Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Spam Security United States

FTC Recommends ISPs Disconnect Spam Zombies 411

Posted by Zonk from the spombie-hunting dept.
Mike Markley writes "CNN is carrying a story about the the FTC's plans and concerns around spam zombies. They say they will be identifying such zombie hosts and notifying ISPs, and are recommending that the ISPs disconnect indicated users. There's also a recommendation likely to raise the ire of the geekier sorts: that ISPs only permit users to send mail through their own servers (presumably by blocking port 25 outbound)." From the article: "Law enforcers in 25 other countries, from Bulgaria to Peru, are also participating in the campaign, the FTC said. Absent from the list of cooperating countries was China, where experts say rapid growth and a relative lack of technical sophistication have led to a large number of zombie computers."
This discussion has been archived. No new comments can be posted.

FTC Recommends ISPs Disconnect Spam Zombies More

FTC Recommends ISPs Disconnect Spam Zombies

Comments Filter:

  • Block 25 all you like. (Score:3, Interesting)

    by jd ( 1658 ) <imipak@ y a hoo.com> on Tuesday May 24, 2005 @07:17PM (#12628923) Homepage Journal
    I've got an IPv6 tunnel onto the 6bone, and can therefore run my own IPv6-aware mailserver. I can still send to IPv4 mail addresses, because mail addresses aren't IP version-aware.


    So nyah!


    Oh. They just blocked tunnels, too. Shit.

    • Anybody smart enough to get around port 25 blocking is probably smart enough to not get his machine owned by spammers... Yes, all ISPs should block port 25 by default, and only open it up for customers that specifically request it (and probably should charge those customers more). But then, I'm certainly not the first person to suggest this.
      • Instead of charging customers for opening the port, they could have a provision where you request in writing that the port be opened for your IP address. Upon finding that you have been spamming (intentionally or not), they disconnect you (for a minimum time, say, 24 hours) until you pay a reconnect fee. A second time results in a longer disconnect (a week, perhaps) and a higher fee. A third offense bars you from their network for a year.

        • Re:Block 25 all you like. (Score:3, Interesting)

          by jd ( 1658 )
          That would be a very good system - perhaps even extend it to people who have any kind of virus, trojan or zombie that inconveniences or harms others, even if it's not spamming people.


          (It would be no different from, say, driving a car that had failed - or not received - State safety checks, in those States that require them. If you do something reckless, but do so in a way that doesn't actually interfere with anyone, then there's no big deal, but it's on you - not them - to make sure of that.)

        • Re:Block 25 all you like. (Score:3, Interesting)

          by msim ( 220489 )
          My isp blocks inbount port 80, 25, netbios, etc, packets by default, and you have to go into your system profile and have this blocking disabled if you want to look after this yourself.

          I presume a similar thing could be configured for outbound port 25 if they wanted to, perhaps even with a "whitelist" of hosts your permitted to send to. Definitely food for thought

        • Re:Block 25 all you like. (Score:4, Insightful)

          by tacocat ( 527354 ) <tallison1&twmi,rr,com> on Wednesday May 25, 2005 @04:04AM (#12631899)

          Both of these concepts have a potential flaw. Burden of Proof.

          If someone is using my email address for fraudulent headers to make it appear that I am sending the spam, is that sufficient for them to shut me down? Do I have to prove that the email which I do not have a copy of, did indeed not come from me?

          Based on how ISP's have behaved in the past, they would be more likely to arbitrarily shut someone down because their either triggered a spam filter erroniously (false positive) or got their email address put into the spam headers.

          I do not agree that there should be a nominal fee applied to someone who is hosting their own mail server. On the contrary I should be getting refund on the basis of lower costs are realized against my account since I have zero email disk usage on their servers and have fewer help desk calls. The uber-geek types only need to call the ISP when the connection is down or blocked.

          • Burden of proof is easy. Hook up network traffic monitors that track the port usage on all of the systems in the network. Excessive port 25 usage would be used in conjunction with reports from the outside. If they get 300 reports of spams using your e-mail address, but they look and you have virtually no port 25 usage, then it's a safe bet that you didn't send it, at least from that system. No reason to shut it down.

            If, OTOH, they look and you're sending a solid 30KB/sec over port 25 for the last six d
      • I don't like the idea that my isp could arbitrarily block certain ports from being used. I don't need a nanny. I know I'm not typical in this sense, maybe among the slashdot crowd I am, but you gotta ask yourself where do they draw the line? So they start blocking 25 on major isps so all the morans [sic] that got owned can't be used to spam. But how easy would it be for these zombie creators to worm their way around a blocked port? How easy would it be for the zombies' masters to not use the zombies fo

  • Go ahead, block 25 (Score:4, Interesting)

    by ProfaneBaby ( 821276 ) on Tuesday May 24, 2005 @07:17PM (#12628924)
    Just leave 587 open. The 'geek' users should be smart enough to figure that out anyway.

    Home users SHOULD be blocked or disconnected, one or the other. I don't actually care which, but as someone who watches mail queues for busy hosting servers, home users infected with viruses become a huge annoyance.

