Verizon.net Finally Moving Email To Port 587 195
The Washington Post's Security Fix blog is reporting that Verizon, long identified as the largest ISP source of spam, is moving to require use of the submission port, 587, in outbound mail — and thus to require authentication. While spammers may still be able to relay spam through zombies in Verizon's network, if the victims let their mail clients remember their authentication credentials, at least the zombies will be easily identifiable. Verizon pledges to clean up their zombie problem quickly. We'll see.
try PRQ.se (Score:2, Informative)
I've been routing my traffic thru their traffic for a few years now, they're not limiting anyone and keep great privacy. what i heard their tunnel service will be open for new customers in a few days again so now is a great time.
Yo Dawg, (Score:4, Funny)
Opportunity (Score:2)
Sounds like a great opportunity to charge millions of clueless users $50 to change the setting for them. I see a Vegas vacation on my event horizon.
Finally, Verizon, Finally!! (Score:5, Interesting)
I found out I was a spammer when I investigated a message returned to me. I ended up talking with someone from SORBS. After emailing SORBS a couple of times, I received this message from Michelle Sullivan: "SORBS lists IP addresses that send spam. Often there is real email mixed with the spam, sometimes deliberately, sometimes accidentally. In this case you are using an IP address to send your email that has previously, and is still, sending spam. The IP address is blocked. I'd contact your provider and complain bitterly about it, because it's the provider that is listed, not you specifically."
I send out a newsletter with about 250 subscribers. After talking with SORBS, I contacted Verizon and found out that, even though we signed up for Verizon Business, they limit the amount of email I can send a week to 500 messages. I rarely approach 200 messages and the newsletter is a monthly. Verizon told me I couldnâ(TM)t even send the newsletter in one blast; I had to limit it to 100 subscribers an hour! And in late Fall 2008, some providers, like MS, would reject my mail simply because it had @Verizon.net in the senderâ(TM)s address. I knew I wasn't sending out large amounts of email, let alone spam.
Within those imposed limits, Verizon still could not bring its huge entity to investigate my complaint. In late December, we switch to Constant Contact to email the newsletter. While my boss uses Cox since he works mostly from home, the office is still âoeconnectedâ with Verizon!
Boy, I hate Verizon! Now, maybe they will kill the Zombies from all those dead zones they claim not to have!
=smidge=
Re:Finally, Verizon, Finally!! (Score:5, Funny)
I send out a newsletter with about 250 subscribers per zombie.
Re: (Score:2, Interesting)
than guess what, you not only are a spammer, but you probably also broke the law [ftc.gov].
Re: (Score:2, Informative)
Re:Finally, Verizon, Finally!! (Score:4, Informative)
Guess what, "The CAN-SPAM Act of 2003 (Controlling the Assault of Non-Solicited Pornography and Marketing Act) establishes requirements for those who send commercial email"
Parent did not specify that it was commercial email and "newsletter" indicates that it likely is not. Even if they were of a commercial nature they would likely be exempted under the CAN-SPAM act as they would qualify as "relationship" messages [cornell.edu].
Re: (Score:2, Flamebait)
From the parent's posting:
After talking with SORBS, I contacted Verizon and found out that, even though we signed up for Verizon Business, they limit the amount of email I can send a week to 500 messages.
Sounds like commercial mail to me. Sounds like SPAM.
Re:Finally, Verizon, Finally!! (Score:5, Informative)
I send out a newsletter with about 250 subscribers. After talking with SORBS, I contacted Verizon and found out that, even though we signed up for Verizon Business, they limit the amount of email I can send a week to 500 messages.
Verizon Business accounts assume that you will probably be running a business, and have your own domain.
If you do things this more professional way, there are no limits with Verizon DSL or FiOS (other than the speed you pay for being a "limit").
Re: (Score:2)
There's a problem with your posting. What is trademarked about whatever it is you are referring to?
In late December, we switch to Constant Contact to email the newsletter.
Oh, that's rich. Complain about being branded a spammer, and then hire a professional spammer to send your email for you.
I have never been able to get off a "constant contact" email list once some idiot gave them my address. Never. They take their responsibility (constant contact) quite l
Your Ideas .... (Score:2)
... are intriguing and I wish to subscribe to your newsletter.
