AcidAUS writes "Last week's bust of the largest spam operation in the world has had no measurable impact on global spam volumes. The spam gang, known by authorities and security experts as HerbalKing, was responsible for one-third of all spam, the non-profit antispam research group Spamhaus said." The article speculates that the operators of HerbalKing simply passed on to associates the keys to the automated, 35,000-strong botnet, and the spam flow didn't miss a beat.
speculates that the operators of HerbalKing simply passed on to associates the keys to the automated, 35,000-strong botnet, and the spam flow didn't miss a beat
If they sent the keys to that botnet via email. If it got eaten up by the other ends spam filters, that would be irony indeed.
That is an interesting idea, but what would be the incentive for spammers to cooperate?
I suspect it is more likely that the systems in their botnet - of which many are compromised windows PCs - were re-compromised by someone else's worm and is now doing someone else's botnet work.
"The article speculates that the operators of HerbalKing simply passed on to associates the keys to the automated, 35,000-strong botnet, and the spam flow didn't miss a beat." Whatever. I've seen way too many scifi films to believe that. Obviously, skynet is now self-aware.
i don't think the government is spending half the money they spend on the War on Drugs on fighting spam. you can't even compare the two.
if we lived in a true democracy--one that gave citizens direct voice in public policy--replacing congress with regular national referendums for passing legislation, the spam problem would be solved in under a year.
everyone hates spam because it negatively affects our daily lives. few people profit from spam and at great societal costs. so if a referendum was held to divert tax funding away from the War on Some Drugs, the War on Iraq, the War on Terrorism, etc. and put these resources into combating spam, our prisons would no longer be filled with harmless drug users (and illegally detained arabs) and instead of filled with spammers, malware writers, and other real societal parasites. most people would probably vote to ban spam outright--that means companies that hire spammers & malware creators would be punished just as harshly. this would immediately cut off the financial incentive to spam. spammers don't send spam because they enjoy it; they do it for money. cut off the cash flow, and there'd be no reason to send spam.
the other solution is to change our culture of consumerism. spam is a direct result of unbridled capitalism. financial greed and selfishness have become virtues in our society. spammers are the embodiment of the "entrepreneurial" spirit. we're trained to seize any and all opportunity to make money. our society glamorizes the rich, marginalizes the poor, and our entire society and political system is skewed in favor of the wealthy. and it's this pro-business political culture that allowed spam and malware to grow into a such a prevalent institution. politicians were so used to putting business interests above public interest that spam was just an given.
but it'll take a long time to change our culture of capitalist greed & materialistic consumerism. our children need to be taught that personal integrity is more important than wealth, and to not equivocate money with happiness/success. most importantly, we need to value people based on their moral character and contribution to society, not their bank balance. instilling these positive values in kids will ensure that they don't grow up to be spammers. but that's hard in a society where money and socioeconomic status are everything. you can't even get a good education, decent health care, or justice if you don't have money. so this is an uphill battle.
They could have designed the botnet with a dead man's switch... if they were busted, start feeding their partners' spam at double vigor, and have the bots create as much noise and general chaos as possible.
Why wouldn't it just keep on churning out the spam it has until given new stuff?
Because the life expectancy of a given spammed domain is on the order of several hours now, even with fast-flux DNS tactics, and professional spammers certainly understand that. There's no reason to expect that botnets are given a "spam this until otherwise instructed" order; instead, evidence points to very specific commands from botnet operators to mail each campaign for X site to Y addresses over Z period of time. There are screenshots out there of popular spam/bot controller interfaces. Besides, if the botnet operators have been busted, we have to presume that access to their C&C (and the ability to shut down the botnet) was part of a plea bargain.
I've mentioned this anecdotally to friends and coworkers over the past week, but apparently I'm not the only one to notice: after the bust, spam volume has remained steady. Claims that this group was responsible for a third of all spam appear to be sorely overrated.
Consider the economic benefits of spam! [today.com] MessageLabs reports that Egham, Surrey, on the suburban outskirts of London, is the town that receives the most spam in Britain.