    • Re:Go ahead, block 25 (Score:5, Insightful)

      by dgatwood ( 11270 ) on Tuesday May 24, 2005 @07:22PM (#12628973) Homepage Journal
      The right answer is pretty simple, actually. Start out with port 25 blocked. When the user calls to complain, unblock it on a per-user basis. People who need port 25 unblocked know enough to request it, and there's no valid excuse for denying it. People who run Win-zombies don't have any valid reason to ask for it to be unblocked and generally don't know enough to ask for it anyway, as most of them think that "port" means the ethernet jack on their DSL router/modem....

      Problem solved, and everybody wins.

      • The proper solution is to only let MTAs communicate via port 25, and to use 587 as it was intended, for MUAs. Stick SMTP Auth on port 587, and you're on your way. The only downside to this is if the worm authors start using the MUA (by this I mean Outlook Express in particular) to send email. I suspect that most users aren't really aware enough to notice a dozen messages they didn't write flying out of their Outbox.
      • What about when the spamware/viruses simply use the ISP's mail server to blat out their crap instead?

        It's already been happening. I thought there was even one that was grabbing smtp auth information from mail clients and using it..
        • That's a separate issue. And in that case, if the ISP uses SMTP auth, it's easy to track the mail back to the person infected and cut them off until they fix their computer....

          What makes port 25 such a problem is that it is MTA to MTA, which means that for machines with dynamically-assigned IPs, there is almost no way to track it back to a given end user's machine short of grepping through piles of dhcpd/pump/bootpd/pppd logs.

          • Exactly why isps should:
            1. use static dhcp.
            2. tie the ip address to the modem/account
            3. cap the outbound bandwidth (like they already
            do)
            4. let anyone run a server.

            Personal responsibility shouldn't end at your modem.

            It doesn't end at your door.

            • Word.

              Honestly, education starts with being burned. Its 2005 and we're still trying to convince people that driving without seatbelts or racing other commuters, or ... insert public safety campaign here ... is a bad idea.

              It gains traction when folks who are spreading it are having their feet held to the fire.

              I'm not being an elitist jerk, I'm sayin that owning a computer is as much a responsibility as any thing else in life. You own a car, you're responsible for what you do with it. If your car is blowing

      • Re:Go ahead, block 25 (Score:4, Interesting)

        by Lord Kano ( 13027 ) on Tuesday May 24, 2005 @08:12PM (#12629415) Homepage Journal
        What happens when spam-bots block pop/IMAP ports on the local machine and then send pop-up windows to the user saying "You can not recieve email because your ISP blocks 'Port 25', call and request that they unblock it."

        User:"I need you to um, 'Unlock Port 25'?"
        Tech Support:"What seems to be the problem?"
        User:"I can't get my email and I need you to unlock port 25."
        Tech Support:"You'll have access in 30 seconds."

        LK
        • If a spam-bot appears that blocks the local POP and IMAP ports and notifies users with a message saying "You cannot recieve email because your ISP is blocking port 25 -- call and request that they unblock it", chances are that the helpdesk will soon be asking the right questions to figure out whether the user is infected with a common virus or not. Sure, helpdesk people may not always be that experienced themselves, but they can usually follow procedures.
      • I run my own SMTP server on my laptop. It ignores anything not coming from localhost, so it's at least reasonable safe.

        I use it because when I'm jumping onto a friend's wireless network, my ISP of course any mail I'm trying to send (since I'm outside their network), and it's impractical to reconfigure for every five minutes I want to spend sending something from a friend's system.

        So I always send it myself. This obvious won't work if port 25 is blocked by default, as I'm also not going to call the ISP to

      • Re:Go ahead, block 25 (Score:5, Funny)

        by Bombcar ( 16057 ) <racbmob@@@bombcar...com> on Tuesday May 24, 2005 @08:17PM (#12629455) Homepage Journal
        You'll then see trojans that say, "Call your ISP and ask them to unblock port 25 to see hot naked networks!"

        Bet your last dollar on it.

      • Re:Go ahead, block 25 (Score:4, Interesting)

        by Sheepdot ( 211478 ) on Tuesday May 24, 2005 @08:22PM (#12629490) Journal
        Yes, this seems like an answer to the problem, but what I've never understood is that ISPs have the capability to determine when someone is sending spam and when someone isn't. Just monitor egress port usage. If someone is sending out 50 emails per second then block them. If they are sending one every 2 minutes, then don't.

        Or, when a user signs up, give them the option! Why ISPs haven't provided this yet is beyond me. Have a simple web form that lets users sign in and turn off port blocking, the only ones smart enough to know they need to turn it off are also the ones that most likely need to.

        For that matter, why hasn't Microsoft implemented this as a "feature" of windows XP? If they are turning off raw socket access, they might as well also turn off sending from port 25 by default. It'd upset some of us who host websites on our XP workstations, but if they really want to promote Windows 2003 Server, then this would seem like a viable option.

        Or maybe, just maybe, we could abandon the ridiculous email protocol altogether, and move to something that is built with trust in mind. Or we could all start implementing greylisting and actually increase the cost of spam.

