Fighting "Snowshoe" Spam 85
Today Spamhaus announced they are releasing a new list of IP addresses from which they've been receiving "snowshoe" spam — unsolicited email distributed across many IPs and domains in order to avoid triggering volume-based filters. "This spam is sent from many small IP ranges on many Internet Service Providers (ISPs), using many different domains, and the IPs and domains change rapidly, making it difficult for people and places to detect and block this spam. Most importantly, while each host/IP usually sends a modest volume of bulk email, collectively these anonymous IP ranges send a great deal of spam, and the quantities of this type of spam have been increasing rapidly over the past few months." A post at the Enemies List anti-spam blog wonders at the impact this will have on email service providers and their customers. The author references a conversation he had with an employee from one of these providers: "... I replied that I expected it to mean the more legitimate clients of the sneakier gray- and black-hat spammers would migrate to more legitimate ESPs — suggesting that it was, in the long run, a good thing, because ESPs with transparency and a reputation to protect will educate their new clients. His reply was essentially that this would be a problem for them in the short run, because it would swamp their new customer vetting processes and so on."
Snowshoe? (Score:2, Insightful)
Whoever keeps naming things with these slightly-plausible analogies, please stop.
Re:Snowshoe? (Score:4, Insightful)
Blame Evolution. A virus that messes too much with the host PC has a low survival rate. The most successful viruses don't do too much damage, as that keeps them a low priority with AV software, and don't cripple the infection vectors, as that helps them spread, and aren't too OS specific, as that allows them to tolerate service packs and software upgrades.
Re: (Score:2)
A virus that messes too much with the host PC has a low survival rate.
You're making me want to read The Andromeda Strain again. (Read the book, the movie is meh!)
Re: (Score:2)
A virus that messes too much with the host PC has a low survival rate.
You're making me want to read The Andromeda Strain again. (Read the book, the movie is meh!)
The other night at my wife's mothers place there was this crummy telemovie on. I nearly had a fit. It was a remake of The Andromeda Strain. You know, that original movie isn't so bad....
(this line left intentionally blank).
Re: (Score:2)
The other night at my wife's mothers place there was this crummy telemovie on. I nearly had a fit. It was a remake of The Andromeda Strain. You know, that original movie isn't so bad....
(this line left intentionally blank).
Yeah--I should have clarified. The book is awesome. The old 1970ish movie is great, the current movie was remade so the entire point was environmentalist garbage.
If I want to get preached at, I'll go to church--not a movie theater.
Re:Snowshoe? (Score:5, Funny)
Evolution?
More likely Outlook and the colander-like OS it runs on.
Re: (Score:2)
So viruses are evolutionary winning against most of humanity. It was clear to me, that some day we would create life that would take over the world, but that it would happen this way...
Re: (Score:2)
Blame Evolution.
You mean Intelligent Design!
</joke>
Re: (Score:1)
Re:Snowshoe? (Score:4, Funny)
unsolicited email distributed across many IPs and domains in order to avoid triggering volume-based filters.
Snowshoe: spam not ordinarily wanted sent hourly occupying email
Re: (Score:3, Informative)
> in order to avoid triggering volume-based filters.
I hereby propose we just call it "spam" and have done.
I mean, seriously, is anybody really still worried about the old-fashioned kind of spam that was sent back in the early nineties, going out from one mail server with one IP for months on end, using an actual valid return email address from an actual valid domain owned by the senders? Have you *received* any of that lately?
I haven't. Near
Re: (Score:1)
Do you prefer yellow-snow spam? :)
Re: (Score:3, Insightful)
I represent that! (Score:5, Informative)
As a Canadian I figured I'd better look that up.
http://www.spamhaus.org/faq/answers.lasso?section=Glossary#233 [spamhaus.org]
Re: (Score:1, Insightful)
This isn't going to be popular, but its true...