"It's not like there's much else to do," says Boris Busybody, 77 (IQ), of Egham Hythe, idly whirling his four-foot penis around his head in a desultory fashion. "Expanding your manhood, growing your breasts, increasing your sperm... the Lib Dem phone calls get a bit much. That's Doctor Busybody, by the way. My Ph.D arrived last week."
Spam has revitalised the local economy. Busybody has given up cab driving and is now working a lucrative job processing payments from home after he sent them his bank details in response to an urgent security message. "I had that King Otumfuo Opoku Ware II in the back of my cab once. Very generous and helpful fellow."
The Egham Tourist Board has seized the day, with plans for a 50 foot tall penis sculpture at Junction 13 of the M25 on the exit ramp to the town. The sculpture will be encircled by a genuine imitation Rolex and spray a fountain of Spermamax, obtained at a very reasonable rate from a Canadian pharmacy. "You will search an hour for your underwear in the ocean of our spam!" is to become the new town motto.
"I did get a good one the other day," says Busybody. "Barrister Matthew Sergeant Busybody of MessageLabs said we could promote our town to millions of people just by sending them an advance fee to process our incoming email. The stuff they try! â(TM)Scuse me, V!k@grk@ kicking in, got to go have sex again. Sorry."
Exactly when the original story broke, I went from about two hundred spams a day to over a thousand, almost all of which were new topics, and it hasn't let up since. So the keys may have been passed on to several parties who are making more extensive use of the botnet than the HerbalKing group did.
I wonder how many it will take before Yahoo finally decides to start blacklisting spam hosts rather than sticking to the woefully inadequate filters.
Same here (N Europe), I spent yesterday checking my mail server because I had not received any spam for 5 days. Usually, one or 2 will get through the filters but it had been quiet since before the weekend. NO SPAM at all is even arriving at my server. I am reluctant to attribute it to the bust, but I have nothing else to offer that will account for it.
Doesn't mean that the 'machines' will stop doing what they have been 'told' to do.
FCOL, 99% of the spam is rejected because of bad addresses, rules, and so forth.
It's just possible that these bots will continue to spam until they are physically shutoff by their owners.
What? You mean to tell me that after the people were arrested, the compromised machines kept doing what they were told to do?
I thought that they sent every spam by hand.....
Really, you obviously see what TFA seems to be blind to. It is absolutely stupid to assume that somehow arresting people will fix the problem of automated spamming. For all we know, the compromised machines have a 6 month queue of spam to send, in pre-purchased amounts. Set it up once, charge your slimy clients once, and then sit on y
Busting the operators of this botnet isn't going to end the problem. It's going to continue as long as Joe The Plumber is surfing the net on a computer running an OS which is insecure by design. Even if it has a firewall, it's probably third-party software, and as such, doesn't start until after the network interface is up and running, leaving a huge (by computer standards) window of opportunity for the box to get pw0ned. And, of course, the same is true for any anti-virus running.
Now, personally I run Linux, so for right now, I don't have to worry. Of course, if Linux ever gets popular enough to put a real bite in Microsoft's monopoly that will change, but it's not vulnerable in the same way. Not only is it (more) secure by design, the firewall goes up before, not after the network interface, so there's no time that it's exposed to the network without protection.
Like it or not, most of the world's private computers are going to be running one form or another of Windows for the foreseeable future, and unless and until Redmond sets things so that there's a built-in firewall up and running while the box is still isolated, MS boxen are going to get pw0ned, and Joe The Plumber won't know that there's anything wrong except that his computer isn't as fast as it used to be, but he's accustomed to that by now anyway, and won't realize that it's a problem.
The problem with spam isn't the less than 40 seconds it takes for the firewall to come up on a WinTel box.
It's the idiot behind the keyboard. Always has been, always will be.
Nobody seems to realize (or face the facts thereof) that spam became more and more profitable, as more and more (soccer moms, idiot dads, stupid kids with no idea about what they are clicking on, hell a slashdotter here stated he has missed the no and hit yes trying to get the box to go away) people where given access to computers and high speed connections.
