New Spam Zombies Use ISPs' Mailservers 383
RMX writes "CNet's reporting
that the new
spam zombie PCs are no longer acting as their own mailservers, but cooperate with the ISPs' recommendation that instead of running your own mail server, to use theirs instead."
Eh? (Score:3, Insightful)
Re:Eh? Because... (Score:5, Insightful)
Because I suspect it doesn't work as well. It's pretty easy for an ISP to notice 100,000 emails from one sender pumping through their SMTP server, but relatively difficult to notice those mails when sent directly through the net. Also, outgoing servers are often set up with throttling.
Of course, nowadays, ISP's have no excuse in either scenario. There are plenty of network monitoring tools that will notice spamming.
And a lot easier to get them to stop. (Score:3, Insightful)
With an ISP's mail server, you can.
And they should be more interested in shutting down the thousands of spam messages so that their regular mail can be sent.
Re:Eh? (Score:3, Informative)
The throttling is another issue, however.
Re:Eh? (Score:3, Interesting)
No, forcing clients to use valid SMTP servers is the most of the reason SPF exists. The point is, most security measures on SMTP servers are moot because they can work around them simply by running their own SMTP process.
The idea is to force them to adhere to using authorized servers that are actually under someones control.
Now things like shutting down open relays, smtp auth, send limits, outgoing filters etc. are not just a wasted effort.
Right now if an infect
Re:Eh? (Score:3, Interesting)
violation of ISP contract? (Score:4, Funny)
Re:violation of ISP contract? (Score:3, Insightful)
Re:violation of ISP contract? (Score:5, Insightful)
In order to stop their networks from becoming ridden with viruses, they simply closed off the accounts of whom ever was infected. Sure people complained, but in the end, there were more people that were satisfied since their computer only needed to be infected with one virus for them to notice. Instead of having a computer with 20+ self-propagating viruses, the user only had one when they realized they needed it fixed.
Joe User's seem to ignore popups and slow-downs of their computers as long as they can still connect to the internet and check their AOL email. As soon as they're disconnected, they will call up the ISP and find out how to get their computer fixed.
If these ISP's can take the same stance against zombies becoming spam servers, it shouldn't be long until Joe User is forced to learn how to use a firewall to protect himself from being disconnected.
As soon as we have ISP's that are *more* responsible for the content going through their networks, we'll have a better internet.
Re:violation of ISP contract? (Score:5, Insightful)
Let's say the ISP tells him to run ZoneAlarm (firewall for PCs), he will most likely end up just saying "Allow always" to any suspicious programs requesting internet access, or "Deny always" and he'll just have to call the ISP back to figure out why Windows can't open any TCP/IP connections....it's a great fix on paper, but I think there are a lot of other factors that need to be considered before you assume you can "just tell them to become computer security experts"
Re:violation of ISP contract? (Score:4, Interesting)
I'm going to go on a strech here. It's similar to driving a car (Please note, I said similar, not the same as). You recieve a license to use a car so that you can drive around in a controlled environment where other people reside: The public roadways. You can do what ever you want on your own environemtn (Own PC) just as you can spin doughnuts in your backyard if you really want to.
You get your license to drive on the public roadways (Networks) and if you choose to not lock your car, then somebody else will steal it and hopefully the police will either take your car away (take your computer away) or they'll take your license away if you were the one actually doing the infraction. (ISP disconnects you from the internet)
If you are caught doing something bad in a car on public roadways, you should be punished; if you choose to turn on that computer that is not secured in any way, shape, or form, you should not be allowed to take the use it. [Don't yell at me yet]. If you're not prepared to get into a car and harness its abilities, then you'll want to start with a car that's attached to a track, like those ones the 4 year olds use in amusement parks.
You can consider those tracked cars like Mac's; because with all due respect, you can't become a zombie computer without at least trying.
Until you learn to use a car, you'll never get a license to use it. Until you learn to use a computer, you shouldn't be on the internet.