    • Or... (Score:3, Funny)

      by jd ( 1658 )
      Use X.400 - it's a lot more powerful than SMTP, supports receipts for e-mails, is much harder for spammers to inject fake-mails, and is ruthlessly standardized.


      Well, it does have the drawback that nobody uses it anymore, but that does mean you never have to worry about your mailbox being flooded AND you get an excuse on why you didn't turn up to that important meeting that was called electronically.

    • "Home user" is not synonymous with "personal user," especially as more and more people work from home. (Either by choice or because their employers are too cheap to spring for office space.)

      I paid substantially more for a Comcast "business" account at my home address, then found I still had problems hosting my own domains because of their inability to provide a static address... or even a dynamic address within a "business class" block. (The latter meant I was blocked by RBLs listing all residential DSL/c

  • China will play along (Score:3, Interesting)

    by winkydink ( 650484 ) * <sv.dude@gmail.com> on Tuesday May 24, 2005 @07:17PM (#12628930) Homepage Journal
    If this gets substantial traction, China will get it's collective shit together and do something about it. A few days of null-routing their traffic should do the trick.
    • Interesting that you would use the word "collective" next to "shit", and in reference to a Communist government.
    • What is it about all this nagging about China, Brazil et al, when the wast majority of spam still comes from the US? Not only are it sent from US based computers, zombies or otherwise. But the seller of the gods advertised are also in most cases US based.
      • Fear Me, Fear Me!

        I am Zeus, Seller of the Gods.

        Opening bids up for Narcissus. He's in beautiful shape! Any takers for Narcissus? (Sorry, sir, but you cannot bid on yourself.)

        What am I bid for this muse, Apollo? Anyone care to bid on Apollo? Slightly used, I'm letting him go for a paean.

        We've got goddesses, too! Aphrodite is going fast! She always goes fast!

        Oh, you meant "seller of the goods"? Never mind.

  • It's enough that I get spam from life people..
    but now spam from the undead?

    • Re:Spam Zombies? (Score:5, Funny)

      by Rei ( 128717 ) on Tuesday May 24, 2005 @07:37PM (#12629138) Homepage
      dear brain owner,

      compliments of the season to you. I am Barrister Urrrrrrrrrrrr Guurrrrrrrr. I represent Rrrrrrrr Rrrrrrrrrr, son of the late gen. Rrrrrrr Urrrrrrrgh, who was the former military head of state in Transylvania. he died in 1312. since his death, the family has been losing a lot of money due to vindictive church officials who are bent on dealing with the family. based on this therefore, the family has asked me to seek for a foreign partner who can work with us as to move out the total sum of us$75,000,000.00 ( seventy five million united states dollars ) in gold, presently in their possession. this money was of course, acquired by the late president and is now kept secretly by the family. the Swiss government froze all the accounts of the family in Switzerland in 1571, and some other countries would soon follow to do the same. This bid by some government officials to deal with this family has made it necessary that we seek your assistance in receiving this money and in investing it on behalf of the family.

      This must be a joint venture transaction and we must all work together. since this money is very heavy, extra security measures have been taken to protect it from theft or seizure, pending when agreement is reached on when and how to move it into any of your nominated bank accounts. please contact me so we can arrange to meet you at a graveyard of your convenience in the Transylvania area to complete the transaction. as it is in a rather large box, please bring a chainsaw to assist in cutting it open.

      Note: Please send your reply through (Urrrrrrrrrrrr.Guurrrrrrrr@sco.com)

  • Comment removed (Score:5, Interesting)

    by account_deleted ( 4530225 ) on Tuesday May 24, 2005 @07:19PM (#12628954)
    Comment removed based on user account deletion

    • Re:25? Already blocked. (Score:3, Interesting)

      by Chmarr ( 18662 )
      Umm... how does sending to port 80 work? Or... have you configured your mail server to accept mail on port 80... and they're only sending to you?
    • Why should outlook be connecting to port 25 of a server that is not the ISP's official mail server?

      • Re:25? Already blocked. (Score:5, Insightful)

        by barc0001 ( 173002 ) on Tuesday May 24, 2005 @07:38PM (#12629146)
        Here's Bob. Bob is your boss at a small to mid sized company. He's not what you'd call "technical". You're the company's "tech" guy. You also do other things, but when the computers don't work, you're the go-to guy. Your company isn't that large, or that technical itself, so you host your mail with your company's ISP, PhoneCo. When Bob goes home, however, his ISP at home is CableCo. Bob is perpetually calling you either at home, or into his office because he "damn well can't send that email!" Invariably, the reason is because his account is configured to the wrong SMTP server, depending on where he his located.

        Wouldn't it be nice if you could just set up his account to use the company's ISP for SMTP all the time? You used to be able to do that, until the spineless CableCo decided they were just going to blanket-block port 25, no exceptions, instead of doing traffic analysis and chopping off the offenders. But that would take work, and effort, and nobody wants to do that, so just block 25 and call it a day!

