Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Spam

New Spam Zombies Use ISPs' Mailservers 383

Posted by samzenpus from the trust-this-mail dept.
RMX writes "CNet's reporting that the new spam zombie PCs are no longer acting as their own mailservers, but cooperate with the ISPs' recommendation that instead of running your own mail server, to use theirs instead."
This discussion has been archived. No new comments can be posted.

New Spam Zombies Use ISPs' Mailservers More

New Spam Zombies Use ISPs' Mailservers

Comments Filter:

  • Eh? (Score:3, Insightful)

    by Anonymous Coward on Wednesday February 02, 2005 @09:22PM (#11557631)
    Is this just doing what normal email clients do already? Why didn't they think of it earlier?

    • Re:Eh? Because... (Score:5, Insightful)

      by kd3bj ( 733314 ) on Wednesday February 02, 2005 @09:57PM (#11557921) Homepage
      Why didn't they think of it earlier?

      Because I suspect it doesn't work as well. It's pretty easy for an ISP to notice 100,000 emails from one sender pumping through their SMTP server, but relatively difficult to notice those mails when sent directly through the net. Also, outgoing servers are often set up with throttling.

      Of course, nowadays, ISP's have no excuse in either scenario. There are plenty of network monitoring tools that will notice spamming.

      • With a regular zombie, you really can't email the person controlling the machine (or the one who has it in his house).

        With an ISP's mail server, you can.

        And they should be more interested in shutting down the thousands of spam messages so that their regular mail can be sent.

  • violation of ISP contract? (Score:4, Funny)

    by Starbreeze ( 209787 ) on Wednesday February 02, 2005 @09:23PM (#11557640) Homepage
    Yeah, and then all those zombies lose their ISP accounts, and suddenly become much more aware of the need to secure their PC.
    • That can also happen to zombies that send spam without using the ISP's SMTP server. If they do use the ISP's sever that should make the ISP notice sooner though.

    • Re:violation of ISP contract? (Score:5, Insightful)

      by xtrvd ( 762313 ) on Wednesday February 02, 2005 @09:35PM (#11557756)
      Telus, my ISP in British Columbia (Canada) already takes a fairly agressive stance on this situation. In the past few years, they have realized that their clients are idiots and will open up any attachments they get in their email clients, even those great ones with .scr's from v1agra@sh0p0ur31337store.ch.

      In order to stop their networks from becoming ridden with viruses, they simply closed off the accounts of whom ever was infected. Sure people complained, but in the end, there were more people that were satisfied since their computer only needed to be infected with one virus for them to notice. Instead of having a computer with 20+ self-propagating viruses, the user only had one when they realized they needed it fixed.

      Joe User's seem to ignore popups and slow-downs of their computers as long as they can still connect to the internet and check their AOL email. As soon as they're disconnected, they will call up the ISP and find out how to get their computer fixed.

      If these ISP's can take the same stance against zombies becoming spam servers, it shouldn't be long until Joe User is forced to learn how to use a firewall to protect himself from being disconnected.

      As soon as we have ISP's that are *more* responsible for the content going through their networks, we'll have a better internet.

      • Re:violation of ISP contract? (Score:5, Insightful)

        by CrackerJack9 ( 819843 ) on Wednesday February 02, 2005 @09:41PM (#11557804) Journal
        That would be great, but for some of the same reasons Joe User isn't already securing his PC is because he doesn't know where to start, let alone how to finish.

        Let's say the ISP tells him to run ZoneAlarm (firewall for PCs), he will most likely end up just saying "Allow always" to any suspicious programs requesting internet access, or "Deny always" and he'll just have to call the ISP back to figure out why Windows can't open any TCP/IP connections....it's a great fix on paper, but I think there are a lot of other factors that need to be considered before you assume you can "just tell them to become computer security experts"

        • Re:violation of ISP contract? (Score:4, Interesting)

          by xtrvd ( 762313 ) on Wednesday February 02, 2005 @09:58PM (#11557927)
          I agree with you on making everybody a security expert. People simply don't have enough time to learn how to use a computer, especially if they just want to check their email on it. But if they cannot use their computer without it causing problems to the rest of us on the internet by being a Spam server, they need to take responsibility somehow.

          I'm going to go on a strech here. It's similar to driving a car (Please note, I said similar, not the same as). You recieve a license to use a car so that you can drive around in a controlled environment where other people reside: The public roadways. You can do what ever you want on your own environemtn (Own PC) just as you can spin doughnuts in your backyard if you really want to.

          You get your license to drive on the public roadways (Networks) and if you choose to not lock your car, then somebody else will steal it and hopefully the police will either take your car away (take your computer away) or they'll take your license away if you were the one actually doing the infraction. (ISP disconnects you from the internet)

          If you are caught doing something bad in a car on public roadways, you should be punished; if you choose to turn on that computer that is not secured in any way, shape, or form, you should not be allowed to take the use it. [Don't yell at me yet]. If you're not prepared to get into a car and harness its abilities, then you'll want to start with a car that's attached to a track, like those ones the 4 year olds use in amusement parks.
          You can consider those tracked cars like Mac's; because with all due respect, you can't become a zombie computer without at least trying.