My two cents.
Thanks for your insightful reply CrackerJack9.
Re:violation of ISP contract? (Score:5, Insightful)
Yep. And the great thing about having a licence to use a computer is the immense power it gives the government over you.
Piss off someone in power? Take away your licence.
Mistakenly accused? Take away your licence until you clear things up.
Go up against the latest policial hotbutton that no one takes seriously? To make it serious, they come up with a new punishment. Take away your licence!
A licence to operate a computer is a horrible, horrible idea.
Re:violation of ISP contract? (Score:5, Interesting)
Demonstrate you can use a computer responsibly and you can get an SSL-like certificate from any number of private companies and other organizations saying so.
People would be free to send email without such a certificate.
People would also be free to reject any such email. Or accept it, it would be their choice.
Re:violation of ISP contract? (Score:3, Interesting)
From what people are saying, ISPs can't even manage the spam and virii coming from their own customers computers.
I doubt they'll be able to handle anything like a licence.
Re:violation of ISP contract? (Score:4, Interesting)
Re:violation of ISP contract? (Score:5, Interesting)
Personally I would rather see it this way; if your car is doing something bad, then it should be stopped and not allowed on the road until it's fixed. IE leaking oil on the road, lots of smoke coming out of it, or parts falling off.
If your driving down the freeway with a 300 feet of linked banners attached to the back of your car, then you should be stopped. Even if you didn't attach those banners to it.
Re:violation of ISP contract? (Score:4, Funny)
It's not quite clear from context: did you mean "IE" to represent "id est" or "Internet Explorer"?
Re:violation of ISP contract? (Score:3, Insightful)
Re:violation of ISP contract? (Score:4, Informative)
The pages even have lovely pictures so the users can't(read: shouldn't be able to once they have removed their heads from their asses) make a mistake.
When the user think that they are clean we rescan their network traffic and if everything checks out we place them back on the standard network.
Last year almost the entire campus fell victim to adware, spyware, and virii... this year only a handful. It seems to work. If they get re-infected they lose their internet access again.
OH NO!!!! (Score:2, Offtopic)
(I know there's been rumours on 'em)
Re:OH NO!!!! (Score:2)
No, it's only the end of the Nucular Innernet.
Re:violation of ISP contract? (Score:4, Interesting)
And yes, Joe User tends to ignore popups, because a lot of the "professionals" are idiots. We have a radio program in Portland on the weekends hosted by some "long time computer experts". Every time the topic of "how to prevent popups" comes up, the host insists that your web browser has NOTHING TO DO WITH IT. Popups are entirely a problem with your machine being infected and you need to install a good virus scanner to avoid them.
People have called up and said "no, I think they're talking about web popups that you get when you visit a website without a popup blocker". Rather than suggesting people use Firefox or something, he actually says "If you're getting popups, it is because you've done something wrong and aren't protecting your PC". He refuses to acknowledge (and has for many months) that if you visit a website without some form of popup blocker, you'll often encounter popups BECAUSE THE WEBSITE IS SENDING THEM.
I mean... it baffles me that people like this are being treated like expert professionals and they're misleading thousands of people in the process of pumping up their own misguided ego.
Re:violation of ISP contract? (Score:2)
One that charges extra for AV and Spam protection
The rest of us provide it free with ClamAV and SpamAssassin.
Re:violation of ISP contract? (Score:2)
Who says he's really an expert at anything? For all I know the only thing he knows is how to keep people from securing their machines so that the popup ads on the sites he hosts can get through.
Re:violation of ISP contract? (Score:5, Interesting)
Probably the kind of ISP that realizes it's a security issue related to Windows, and therefore one of the risks best dealt with by the end user. Editing users' e-mail based on a file extension is stupid anyway. That's probably the same kind of thinking that went on at Microsoft's OS development group when they implemented file-type detection; More specifically, that shallow thinking is what is directly responsible for the Windows vulnerabilities based on extension-only file-type detection and the shell's automatic file association helper.
