Slashdot Log In
Washington Post Blog Shuts Down 75% of Online Spam
Posted by
CmdrTaco
on Wed Nov 12, 2008 10:10 AM
from the real-american-hero dept.
from the real-american-hero dept.
ESCquire writes "Apparently, the Washington Post Blog 'Security Fix' managed to shut down McColo, a US-based hosting provider facilitating more than 75 percent of global spam. " Now how long before the void is filled by another ISP?
Related Stories
[+]
McColo Briefly Returns, Hands Off Botnet Control 242 comments
A week ago we discussed the takedown of McColo (and the morality of that action). McColo was reportedly the source of anywhere from 50% to 75% of the world's spam. On Saturday the malware network briefly returned to life in order to hand over command and control channels to a Russian network. "The rogue network provider regained connectivity for about 12 hours on Saturday by making use of a backup arrangement it had with Swedish internet service provider TeliaSonera. During that time, McColo was observed pushing as much as 15MB of data per second to servers located in Russia, according to ... Trend Micro. The brief resurrection allowed miscreants who rely on McColo to update a portion of the massive botnets they use to push spam and malware. Researchers from FireEye saw PCs infected by the Rustock botnet being updated so they'd report to a new server located at abilena.podolsk-mo.ru for instructions. That means the sharp drop in spam levels reported immediately after McColo's demise isn't likely to last."
[+]
New Massive Botnet Building On Windows Hole 223 comments
CWmike writes "The worm exploiting a critical Windows bug that Microsoft patched with an emergency fix in late October is now being used to build a fast-growing botnet, said Ivan Macalintal, a senior research engineer with Trend Micro. Dubbed 'Downad.a' by Trend (and 'Conficker.a' by Microsoft and 'Downadup' by Symantec), the worm is a key component in a massive new botnet that a new criminal element, not associated with McColo, is creating. 'We think 500,000 is a ballpark figure,' said Macalintal when asked the size of the new botnet. 'That's not as large as some, such as [the] Kraken [botnet], or Storm earlier, but it's... starting to grow.'"
[+]
Spam Back Up To 94% of All Email 266 comments
Thelasko writes "A NYTimes blog reports that the volume of spam has returned to its previous levels, as seen before the McColo was shut down. Here is the report on Google's enterprise blog. Adam Swidler, of Postini Services, says: 'It's unlikely we are going to see another event like McColo where taking out an ISP has that kind of dramatic impact on global spam volumes,' because the spammers' control systems are evolving. This is sad news for us all."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Not Just Spam (Score:5, Interesting)
The badness attributed to McColo was not limited to spam. It included child pornography sites; sites that accepted payment for spam and child porn; rogue anti-virus Web sites; and a huge malicious software operation that apparently stole banking and credit card data from more than a half million people worldwide.
And they operated for how long before they were shut down ... as a United States based hosting provider?
... I'm all for user privacy policy from an ISP but obviously these people are criminals.
If they have evidence of these things, I certainly hope that The Washington Post turns any evidence over to the FBI or at the least the local law enforcement where McColo is operating. And I hope a warrant is obtained through the appropriate channels to collect evidence from Hurricane Electric & Global Crossing
ISPs are clueless? (Score:5, Insightful)
Also FTA:
'Two hours later, I heard from Benny Ng, director of marketing for Hurricane Electric, the Fremont, Calif., company that was the other major Internet provider for McColo.
Hurricane Electric took a much stronger public stance: "We shut them down," Ng said.
"We looked into it a bit, saw the size and scope of the problem you were reporting and said 'Holy cow! Within the hour we had terminated all of our connections to them."'
So, after much hand-waving here, and elsewhere, about what info the Gov. and your ISP may be collecting about you, they could not spot this, a major spam, child-porn and theft site?
Maybe the honest version would be;
"We were making shitloads of money out of selling bandwidth to these bastards, 'no questions asked', but now you've blown the whistle on them I guess we've gotta look responsible."
Parent
Re:Not Just Spam (Score:5, Insightful)
I certainly hope The Washingto Post doesn't have to do the job of the Federal Authorities in the future.