          Until you learn to use a car, you'll never get a license to use it. Until you learn to use a computer, you shouldn't be on the internet.

          My two cents.
          Thanks for your insightful reply CrackerJack9.

          • Re:violation of ISP contract? (Score:5, Insightful)

            by ErikZ ( 55491 ) on Wednesday February 02, 2005 @10:04PM (#11557964)

            Yep. And the great thing about having a licence to use a computer is the immense power it gives the government over you.

            Piss off someone in power? Take away your licence.

            Mistakenly accused? Take away your licence until you clear things up.

            Go up against the latest policial hotbutton that no one takes seriously? To make it serious, they come up with a new punishment. Take away your licence!

            A licence to operate a computer is a horrible, horrible idea.

          • Re:violation of ISP contract? (Score:4, Interesting)

            by CrackerJack9 ( 819843 ) on Wednesday February 02, 2005 @10:22PM (#11558111) Journal
            While I agree with your post, can we both also agree that "stay between the lines" "obey speed limits" and the like are much more simplistic than some of those you would need to understand to be truly proficient at protecting your home network. I realize, "don't double click that attachment that says it will show boobies if i do" isn't too complicated, but it also takes place in a different realm than driving a car does. Perhaps we should blame culture, simply that computers are relatively new, or even that you don't need a license (to show at least some proficiency and basic rules to follow, like a drivers permit) that there are so many problems that can very easily be avoided. What I don't think is that by making (people who have car accidents or get speeding tickets) them install a program that is quite complicated, (even if considering only the conceptual complications) such as a firewall, will help solve the problem to a reasonable degree. By reasonably, I mean not snatching anyone's computer away simply because they did not run Windows Update hourly. Just like we don't get driving licenses revoked after a single accident or ticket. I'm all for Computer Usage 101 coming with any computer purchase or something in that sense, but ISPs forcing them to install things or improve security beyond their capacity to do so seems unreasonable to me (see parent post/my reply).

          • Re:violation of ISP contract? (Score:5, Interesting)

            by rawg ( 23000 ) <phill@ken[ ]r.com ['oye' in gap]> on Wednesday February 02, 2005 @10:52PM (#11558330) Homepage
            Yeah, the police should take your car away if you leave it unlocked. You must live in California.

            Personally I would rather see it this way; if your car is doing something bad, then it should be stopped and not allowed on the road until it's fixed. IE leaking oil on the road, lots of smoke coming out of it, or parts falling off.

            If your driving down the freeway with a 300 feet of linked banners attached to the back of your car, then you should be stopped. Even if you didn't attach those banners to it.

        • Re:violation of ISP contract? (Score:4, Informative)

          by jessecurry ( 820286 ) <jesse@jessecurry.net> on Wednesday February 02, 2005 @11:26PM (#11558564) Homepage Journal
          We do this on our campus networks. Basically we get pissed off people calling us and we provide them with a disk containing a virus scanner(McAffee in our case) and some antispyware tools(Ad-aware for now, although MS's adware offering is looking surprisingly promising ATM) and a page with instructions on how to install the software and run the scans.
          The pages even have lovely pictures so the users can't(read: shouldn't be able to once they have removed their heads from their asses) make a mistake.
          When the user think that they are clean we rescan their network traffic and if everything checks out we place them back on the standard network.
          Last year almost the entire campus fell victim to adware, spyware, and virii... this year only a handful. It seems to work. If they get re-infected they lose their internet access again.

      • OH NO!!!! (Score:2, Offtopic)

        by Jeremiah Cornelius ( 137 )
        It's The end of the INNERNETS!

        (I know there's been rumours on 'em)

      • Re:violation of ISP contract? (Score:4, Interesting)

        by Seumas ( 6865 ) on Wednesday February 02, 2005 @09:52PM (#11557884)
        What kind of crappy ISP delivers messages containing *.SCR, *.CPL, *.COM, *.PIF, *.BAT and so forth to their customers?!

        And yes, Joe User tends to ignore popups, because a lot of the "professionals" are idiots. We have a radio program in Portland on the weekends hosted by some "long time computer experts". Every time the topic of "how to prevent popups" comes up, the host insists that your web browser has NOTHING TO DO WITH IT. Popups are entirely a problem with your machine being infected and you need to install a good virus scanner to avoid them.

        People have called up and said "no, I think they're talking about web popups that you get when you visit a website without a popup blocker". Rather than suggesting people use Firefox or something, he actually says "If you're getting popups, it is because you've done something wrong and aren't protecting your PC". He refuses to acknowledge (and has for many months) that if you visit a website without some form of popup blocker, you'll often encounter popups BECAUSE THE WEBSITE IS SENDING THEM.