Re: (Score:2, Informative)
A number of admins I know block all email originating from Constant Contact as UCE. That's the problem with a lot of 'email marketing firms' - they take legit users along with spammers or quasi-spammers. Unless you decide to truly take control of your email by operating your own mail server, you run the risk of getting caught using an entity that gets blocked for their other clients' activities.
Re: (Score:2)
I'm in the same situation — I run a mailing list with about 60 subscribers. Normally, things are just fine, but when a discussion springs up, the 100/hour limit is easily hit. The particularly dumb bug on Veri
What's this "finally" shit? (Score:5, Informative)
You can set up port 25 SMTP to require authentication for relay purposes, without having to configure end user's machines for another port.
Re: (Score:3, Insightful)
You can set up port 25 SMTP to require authentication for relay purposes, without having to configure end user's machines for another port.
More broadly, authentication can be configured for port 25, port 587, or not at all. Typically, the submission port requires authentication.
As for the article, this factoid is amusing:
Re:What's this "finally" shit? (Score:5, Interesting)
This implies that they are blocking all outbound port 25 requests. All ISPs in Japan that I am aware of have been doing this for a long time. The problem is that if you have a 3rd party email service provider, you can no longer send email through them because port 25 will be blocked and if the other party offers the alternative port as well, it is still often blocked.
Still, for MOST people, this is a good plan. I just think that users should be informed of this change, informed why it is a good idea for MOST people and to give them an option to "opt out" of the restriction in some way if the restriction is not compatible with their current needs.
Re: (Score:2)
> This implies that they are blocking all outbound port 25 requests.
It doesn't imply that at all. Now they do that in the future, but there's absolutely no logical reason to do so now. After all, they'll have enough complaints on their hands with just this transition, let alone blocking all other (possibly unauthenticated) outgoing mail too.
No, port 587 is simply where authenticated SMTP usually goes, and so that's the port they're using. It also helps that most mail clients automagicly link 587 and a
Re: (Score:2)
Re: (Score:2)
Comcast did the same thing a few months back. I can no longer run a mail server on my home machine.
Per the TOS for home-tier service, you never could. As I understand it, the restriction goes away once you upgrade your high-speed Internet service to Comcast Business Class.
Re: (Score:2)
Re: (Score:2)
Wow. Not a ripoff at all!
No, not really. You pay more for business class, and they do things like ignore the stupid 250 GB home-user cap, or unblock port 25 since they expect businesses to have IT people.
Re: (Score:3, Insightful)
Will they even let you get business class? My ISP (Time Warner) simply refuses to sell business class to a building zoned residential.
Re: (Score:2, Interesting)
I have Comcast Business internet, and it is exactly as others have described: no blocked ports, no upload/download limits, and (so far) very decent customer service.
I also have five static IPs, run an email server and web server out of my house for commercial and non-commercial purposes. I've had zero issues in the year I have had this configuration.
Re: (Score:2)
While i see the issue i normally hardly see it necessary or even advantageous nowadays to run my own e-mail server, neither on my home machine nor on my machine at work/university. Email servers are something which required you seeing available for 24x7 in case somebody starts (due to some misconfiguration or bug in the software) to use your machine as a relay for his spam. You can get yourself quite easily blacklisted nowadays, so if you are interested in your email arriving at the recipients, just use som
Re: (Score:2)
Because Comcast has blocked incoming port 25 traffic as well!
As someone with a personal domain, I'm not sure what the long term solution is going to be. Eventually, everyone is going to block all port 25 traffic, and only the "big guys" will be able to send and receive email. I don't want to pay for some co-lo since I am already paying for Internet service and can run a small mail server just fine. Google mail for domains (or whatever its called) might be a solution, but I don't like the idea of Google r
Re: (Score:2)
Re: (Score:3, Interesting)
Correct for most people this is a good plan. For spammers it is not. They will of course opt out of the restriction.
So long as there is no way for the zombie itself to opt out, there's no (big) problem: the owner probably won't opt out, and the spammer won't go to the (fairly substantial) effort to social engineer his way past the restriction. What this does mean is that it pretty much requires that people who want to opt out call their Customer Services line rather than using a self-service webpage. It's horrible, but necessary.