Bottom line, the luser is the problem, not the machine, not the operating system (god knows, Linux doesn't have a single virii or worm or anything for it, does it),.... It's the ID10T's.
To look at it any other way is just fooling yourself and being a fanboi.
Bottom line, the luser is the problem, not the machine, not the operating system (god knows, Linux doesn't have a single virii or worm or anything for it, does it),.... It's the ID10T's.
As I said, there isn't any malware for Linux...yet. There will be, as soon as it becomes, as you point out, profitable. As far as your assertion about the delay in the firewall going up not being a factor, I disagree, but I won't argue the point because it's just my opinion and I don't have any facts to back it up. Howe
Well, an idiot running Linux isn't such a big threat as an equal idiot running Windows.
I've switched all my family's computers to Linux after I got tired of cleaning malware regularly. And that's beside they all know the basics of computer security. As no one in my family is a hardcore gamer nor a photoshop/AutoCAD user, the switch went pretty easy (they were using firefox anyway).
The situation *might* change, but for the time being I have much less hassle with Linux boxes they use. It's much more easier to
Even if it has a firewall, it's probably third-party software, and as such, doesn't start until after the network interface is up and running, leaving a huge (by computer standards) window of opportunity for the box to get pw0ned. And, of course, the same is true for any anti-virus running.
First, XP has a firewall built in. It's not likely to be "third-party software". Second, firewalls and virus scanners use the same Windows Filtering Platform to do their work. This platform installs boot-time filters that are in effect until the user-mode software is finally up, at which point there's an atomic hand-off. At no time is the system open to any sort of "window of opportunity" like you describe.
Even if it has a firewall, it's probably third-party software, and as such, doesn't start until after the network interface is up and running,
I imagine most people either use the firewall in their router or they use the default firewall that comes with Windows. How many people install 3rd party firewalls?
Like it or not, most of the world's private computers are going to be running one form or another of Windows for the foreseeable future, and unless and until Redmond sets things so that there's a built-in firewall up and running while the box is still isolated, MS boxen are going to get pw0ned
I had never heard of the problem with firewalls being disabled at boot, but I looked around and yes, it seems like it was a problem before XP Service Pack 2 that has since been fixed [cnrs-orleans.fr]:
SP2 turns on Windows Firewall by default and starts it earlier in the boot process. [...] In Windows XP Service Pack 2, the firewall driver has a static rule, call
When you arrest certain people, it doesn't remove the profitability of the activity, it doesn't remove the tools or knowledge used to perpetrate the activity, and it doesn't remove the infected computers already carrying out payloads. Maybe for a few who are deeply involved individuals with a lot to risk, they will reconsider what they're involved in, but there must be a large population who still consider it profitable and worth the risk.
While (mostly) joking, we should simply say that we're going to treat spammers as some of the most vile people in society and punish them accordingly. No 3-5 years in jail or a fine. You spam, you go to jail for life. If somehow you get out and do it (again), then second offense is a capital punishment. Either that, or treat them as 'terrorists' against the Interwebs, and allow police/military to shoot them on sight as combatants.
Yes, I am mostly joking, but we need to let these people know that having an
Maybe most of my spam originated on their bot net. My dSPAM fourteen day analysis shows my incoming spam rate has dropped to less than half the level of a week ago.
If anyone is surprised by this news, they need to think about what they think they know about spam.
Sure not many people like to see the unsolicited ads for herbal viagra and pirated copies of photoshop. But why do the spammers send them out in the first place? It isn't because they hate us, and it isn't just because they can send out billions of them at next-to-no cost to themselves.
They send them out because they make money doing it. Which means that someone, somewhere, is paying for spam as a service. Which means that even if 100 spammers were instantaneously taken offline and thrown into pound-me-in-the-ass prison, 100 new spammers would emerge to fill there places and likely send out even more spam.
If we want to stop spam, we need to remove the economic incentive. And throwing spammers in jail does not accomplish that. So naturally the spam epidemic was largely unchanged by these arrests.