        I mean... it baffles me that people like this are being treated like expert professionals and they're misleading thousands of people in the process of pumping up their own misguided ego.
        • What kind of crappy ISP delivers messages containing *.SCR, *.CPL, *.COM, *.PIF, *.BAT and so forth to their customers?

          One that charges extra for AV and Spam protection :)

          The rest of us provide it free with ClamAV and SpamAssassin.
        • I mean... it baffles me that people like this are being treated like expert professionals and they're misleading thousands of people in the process of pumping up their own misguided ego.

          Who says he's really an expert at anything? For all I know the only thing he knows is how to keep people from securing their machines so that the popup ads on the sites he hosts can get through.

        • Re:violation of ISP contract? (Score:5, Interesting)

          by ThisIsFred ( 705426 ) on Wednesday February 02, 2005 @11:32PM (#11558604) Journal
          What kind of crappy ISP delivers messages containing *.SCR, *.CPL, *.COM, *.PIF, *.BAT and so forth to their customers?!

          Probably the kind of ISP that realizes it's a security issue related to Windows, and therefore one of the risks best dealt with by the end user. Editing users' e-mail based on a file extension is stupid anyway. That's probably the same kind of thinking that went on at Microsoft's OS development group when they implemented file-type detection; More specifically, that shallow thinking is what is directly responsible for the Windows vulnerabilities based on extension-only file-type detection and the shell's automatic file association helper.

          So why not stop there? Windows' shellexec helper also attempts to do something with .zip, .wav, .mid and .mp3 extensions. Would you like your ISP to discard those messages automatically? I send a lot of material between work and home in .zip format. I'd change ISPs if some dunderhead was stupid enough to filter my e-mail based on meaningless extensions.

          Jesus, why are we still having this discussion? It's real simple for Microsoft to fix: Make it so any file coming from someplace other than the local filesystems is downloaded to disk only. Or simply give IE and Outlook their own file helper registries, where the default is to just download the file without attempting to open it. People have been setting up their own helper applications in Netscape for years, and no one ever died of exhaustion from the extra work.

      • Re:violation of ISP contract? (Score:5, Interesting)

        by RollingThunder ( 88952 ) on Wednesday February 02, 2005 @09:57PM (#11557923)
        Heck, we had our Telus business ADSL shut down because somebody bounced through a wireless card on an XP laptop that the dumb**** marketing director had enabled the "provide access to the internet" or whatever it is via.

        Our office was only on the 4th floor, and his system was right at the window, so somebody popped through and started doing crap on the Zone servers. Telus cut us off within a day, and I was damned impressed.

        I was angry too - but not at Telus. At the marketing guy and myself (for leaving open outbound access). I fixed his system, and instituted "via proxy only" outbound for port 80, and no more problems.

      • Re:violation of ISP contract? (Score:5, Interesting)

        by schon ( 31600 ) on Wednesday February 02, 2005 @10:46PM (#11558291)
        Telus's attempts at spam control remind me of the keystone cops. They hinder people who know what they're doing, and do *nothing* to stop spam.

        Telus has had its netblocks (including the ones their mailservers are on) blacklisted many, many times - and their respons has been to simply ask for removal, without actually fixing the problem. When their mail servers got blacklisted by Spamcop, their response went something like "well, we're a large ISP, so you should remove the block."

        here [google.ca] is an example of Telus stupidity in action. I've received the *exact same* response from them

        They don't give out static IP addresses (even though they claim they do), instead forcing their customers to use DHCP for their mailservers (yes - even when the customers *PAY* for a static IP address) - and when the addresses change, the customers frequently find themselves in various blacklists.

        If you think that Telus is responsible, you should do a google groups search for them in news.admin.net-abuse.email
      • it would be interesting if, instead of simply cutting off their access, they switched them over to a non-routeable subnet (via a short dhcp lease time) and direct all HTTP traffic to a single server which would then alert them to the problem (with bold blinking red on black text or something equally as noxious) and provide them with a list of links to various tools to disinfect them, based on what's a common problem at the time being. all stored on this private subnet, of course.

        They could even go a step f

      • even those great ones with .scr's from v1agra@sh0p0ur31337store.ch.

        Why does everyone pick on Switzerland as being the source of spam? I would have thought .cn (China) would be more appropriate...

  • Simple solution (Score:4, Interesting)

    by MarkRose ( 820682 ) on Wednesday February 02, 2005 @09:24PM (#11557648) Homepage
    There's a very simple solution that many webhosting companies already use -- the ISP should force their users to authenticate with the server, using secure SSL. It's good practice any way, and doing so would make even more work for the spam bots (they would have to find the user's login and password for the SMTP server).

    • Re:Simple solution (Score:5, Insightful)

      by kerrle ( 810808 ) on Wednesday February 02, 2005 @09:26PM (#11557676) Journal
      Or the bots could ignore that, and just send out with the default mail settings - most users would have OE set to remember password, so no real gain there.