The thing is, what exactly is a 'legitimate mailer'? Defined by US law, its somebody who honors the provisions of CAN SPAM. As the US Appeals court so eloquently stated, "As should be apparent here, âthe lawâ(TM) that Gordon purportedly enforces relates more to his subjective view of what the law ought to be, and differs substantially from the law itself.". You seem to be losing sight of the fact that you are not law enforcement officers. You are
Greylisting! (Score:4, Insightful)
Okay okay! I heard you all the last time I brought it up. But the results are simply awesome. And greylisting is perfect against these snowshoe distribution methods. The downside might be the database filling up.
Re: (Score:2, Interesting)
Greylisting just doesn't work in a business environment. When an e-mail is rejected with a "please try again later" response, it makes the recipient's company look bad at an organizational level. What's worse, senders may ignore these "try again" messages, or never see them at all. Greylisting doesn't work well in high volume business environments.
Re: (Score:1, Insightful)
Dude, do you actually know how greylisting works?
Re:Greylisting! (Score:4, Insightful)
Then the senders' mail servers are broken, and don't deserve to have their mail read. Greylisting is perfectly acceptable, however it is slightly less than effective as more and more bots will actually retry.
Re: (Score:2)
If the email in question is about a multi-million dollar business deal, then I guarantee you they have a right to have their email read. Suggesting otherwise is a good way to torpedo your company's future.
Re: (Score:2)
There's not difference between email and phone in terms of "on the cheap" except in the eyes of moronic luddites.
Re: (Score:3, Insightful)
If the email in question is about a multi-million dollar business deal, then I guarantee you they have a right to have their email read. Suggesting otherwise is a good way to torpedo your company's future.
Assuming that both sides are legitimate businesses (e.g. not selling millions of dollars worth of cocaine), I'm pretty sure they would both spend the extra few dollars on a reliable email provider or a competent IT person to run an SMTP server. Email delivery can fail on the first attempt for many different reasons, so giving up after one failure is never reasonable.
Re: (Score:2)
If they are negotiating a multi-million dollar deal, chances are really good that there is a lot of email correspondence going on in which case, they get right through the greylisting with no delays. Do you even know how it works? Only the first email is delayed.
Re: (Score:3, Informative)
The "try again" message goes to the sender's mail server. Greylisting is performed between servers. The only perceptible result of greylisting for people is that the first time they email somebody, it might take longer than normal for the recipient to get it.
Re:Greylisting! (Score:4, Informative)
Re: (Score:2)
True, and I haven't found greylisting to be worthwhile enough yet to use myself. But it should also be noted that the problem you describe is a problem for the greylister, not the greylistee. It's problems for the greylistee that would cause most of the "we could lose business" issues, like the one to which I replied.
Re: (Score:1)
True, and I haven't found greylisting to be worthwhile enough yet to use myself. But it should also be noted that the problem you describe is a problem for the greylister, not the greylistee. It's problems for the greylistee that would cause most of the "we could lose business" issues, like the one to which I replied.
A good greylisting implementation creates at most a 3-5 minute delay, assuming the MTA on the sending end isn't broken (which is why you don't put MS Exchange on the network edge sending direct email to MX'en).
Re: (Score:1)
it is important to note that "longer than normal" can mean 24 or more hours for a surprisingly large number of mail servers. Forum registrations and the like are particularly frustrating.
This is what throw away freemail accounts are for.
Re: (Score:2)
No person but a mail admin ever sees the try again messages at all. Any vaguely compliant mail server will try again after a back-off time without any user intervention at all.
Re: (Score:2)
Or a compliant mailserver will immediately retry on the backup MX. Just hope that the greylister is clueful enough to handle that case.
Unfortunately, not all are, as I found out this week. A 430 on the primary MX, and the backup accepts and drops silently, and the idiots on the other side are trying to blame a non-existent Exchange server. Yeah right.
Mart
Re: (Score:2)
There is that. If it's set up wrong there will be trouble. Of course if their secondary was going to /dev/null, they had some really serious flaws in their setup anyway.
Re: (Score:2, Informative)
> response, it makes the recipient's company look bad at an
> organizational level.
Only if the delay gets noticed.
> What's worse, senders may ignore these "try again" messages,
> or never see them at all.