        Note: Some elements of this story might be based on real experiences, which may explain the negative bias towards blanket policies of any type as bandaids.
        • Good example. None of the obvious workarounds (set up DHCP or DNS to give him different SMTP servers in different places, ssh-tunnel port 25 to the office, etc) seem workable for a PHB. So the ISP needs to have some kind of opt-out mechanism for users who are technically savvy and responsible (or have handlers who are). Maybe allow each user a maximum number of port-25 connections per minute?

          A better solution would be to separate out the ports used by MUA-MTA and MTA-MTA connections. This would stop th

        • Re:25? Already blocked. (Score:5, Informative)

          by The Cisco Kid ( 31490 ) on Tuesday May 24, 2005 @07:59PM (#12629313)
          Yes, so you make sure you pick a clueful ISP that has MSA (RFC 2476) support, which uses port 587, then you set his mail client to use that, and it works fine both when hes in the office, or at home, regardless of port 25 restrictions wherever he's getting his connectivity from.

          Since MSA requires him to *authenticate* (which most clients, even OE and ilk will do happily) when he connects on port 587, and the ISP only accepts *outbound* mail on that port (other ISP's wanting to delvier mail *to* your ISP still use 25) it isnt terribly attractive to spammers.
        • Invariably, the reason is because his account is configured to the wrong SMTP server, depending on where he his located.

          1) Configure his mail client to speak SMTP to mailhost.domainthatIcontrol.com, and to speak DNS to dnshost.domainthatIcontrol.com.

          2) Configure bind on dnshost.domainthatIcontrol.com to give different answers to the forward lookup on mailhost.domainthatIcontrol.com depending on where the request comes from.

          3) Profit!!!

      • He is ISP Internet Service Provider, hosting a server with a domain name is a service, the service often includes web server, Email smtp, and pop or imap, people who are paying for the service sometimes need to send Email. When the service provider that is providing merely an internet connection email and DNS service blocks port 25, then he cannot send his Email. If your responding to a customer's billing question about your online store do you want the Email to come from customer-service@example.com or Hot
    • we just switch them to port 3535

      why not use port 587, which is specifically intended for this purpose?

    • I'm confused- you mean you act as a relay and run SMTP servers on 3535 and 80? Or you mean source port 25 is blocked, which makes no sense, and would have no effect on web browsing?

      The way to block zombies would be to block the customer from port 25 dst for all IP but the ISP.

      Nothing the customer could do (short getting the receiver to accept SMTP on some other port) could change that.

      If the customer decided to send to port 80, (and assuming they convinced the receiving end to run an SMTP server on 80)
      • Comment removed based on user account deletion
        • I suspect the logic is, if you're sending out requests for web and email through the same port, there might be conflicts?

          Why would there be conflicts? A TCP connection is defined by four things... source IP, source port, destination IP, destination port. So long as any one of those four things is different from all the other connections currently being handled by, well, anyone, then it's a unique connection and its not going to tread on any other's toes.

          Getting a box to listen on port 80 for SMTP and HTTP

        • If more and more major ISP's block port 25 outbound for their 'consumer grade' service, there will be less and less zombie spam from those networks. As more web and mailhosts come to grips with this (most already have, to be honest), they will ensure that they support MSA (RFC 2476), and those users that need to travel between connectivity providers will be setup to use it (only once, as it will also work when on onces 'home' network, no need to switch back and forth).

          Mail that servers send to other server

  • Anyone got bandwidth for new venture? (Score:3, Funny)

    by conteXXt ( 249905 ) on Tuesday May 24, 2005 @07:21PM (#12628963)
    1. Get fcc to 'advise' isps to block 25.
    2. wait for futility among the geeks to set in.
    3. set up vpn server for aforementioned geeks.
    (real verified reg required)(paid service but
    (Real Cheap)
    4. profit!!!

    any takers?
  • <homersimpsonvoice>Mmmmm iptables</homersimpsonvoice>

    [0:0] -A PREROUTING -p tcp -m tcp --dport 26 -j REDIRECT --to-port 25

    (You have to add that to your server machine, not your client machine)

  • I second! (Score:3, Informative)

    by Hrodvitnir ( 101283 ) on Tuesday May 24, 2005 @07:24PM (#12628990)
    Having worked for a university tech department that did this, I would have to say, I can't think of a better way to open peoples eyes to the threat of virii than to revoke their internet privilages.

    • Re:I second! (Score:2, Insightful)

      by Mad Merlin ( 837387 )
      Are you going to refund the money they paid for the 'net connection for that time too? I agree that a network connection is not a right but a privilege, but at the same time, they're still paying for that privilege, what gives you the right to take their money and give nothing in return?

  • What about VOIP/911 services? (Score:4, Interesting)

    by ringfinger ( 629332 ) on Tuesday May 24, 2005 @07:25PM (#12629010) Homepage
    Completely cutting them off would be a disaster. Most users wouldn't know what happened or how to get back connected. Plus, support costs for ISP's would go through the roof.

    People use their broadband connections for phone and 911 services now -- cutting them off completely could literally cut them off from emergency services.