      • Re:Simple solution (Score:2, Insightful)

        by MarkRose ( 820682 )
        However, using authentication, ISP's can easily block users who begin to send out too many emails (most likely spam), forcing them to deal with the problem (or get the ISP to allow them to send large volumes), or at least stopping the spread of spam.

    • Re:Simple solution (Score:3, Insightful)

      by SpottedKuh ( 855161 )
      [T]he ISP should force their users to authenticate with the server, using secure SSL.

      It's a shame that people are so attached to their horrid Microsoft Outlook email client. Otherwise, two problems could be solved in one fell swoop: Have users SSH into the ISP email server, and use a simple client like Pine to send and receive their email.

      First, this setup would enforce strong user authentication, as the parent wisely suggested. Secondly, it would eliminate that whole host of attacks against bad ema

      • Re:Simple solution (Score:3, Insightful)

        by caino59 ( 313096 )
        oh yea...pine - my mom will be all over that one!

        remember, you have to keep these dumbed down for the masses.

      • Re:Simple solution (Score:4, Informative)

        by Osty ( 16825 ) on Wednesday February 02, 2005 @10:00PM (#11557934)
        It's a shame that people are so attached to their horrid Microsoft Outlook email client. Otherwise, two problems could be solved in one fell swoop: Have users SSH into the ISP email server, and use a simple client like Pine to send and receive their email.
        First, this setup would enforce strong user authentication, as the parent wisely suggested. Secondly, it would eliminate that whole host of attacks against bad email clients (eg. Outlook) that the average computer user inexplicably blames on their ISP.

        I'm going to assume you mean "Outlook Express" when you say "Outlook", otherwise your argument has no merit. Even then, Outlook Express isn't as bad as you make it out to be. For example, both Outlook and OE support SMTP-AUTH, via SSL or not (as well as both POP3 and IMAP-v4 over SSL). That addresses your first problem, which at this point is an ISP issue rather than an MTA issue. Your second point is really only valid for OE, and then only if you've never bothered to use Windows Update (in which case you're asking for other problems anyway). Outlook has blocked bad attachments since a service pack for Outlook 2000 (there have been two versions of Outlook since then, XP/2002 and 2003). Outlook 2003 (which is the only version I have installed right now, so I can only speak to other versions on memory) will also block malicious content in the body of the message itself (scripts, images linked to external sites, etc). If you're still getting infected by email viruses while using Outlook, you're either running a ridiculously old version, or you're explicitly overriding Outlook's protection mechanisms.

        Moving everybody back to pine (or better, mutt, but that's my own personal preference) via ssh is not an acceptable solution. Forcing everybody through a webmail interface is only slightly better, but even that is not very desirable (see the new Outlook Live [msn.com] service from Microsoft that lets you read your hotmail email via Outlook rather than the web page, or RPC over HTTP [microsoft.com] in Exchange 2003 that lets you access corporate email without a VPN rather than using OWA).

      • Re:Simple solution (Score:5, Funny)

        by mcc ( 14761 ) <amcclure@purdue.edu> on Wednesday February 02, 2005 @10:07PM (#11557989) Homepage
        Otherwise, two problems could be solved in one fell swoop: ... use Pine

        But then they would have a third problem.

    • Re:Simple solution (Score:3, Insightful)

      by danielcole ( 811536 )
      The simple problem of 'Remember my user id and password' negates your simple solution.

    • Re:Simple solution (Score:2, Interesting)

      by Seumas ( 6865 )
      Are you saying that major ISPs don't require authentication to relay mail?! I have Comcast, but I've never used their servers (I run my own externally). What do they do then, just base whether or not to relay based on whether or not you're in their IP blocks?

      That's ludicrous. POP-BEFORE-SMTP or SMTP AUTH are extremely simple to setup without any additional complexity on the user's end. If the ISPs are not protecting their mailservers, then I would suggest this is THEIR problem - not the end-user.

  • Why aren't they using SMTP-AUTH? (Score:4, Informative)

    by PornMaster ( 749461 ) on Wednesday February 02, 2005 @09:24PM (#11557651) Homepage
    I really don't understand why they don't just use SMTP-AUTH. This shouldn't be something that's such a huge deal... and certainly shouldn't come anywhere near what this guy said in the article...

    "The e-mail infrastructure is beginning to fail," Linford warned. "You'll see huge delays in e-mail and servers collapsing. It's the beginning of the e-mail meltdown."

    • Re:Why aren't they using SMTP-AUTH? (Score:4, Insightful)

      by LostCluster ( 625375 ) * on Wednesday February 02, 2005 @09:26PM (#11557668)
      I don't see how that solves this problem. If the mailware can read the configurations of the host's e-mail program, it can immitate any authorization you throw at it...

      • Re:Why aren't they using SMTP-AUTH? (Score:5, Informative)

        by PornMaster ( 749461 ) on Wednesday February 02, 2005 @09:31PM (#11557716) Homepage
        Not only does it authenticate the user, it also provides a way to revoke authorization on a per-user basis in a way that still allows the user to receive a mail explaining why they're unable to send mail -- simply shutting off the user's internet access doesn't do this, and putting in ACLs to block only port 25 from their IP probably isn't practical on many ISPs' infrastructures.
      • Of course, if the user doesn't let their mail client "remember" their password (I never trust mail clients to remember anything for me), then the virus would indeed be unable to complete it's evil plan.