So why not stop there? Windows' shellexec helper also attempts to do something with
Jesus, why are we still having this discussion? It's real simple for Microsoft to fix: Make it so any file coming from someplace other than the local filesystems is downloaded to disk only. Or simply give IE and Outlook their own file helper registries, where the default is to just download the file without attempting to open it. People have been setting up their own helper applications in Netscape for years, and no one ever died of exhaustion from the extra work.
Re:violation of ISP contract? (Score:3, Informative)
Re:violation of ISP contract? (Score:5, Interesting)
Our office was only on the 4th floor, and his system was right at the window, so somebody popped through and started doing crap on the Zone servers. Telus cut us off within a day, and I was damned impressed.
I was angry too - but not at Telus. At the marketing guy and myself (for leaving open outbound access). I fixed his system, and instituted "via proxy only" outbound for port 80, and no more problems.
Re:violation of ISP contract? (Score:4, Insightful)
1) Never ever let a marketing person configure some hardware!
2) Never ever let a marketing director use the internet unattended!
This sounds funny but it is meant seriously!
Re:violation of ISP contract? (Score:4, Insightful)
The proxy server at work does filtering; it won't let me search google for cable 'strippers', or go to 'demorcrat' or 'buddist' related sites (though I can go to 'republican' or 'christian' related sites). Draw your own conclusions.
Maybe your employer has high grammar standards? Have you tried searching for "democrat" or "buddhist" web sites?
Re:violation of ISP contract? (Score:5, Interesting)
Telus has had its netblocks (including the ones their mailservers are on) blacklisted many, many times - and their respons has been to simply ask for removal, without actually fixing the problem. When their mail servers got blacklisted by Spamcop, their response went something like "well, we're a large ISP, so you should remove the block."
here [google.ca] is an example of Telus stupidity in action. I've received the *exact same* response from them
They don't give out static IP addresses (even though they claim they do), instead forcing their customers to use DHCP for their mailservers (yes - even when the customers *PAY* for a static IP address) - and when the addresses change, the customers frequently find themselves in various blacklists.
If you think that Telus is responsible, you should do a google groups search for them in news.admin.net-abuse.email
Re:violation of ISP contract? (Score:3, Interesting)
They could even go a step f
Re:violation of ISP contract? (Score:3, Informative)
even those great ones with .scr's from v1agra@sh0p0ur31337store.ch.
Why does everyone pick on Switzerland as being the source of spam? I would have thought .cn (China) would be more appropriate...
Simple solution (Score:4, Interesting)
Re:Simple solution (Score:5, Insightful)
Re:Simple solution (Score:2, Insightful)
Re:Simple solution (Score:2, Informative)
Trust me, I've set it up.
Re:Simple solution (Score:3, Insightful)
It's a shame that people are so attached to their horrid Microsoft Outlook email client. Otherwise, two problems could be solved in one fell swoop: Have users SSH into the ISP email server, and use a simple client like Pine to send and receive their email.
First, this setup would enforce strong user authentication, as the parent wisely suggested. Secondly, it would eliminate that whole host of attacks against bad ema
Re:Simple solution (Score:3, Insightful)
remember, you have to keep these dumbed down for the masses.
Re:Simple solution (Score:2)
Re:Simple solution (Score:4, Informative)
I'm going to assume you mean "Outlook Express" when you say "Outlook", otherwise your argument has no merit. Even then, Outlook Express isn't as bad as you make it out to be. For example, both Outlook and OE support SMTP-AUTH, via SSL or not (as well as both POP3 and IMAP-v4 over SSL). That addresses your first problem, which at this point is an ISP issue rather than an MTA issue. Your second point is really only valid for OE, and then only if you've never bothered to use Windows Update (in which case you're asking for other problems anyway). Outlook has blocked bad attachments since a service pack for Outlook 2000 (there have been two versions of Outlook since then, XP/2002 and 2003). Outlook 2003 (which is the only version I have installed right now, so I can only speak to other versions on memory) will also block malicious content in the body of the message itself (scripts, images linked to external sites, etc). If you're still getting infected by email viruses while using Outlook, you're either running a ridiculously old version, or you're explicitly overriding Outlook's protection mechanisms.