    • Re:What about VOIP/911 services? (Score:4, Funny)

      by winkydink ( 650484 ) * <sv.dude@gmail.com> on Tuesday May 24, 2005 @07:29PM (#12629055) Homepage Journal
      You're betting on your ISP's reliability to get you through in an emergency? Perhaps natural selection is making a comeback.
    • OK, it's no solution to the VoIP emergency call scenario, but most ISPs that have implemented this kind of denial of net access in a sensible manner don't actually cut the user off out right. The preferred solution is to move the problematic user onto a dedicated VLAN. From there it's a trivial matter to redirect any attempt to access to web to a information page that informs the user what has happened and what to do about it. Here in the UK this usually applies to people who are "over using" their DSL l
    • A phone is what these people need, not a computer.
    • Keep a deactivated cell phone for just such emergencies. And it'll still work even when the power goes out!

  • blocked ports (Score:3, Insightful)

    by DaveCar ( 189300 ) on Tuesday May 24, 2005 @07:26PM (#12629018)
    I wouldn't mind to much, so long as you could opt out - just call up and say "I have half a clue what I'm doing" or "I'm not running a festering infected OS from Redmond".

    I'm guessing most of the people who unwittingly harbour zombie machines wouldn't know wtf port 25 was anyway ...

    Maybe a couple of basic networking questions to weed out the chancers?

  • I already do this on my home net (Score:5, Interesting)

    by WillerZ ( 814133 ) on Tuesday May 24, 2005 @07:28PM (#12629040) Homepage
    Traffic to or from port 25 is dropped at my router. My external email provider gives me SMTP-TLS on a high port, so I lose nothing.

    This means that even if a worm gets through the NAT and manages to infect my patched-to current AV-running machines, it can't do what 90% of them want to. Thus, when the patch/AV database update arrives and kills it, I know I've not contribued to the problem.
    • That's fantastic. But anyone who knows as much about computers as you do tends not to be the problem in the first place. Those lazy about the problem are much less of an issue than those that are ignorant of the problem.

      • Yes, and now it looks as though the "powers that be" are going to force everyone to do something similar. Either you are going to have to be smart enough to set up your mail so that these sorts of attacks are impossible, or you don't get to send email at all.

  • So what? (Score:5, Informative)

    by grub ( 11606 ) <slashdot@grub.net> on Tuesday May 24, 2005 @07:28PM (#12629046) Homepage Journal

    That ISPs only permit users to send mail through their own servers (presumably by blocking port 25 outbound)

    My ISP doesn't block 25 outgoing but a few spam blacklists have my IP range on their "DSL/Cable/Dialup" listings so I send mail from my internal server through the ISP.

    The result? No more "You're on a dynamic IP" bounce messages.

  • Blocking port 25 would just about kill small business people that use a 3rd party hosting service for their webpages and email.

    Guess that means the ISP gets a 'forced market' when it comes to email and hosting domains.
    • I don't get it. My Web site and (incoming) mail server is not hosted by my ISP, but I happily send my outgoing mail through my ISP's SMTP server.
    • Nope.

      http://www.ietf.org/rfc/rfc2476.txt [ietf.org]

      This idea is to seperate 'a mailserver connecting to another mailserver to drop of mail that is addressed to a user at the destination server' from 'a user connecting to his own server, authenticating as such, and then dropping of outbound mail for that server to then send on to the final destination', and restrict the first to non-dynamic, non-'consumer', or any addresses where there isnt some reasonable expectation of a positively identifiable responsible party.

    • Re:Small Business Users / external hosting (Score:5, Interesting)

      by gregmac ( 629064 ) on Tuesday May 24, 2005 @08:30PM (#12629539) Homepage
      Blocking port 25 would just about kill small business people that use a 3rd party hosting service for their webpages and email.

      It doesn't matter what SMTP server you send outgoing mail from (so long as it's not blacklisted) -- SMTP doesn't check domain names or anything (which is also really the reason spam can exist so easily).

      I had a situation that was really annoying a few years ago. We were on DSL with the incumbant phone company, and used our own co-located server to send mail. One day, I could no longer connect to SMTP. Called them, of course teir 1 tech support says "no, nothing has changed". I wait for a while to see if it'll go away, then call them back a couple hours later. This time, the guy says that they noticed one router wasn't blocking 25, so they "fixed" it. I decided just to use their server, since it was an easy fix (make a DNS entry in the office only that points to their IP instead of ours).

      This was fine for a couple months. Then one day, we couldn't send mail again. I tried to connect to their SMTP, and it would either timeout, or VERY slowly connect. I call them, and they say they're being hammered by viruses, and it'll be fixed soon. Within half an hour it was back to normal. This happened about 3 more times, and I got really annoyed. I called and asked them to remove the port 25 block (just for my account -- even to only my mail servers IP), because it was rediculus we couldn't send email. They said they couldn't, I'd just have to wait. Well, it was several hours and still not working, so I called again, and asked to speak to a manager or supervisor. Basically, same deal "no, we can't take off the block. Maybe you can use webmail". Although it would work, I didn't want to tell everyone to use webmail instead of their email clients just because of this. I called another ISP, asked them how long it would take to get me DSL (and made sure I could use my mail server), ordered it, and called my ISP back and set to get rid of their connection.