        They'd need to take the time to write a more sophisticated version of the trojan that first does some keystroke logging to steal your AUTH password, -then- sends spam with it.

        Once a virus allows "a remote attacker to gain complete control of your computer", there's really nothing that you could do that they

  • MMMMmmmm (Score:2, Funny)

    by Azeroth48 ( 855550 )
    MMMMmmmmm Brai.... Opps MMMMmmmmm Spam

  • Many ISP mail servers get blacklisted now? (Score:5, Interesting)

    by enosys ( 705759 ) on Wednesday February 02, 2005 @09:25PM (#11557662) Homepage
    Will many ISP SMTP servers get automatically blacklisted because of this?
    • I work for a ISP and our mailservers do get blacklisted by AOL sometimes. Some of our customers complained and that is how we found out.

      The ISP I work for mandates the use of their mailserver for outgoing e-mails and limits the number of mails that can be sent in a certain timeframe.
    • Will many ISP SMTP servers get automatically blacklisted because of this?

      You may be joking, but this is alrady happening. I can't send mail to AOL or Netscape.com becasue they claim my ISP sends too much spam, and provide no method of redress or whitelisting. Another local ISP keeps throttling my messages (not rejecting outright, but delaying) because of "too many connections from your server". In both case a combinationm of stupidity and arrogance, triggered perhaps by spambots like these, is preventing

    • This is a good thing (IMHO, IANA-SysAdmin). If an ISP gets their mailserver blacklisted because their customers computers are full of crap, it encourages ISP's to take more responsibility for the traffic that's flowing through their network.

      Actually, that's a really bad thing, but 90% of people are stupid, and 90% of windows installs (IMHO) are crap so it's not always the end user's fault. Maybe it's this OSX-like influence seeping in to me, but if all you want to do is check email and browse the web, yo

  • SMTP Authentication (Score:2, Redundant)

    by GrAfFiT ( 802657 )
    Now just force SMTP Authentication on the ISP side. They didn't implement it just for fun. Everybody put his login/password in the pop3/imap textboxes, just put your login/password in the smtp textboxes. Won't kill anyone.
    Problem instantly resolved.
    • Now just force SMTP Authentication on the ISP side. They didn't implement it just for fun. Everybody put his login/password in the pop3/imap textboxes, just put your login/password in the smtp textboxes. Won't kill anyone.

      Also won't do much good. This is a young thread, and I've already seen several suggestions like this.

      See, Outlook (Express) keeps that login information handy so that it can send a message without buggering you for said login information.

      What's to say that the virus/worm won't use a C

  • Unnamed processes (Score:3, Insightful)

    by Dancin_Santa ( 265275 ) <DancinSanta@gmail.com> on Wednesday February 02, 2005 @09:25PM (#11557664) Journal
    I was reading about the "American GI (Joe) captured in Iraq" yesterday and the same thought crossed my mind today.

    If you are going to tell everyone that spam zombies (or terrorist websites) are out there, why don't you give details like processname (or website URL)?

    It does no one any good if you just say, "Hey, there's a chance your computer may be infected and is a zombie spammer," if you don't also tell us the zombie process name.
    • Um... there's a -lot- of possible names they might be using, and more than one vector that can result in zombification.

      Consult your preferred anti-virus vendor's online database for more detailed information.

    • Re:Unnamed processes (Score:5, Insightful)

      by rusty0101 ( 565565 ) on Wednesday February 02, 2005 @09:44PM (#11557828) Homepage Journal
      That presumes that the process name will be pre-defined. We already have viruses that generate a new name for their executable, or library, and use that name to modify the workstation or server's database to automatically launch it each time the computer is rebooted. If this virus also is generating spam, it will be run with the process name of the executable or library, and at best you will see a process name that you don't recognize. Considering the fact that a significant percentage of the population of computer users do not even know how to bring up the task list, much less know what each process that normally runs is, is named, or does, telling them to kill off any process that looks like 'libraryname0.dll' is not going to be particularly helpful.

      Your best bet is to find a personal firewall that asks you if application x is allowed to generate network traffic. Hopefully the firewall will tell you more, such as the type of traffic the application is attempting to generate, but even that can be more information than a general user is prepared to try to asses.

      If your firewall tells you that 'tobmaps.exe' is trying to send e-mail to your isp's mail server, you might tell it no, don't allow that sort of traffic. If it tells you that 'tobmaps.exe' is attempting to connect to login.yahoo.com via http, you might inadvertantly allow it, even though login.yahoo.com is the first step towards sending e-mail through Yahoo.