And for the love of God, don't encourage J Random Grandma to opt out unless she's actually bu
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
However, he did also say that there was no guarantee that it wouldn't be blocked again, all that had to happen was for someone to make a complaint against me for spam.
So why not take the hint, and send your mail through a 3rd party (maybe the free comcast SMTP server)?
Re: (Score:2)
Re: (Score:2)
Just use an ssh tunnel to work, this is one of the times when it seems like it's actually a valid and even reasonable use.
Re:What's this "finally" shit? (Score:5, Funny)
So, you spent "many days bitching at my IT guys at work" and in the end the problem was with your Internet Service at home?! You posted this on Slashdot?
Ummm, yeah, we're going to need your address. I've already handed out the torches and pitchforks.
Re:What's this "finally" shit? (Score:4, Funny)
Hear! Hear! (Score:2)
Re: (Score:2)
Posting Bill Gates' home address is refusing to live in fear?
Re:What's this "finally" shit? (Score:5, Interesting)
My home ISP (oblig. disclaimer: I now work for them too) has blocked port 25 outbound by default on 'Home' ADSL connections for a while now.
It's all configurable from the online webtools, so you can turn it back on if you want it.
And there's even an in-depth FAQ [on.net] about it on the site.
IMHO it's a great idea, and I wish more ISPs did it.
Re: (Score:2)
Re:What's this "finally" shit? (Score:4, Interesting)
I have never really understood why this is an issue. I do think ISPs should be upfront about it before you sign up and if they change what ports they block and how they police their network you should be allowed out of the contract. I don't think its fair for them to write terms that say we can limit what you do in any way we like.
That aside I would like to ask my fellow slashdots running their own mail servers, (I do speakeasy actaully allows this under their tos) why its a problem for you to use your ISP as a smart host?
Personaly I like it. Unlike at work I don't have to worry about keeping the mail server off the black lists, contacting post masters at other domains to get mistakes corrected etc etc. The ISP does msot of that for me. Now speakeasy will relay for my domain, but I think most ISPs will probably trust whatever is coming from their own network to their relay, I hope they pass it through some outbound filter.
On the inbound side, the MX record points directly at my ip address so I get to handle the mail coming in a filter/black list etc according to my own needs. TLS works too if things need ot stay private.
I suppose the only arugment I can think of is even if you are using TLS your ISP can still read your outboand mail, and if I was using version or comcast I might be more concerned about that....
What are other peoples reasons?
Re: (Score:2)
That aside I would like to ask my fellow slashdots running their own mail servers, (I do speakeasy actaully allows this under their tos) why its a problem for you to use your ISP as a smart host?
I've run my own mail server on and off over the years, and decided to do it permanently just over two years ago.
Why?
Why do anything for yourself rather than let someone else provide a comparable service? Allow me to use a non-car analogy. The Holiday Inn suits some folks fine, some want their own apartment, while
Re: (Score:2)
You can still run your own mail server and use someone else's server as a smart host. That what I am asking about, becuase this is what I do and i get the best of both worlds.
You can, but it's hokey (Score:3, Informative)
Yeah, it's possible to do authentication on Port 25, but it's generally hokey and often broke things when people did it, and left passwords in the clear for eavesdroppers - 587 is a cleaner and more standardized solution. I remember having to configure Eudora for receive-before-send when my email provider was trying that approach...
Re: (Score:3, Interesting)
You do realize that SMTP on port 25 and MSA on port 587 are the same protocol, right? There's no way that one can be hokey and the other not. In both cases, STARTTLS can be used, and should be required before authentication is allowed.
Providers should universally provide service on 587 in order to allow other ISPs to block outbound port 25, but arguing that authentication on 25 is hokey is just silly. The only reason not to bother is that sooner or later, port 25 is going to be blocked by the ISPs of rem
Re: (Score:2)
You can set up a MSA (mail submission agent) on port 25, but Verizon users will not be able connect to it after this change. If you run a mail service, the practical effects of this change are (1) you will need to set up port 587 if you have any customers who get transit through Verizon and (2) you will receive less spam.
Verizon wants to stop customers from directly co
Re: (Score:2)
Or you can set up your MSA's on any random port, it doesn't really matter. My personal mail server accepts connections on SMTP, SMTPS, submission, and two other random ports just in case the above are blocked.