      Of course, this started another rediculus series of events. The DSL remove order and DSL add order (that get filed by old and new ISPs, respectively) got "mixed up", and a couple days after moving to my new ISP the DSL signal was lost. An angry call to the phone co had it back within an hour (yet it somehow still takes 5 business days normally).

      The old ISP also decided that we actually couldn't cancel when we did - we were on a 1yr contract, and had to pay 50% of 8 months service or something for cancelling early. We had been a customer for 3 years, and none of our bills for the past year said anything about a 1year contract. They also couldn't produce the contract -- not even an unsigned version. In subsequent calls, they claimed that it was a verbal contract yet couldn't name who had supposedly made it. Eventually months later, in an effort to get our local phone service back (we had switched to a CLEC many years ago), they decided to "credit" our account for the charges. Of course, we remained with the CLEC.

      Anyway, that got a tad off topic, but I felt the need to vent. Stay away from the big phone companies ;)
    • Blocking port 25 would just about kill small business people that use a 3rd party hosting service for their webpages and email.

      Running an MTA is serious business these days. It's not just about blocking VRFY and ETRN. I'm battling bounce attacks, attacks on postmaster and make-baby-jesus-cry brute force attacks which are:

      1. Difficult to stop.
      2. Apparently increasing in popularity.

      We process a bit over 100K emails/day. We reject about 15K emails/day.

      Are these small businesses going to try to address th

  • Blocking port 25 only half bad (Score:3, Informative)

    by thegrassyknowl ( 762218 ) on Tuesday May 24, 2005 @07:29PM (#12629053)

    that ISPs only permit users to send mail through their own servers

    I am a geekier sort, and this pisses me off. At the same time I'm kinda glad. I only really use my ISP mail server for everything. They relay on even if my From: address is set to something other than my ISP-provided email address.

    Anything to bring the amount of SPAM down is good in my books. Even if it means a slight loss of accessibility to other mail servers... That said, SMTP has authorisation capabilities now. They should rethink the blanket block and block only those SMTP servers that don't force authorisation to send mail. At least that way you'd need an account on it to send mail.

  • My ISP blochs port 25 outbound, forcing me to use their mail servers. When I am traveling and connected with a different ISP, I have to go into my email program's (Thunderbird) settings and change the outbound server (or not send mail). Also, what if I had to send an urgent message and my ISP's servers were down (it hasn't happened, but it could).
    • And this is why ISPs should open port 587 with SMTP Auth on it (to prevent unwanted relays), and newer mail programs should automatically try port 587 before port 25. We have a number of roaming customers who can plug into darn near any network and still send mail via our mail server. For most mail clients, it isn't that tough to change the port, though, as I say, I still think that mail program writers could give a helping hand by recognizing port 587 as a sending port.
    • You'd use your telephone?

      A throwaway gmail, yahoo, hotmail, etc... account?
    • My ISP blochs port 25 outbound, forcing me to use their mail servers.

      Wrong. You can use whatever mail server you want as long as you connect on a different port. Very few (if any) ISPs block 587.

      When I am traveling and connected with a different ISP, I have to go into my email program's (Thunderbird) settings and change the outbound server (or not send mail).

      If mobile email is important to you this is why it is an excellent idea to use an ISP independent mail server. You can get a cheap web hostin
      • I should also add that if you don't want to run a mailserver yourself you can just as easily use your hosting provider's server as long as they provide an alternate port. With as many hosting providers as there currently are, finding one that allows this should not be overly difficult.
  • Earthlink doesn't block outbound on port 25 but does block port 25 to other SMTP servers besides Earthlink's servers. Does SPAM still bounce off other servers anymore?? I know at one time there were lists of open SMTP servers.

    Luckily I can bounce my work email off the Earthlink server without it looking any different.
  • The FTC should stick to trade, and leave the mismanagement of the Internet to the FCC. The FCC just ruled last week VOIP to tell their customers if they provide 911 access or not after a girl died because her mom couldn't call 911 on her VOIP phone.

    It wont be long before someone dies because their newly 911 enabled VOIP phone was disconnected because their machine was suspected of being a spam zombie.

  • Stupid policy. (Score:4, Insightful)

    by Erris ( 531066 ) on Tuesday May 24, 2005 @07:52PM (#12629250) Homepage Journal

    Closing port 25 is pointless because the owners of the botnet already know to use the ISP's SMTP server, just like the victim does, to send mail. You won't really stop the spam or DDoS this way, you will just stop normal users from doing something that's easy and useful.

    There's nothing difficult about running a mail server. Exim comes with debian and has reasonable default values set in a script that tells you what it's doing. It's no harder to run than it is to use a GUI client. There are many advantages to it as well, such as custom mail addresses for registrations and other junk.

    Reducing redundancy is bad for national security. In the end, it's much easier to DDoS email by targeting two broadband providers than it is to target thousands of individual users with a clue. The setback will be temporary. As email dies as a useful communication media, Jabber and others will rise in it's place.