      In most cases however you can probably tell your personall firewall to block all traffic to any IRC network, unless you speicifically approve the app, and know what you are doing. Of course over time spambots are going to move on from IRC channels to Instant Messaging services, to various p2p applications, if they haven't already.

      Saying 'kill off any process named xyz-abc.exe' is all well and good, but is probably going to be a one shot solution to a small subset of the people infected with a spambot.

      -Rusty

  • This is why some isp's.. (Score:3, Informative)

    by lordsilence ( 682367 ) * on Wednesday February 02, 2005 @09:26PM (#11557667) Homepage
    throttle the amount of e-mails a customer can send per time-period.. and the max amount of "BCC, CC" addressess.

    It's just a hell and takes lots of time to go through contacting abuse-department of ISP's like AOL and Verizon who decide to block for very few spam-reports. Even though the damage of spambot-infested computers on your own network is limited.

    • Re:This is why some isp's.. (Score:4, Informative)

      by fimbulvetr ( 598306 ) on Wednesday February 02, 2005 @10:28PM (#11558167)
      Yeah unless the customer is large.
      I tried this. I limited outbound emails to 1000 addresses at a time thinking that was very reasonable. Within a week there was a complaint from one of major companies that they couldn't send to all of thier remote offices. Sure enough, not only did they have more than 1000, they had 13,000.
      I realize this isn't an everyday occurance, but this situation should show that using a limit fix is not a good solution.
      Even doing a max-per-hour won't work. There are times when outbound email from a company can increase exponentially for legit reasons.

  • This is easier to solve (Score:5, Insightful)

    by digitalgimpus ( 468277 ) on Wednesday February 02, 2005 @09:26PM (#11557670) Homepage
    Unlike when they did it on the clients, this puts it through a limited number of gates.

    ISP's will likely start limiting outbound email to x email/hr. Companies and ISP's will likely start monitoring and kill quicker.

    This will benefit spammers for a very short period, then bite them in the ass.

    ISP's and companies aren't going to tolerate a spike in CPU usage, and possible blacklisting if they can take care of it. They will start blocking IP's from sending mail, etc. etc.
  • What ISP isn't going to notice thousands if not millions of rapid-fire connections to its SMTP server?

    • There are a lot of second and third tier ISPs that won't notice or won't care to do anything about it. Worm and virus writers will just have to aim their target systems a bit more carefully.

      You can already see this happening in the way that spammers use Usenet news servers. The big players watch their queues closely and quickly boot spammers. Other Usenet server companies give lip service to controlling spam by just cancelling (or claiming to cancel) accounts. The next day the same people are in oper

  • I think that they had the right idea. The only way to stop these b@$t@rds is to hit them in the wallet. If they were physically nearby, there's somewhere else I'd like to hit them, but if you make spamming unprofitable through bandwidth usage, that'll change the whole dynamic.

    I know two wrongs don't make a right, but--grrrrrrr--I HAT how these spammers work.

  • You gotta love a Zombie that plays by the rules...

    It'll be interesting to see how this effects ISP's Service Agreements:

    "The customer, nor any device connected to the customer's network will not for any reason, send emails regarding 'P3n15 Enl4rgm3n7!!!', etc.. etc.."

    Buuhahaha...

  • can we expand the war on terra to include spammers (Score:5, Funny)

    by trolluscressida ( 564353 ) on Wednesday February 02, 2005 @09:33PM (#11557738)
    I would love to see a Special Ops unit bust down the walls of a spammer's house, beat him, gag him, beat him again, send him to Guantanomo Bay for eternity, and than C-4 the spam servers.

    Everyone should write their congressmen [house.gov] requesting this.

  • Email Meltdown my ass (Score:5, Funny)

    by mg2 ( 823681 ) on Wednesday February 02, 2005 @09:34PM (#11557746)
    If we just switched to a secure email system (SSL/TLS, or whatever), a lot of these dumb problems would go away.

    Yes, I know some mail clients don't support this functionality, but come on. Name one of the modern clients that won't do it. Thunderbird, Mail.app, Eudora, Outlook ... they all know how.

    I suppose then you just have to convince users. This, though, should be the easiest part:

    Dear User,
    This email is to notify you that your neighbor has been recieving your monthly e-bank statements and password confirmation emails because you are stubborn and insist on using insecure email protocols.

    Incidentally, we'd like to thank you for your subscription to DAILY LESBIAN ACTION MAIL!!!1

    • I would really like my ISP (both of them) to use SSL/TLS for email.

      Unfortunately, neither of them do. Shoot, one ISP doesn't even protect its web mail client via https. Needless to say I don't send or receive ANY important mail using that ISP.

      What's even more irritating about this ISP is that your account information is protected by the same username/password as your default mail account. Who knows what fun could be had with this information.

      I've talked to tier two support about this issue seve

  • Frankly, I haven't used my ISP's email regularly since 1999 or so. Instead, I've used yahoo (which already has problesm with people spamming from @yahoo.com and deals with it).

    Instead of bringing about some sort of "email meltdown" won't this simply push email into being a web-based service instead of an isp-provided service?