Moving everybody back to pine (or better, mutt, but that's my own personal preference) via ssh is not an acceptable solution. Forcing everybody through a webmail interface is only slightly better, but even that is not very desirable (see the new Outlook Live [msn.com] service from Microsoft that lets you read your hotmail email via Outlook rather than the web page, or RPC over HTTP [microsoft.com] in Exchange 2003 that lets you access corporate email without a VPN rather than using OWA).
Re:Simple solution (Score:5, Funny)
But then they would have a third problem.
Re:Simple solution (Score:3, Insightful)
Re:Simple solution (Score:2, Interesting)
That's ludicrous. POP-BEFORE-SMTP or SMTP AUTH are extremely simple to setup without any additional complexity on the user's end. If the ISPs are not protecting their mailservers, then I would suggest this is THEIR problem - not the end-user.
Re:Simple solution (Score:2)
Re:Simple solution (Score:3, Insightful)
The users machine is comprimised. There is no method that can be widely adopted that will keep these programs from using the same functions that the computer does on daily basis.
Re:Simple solution (Score:3)
Re:Simple solution (Score:3, Informative)
Most root CAs (at least the ones that are found in browsers' CA list) charge a fortune to let an ISP have an intermediate CA certificate that can signoff additional client CA certificates.
Plus, business sense forces the buyer of intermediate CA certificate to recoup the exhorbitant cost by charging all those who wants to have their CA tied to the intermediate CA server.
Not worth it. Just go self-signing and distribute the trusted root to the cus
Why aren't they using SMTP-AUTH? (Score:4, Informative)
"The e-mail infrastructure is beginning to fail," Linford warned. "You'll see huge delays in e-mail and servers collapsing. It's the beginning of the e-mail meltdown."
Re:Why aren't they using SMTP-AUTH? (Score:4, Insightful)
Re:Why aren't they using SMTP-AUTH? (Score:5, Informative)
Re:Why aren't they using SMTP-AUTH? (Score:3, Insightful)
They'd need to take the time to write a more sophisticated version of the trojan that first does some keystroke logging to steal your AUTH password, -then- sends spam with it.
Once a virus allows "a remote attacker to gain complete control of your computer", there's really nothing that you could do that they
MMMMmmmm (Score:2, Funny)
Many ISP mail servers get blacklisted now? (Score:5, Interesting)
Re:Many ISP mail servers get blacklisted now? (Score:3, Informative)
The ISP I work for mandates the use of their mailserver for outgoing e-mails and limits the number of mails that can be sent in a certain timeframe.
Re:Many ISP mail servers get blacklisted now? (Score:2)
You may be joking, but this is alrady happening. I can't send mail to AOL or Netscape.com becasue they claim my ISP sends too much spam, and provide no method of redress or whitelisting. Another local ISP keeps throttling my messages (not rejecting outright, but delaying) because of "too many connections from your server". In both case a combinationm of stupidity and arrogance, triggered perhaps by spambots like these, is preventing
Re:Many ISP mail servers get blacklisted now? (Score:2)
Actually, that's a really bad thing, but 90% of people are stupid, and 90% of windows installs (IMHO) are crap so it's not always the end user's fault. Maybe it's this OSX-like influence seeping in to me, but if all you want to do is check email and browse the web, yo
SMTP Authentication (Score:2, Redundant)
Problem instantly resolved.
Re:SMTP Authentication (Score:2)
Also won't do much good. This is a young thread, and I've already seen several suggestions like this.