Re: (Score:2)
That works, of course, but there are benefits to standardization, among them reduced user confusion.
What ISPs have you encountered that block port 587 but allow any of your others?
Re: (Score:2)
Mostly it's hotel internet access that filters anything listed as a "common" tcp port until you pay an exorbitant fee. I could have gotten around that by putting SSH on a non-standard port and making a tunnel, but what's the fun in that.
Re:What ever happened to SSL and port 465? (Score:5, Informative)
Port 587 was allocated by IANA and is documented by the IETF in RFC 2476, and the STARTTLS capability is documented in RFC 2487. It is not clear from the article whether Verizon is going to require STARTTLS or not. They may require STARTTLS for all mail on port 587 if they so choose.
I assume that the "full-on SSL" that you would prefer refers to the non-standard port 465 ("SMTPs"). That port was chosen arbitrarily by Microsoft, has not been standardized by any common standards body, and was previously already allocated to "URL Rendesvous Directory for SSM".
Why perpetuate non-standards when there are established standards which have the same functionality?
Re: (Score:3, Insightful)
Don't be stupid. Verizon is planning to block outbound port 25 like a lot of other ISPs do in order to prevent trojans from sending out email. It's not their business to impose a requirement that other mail providers use their choice of STARTTLS on 587 or SSL on 465.
If anyone is failing to do SSL, it has nothing to do with Verizon blocking outbound port 25, and Verizon should in no way be scolded for taking this step.
Re: (Score:3, Insightful)
smtps is rarely used these days. None of our customers are using it, I guess because most of them use clients such as outlook can't do it. They all do TLS, which is available on both port 25 and 587. And most mail servers disallow smtp auth over an unencrypted session.
Lots of provider-provider smtp traffic is now encrypted, and still uses (and will always continue to use) port 25.
The only difference between ports 25 and 587 is that 587 requires SMTP AUTH. Therefore, 587 is not suitable for delivery of mail
Comment removed (Score:5, Funny)
Re:Verizon spam zombies (Score:5, Funny)
Re: (Score:2)
Comcast did it already (Score:2)
Comcast has required email to be on port 587 for a while now.
Re: (Score:2)
Not where I am:
$ telnet a.mx.mail.yahoo.com. 25
Trying 67.195.168.31...
Connected to a.mx.mail.yahoo.com.
Escape character is '^]'.
220 mta112.mail.ac4.yahoo.com ESMTP YSmtp service ready
quit
221 mta112.mail.ac4.yahoo.com
Connection closed by foreign host.
Re: (Score:2)
Article Confuses Mail Servers vs. Network Filters (Score:3, Insightful)
As far as I can tell from this article and a few others that are derived from the same press releases, what VZ is doing here is setting up their own mail servers to use Port 587 submission instead of Port 25. That won't stop zombies or legitimate Linux mail systems from sending mail directly to their recipients' systems, though I'm guessing that they'll get around to blocking Port 25 (sigh) once they've got most of their users migrated to 587.
What this will do is give them authentication, which makes it easier for them to block customers who use VZ's mail servers from spamming, but I'd be surprised if there's much of that happening (though botnets keep evolving their techniques.) It's already possible to reduce that simply by using passwords, or using various hokey port 25 authentication methods like receive-before-send; this cleans up the process a bit.
Re: (Score:2)
It's already possible to reduce that simply by using passwords, or using various hokey port 25 authentication methods like receive-before-send; this cleans up the process a bit.
There is no requirement for any "hokey" authentication...port 25 for connections from inside an ISP could be routed (netcat, iptables, etc.) straight to where an MTA that allows relaying would be listening. For bonus points, any connection from inside the ISP to port 25 on any machine would end up at the same ISP "internal" MTA.