  • Great (Score:3, Funny)

    by bahamat ( 187909 ) on Wednesday February 02, 2005 @09:39PM (#11557782) Homepage
    Since they're cooperating so wonderfully, has anybody thought to ask them to stop sending spam?
  • Force users to install one of these insane Captcha thingies [rr.com] as plugin to their Outlook Express client. That would work for sure. By the way it would prevent your 6 year old son from sending stupid emails to your coworkers. Or maybe not. Yeah, they should force you to physically come to the ISP headquarters with your .eml on a floppy disk.
  • This might be a little OT, but I've been thinking about this, and I'm not sure if there is something like it...Think a global repository (Thunderbird style) of spam, which your e-mail client feeds off of. You mark something as junk, and it uploads that addition to the DB that everyone else feeds off of in realtime. Wouldn't this work? Wouldn't it virtually eliminate spam (or at least cut it back DRASTICALLY)..? You could even go a step further to allow SMTP servers to access the list as well, and nuke spam

  • Death of the net predicted - pictures at 11. (Score:3, Funny)

    by Michael Woodhams ( 112247 ) on Wednesday February 02, 2005 @09:41PM (#11557799) Journal
    "The e-mail infrastructure is beginning to fail," Linford warned. "You'll see huge delays in e-mail and servers collapsing. It's the beginning of the e-mail meltdown."

  • We're winning (Score:5, Insightful)

    by SiliconEntity ( 448450 ) * on Wednesday February 02, 2005 @09:41PM (#11557802)
    This is the best sign yet that we're winning the war on spam. This is exactly what measures like SPF were designed to induce - forcing zombies to go through the ISP rather than sending mail themselves.

    Now all the ISPs have to do is to filter and detect sudden jumps in email traffic. It will be easy for them to detect systems which have been infected. This will catch the small number of users who suddenly start running high volume email lists from their home systems, but those cases will be few enough that they can be dealt with manually.

    This is the beginning of the end for the zombie spam problem!

    • Re:We're winning (Score:4, Informative)

      by MikeBabcock ( 65886 ) <mtb-slashdot@mikebabcock.ca> on Wednesday February 02, 2005 @10:15PM (#11558050) Homepage Journal
      This is a loss. The ISP *can't* detect this without huge amounts of effort *and* the probability of pissing off lots of customers.

      PS, blocking port 25 for customers is just plain dumb -- I have a lot of customers that go on the road and don't want to reconfigure their laptop to use the local dial-up access SMTP server for two hours, then do again in the next city.

      They just leave the SMTP set to us, and we have secure logins. Voila. Oh, but we can't use port 25 because a lot of ISPs block it.

    • Re:We're winning (Score:3, Insightful)

      by Malc ( 1751 )
      I doubt this has much to do with SPF. It's not like SPF is even implemented widely enough to make a difference, yet. I would guess that this is more to do with major ISPs blocking outgoing port 25 and forcing their user to go through the ISPs rely/smarthost. I predicted this would eventually happen a few years ago when ISPs started taking these measures. The good thing about this though is that there is a bottleneck that is easy for the ISPs to monitor and control.
  • For me, the amount of spam I receive has gone down steadily for the past year, on all my email accounts, as ISPs and other email providers have improved their filtering capabilities.

    Looking at my spam folder, I get between five and eight spam mail per day delivered, most of which I never saw since I also filter locally with spamassassin (this does not count those tagged as spam by my ISPs). A year ago, the number would have been ten to twenty times higher.

    If anything, I get the distinct impression that if
    • I've managed to cut incoming spam to two ISP MTAs by about 75% by moving SpamAssassin to the SMTP level, anything over a 10.0 is refused at the door.

      RBLs already stop a large percentage before it even reaches the SpamAssassin check, so even if the spammer switch to using ISP MTAs when they can the SpamAssassin bit will likely still result in refusal.

      It is pissing off the spammers .. to get past the RBLs only to be stopped by SA means they have to make their junk more and more legit looking and that is tou
    • As an ISP, I can tell you that for the last two years we put all of our R&D money into fighting spam. For us, that's about $100/yr per customer. That's a lot of money pissed away, and it's damn near bankrupting us.

      But more significantly, it represents a massive opportunity cost. There are all sorts of cool things we could have created for our users that we haven't been able to get to because we were tied up with weekly SpamAssasin upgrades. Spam is short circuiting the work of a lot of the most brill

  • Most ISPs have limits (Score:3, Interesting)

    by appleprophet ( 233330 ) on Wednesday February 02, 2005 @09:47PM (#11557854) Homepage
    First of all, most ISPs require you to authetenticate in some way. Either they require a login/password or more often, they wait until you check your POP3 email and give you a 30 minute window to send email without authentication.

    Secondly, ISPs often have a limit to how fast you can send mail or how many per day you can send.

    I don't really see this as a problem.
    • First of all, most ISPs require you to authetenticate in some way.