See, Outlook (Express) keeps that login information handy so that it can send a message without buggering you for said login information.
What's to say that the virus/worm won't use a C
Unnamed processes (Score:3, Insightful)
If you are going to tell everyone that spam zombies (or terrorist websites) are out there, why don't you give details like processname (or website URL)?
It does no one any good if you just say, "Hey, there's a chance your computer may be infected and is a zombie spammer," if you don't also tell us the zombie process name.
Re:Unnamed processes (Score:2)
Consult your preferred anti-virus vendor's online database for more detailed information.
Re:Unnamed processes (Score:5, Insightful)
Your best bet is to find a personal firewall that asks you if application x is allowed to generate network traffic. Hopefully the firewall will tell you more, such as the type of traffic the application is attempting to generate, but even that can be more information than a general user is prepared to try to asses.
If your firewall tells you that 'tobmaps.exe' is trying to send e-mail to your isp's mail server, you might tell it no, don't allow that sort of traffic. If it tells you that 'tobmaps.exe' is attempting to connect to login.yahoo.com via http, you might inadvertantly allow it, even though login.yahoo.com is the first step towards sending e-mail through Yahoo.
In most cases however you can probably tell your personall firewall to block all traffic to any IRC network, unless you speicifically approve the app, and know what you are doing. Of course over time spambots are going to move on from IRC channels to Instant Messaging services, to various p2p applications, if they haven't already.
Saying 'kill off any process named xyz-abc.exe' is all well and good, but is probably going to be a one shot solution to a small subset of the people infected with a spambot.
-Rusty
This is why some isp's.. (Score:3, Informative)
It's just a hell and takes lots of time to go through contacting abuse-department of ISP's like AOL and Verizon who decide to block for very few spam-reports. Even though the damage of spambot-infested computers on your own network is limited.
Re:This is why some isp's.. (Score:4, Informative)
I tried this. I limited outbound emails to 1000 addresses at a time thinking that was very reasonable. Within a week there was a complaint from one of major companies that they couldn't send to all of thier remote offices. Sure enough, not only did they have more than 1000, they had 13,000.
I realize this isn't an everyday occurance, but this situation should show that using a limit fix is not a good solution.
Even doing a max-per-hour won't work. There are times when outbound email from a company can increase exponentially for legit reasons.
This is easier to solve (Score:5, Insightful)
ISP's will likely start limiting outbound email to x email/hr. Companies and ISP's will likely start monitoring and kill quicker.
This will benefit spammers for a very short period, then bite them in the ass.
ISP's and companies aren't going to tolerate a spike in CPU usage, and possible blacklisting if they can take care of it. They will start blocking IP's from sending mail, etc. etc.
Assuming the Zombie's ISP doesn't notice (Score:2, Interesting)
Re:Assuming the Zombie's ISP doesn't notice (Score:2)
There are a lot of second and third tier ISPs that won't notice or won't care to do anything about it. Worm and virus writers will just have to aim their target systems a bit more carefully.
You can already see this happening in the way that spammers use Usenet news servers. The big players watch their queues closely and quickly boot spammers. Other Usenet server companies give lip service to controlling spam by just cancelling (or claiming to cancel) accounts. The next day the same people are in oper
Bring back Make Love not Spam... (Score:2)
I know two wrongs don't make a right, but--grrrrrrr--I HAT how these spammers work.
Re:Bring back Make Love not Spam... (Score:3, Funny)
I fail to see the second wrong. Perhaps you are equating legality with morality?
Polite Zombie (Score:2)
It'll be interesting to see how this effects ISP's Service Agreements:
"The customer, nor any device connected to the customer's network will not for any reason, send emails regarding 'P3n15 Enl4rgm3n7!!!', etc.. etc.."
Buuhahaha...
can we expand the war on terra to include spammers (Score:5, Funny)
Everyone should write their congressmen [house.gov] requesting this.