Meanwhile, connections to port 25 from outside the ISP would be routed to a "normal" MTA that doesn't require authentication and will not relay...it would only accept e-mail for dom
Re: (Score:2)
Re: (Score:2)
What hokey port 25 authentication methods? Any authentication methods offered on port 587 can also be offered on port 25. There is nothing magical about "25" that makes strong authentication unpossible. There is nothing magical about "587" that makes it any more secure than "25." You can run a open relay just as easily on port 587 as you can run one on port 25. You can run SMTP-AUTH and TLS on port 25, and permit relaying to authenticated clients that use TLS, while non-authenticated and/or plain-text
Directive 587 (Score:2)
Remove the head, destroy the brain. [youtube.com]
great, only 7 years late (Score:5, Informative)
Verizon has been an epic sewer network for years, and has ignored their spam problem for years. If they want to clean up now (or make a lame attempt to clean up, as most telco's do), fine. It just means less work for iptables at my end.
For those who are sick of Verizon's bullshit, here's my list (no promises this is complete, but it should have most of em) of Verizon's ip blocks.
206.46.0.0/16
66.12.0.0/14
207.68.0.0/17
71.96.0.0/11
72.64.0.0/11
72.42.0.0/18
71.160.0.0/15
71.162.0.0/16
96.224.0.0/11
98.108.0.0/14
98.112.0.0/13
68.160.0.0/14
162.84.0.0/16
162.83.0.0/16
151.204.0.0/15
138.88.0.0/21
66.171.0.0/16
66.14.128.0/17
151.201.0.0/16
138.89.0.0/16
141.149.0.0/16
141.150.0.0/15
141.152.0.0/14
141.156.0.0/15
141.158.0.0/16
68.160.192.0/18
68.161.192.0/18
66.14.0.0/17
151.196.0.0/14
151.200.0.0/14
151.204.0.0/15
129.44.0.0/16
138.88.0.0/16
64.222.0.0/15
68.236.0.0/14
70.104.0.0/13
70.16.0.0/13
71.96.0.0/11
209.158.0.0/16
209.159.0.0/19
71.160.0.0/11
173.64.0.0/12
70.192.0.0/11
66.174.0.0/16
75.224.0.0/12
75.240.0.0/13
75.192.0.0/10
97.0.0.0/10
E-mail Clients and Ports (Score:3, Interesting)
I wish that more software would default to 587 instead of 25. For example, Thunderbird doesn't even mention the possibility of 587 as a "default" port, which really needs to be changed.
In any case, it's good to see the change to 587 become more widespread and hopefully it will eventually become the default port for sending messages (along with encryption + authentication), while 25 will be reserved exclusively for server-to-server communication.
Remembering credentials?! (Score:5, Insightful)
I like the suggestion that people are somehow lax in security because their mail client remembers their password. Who are these guys who type the password in every 3 minutes when they check their mail?
Re: (Score:2)
I like the suggestion that people are somehow lax in security because their mail client remembers their password. Who are these guys who type the password in every 3 minutes when they check their mail?
Every three minutes? In my day we were checking our mail every 20 seconds, both ways uphill, and tapping out the password in binary!
New generation of bots (Score:2)
This will be even more wonderful because all of that spam will now have your name and email address on it.
The numbers don't match up (Score:2)
I often seen antecdotal numbers in the "millions" when people talk about zombie infected boxen. Yet the article quotes Spamhaus.org claiming "225,454" machines on all networks are sending spam. Even if one were to assume that only a quarter of all zombie machines are sending spam at any one given time, that's still only a million boxes that are compromised and sending spam.
What's the deal? Are there really millions and millions of compromised Windows boxes out there in zombie networks? Or are the number
Re: (Score:2)
There's probably millions, just not used for sending spam.
Most botnet owners charge for their usage for denial of service attacks. A popular example being halo tards DOSing others in the games at $500 a pop so they lag and can be killed easier.
Re: (Score:2)
Completely pointless? (Score:4, Insightful)
In my opinion, the transition to port 587 is nearly pointless. I already use authentication on port 25 to identify customers.
And according to one of the only people I'd trust on SMTP issues, "the SUBMIT specification has several fundamental flaws that make compliance practically impossible. I advise against all use of port 587" -- djb [cr.yp.to].
It's not pointless (Score:2)
It is useful because it allows ISPs to block port 25 for customers who do not run their own mail server (the vast majority of them). This makes it impossible for zombied machines to send mail directly , instead having to go through a relay. Open relays are much easier to filter against / get shutdown for abuse, than a whole swath of zombie computers. Mail going through authenticated relays is also easier to monitor for abuse, plus once the mailhosts relaying the authenticated mail are affected by zombie gen
hehe (Score:4, Informative)
I just reread your link. In it DJB explicitly advises against running authentication on port 25. In fact, for security reasons, he wrote two separate programs, qmail-smptd and ofmipd, to keep the tasks of relaying authenticated email and accepting mail for local delivery as removed from one another as possible.