I think this quote down on the third page was probably the best, from a Trend Micro researcher (emphasis mine):
Parent
Re:Not Just Spam (Score:5, Insightful)
Parent
Re:Not Just Spam (Score:5, Insightful)
Did you just fill that in at random, or what?
Parent
Re:Not Just Spam (Score:5, Insightful)
I don't see how providing evidence to the government is "vigilante justice". On the contrary it is government justice which is what government is there to provide.
Parent
Slashdot can shut down spammers, too (Score:5, Funny)
Just give us an IP address linked in the summary. That's all we ned.
good job! (Score:5, Funny)
First they shut down McCain, now McColo. Next up: McDonalds?
Re:good job! (Score:5, Interesting)
Seems like McD is moving quick:
http://inventorspot.com/articles/mcdonalds_japan_goes_nobrand_with_quarter_pounder_shops_19505 [inventorspot.com]
Parent
Re:good job! (Score:5, Funny)
Parent
Oblig. (Score:5, Funny)
http://craphound.com/spamsolutions.txt [craphound.com]
Re:Oblig. (Score:5, Funny)
More like:
Your post advocates a
(x) technical (x) legislative (x) market-based (x) vigilante
approach to fighting spam. Your idea will not work. Here is why it won'... Holy crap how did you do that? 75% of all spam!? So much for it being botnets causing it! Congratulations!
Parent
As long as there is money in it... (Score:5, Insightful)
the spam will flow. It's the old "balloon dog" effect. Squeeze it in one place and it balloons in another. The ONLY way to attack this problem is to go after the advertisers who are willing to use spam as a medium to sell product.
Re:As long as there is money in it... (Score:5, Funny)
the spam will flow. It's the old "balloon dog" effect. Squeeze it in one place and it balloons in another. The ONLY way to attack this problem is to go after the advertisers who are willing to use spam as a medium to sell product.
I think we need to go after the clowns making the balloon animals!
God, I hate clowns...
Parent
Re:As long as there is money in it... (Score:5, Insightful)
So how do you set up a system where people can still be anon(even if the government issues some warrents) but held accountable for spam?Got any protocols which allow that?
Parent
Sigh (Score:5, Funny)
is it morally right to DDoS spaming ISPs? (Score:5, Interesting)
Recomment (Score:5, Informative)
"Brian - Well done, and well reported. For the user who asked about reporting news versus creating news, you misunderstand Krebs's reporting. Like most good reporters who write big stories, he either got tips or analyzed data regarding spam and cyber-security. It probably was a combination of both. If he determined from his research, reporting and analysis that this data was coming from one place, he did not create a story by informing the spam host's business partners. Rather, he sought comment from them about this site, and they took action. What Krebs reported is not a big a story as Watergate, but what do you think Woodward & Bernstein did? Wait for a press release? A regulatory filing? No, they took one news event, worked backwards from it, and determined that something big was going on -- just like a spammer. Then they wrote about it, just like Krebs did. When Henry Blodget on Silicon Alley Insider wrote that The New York Times Co faces several possibilities for survival, he did not tap into a planned news event. He analyzed a balance sheet and made conclusions. Much of the news that comes out is because beat reporters see connections and draw conclusions that are not opinion, but reasoned and accurate viewpoints based on evidence out there that resists coalescing into a larger news event because most of us don't get it. That's why we have journalists, and this is a great example of that. And now for the full disclosure: I'm Robert MacMillan. I am a reporter at Reuters who covers the journalism business, and I worked at washingtonpost.com for many years with Brian. I sat right across from him so I know what he eats for lunch. Posted by: easymac | November 11, 2008 9:45 PM "
Better to NOT shut them down? (Score:5, Interesting)
When it comes to these sorts of things, oft times law enforcement and intelligence agencies who know about a source of major operations DON"T shut them down, so as to build a case against the bigger players or to maintain the ability to track what is going on. Given that this is a US-based corporation with US-based servers, I wonder if this shutdown has seriously compromised on-going monitoring and criminal cases. While this has almost certainly seriously disrupted operations of the various bad guys for now, I would give it only a few days before they're back online based at overseas locations where they're less easily reachable. Except for some script kiddies, the operations are all sophisticated enough to use standard techniques such as multiple hardcoded fallback IPs. DNS redirection, and using fake BGP announcements to hijack IP blocks to get back online.