    • Re:Stupid policy. (Score:4, Insightful)

      by ErikTheRed ( 162431 ) on Tuesday May 24, 2005 @08:22PM (#12629494) Homepage
      Closing port 25 is pointless because the owners of the botnet already know to use the ISP's SMTP server, just like the victim does, to send mail. You won't really stop the spam or DDoS this way, you will just stop normal users from doing something that's easy and useful.
      Most ISPs rate-limit outbound SMTP. Some will shut down a client that appears to be spamming, and force the user to call in to reestablish service. It's important to keep in mind that the vast, vast majority of users barely know how a computer works. ISPs are more or less forced to cater to the lowest common denominator. If you don't like that, then use a geek-friendly ISP like SpeakEasy.

    • Re:Stupid policy. (Score:5, Interesting)

      by alienw ( 585907 ) <alienw.slashdot@ ... inus threevowels> on Tuesday May 24, 2005 @08:31PM (#12629549)
      Finally, someone with an ounce of sense. Or, how about this (very real) scenario? My university now publishes SPF listings. Therefore, I have to use the university (authenticated) SMTP server to send out email (to avoid getting an SPF fail for that email). However, my new ISP blocks port 25, so I can't use the university's server anymore and they cannot be bothered to port-forward some other port to the SMTP server. I have to use the ISP's mail server and risk getting my email deleted by the recipient as spam.

  • port 25, zombies, DNS cache stuffing, debris (Score:3, Funny)

    by Senor_Programmer ( 876714 ) on Tuesday May 24, 2005 @08:01PM (#12629324)
    Find a buddy with a mail server and use it. Port 25? You should use port 22 to talk to your mail server from anywhere other than it's console. Seriously, if you want to tx&rx mail from wherever you are there are plenty of servers available to friends and friends of friends.

    ISPs should block zombies. A simple auto-generated email aroused by traffic level and requesting an explanation should be sufficient. Blcok all except port 53and whatever the heck VOIP uses if there is no reply.

    DNS cache stuffing is still a problem. Who needs an open proxy when you're a legal host?

    A bounty on spammers perhaps? Outsource to Indonesia, Malaysia, Peru, Belarus, Ukraine, Pakistan, or any number of places.

    Hell, my lawn guy in USA, and this is an honest to $deity(s) quote...

    "Twenty dollah? TWENTY DOLLAH? I KEE a MAN FO TWENTY DOLLAH!"

  • Not the worst solution.. (Score:5, Interesting)

    by Fatal67 ( 244371 ) on Tuesday May 24, 2005 @08:21PM (#12629485)
    But there are better ones. I have just shy of 2 million broadband users on my network. Every day I have many customers who are detected as being infected. Automagically they are placed in a walled garden where the only page they can load tells them what is happening. Basically it tells them that they have been compromised. If we can determine the virus/trojan they are running, we give them a link to a locally stored method of corrrecting the problem. I have never received a complaint about it, but I have received hundreds of calls saying thank you.

    I do have to question the FCC's thinking though. Most people who get infected are not of a technical nature. If you disconnect them from the net, they are at a loss of how to fix the issue. Obviously they don't have uptodate protection on their machine. if they go out and buy a brand new copy of whatever virus software, it will need to download the latest definitions, which they can;t do because you shut them off.

    It reminds me of the mid 90's where if your ds3 to one of the 6 or so backbones went down they would send you an email to notify you. Or sending them a letter telling them you shut their phone off and telling to call you to get it turned back on.

    • Actually, although I've not read the article, personally your description of what you do (divert all traffic to a set page) meets my definition of "disconnected from the net".

      The user's PC can still connect to a small area of the ISP's network, but not to The Internet - surely that counts? (It's also a far better solution than just killing their connection completely, as you say)

  • FTC Does NOT Recommend Blocking SMTP / Port 25 (Score:4, Informative)

    by jonathanbearak ( 451601 ) on Tuesday May 24, 2005 @09:10PM (#12629795)
    The article is quite vague. But I really think that Reuters is misunderstanding the details here and creating this inclarity. The FTC is not so stupid as to block port 25.

    I immediately went to ftc.gov.
    Here is a link to their actual press release:
    http://ftc.gov/opa/2005/05/zombies.htm [ftc.gov]

    They have a more detailed website at:
    http://www.ftc.gov/bcp/conline/edcams/spam/zombie/ index.htm [ftc.gov]

    This site appears to be geared for the people who actually understand what's going on. The very first bullet point on the site states very clearly:
    "block port 25 except for the outbound SMTP requirements of authenticated users of mail servers designed for client traffic. Explore implementing Authenticated SMTP on port 587 for clients who must operate outgoing mail servers."

    In other words, under their proposal, can still send emails so long as we are authenticating to an SMTP server.

    We can use our College email, our Google, Yahoo, etc. accounts.

    This is how I interpret their idea:
    - You want to send email? Connect to an SMTP server and log on.
    - Incoming traffic is not interfered with.
    - If you send SMTP traffic directly from your computer to someone else's computer, this is blocked.