He defends the idea of separating these two tasks, not only to separate ports but separate programs, on this thread [imc.org] on the IETF-SUBMIT mailing list.
So, yeah, his complaint against port 587 was simply that if you can't implement the SUBMIT standard correctly (which according to him noone can), you should use a different port then the one specified in that standard. The rest of the world doesn't care, because it sees all the various authentication methods (including SUBMIT) as extensions to SMTP, and not as a different protocol (OFMIP as DJB calls them collectively), and have no qualms running a standard (non-SUBMIT compliant) SMTP server on port 587.
wishing for Domain Keys Identified Mail (DKIM) ? (Score:2)
YAY port 587 is a great thing !
but are they going to sign their mail ?
now that would be a good thing so people can not FAKE a @Verizon.net address
google paypal yahoo etc do this
if Verizon did it people would start to respect @Verizon.net
simple if I get a Verizon.net address and it pass's the DKIM then I know it came from their domain
but a big WELL DONE ! someone with a clue got this done !
regards
John Jones
Re: (Score:2)
Zombies (Score:2)
Verizon pledges to clean up their zombie problem quickly.
That's what they said abot Ravenholm, and see what happened!
Re: (Score:3, Funny)
No, the guy posting before you did that ;-)
Comcast (Score:5, Funny)
Re: (Score:2, Funny)
no probably AOL
l2ISP
I thought AOL customers just posted ....
HOW DO I POST!!!!!!!!!!!!!!!
27 times in a row.
Re: (Score:2, Funny)
Re:Do zombies even use ISP mail servers? (Score:5, Insightful)
Indeed.
But if you're the ISP you can just say "Hey customers outgoing port 25 is blocked - use authentication and port 587 to send mail".
In general I'm against ISP blocking services, but in the case of spam prevention its a good choice to make.
(The ideal would be to allow outgoing, but cut people off if they spam. That would punish only the guilty, but I guess they're not so keen on that).
Re: (Score:3, Interesting)
(The ideal would be to allow outgoing, but cut people off if they spam. That would punish only the guilty, but I guess they're not so keen on that).
I'd be more content if they said, "You're blocked by default, but contact our support line and we'll open port 25 for you."
But I find it really frustrating when they block port 25. I use two different email services, and both of them require authentication and SSL, but do it via port 25, so I can't use them for outgoing SMTP if that port is blocked. I've had an ISP block port 25 on me, requiring me to use their SMTP server, but then they wouldn't let me use their SMTP server when I wasn't connecting thro
Re: (Score:2)
That actually sounds reasonable to me. If you plan to run your own web server you are bound to create extra traffic. You pay for that. And if you think it's too much then rent server space at a web server co. Probably cheaper even.
Home internet connections are not to run servers on. Then you need a business connection. In which case you probably get a fixed IP to boot, saves finding (and paying for) a dynDNS service.
Re: (Score:2)
Home internet connections are not to run servers on.
What, is that a rule of some kind? I guess home internet connections are just meant for media companies to broadcast out to you, and not for you to participate on the Internet, right? We probably don't need to be able to get good upload rates either, or anything like that. Hell, let's just block all ports, and make traffic completely one-way unless it's traveling through ISP-approved servers.
Re:Do zombies even use ISP mail servers? (Score:5, Insightful)
In general I'm against monitoring people secretly and continuously; but in the case of cities where children are legally or physically possibly present, it's a good choice to make to stop pedophiles.
... what?
Re:Do zombies even use ISP mail servers? (Score:5, Insightful)
Re:Do zombies even use ISP mail servers? (Score:4, Interesting)
Yes and it is only a matter of time before that changes and evolves.
The reason these alternative ports and blocking works is because most everyone else isn't doing this. When it comes to the point where most people are doing this, new methods will arise.