It adds significant risk and potential complexity to their operating activities. As such, it reduces the economic incentive significantly.
The problem with that is that very few countries enforce anti-spam laws with criminal prosecution. The US could pass the most brutal anti-spam laws they want and it wouldn't make an impact because there would still be plenty of other countries that have no anti-spam laws at all.
If spamming were a capital offense in the US, but not a crime at all in another country, the spammers will just go to another country and setup shop there. The end result would just be less spam originating in the US. The net e
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses ( ) Mailing lists and other legitimate email uses would be affected (X) No one will be able to find the guy or collect the money ( ) It is defenseless against brute force attacks ( ) It will stop spam for two weeks and then we'll be stuck with it ( ) Users of email will not put up with it ( ) Microsoft will not put up with it ( ) The police will not put up with it (X) Requires too much cooperation from spammers ( ) Requires immediate total cooperation from everybody at once ( ) Many email users cannot afford to lose business or alienate potential employers ( ) Spammers don't care about invalid addresses in their lists (X) Anyone could anonymously destroy anyone else's life
Specifically, your plan fails to account for
(X) Laws expressly prohibiting it ( ) Lack of centrally controlling authority for email ( ) Open relays in foreign countries ( ) Ease of searching tiny alphanumeric address space of all email addresses (X) Asshats (X) Jurisdictional problems ( ) Unpopularity of weird new taxes ( ) Public reluctance to accept weird new forms of money ( ) Huge existing software investment in SMTP ( ) Susceptibility of protocols other than SMTP to attack ( ) Willingness of users to install OS patches received by email ( ) Armies of worm riddled broadband-connected Windows boxes ( ) Eternal arms race involved in all filtering approaches (X) Extreme profitability of spam ( ) Joe jobs and/or identity theft (X) Technically illiterate politicians ( ) Extreme stupidity on the part of people who do business with spammers (X) Dishonesty on the part of spammers themselves ( ) Bandwidth costs that are unaffected by client filtering ( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical ( ) Any scheme based on opt-out is unacceptable ( ) SMTP headers should not be the subject of legislation ( ) Blacklists suck ( ) Whitelists suck (X) We should be able to talk about Viagra without being murdered ( ) Countermeasures should not involve wire fraud or credit card fraud ( ) Countermeasures should not involve sabotage of public networks ( ) Countermeasures must work if phased in gradually ( ) Sending email should be free ( ) Why should we have to trust you and your servers? ( ) Incompatiblity with open source or open source licenses ( ) Feel-good measures do nothing to solve the problem ( ) Temporary/one-time email addresses are cumbersome ( ) I don't want the government reading my email (X) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(X) Sorry dude, but I don't think it would work. ( ) This is a stupid idea, and you're a stupid person for suggesting it. ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Might I suggest doing business with spammers a crime instead?
I'm thinking something more direct... an anonymous-looking execution of a hooded spammer won't get quite as much attention and effect as, say, the severed heads of spammers jammed onto a pike and set in front of a datacenter.
That, or we could show some mercy and at the same time have a living, breathing object lesson by castrating viagra spammers, etc...
"Make big time spamming a hanging offense. That will stop it fast."
Just make sure you get the executioners ragingly intoxicated before they do the deed. I would hate for a spammer, of all people, to be remembered as being particularly well hung.
The way draconian sentences have stopped drug dealing?
Something like that. You cannot legislate away trade in something that people want to buy and other people are willing to sell.
Email spam is profitable due to the economics of the situation, it used to be nearly free to send out spam, now with botnets it's much, much worse than that.
Consider it from another angle. How much electricity world wide is consumed by the generation of spam and the receipt and deletion of spam? What's the carbon footprint of all this mostly useless activity? Save the Planet! Stop Spamming Now!
Like every thing else that gets a death penalty, it'll only stop the same people from repeating the crime, once they're caught.
It won't stop new spammers from popping up before the first one's body is even cold.
> Would be nice to see something legally happen to them, as well. Seriously, if one pulls > a number out of their ass, no matter what side of the fence they are on, they should be > held accountable for lying at the least (publicly shunned on their "stats" in the > future), libel, to out and out fraud.
