from 10.10.17.17 ([10.10.17.17]) by 91011.com with NNFMP; 29 May 2002 15:42:22 +0300

  5. Reply-To: <1234@1234.com>

  6. Message-ID: <...>

  7. From: <1234@1234.com>

  8. To:  <my@mailbox.com>

  9. Subject: Want to refinance your home?? 3485VFcp5-700XlaV1064-20

  10. Date: Wed, 29 May 2002 09:48:08 +0900

  11. MiME-Version: 1.0

  12. Content-Type: multipart/mixed;

  13.             boundary="----=_NextPart_000_00E2_57C33D8D.E5578D88"

  14. X-Priority: 3 (Normal)

  15. X-MSMail-Priority: Normal

  16. X-Mailer: Internet Mail Service (5.5.2650.21)

  17. Importance: Normal

  

Note the last "Received" line (line 4). It contains the IP address of the sender (10.10.17.17). With this information you may now find contact information for the service provider and/or company that owns this IP address.

  • Go to www.arin.net and enter 10.10.17.17 to determine the owner of the IP address:
    • The website will indicates who the IP belongs to

     

  • Write a complaint email to the ISP, such as,

To: abuse@company.com
From: youremail@mail.ucf.edu
Subject: Want to refinance your home?? (fwd)

I have received an unsolicited email from a computer (10.10.17.17) in your address space as indicated in the email headers pasted below. Please take appropriate action to stop spam from this system. 

Thank you

[Paste the header of the email here after you have determined it in the above step]

 

IV. If all the above fails...

  • Due to the number of complaints we receive regarding spam, we strongly encourage the recipient to take the appropriate measures described above to mitigate spam.
  • Check What is not against law or policy (Spam)?
  • When your efforts have been exhausted, you may contact the Service Desk at Servicedesk@mail.ucf.edu and/or  GroupWise Helpdesk at gwhelp@mail.ucf.edu. and include in the email the original email with complete email headers. Computer Services will take appropriate measures to stop the offending spam.
                          

All contents are copyrighted
Maintained by the Information Security Office
Computer Services & Telecommunications