Spam e-mail is the common term which refers to unsolicited and unwanted electronic mail messages. Many people at the university have already received such messages in their mailbox in the past and have strongly expressed their desire to have something done about this.
IronPort®: a hardware anti-spam solution
On 27 March 2007, the Computing Centre has replaced its anti-spam measures by one hardware solution: IronPort®. All mail for addresses @vub.ac.be and @ulb.ac.be are treated by the IronPort® systems.
For details how it works, please see http://webnotes.vub.ac.be/¬eid=270
Limiting mail coming from suspected servers
Mail for departmental mailservers are not being processed by the IronPort® solution. For those mailservers, messages are crossreferenced with blacklists maintained by MAPS, Inc. and Spamhaus. These lists contain IP addresses of mailservers that spammers use to send their messages from. The filtering system verifies if a message is sent from a mailserver on the list, and if so, it is refused by the VUB and ULB mailservers.
When a message coming from a blacklisted server is sent to the university's mailservers, an error message is returned to the sender with instructions on who to contact to remedy the situation.
Note: For servers, blacklisted by the Computing Centre itself, the error message contains a fax number. When we receive notice of unwarranted blocking, we IMMEDIATELY remove the blacklisted IP address from our list without further need for explanation by the sender.
This service is operational on the mailservers at the Computing Centre since 20th February 2001. This procedure has the approval of both VUB and ULB authorities and its effectiveness is monitored by Computing Centre staff.
Content filtering
On March 27 2007, the content anti-spam software SpamAssassin™ was replaced by the IronPort® hardware that evaluates each incoming message and gives it a stamp of wanted or unwanted e-mail. Based on this stamp you can define a filter or rule in your mailprogram to filter out messages.
Do note that the Computing Centre does NOT filter messages by itself, the option whether or not to use the spam-status information provided by the IronPort® is entirely up to the end-user, you.
For details on how to filter messages based on this spam-status, please see http://webnotes.vub.ac.be/¬eid=59
No. But there is a distinct possibility that you exchange mail with legitimate persons whose mailserver is blacklisted. You will be able to send messages to them, but they won't be able to send you a reply. They will get an error message from the VUB/ULB mailserver which points them to a webpage with more information. The person on the other site should contact his/her system administrator to have the problem fixed.
Unfortunately no. The procedure based on suspected servers will block all messages coming from a blacklisted host, but some messages may still get through because spammers find other mailservers who lack the necessary protection to avoid being used for spamming purposes.As to the content filtering, filtering out messages based on the information added by the IronPort® is entirely up to you. See http://webnotes.vub.ac.be/¬eid=59 for details.
Unless the content of a message is extremely disturbing or unless it implies illegal activities, delete the message without further ado. If you wish to file a complaint, you can forward your mail to abuse@vub.ac.be or abuse@ulb.ac.be Please include all headers so that we can determine the origin of the mail. We will then examine if and in what way any steps can be taken officially. Note that if an unwanted message has been sent from outside Belgium, chances are slimm not to say non-existant that something can be done about it.
In addition to the filtering options offered by the Computing Centre, you can use the filter mechanisms available in e-mail client programs (Outlook Express, Eudora, ...) to discard (or automatically file) messages containing certain words or phrases (this is called "client-side filtering").If you wish to do so, first a word of caution though. The risk involved in content filtering is that more messages than anticipated may be filtered out, and so there is a risk of putting aside or deleting a message that was actually intended for you. So when you do your own filtering, caution is advised.
Note: Third-party utilities that can be incorporated into existing mailprograms such as Outlook and Eudora are also available. The Computing Centre does not offer such programs, but you are free to use them if you wish. Please do keep in mind that the Computing Centre does not offer any support for these utilities.
Note: Do not have your anti-spam software generate error messages (user unknown) to try to get spammers to unlist your seemingly unexistant address. This does not work and only generates problems on the university's mailservers.
Hint: do not delete the messages you filter, instead save them to a separate mailfolder so that you can still review them later, and keep a possibility to recover a message that shouldn't have been set aside.
The mailservers at the Computing Centre currently scan incoming messages for computer viruses and intercept infected messages.Important: do note that sometimes viruses are sent faster than antivirus manufacturers can provide antidotes, so caution on opening strange messages is still advised. We will try to keep you up to date in our CCinfo service and our Virus FAQ when virus infected messages may have gotten through.
Good question, we sometimes wonder about that ourselves. There are a number of methods spammers use to assemble the large numbers of lists of e-mail addresses. Here are a few of them:
- scanning of webpages for e-mail addresses
- searching for e-mail addresses in NetNews postings
- searching addresses in mailinglists
- collect e-mail addresses when you "unsubscribe" (don't unsubscribe, you only confirm that you use the e-mail address for which you unsubscribe)
(1) Technical detail: if you wish to know which computer was infected, and you are sure your computer is protected against this virus, view the headers of the message containing the virus and look for the lines Received: ... The last one in the list indicates which computer the message originated from (though very little will be known about the owner). If the computer is a VUB or ULB computer, feel free to forward this information to support@ulb.ac.be
(2) To view the headers of a message, click on the Blah Blah icon in Eudora, or look at the Message Properties in Outlook Express.