I wonder... (Score:5, Funny)
speculates that the operators of HerbalKing simply passed on to associates the keys to the automated, 35,000-strong botnet, and the spam flow didn't miss a beat
If they sent the keys to that botnet via email. If it got eaten up by the other ends spam filters, that would be irony indeed.
thats one possibility (Score:5, Interesting)
If they sent the keys to that botnet via email.
That is an interesting idea, but what would be the incentive for spammers to cooperate?
I suspect it is more likely that the systems in their botnet - of which many are compromised windows PCs - were re-compromised by someone else's worm and is now doing someone else's botnet work.
Parent
Re:thats one possibility (Score:4, Insightful)
If they sent the keys to that botnet via email.
That is an interesting idea, but what would be the incentive for spammers to cooperate?
A couple of bullets to the back of their head! Of course, they won't exactly cooperate after that, but the next spammer will.
Parent
Re:thats one possibility (Score:5, Interesting)
Either that or they had a queue of spam that needed to be sent and its still flushing it out.
Parent
Botnet is obviously now self-aware (Score:5, Funny)
"The article speculates that the operators of HerbalKing simply passed on to associates the keys to the automated, 35,000-strong botnet, and the spam flow didn't miss a beat."
Whatever. I've seen way too many scifi films to believe that. Obviously, skynet is now self-aware.
I for one... (etc.)
Re:Botnet is obviously now self-aware (Score:5, Funny)
If you're right, then the human race's biggest worry is not killer cyborgs. It's erectile dysfunction remedies...
Parent
Re: (Score:3, Funny)
Maybe it's both (Score:5, Funny)
Cum with me if you want to live
Buh-bye karma!
Parent
Re: (Score:2)
Re:Botnet is obviously now self-aware (Score:4, Funny)
Parent
Notice there are no more illegal drugs for sale (Score:3, Insightful)
Since they did that bust in that other endless, fruitless war.
Re:Notice there are no more illegal drugs for sale (Score:5, Insightful)
the war on terror?
Parent
Re:Notice there are no more illegal drugs for sale (Score:5, Insightful)
i don't think the government is spending half the money they spend on the War on Drugs on fighting spam. you can't even compare the two.
if we lived in a true democracy--one that gave citizens direct voice in public policy--replacing congress with regular national referendums for passing legislation, the spam problem would be solved in under a year.
everyone hates spam because it negatively affects our daily lives. few people profit from spam and at great societal costs. so if a referendum was held to divert tax funding away from the War on Some Drugs, the War on Iraq, the War on Terrorism, etc. and put these resources into combating spam, our prisons would no longer be filled with harmless drug users (and illegally detained arabs) and instead of filled with spammers, malware writers, and other real societal parasites. most people would probably vote to ban spam outright--that means companies that hire spammers & malware creators would be punished just as harshly. this would immediately cut off the financial incentive to spam. spammers don't send spam because they enjoy it; they do it for money. cut off the cash flow, and there'd be no reason to send spam.
the other solution is to change our culture of consumerism. spam is a direct result of unbridled capitalism. financial greed and selfishness have become virtues in our society. spammers are the embodiment of the "entrepreneurial" spirit. we're trained to seize any and all opportunity to make money. our society glamorizes the rich, marginalizes the poor, and our entire society and political system is skewed in favor of the wealthy. and it's this pro-business political culture that allowed spam and malware to grow into a such a prevalent institution. politicians were so used to putting business interests above public interest that spam was just an given.
but it'll take a long time to change our culture of capitalist greed & materialistic consumerism. our children need to be taught that personal integrity is more important than wealth, and to not equivocate money with happiness/success. most importantly, we need to value people based on their moral character and contribution to society, not their bank balance. instilling these positive values in kids will ensure that they don't grow up to be spammers. but that's hard in a society where money and socioeconomic status are everything. you can't even get a good education, decent health care, or justice if you don't have money. so this is an uphill battle.
Parent
Another theory... (Score:5, Insightful)
They anticipated they might someday be busted.