The first scenario that comes to mind is that the next generation of bot-ware will listen to your outgoing email traffic and learn your password then configure itself to send email based on that information. Then once again, the problem returns. And if *I* can conceive of this, then I *know* spammers have already thought of this. (I am comfortable in the assumption that I have never come up with an original idea.) You can expect this to occur within the next year or so. The drive to these measures are largely based on the size of the target audience after all. (This is the reason Mac OS X is mostly immune to attacks and infection... it isn't yet a big enough target!)
Things will get crazier before they get better.
Re: (Score:3, Informative)
The first scenario that comes to mind is that the next generation of bot-ware will listen to your outgoing email traffic and learn your password then configure itself to send email based on that information. Then once again, the problem returns.
The advantage in this instance is that the ISP can easily identify (because the zombie used the user/pass) who has been zombified and inform the customer to get their machine disinfected.
Re: (Score:2)
I particularly like the scenario where the ISP informs the customer via *email* that they're infected - the email is intercepted by the spam bot, which stops for a while, then sends an email back promising that the system has been cleaned. All of which is much less silly than the fact that certificate authorities exchange plain-text emails with their customers, and are currently so easy to social-engineer that a bot could do it.
Re: (Score:2)
Re: (Score:2)
Setting a limit of say 100 mails, no make that 500 mails per day will do the job pretty much as well.
It is a limit that normal users will not reach. OK maybe some send out newsletters, one could consider making the limit a bit flexible on request. Though help desk calls are expensive of course for the ISP.
500 mails per zombie per day I don't think is interesting for a spammer. Now they can do hundreds of thousands in a day per zombie. It would lower the value of botnets for starters. And the user that is
Re: (Score:2)
That's why you also use encrypted connections. It would be stupid to pass login information over unencrypted connections.
Without access to the SMTP port and the login information, the next route is to tell the default mail programs (Outlook express, Mail.app, etc) to send a mail and let those programs h
Re: (Score:2)
Re: (Score:2)
Writing a program to act like a mail server for the purpose of sending spam would not be difficult. You wouldn't need to implement any kind of backend just the simple mail transfer protocol. Take a look at the RFCs 821 [ietf.org] and 2821 [ietf.org]. The original RFC is 821. It contains most everything you would need to write a mailer. The actual communication is very simple by design.
And for the record some virus and trojans do implement this.
Enabler, not longterm solution (Score:3, Insightful)
Most ISPs already do a fair bit of policing on the users of their mail servers, so this probably won't make a big dent (though botnets keep evolving, and if the scalability works to use ISP mail servers, they'll go back to it.) This basically provides a cleaner, more standardized solution for mail submission and authentication. VZ might block Port 25 later, and getting their users onto 587 makes it easier.
Zombies already do deliver their mail directly using Port 25. They're not generally running Real Sen
Re: (Score:2)
But lots of ISPs have been jumping on the "Block Port 25" bandwagon (with no apologies to Linux users who run their own sendmail), so maybe the zombies will go back to using ISP mail servers more often.
Many ISPs will let you use outbound port 25 if you request it. This usually means only responsible users will have the ability.
Also, you can configure sendmail to use port 587 on another server as the relay, so you could still use your own sendmail and relay through the ISP server.
Re: (Score:2, Funny)
Re:PORT 587 THE GATE TO HELL (Score:4, Interesting)
Port 666 is reserved for Doom (video game)
Wow, I thought AC was joking, but it's right there in RFC1700!
doom 666/tcp doom Id Software
doom 666/tcp doom Id Software
Re: (Score:3, Insightful)
The right answer is obviously to send an automated email informing them that according to your data their computer is compromised and if the spam doesn't stop the offending ports will be locked.
That's not an obviously right answer.
First they'll ignore your email. (Assuming they even get it, because the people with zombie PCs don't check their ISP mail they mostly use hotmail/gmail/yahoo etc so they'll never see the message from their ISP.)
Then you follow through on your threat and block their access.
At whic
Re: (Score:2)
The only people I see with SpamHaus listings are:
1. People too clueless to be allowed to send email (or run an email server depending on why the listing is there)
2. People that do not use closed loop, unique token, confirmed opt-in
3. Spammers
If you have a problem with a SpamHaus listing, there are well documented ways to go about resolving the issue and having the listing removed. Remember children, SpamHaus only rejects emails sent to SpamHaus servers. If your mail is rejected by a non-spamhaus server, the