Re:can we expand the war on terra to include spamm (Score:2)
"ONLY TERR . . . er . . . . SPAMMERS HAVE PORT 25 OPEN!!"
Email Meltdown my ass (Score:5, Funny)
Yes, I know some mail clients don't support this functionality, but come on. Name one of the modern clients that won't do it. Thunderbird, Mail.app, Eudora, Outlook
I suppose then you just have to convince users. This, though, should be the easiest part:
Dear User,
This email is to notify you that your neighbor has been recieving your monthly e-bank statements and password confirmation emails because you are stubborn and insist on using insecure email protocols.
Incidentally, we'd like to thank you for your subscription to DAILY LESBIAN ACTION MAIL!!!1
Re:Email Meltdown my ass (Score:2)
I would really like my ISP (both of them) to use SSL/TLS for email.
Unfortunately, neither of them do. Shoot, one ISP doesn't even protect its web mail client via https. Needless to say I don't send or receive ANY important mail using that ISP.
What's even more irritating about this ISP is that your account information is protected by the same username/password as your default mail account. Who knows what fun could be had with this information.
I've talked to tier two support about this issue seve
Re:Email Meltdown my ass (Score:3, Insightful)
I have lived through so many "trivial changes" at ISPs as a tech support rep that not only do I find your statement outright insulting, but that I demand that you immediately retract your statement.
Forcing thousands upon thousands of the unwashed masses to make changes to their computers in "trivial ways" does not take a day. Or a week. Or even a month. It takes approxim
email meltdown? (Score:2)
Instead of bringing about some sort of "email meltdown" won't this simply push email into being a web-based service instead of an isp-provided service?
Great (Score:3, Funny)
CAPTCHA (Score:2)
Global, realtime spamlist? (Score:2)
Re:Global, realtime spamlist? (Score:3, Informative)
So... something like Vipul's Razor?
It's not quite as trivial to set up as you suggest, because of two things...
Fortunately, people are already working together to make this work. Pyzor is another similar effort.
Spamassassin has hooks built in to interface to both Pyzor and Vipul's Razor.
Maybe ISPs should just start running spamassassin (or somet
Damn /. links (Score:2)
Death of the net predicted - pictures at 11. (Score:3, Funny)
We're winning (Score:5, Insightful)
Now all the ISPs have to do is to filter and detect sudden jumps in email traffic. It will be easy for them to detect systems which have been infected. This will catch the small number of users who suddenly start running high volume email lists from their home systems, but those cases will be few enough that they can be dealt with manually.
This is the beginning of the end for the zombie spam problem!
Re:We're winning (Score:4, Informative)
PS, blocking port 25 for customers is just plain dumb -- I have a lot of customers that go on the road and don't want to reconfigure their laptop to use the local dial-up access SMTP server for two hours, then do again in the next city.
They just leave the SMTP set to us, and we have secure logins. Voila. Oh, but we can't use port 25 because a lot of ISPs block it.
RFC 2476 (Score:5, Informative)
I have a lot of customers that go on the road ... They just leave the SMTP set to us, and we have secure logins. Voila. Oh, but we can't use port 25 because a lot of ISPs block it.
You're using SMTP AUTH over TLS on port 587/tcp per RFC 2476, right? ISPs have fewer legitimate reasons (if any) to block 587/tcp out than 25/tcp out.
Re:We're winning (Score:3, Insightful)
Is spam such a huge problem, really? (Score:2)
Looking at my spam folder, I get between five and eight spam mail per day delivered, most of which I never saw since I also filter locally with spamassassin (this does not count those tagged as spam by my ISPs). A year ago, the number would have been ten to twenty times higher.
If anything, I get the distinct impression that if
Re:Is spam such a huge problem, really? (Score:2)
RBLs already stop a large percentage before it even reaches the SpamAssassin check, so even if the spammer switch to using ISP MTAs when they can the SpamAssassin bit will likely still result in refusal.