    I'm not sure exactly how one would implement this because one cannot know every "legitimate" mail server. Further, ISP's will not (should not) be scanning all of our SMTP packets to see what kind of traffic is coming from our computers. The easiest solution is something already in place, although it annoys me. I can still send SMTP from my computer (RoadRunner ISP, New York City) but if I send to an AOL user, for example, I get a reply back from AOL explaining that AOL will not accept emails from a Residential IP address. This is irritating, but it's no bother. Simply have all the ISP's say, these IP blocks are for our residential customers --- if you get email from them, it's probably a spam zombie, so you may wish to block such SMTP traffic if it becomes a bother.

    I'm not proposing anything, just trying to piece together what the FTC is actually saying. Trust me, they're not so clueless; it's usually the papers, especially in these generic wire reports, that mess up the details.

    The FTC is most certainly _not_ recommending that all port 25 traffic is blocked; they are not limiting anyone to their ISP's mail servers.How would the FTC people log in to their own FTC email from their homes? They'd have the same issues we'd have.

    Anyway, since I *never* use my ISP mail server (mostly because Google is faster, has more storage, and is easier to access when I don't feel like carrying my laptop around; and because for professional stuff I tell people to contact me @honorscollege.cuny.edu (even though I SMTP back through Google).

    Though less technical, I'm sure, most professional people require such a setup. Think things through. I see so many posts regarding outright and absolute SMTP / Port 25 blocking. That's too ridiculous to believe. Indeed, it's not even close to what the FTC actually says, as I cite above.

    Read their site if you still have your doubts. Let it be said, however, that the government is not as stupid as some would like to believe.

  • A simple fix? (Score:3, Interesting)

    by blanks ( 108019 ) on Tuesday May 24, 2005 @10:25PM (#12630246) Homepage Journal
    Many ISP's offer a cd that you use to setup your services.

    Why not have built in software (firewall) that by default blocks port 25, and port 80 (inbound) irc in/out etc, and make the customer need to specifically allow those ports if they want them open.

    That way, the 99% of the customers who never use those ports will have cleaner or safer machines, while the people who do run their own servers have the ability to use them.

  • Crap. (Score:4, Insightful)

    by Randseed ( 132501 ) on Tuesday May 24, 2005 @11:05PM (#12630464)
    Earthlink/Mindspring already pull this shit. They block all outgoing traffic on port 25 to all servers except their own SMTP servers which they've blessed. The catch is that then email sits on their lame SMTP server for x number of hours if it doesn't go out, instead of the immediate notification I get from my own server. Then there are problems with the mail servers of the ISP going to shit -- I don't care why.

    Roadrunner, by contrast, doesn't do this. This is why I subscribe to their service now and dropped Mindspring.

    Email I send goes over my LAN to my SMTP server, which then handles sending it out. 99% of the time I don't have a problem. When I do, it's usually for some shit like AOL or sending mail _to_ Earthlink or Mindspring, at which point they get a complaint email (whcih they of course ignore), and then a bunch of enraged calls from their customers (who don't understand the entire thing) saying that the ISP's email reception is broken (which it _is_). This wastes their time dealing with their enraged customers. If they don't like it, they can fix their fucking systems.

    Of course, I could set a smart host to my ISP's mail server, which solves the problem, but grants me the problem I pointed out in the first paragraph.

    If ISPs are going to block outgoing port 25 and effectively break the net that way, then they need to FIX THEIR FUCKING SMTP SERVERS FIRST. If they would do that, then I wouldn't give a rat's ass what the fuck they do aside from the principle of the thing.

    All of this evades solving the real problem. The real solution is to filter spam using something like Spamassassin and, because that's a drain on resources, block the originating SMTP host automatically (and send an email to the technical contact) when X number of spams are received from the same IP address. When Y number of spams are received from an ISP, block that entire ISP. The IP mappings are available or, at least, could be made available. Then the ISP's resources are only tapped up to X (or Y) number of spams. This blocks zombies, but is a stopgap solution. The real solution lies with the originating ISP, which needs to map that back to an account and cut that account off. After that, the originating ISP which was used can send a bill back to the user and turn them into the FTC for violating anti-spam legislation. All this, of course, with forced banning of ISPs running zombies.

    This, in turn, puts pressure on Micro$hit to fix their fucking operating system, and on users to keep their systems up to date.

    Now the simplest solution? Wait for it, it's mind-numbingly simple. If you're going to block port 25, ALL ISPs should allow opening of port 25 with a no-questions-asked phone call with the understanding that if it's caught sending spam then, after a human review, the account will be cut off.

  • get a box hosted (Score:3, Informative)

    by bug ( 8519 ) on Wednesday May 25, 2005 @04:41AM (#12632035)
    I think the legitimate question is "should a consumer expect full freedom to engage in potentially risky behavior from a consumer-grade ISP service?" I think the answer is, VERY unfortunately, no. If you want to have greater freedom (e.g., running your own network services, having unrestricted outbound SMTP, etc.), then you should seriously consider colocation. Paul Vixie has been nice enough to catalog many places all across the US and a few places internationally where you can get a box (or virtual vmware box) hosted for relatively cheap: Personal Co-location Registry [vix.com]

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Close