They could have designed the botnet with a dead man's switch... if they were busted, start feeding their partners' spam at double vigor, and have the bots create as much noise and general chaos as possible.
Re:Another theory... (Score:4, Insightful)
Why would it need any kind of switch? Why wouldn't it just keep on churning out the spam it has until given new stuff?
Parent
Re:Another theory... (Score:4, Interesting)
Why wouldn't it just keep on churning out the spam it has until given new stuff?
Because the life expectancy of a given spammed domain is on the order of several hours now, even with fast-flux DNS tactics, and professional spammers certainly understand that. There's no reason to expect that botnets are given a "spam this until otherwise instructed" order; instead, evidence points to very specific commands from botnet operators to mail each campaign for X site to Y addresses over Z period of time. There are screenshots out there of popular spam/bot controller interfaces. Besides, if the botnet operators have been busted, we have to presume that access to their C&C (and the ability to shut down the botnet) was part of a plea bargain.
I've mentioned this anecdotally to friends and coworkers over the past week, but apparently I'm not the only one to notice: after the bust, spam volume has remained steady. Claims that this group was responsible for a third of all spam appear to be sorely overrated.
Parent
Re:Another theory... (Score:4, Interesting)
"Hey, I got an idea, if we get caught lets make sure something happens that gives us an even longer prison sentence!"
Parent
Au Contraire (Score:4, Funny)
My inbox now seems to be filling up with lobster thermidor aux crevettes instead.
Spam is so unfairly maligned (Score:5, Funny)
Consider the economic benefits of spam! [today.com] MessageLabs reports that Egham, Surrey, on the suburban outskirts of London, is the town that receives the most spam in Britain.
"It's not like there's much else to do," says Boris Busybody, 77 (IQ), of Egham Hythe, idly whirling his four-foot penis around his head in a desultory fashion. "Expanding your manhood, growing your breasts, increasing your sperm ... the Lib Dem phone calls get a bit much. That's Doctor Busybody, by the way. My Ph.D arrived last week."
Spam has revitalised the local economy. Busybody has given up cab driving and is now working a lucrative job processing payments from home after he sent them his bank details in response to an urgent security message. "I had that King Otumfuo Opoku Ware II in the back of my cab once. Very generous and helpful fellow."
The Egham Tourist Board has seized the day, with plans for a 50 foot tall penis sculpture at Junction 13 of the M25 on the exit ramp to the town. The sculpture will be encircled by a genuine imitation Rolex and spray a fountain of Spermamax, obtained at a very reasonable rate from a Canadian pharmacy. "You will search an hour for your underwear in the ocean of our spam!" is to become the new town motto.
"I did get a good one the other day," says Busybody. "Barrister Matthew Sergeant Busybody of MessageLabs said we could promote our town to millions of people just by sending them an advance fee to process our incoming email. The stuff they try! â(TM)Scuse me, V!k@grk@ kicking in, got to go have sex again. Sorry."
It got worse for me (Score:3)
Exactly when the original story broke, I went from about two hundred spams a day to over a thousand, almost all of which were new topics, and it hasn't let up since. So the keys may have been passed on to several parties who are making more extensive use of the botnet than the HerbalKing group did.
I wonder how many it will take before Yahoo finally decides to start blacklisting spam hosts rather than sticking to the woefully inadequate filters.
No spam for 5 days. (Score:3, Interesting)
Re:No spam for 5 days. (Score:4, Funny)
None ? That's weird... What's your address again ?
Parent
Just because they caught the 'humans'... (Score:5, Insightful)
Doesn't mean that the 'machines' will stop doing what they have been 'told' to do.
FCOL, 99% of the spam is rejected because of bad addresses, rules, and so forth.
It's just possible that these bots will continue to spam until they are physically shutoff by their owners.
Re: (Score:3, Insightful)
> It's just possible that these bots will continue to spam until they are physically
> shutoff by their owners.
But the owners are in jail!
Oh. You mean the mules that think they own the machines.
Re: (Score:2)
I thought that they sent every spam by hand.....