      In my experience, most ISPs only require you to be on their network in order to use their SMTP server. No authentication required.
  • Major ISPs are trying to be the only mail servers out there. The problem is that there will always be a way to attack these. Instead, of trying to remove adsl/cable residential systems from the net, they should be rate-limited. It is far easier to detect a system that is doing nothing but noise, then it is to try and seperate the noise from a system that also has high signal. Once a system is picked out as generating noise (spam), then others can seperate it out.
  • This really is old news. I'm a sysadmin for an ISP, and we saw such viruses and infected zombies doing this early last year when we blocked port 25 to residential customers to everything but out own mail servers. About a month later, we started seeing huge increases on traffic coming from our customers, most or all of them being infected zombie boxes.

    The bad thing is that it can get your mail servers on some blacklists instead of just some dynamic IP ranges, the good news is that it's fairly easy to spot s

  • BREAKING NEWS!! (Score:3, Informative)

    by jmcmunn ( 307798 ) on Wednesday February 02, 2005 @10:28PM (#11558165)

    Spammers are using Microsoft's Hotmail servers as Spam servers, and sending out hundreds (of millions) of emails each day to unwilling recipients.

    Come on, this is hardly news worthy on the front page of Slashdot...this kind of thing has been going on in one way or another for a long time.

  • SBC Global / Yahoo has been doing this for 3 weeks (Score:3, Informative)

    by Mustang Matt ( 133426 ) on Wednesday February 02, 2005 @10:45PM (#11558284)
    We host email for a lot of small domains. Many of our customers are using SBC Global for their DSL.

    We had everyone doing authenticated SMTP through our server for outbound but SBC shut that down and forces them to do authenticated SMTP through their servers now.

    I have absolutely no problems with this except two small issues...

    1. They didn't let anybody know. (To my knowledge) There was no press release on the home page or any instructions emailed out to inform customers how to update their mail settings. Since of course they only officially support their email addresses any non-technical customers that called in to SBC royally messed up receiving mail from our servers.

    2. There is no non-customer technical support period. You can't make your way through their automated system and they have no way to contact any body on an ISP to ISP level that I could find.

    I even contacted some marketing person at their HQ that I managed to find contact info for and explained the situation. They even tried to contact support and couldn't figure out how to do it. Very sad. Glad it wasn't an emergency.

  • Law is the answer and the answer is law! (Score:5, Informative)

    by D4C5CE ( 578304 ) on Wednesday February 02, 2005 @11:50PM (#11558723)
    Right below "TFA", there's a link to Yet Another Interesting Article [com.com].

    Just take a look at the statistics:

    Europe has only had strict laws against junk communications for two years (Article 13 of Directive 2002/58/EC) [eu.int], they have only been in full force since November 2003 (and the provisions for criminal penalties are not even in place in each and every corner of the European Union yet) - but they mean pure and simple opt-in, and look how this continent's "spam output" already has become almost completely insignificant.

    The U.S., I'm afraid to say, have put next to nothing in the way of these sociopaths: only a now-you-CAN-SPAM-more-than-ever Act that lives up to its name in the worst of ways, by legalizing most of the spam [slashdot.org], enacting an unworkable opt-out onus on the users, and putting anti-spam warriors at the legal risk of interfering with (and being taken to court by the operators of) what is considered a legitimate "business model" except for some of the worst abuses - and for however little it is, all of this even an entire decade too late.

    Reliance on technical solutions and minimal government intervention is just fine for many things - but it's failed in the fight against spam.

    Here is how to do it:

    Where the rights of the users and subscribers are not respected, national legislation should provide for judicial remedies. Penalties should be imposed on any person, whether governed by private or public law, who fails to comply with the national measures taken under this Directive.
    (...)
    "electronic mail" means any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient.
    (...)
    The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may only be allowed in respect of subscribers who have given their prior consent.
    (...)
    In any event, the practice of sending electronic mail for purposes of direct marketing disguising or concealing the identity of the sender on whose behalf the communication is made, or without a valid address to which the recipient may send a request that such communications cease, shall be prohibited.
    That's certainly nowhere near rocket science, and if the above looks a bit complicated, that's probably just because
    • a directive is a (binding) template for lawmakers in all of the European Union's member states
    • necessarily, the legal techniques as well as the "Legalese" itself vary between jurisdictions
    • this is a great one-ban-fits-all provision that outlaws each and every flavor of spam at once
    "First Amendment" implications: zero (and yes, of course there is freedom of speech in this part of the world as well, and even more of that speech could be heard if it wasn't drowned out by American spam - some of which comes relayed thru Asia of course) - it only bars some people from "pissing in everyone else's pool", but certainly not from speaking their mind!

    There is nothing wrong with following an example that works so well, even if it is from Europe...

    Call your congresscritter now to outlaw unsolicited commercial communications, place a hefty fine and jail time on the offenders, and put an end to these abuses before they put an end to eMail itself.

Slashdot Top Deals

The use of money is all the advantage there is to having money. -- B. Franklin

Close