--Paul
Re:Better to NOT shut them down? (Score:5, Insightful)
As for the other stuff, in a world scripted by Tom Clancy the supervillians simply switch to their backup systems. However in reality shutting down something that has taken a long time to establish can stop them for a long time and can open them up to exposure when they are trying to do it again.
Parent
I wonder what made them turn? (Score:5, Funny)
This is their AUP from 2005 (Mccolo.com)
Acceptable Use Policy (AUP)
All Maxis' Commerce colocation or dedicated server customers are bound by the following Acceptable Use Policy. This document may be updated from time to time. Please consult this site periodically for the most recent revision of this document.
No Maxis' Commerce customer shall:
Do anything illegal or anything that adversely affects Maxis' Commerce legal interests. The following list is non-exclusive, and should not be considered license to commit other illegal activities not specified below. All illegal activity is prohibited, and Maxis Commerce will cooperate fully with any law enforcement officials and/or agencies investigating and/or prosecuting such activities.
Cracking/Hacking - attempts to access accounts or systems other than the userâ(TM)s own accounts or systems or an account or system that the user has been explicitly authorized to access is illegal under federal and state law.
Child pornography - as defined by U.S. law. This is strictly prohibited and dealt with quickly and harshly.
Interstate gambling - because Internet traffic generally ignores state and country boundaries, any Internet based gambling site is restricted by Federal Inter-state gambling regulations.
Pyramid schemes or fraud - are illegal under a number of Federal, State and Local laws.
Theft of services - attempts to utilize services that are not contracted for is considered theft and will be dealt with as such.
Harassment - use of Maxis' Commerce network to harass or threaten (in the legal sense of those terms) any other person is prohibited.
Please consult an attorney if you are unsure of the legal status of your activities.
Do anything that threatens the integrity of Maxis' Commerce network or the utilization there of by other persons.
Denial of Service (DOS) attacks - no customer will commit a DOS attack against any Maxis Commerce customerâ(TM)s host, or any other host on the Internet. Similarly, no Maxis Commerce customer will willfully or negligently allow incitement of others to attack any host on Maxis' Commerce network, or any other host on the Internet.
Blacklists - No customer shall do anything that could get any portion of Maxis' Commerce IP space (or address space announced by Maxis Commerce on behalf of Customer) put on blacklists such the RBL (Realtime Black List) as maintained by MAPS (http://www.mail-abuse.com) or other similar organizations, or perform activities that would cause portions of the Internet to block mail or refuse to route traffic to any portion of Maxis' Commerce IP space (or address space announced by Maxis Commerce on behalf of Customer).
Perform actions that cause unusual load on Maxis' Commerce servers (for example, mail servers, web servers, usenet servers, name servers, etc.), that cause slowness or denial of service to other Maxis Commerce customers.
Do anything that threatens the Internet or any other network.
No customer shall take actions that cause any portion of the Internet, or the Internet as a whole, to become unusable to any other portion of the Internet, or the Internet as a whole.
No customer shall take actions that degrade the usefulness of the Internet, or any portion of the Internet, either through network degradation, flooding of usenet or email or so on.
Spam - No customer shall send unsolicited commercial email, unsolicited mass mailings, spam or flood usenet newsgroups, or anything of that sort. If you have questions about what is allowed and what is not, please email abuse@mccolo.com for clarification.
No spam may originate from Maxis Commerce IP space.
No spam may advertise sites or services located on Maxis Commerce IP space (even if the spam originates elsewhere).
No Maxis Commerce customer shall use third party mail servers to relay spam. This is considered a DOS attack on the third party and will be treated as such.
No customer shall participate in pyramid schemes
OMFG!! (Score:5, Funny)
My personal experience (Score:5, Interesting)
Re:Hosting Child porn? (Score:5, Insightful)
I have come to the conclusion that it must be impossible to engage in any criminal activity which does not somehow involve child porn, as it seems to me that all stories of illicit behavior include accusations of trafficking in child porn.
Parent
Re:BS. Not by volume. (Score:5, Informative)
RTFA. The ISP in question hosted the control points for the botnets which generated the spam. They didn't need crazy bandwidth, just solid hosting.
Parent