Really, you obviously see what TFA seems to be blind to. It is absolutely stupid to assume that somehow arresting people will fix the problem of automated spamming. For all we know, the compromised machines have a 6 month queue of spam to send, in pre-purchased amounts. Set it up once, charge your slimy clients once, and then sit on y
This type of thing is only going to continue (Score:4, Insightful)
Now, personally I run Linux, so for right now, I don't have to worry. Of course, if Linux ever gets popular enough to put a real bite in Microsoft's monopoly that will change, but it's not vulnerable in the same way. Not only is it (more) secure by design, the firewall goes up before, not after the network interface, so there's no time that it's exposed to the network without protection.
Like it or not, most of the world's private computers are going to be running one form or another of Windows for the foreseeable future, and unless and until Redmond sets things so that there's a built-in firewall up and running while the box is still isolated, MS boxen are going to get pw0ned, and Joe The Plumber won't know that there's anything wrong except that his computer isn't as fast as it used to be, but he's accustomed to that by now anyway, and won't realize that it's a problem.
Re:This type of thing is only going to continue (Score:5, Insightful)
You're so wrong, and that's funny.
The problem with spam isn't the less than 40 seconds it takes for the firewall to come up on a WinTel box.
It's the idiot behind the keyboard. Always has been, always will be.
Nobody seems to realize (or face the facts thereof) that spam became more and more profitable, as more and more (soccer moms, idiot dads, stupid kids with no idea about what they are clicking on, hell a slashdotter here stated he has missed the no and hit yes trying to get the box to go away) people where given access to computers and high speed connections.
Bottom line, the luser is the problem, not the machine, not the operating system (god knows, Linux doesn't have a single virii or worm or anything for it, does it),.... It's the ID10T's.
To look at it any other way is just fooling yourself and being a fanboi.
--Toll_Free
Parent
Re: (Score:2)
As I said, there isn't any malware for Linux...yet. There will be, as soon as it becomes, as you point out, profitable. As far as your assertion about the delay in the firewall going up not being a factor, I disagree, but I won't argue the point because it's just my opinion and I don't have any facts to back it up. Howe
Re: (Score:3, Insightful)
Well, an idiot running Linux isn't such a big threat as an equal idiot running Windows.
I've switched all my family's computers to Linux after I got tired of cleaning malware regularly. And that's beside they all know the basics of computer security. As no one in my family is a hardcore gamer nor a photoshop/AutoCAD user, the switch went pretty easy (they were using firefox anyway).
The situation *might* change, but for the time being I have much less hassle with Linux boxes they use. It's much more easier to
Re:This type of thing is only going to continue (Score:5, Informative)
First, XP has a firewall built in. It's not likely to be "third-party software". Second, firewalls and virus scanners use the same Windows Filtering Platform to do their work. This platform installs boot-time filters that are in effect until the user-mode software is finally up, at which point there's an atomic hand-off. At no time is the system open to any sort of "window of opportunity" like you describe.
Parent
Re:This type of thing is only going to continue (Score:5, Funny)
Surely Joe the Plumber of all people should know how the tubes work?
Parent
Re: (Score:3, Informative)
Even if it has a firewall, it's probably third-party software, and as such, doesn't start until after the network interface is up and running,
I imagine most people either use the firewall in their router or they use the default firewall that comes with Windows. How many people install 3rd party firewalls?
Like it or not, most of the world's private computers are going to be running one form or another of Windows for the foreseeable future, and unless and until Redmond sets things so that there's a built-in firewall up and running while the box is still isolated, MS boxen are going to get pw0ned
I had never heard of the problem with firewalls being disabled at boot, but I looked around and yes, it seems like it was a problem before XP Service Pack 2 that has since been fixed [cnrs-orleans.fr]:
SP2 turns on Windows Firewall by default and starts it earlier in the boot process. [...] In Windows XP Service Pack 2, the firewall driver has a static rule, call
Spam is still profitable (Score:4, Interesting)
You can stop me (Score:2)
Life in Jail, or Capital punishment (Score:2)
Yes, I am mostly joking, but we need to let these people know that having an
Re:Life in Jail, or Capital punishment (Score:5, Funny)
Parent
Oh I thought... (Score:5, Funny)
Well, nobody else said it.... (Score:5, Insightful)
Dear F-Secure,
Please note the implications of this story, then promptly stick your request for Internetpol up your collective asses.