It is pissing off the spammers
Re:Is spam such a huge problem, really? Yes! (Score:2, Insightful)
But more significantly, it represents a massive opportunity cost. There are all sorts of cool things we could have created for our users that we haven't been able to get to because we were tied up with weekly SpamAssasin upgrades. Spam is short circuiting the work of a lot of the most brill
Most ISPs have limits (Score:3, Interesting)
Secondly, ISPs often have a limit to how fast you can send mail or how many per day you can send.
I don't really see this as a problem.
Re:Most ISPs have limits (Score:2)
In my experience, most ISPs only require you to be on their network in order to use their SMTP server. No authentication required.
Re:Most ISPs have limits (Score:3, Informative)
hummm. Time to allow systems to be their own serve (Score:2)
This is old news (Score:2)
The bad thing is that it can get your mail servers on some blacklists instead of just some dynamic IP ranges, the good news is that it's fairly easy to spot s
BREAKING NEWS!! (Score:3, Informative)
Spammers are using Microsoft's Hotmail servers as Spam servers, and sending out hundreds (of millions) of emails each day to unwilling recipients.
Come on, this is hardly news worthy on the front page of Slashdot...this kind of thing has been going on in one way or another for a long time.
SBC Global / Yahoo has been doing this for 3 weeks (Score:3, Informative)
We had everyone doing authenticated SMTP through our server for outbound but SBC shut that down and forces them to do authenticated SMTP through their servers now.
I have absolutely no problems with this except two small issues...
1. They didn't let anybody know. (To my knowledge) There was no press release on the home page or any instructions emailed out to inform customers how to update their mail settings. Since of course they only officially support their email addresses any non-technical customers that called in to SBC royally messed up receiving mail from our servers.
2. There is no non-customer technical support period. You can't make your way through their automated system and they have no way to contact any body on an ISP to ISP level that I could find.
I even contacted some marketing person at their HQ that I managed to find contact info for and explained the situation. They even tried to contact support and couldn't figure out how to do it. Very sad. Glad it wasn't an emergency.
Law is the answer and the answer is law! (Score:5, Informative)
Just take a look at the statistics:
Europe has only had strict laws against junk communications for two years (Article 13 of Directive 2002/58/EC) [eu.int], they have only been in full force since November 2003 (and the provisions for criminal penalties are not even in place in each and every corner of the European Union yet) - but they mean pure and simple opt-in, and look how this continent's "spam output" already has become almost completely insignificant.
The U.S., I'm afraid to say, have put next to nothing in the way of these sociopaths: only a now-you-CAN-SPAM-more-than-ever Act that lives up to its name in the worst of ways, by legalizing most of the spam [slashdot.org], enacting an unworkable opt-out onus on the users, and putting anti-spam warriors at the legal risk of interfering with (and being taken to court by the operators of) what is considered a legitimate "business model" except for some of the worst abuses - and for however little it is, all of this even an entire decade too late.
Reliance on technical solutions and minimal government intervention is just fine for many things - but it's failed in the fight against spam.
Here is how to do it:
That's certainly nowhere near rocket science, and if the above looks a bit complicated, that's probably just becauseThere is nothing wrong with following an example that works so well, even if it is from Europe...
Call your congresscritter now to outlaw unsolicited commercial communications, place a hefty fine and jail time on the offenders, and put an end to these abuses before they put an end to eMail itself.
Re:Zombie trick expected to send spam sky-high - t (Score:5, Funny)
Re:Authentication (Score:3, Informative)
It probably won't. Your e-mail client likely remembers your password for you, no? So if your mail client knows the password, what's to stop the Trojan from pulling the password out of where the mail client stored it? And since you're probably using Outlook Express, the Trojan knows exactly where to go. Thank you convenience features.
Re:Not surprised.... (Score:4, Informative)
Re:Not surprised.... (Score:4, Informative)
I don't know if the login/password is stored there as well, but the server information sure is.