Thank you
The Internet
It's just a machine (Score:3, Funny)
It doesn't feel pity or remorse, and it will absolutely will not stop, ever...until our disks are full.
Marked reduction here (Score:4, Interesting)
Maybe most of my spam originated on their bot net. My dSPAM fourteen day analysis shows my incoming spam rate has dropped to less than half the level of a week ago.
Note, I'm not complaining.
Cheers,
Dave
Spam gang whack-a-mole (Score:5, Insightful)
Sure not many people like to see the unsolicited ads for herbal viagra and pirated copies of photoshop. But why do the spammers send them out in the first place? It isn't because they hate us, and it isn't just because they can send out billions of them at next-to-no cost to themselves.
They send them out because they make money doing it. Which means that someone, somewhere, is paying for spam as a service. Which means that even if 100 spammers were instantaneously taken offline and thrown into pound-me-in-the-ass prison, 100 new spammers would emerge to fill there places and likely send out even more spam.
If we want to stop spam, we need to remove the economic incentive. And throwing spammers in jail does not accomplish that. So naturally the spam epidemic was largely unchanged by these arrests.
Re: (Score:3, Informative)
It adds significant risk and potential complexity to their operating activities. As such, it reduces the economic incentive significantly.
The problem with that is that very few countries enforce anti-spam laws with criminal prosecution. The US could pass the most brutal anti-spam laws they want and it wouldn't make an impact because there would still be plenty of other countries that have no anti-spam laws at all.
If spamming were a capital offense in the US, but not a crime at all in another country, the spammers will just go to another country and setup shop there. The end result would just be less spam originating in the US. The net e
Re:Solution (Score:4, Funny)
Your post advocates a
( ) technical (X) legislative ( ) market-based (X) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(X) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(X) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(X) Anyone could anonymously destroy anyone else's life
Specifically, your plan fails to account for
(X) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
(X) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
(X) We should be able to talk about Viagra without being murdered
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(X) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Might I suggest doing business with spammers a crime instead?
Parent
Re:Solution (Score:4, Funny)
I'm thinking something more direct... an anonymous-looking execution of a hooded spammer won't get quite as much attention and effect as, say, the severed heads of spammers jammed onto a pike and set in front of a datacenter.
That, or we could show some mercy and at the same time have a living, breathing object lesson by castrating viagra spammers, etc...
Parent
Re:Solution (Score:5, Funny)
Just make sure you get the executioners ragingly intoxicated before they do the deed. I would hate for a spammer, of all people, to be remembered as being particularly well hung.
Parent
Re:Solution (Score:5, Insightful)
The way draconian sentences have stopped drug dealing?
Parent
Re:Solution (Score:5, Insightful)
The way draconian sentences have stopped drug dealing?
Something like that. You cannot legislate away trade in something that people want to buy and other people are willing to sell.
Email spam is profitable due to the economics of the situation, it used to be nearly free to send out spam, now with botnets it's much, much worse than that.
Consider it from another angle. How much electricity world wide is consumed by the generation of spam and the receipt and deletion of spam? What's the carbon footprint of all this mostly useless activity? Save the Planet! Stop Spamming Now!
Parent
Re: (Score:3, Insightful)
It won't stop new spammers from popping up before the first one's body is even cold.
Re: (Score:2, Insightful)
Scary, isn't it?
Your post dosen't scare me as much as it's insightful mod does.
Re: (Score:3, Interesting)
> Would be nice to see something legally happen to them, as well. Seriously, if one pulls
> a number out of their ass, no matter what side of the fence they are on, they should be
> held accountable for lying at the least (publicly shunned on their "stats" in the
> future), libel, to out and out fraud.
So sue them for the damage they did to you.