Under anything vaguely resembling normal conditions, the sending user never sees the "try again" message and never knows that there's greylisting involved. The mail server takes care of all that. All the major MTAs since the beginnin
Re: (Score:1)
And you're wrong too (mostly, see below). Jeez people. End users never see the 450 errors. The 450s are received and processed by the sending MTA. After the timeout period specified in the 450 message, the sending MTA sends again, and this time the mail is accepted at the greylisting destination MTA returning a 250. On extremely high volume servers greylisting does not scale mainly due to resource consumption.
When you talk about "bad reputation" I'm guessing you're actually referring to challenge/respo
No, greylisting won't help (Score:2, Informative)
Greylisting won't help against any competent snowshoe spam operation.
Greylisting is useful against ad-hoc connections from botnet hosts that are unlikely to try to resend a message within in an appropriate interval. Managing resending in the botnet environment is challenging.
Snowshoe spamming is, in some small part, probably a response to the decreasing likelihood that random, compromised, home machines will be able to deliver much spam -- a decrease that is probably partially attributable to greylisting. T
Re: (Score:2, Interesting)
I agree with everything that you say, however greylisting does have value in this situation.
The delay imposed by greylisting means there is more chance that the sending host's messages have been flagged as spam by razor, pyzor, or d
Re: (Score:2)
I agree. 90-99% of the usual spam does never pass greylisting. Sure you can create a nice whitelisting like SPF tried (but in my eyes failed) to do. But in the real world, greylisting is a simple way for big time real results. And to me, that is the ultimate scale I measure success by.
Re: (Score:3, Informative)
Re: (Score:1)
You're obviously not a mail system op. Snowshoe is the _one_ form of spam that greylisting has little effect on. Most snowshoers are using real MTAs (i.e. qmail) on cheap VPS servers to send the spam. qmail, just like any real MTA, will retry upon temp failure (450). greylisting only stops bot spam and misconfigured/borken MTAs.
How is this different (Score:2)
from the typical spambot? Any big enough botnet dedicated to send spam could have millons of nodes.
Of course, most of those nodes are located in residential IP ranges, not meant to have mail servers usually. There are blacklists [spamhaus.org] for that since a lot ago. That combined with greylisting (some spambots can handle greylistings, some not), and content filtering could reduce a lot the impact of that kind of spam.
Re:How is this different (Score:5, Informative)
from the typical spambot? Any big enough botnet dedicated to send spam could have millons of nodes.
Of course, most of those nodes are located in residential IP ranges, not meant to have mail servers usually. There are blacklists [spamhaus.org] for that since a lot ago. That combined with greylisting (some spambots can handle greylistings, some not), and content filtering could reduce a lot the impact of that kind of spam.
It's completely different. Snowshoe spam does not come from infected PCs (proxies or bots), it comes from *static* IP addresses *bought* by the spammers from ISPs. The spammers have been buying IP ranges, class Cs, directly from ISPs and filling these ranges with 'nonsense' domains, each one sending 'a bit' of spam is order to spread the load across the whole class C to lessen complaints.
Re: (Score:3, Interesting)
In other words we've come full circle and are back to the days when spammers were actually hosted somewhere. Only this time in a bit more of a distributed fashion.
Re: (Score:1)
How does that practice lessen complaints? More IPs, more domains will still gets the same number of complaints if they send out the same amount of spam.
As was pointed out, botnets have been doing this for years. They did it so that they didn't trigger automatic volume based filters run by the ISPs with the infected hosts. The purpose of those filters was to detect a virus-host. But using volume based filtering on //receiving// email has been useless since forever because of the virus detection tactics. S
Snowshoe spam (Score:2, Funny)
That's going to be annoying. I will never in a million years find myself in the market for snowshoes.
Re: (Score:2, Insightful)
Re:I have a fine idea (Score:5, Interesting)
I think a better idea...
Stop filtering spam at all. For a whole week.
Let the spammers break the system.
Re: (Score:2)
What exactly will this accomplish? It will certainly piss off Joe Internet User, but to whom will he be able to direct his anger, and how?
This is not new! (Score:3, Interesting)
Why is this being presented as if it were something new?
As early back is 2001, as an admin for an ISP, I would see what I called a "spam attack" - a large number of emails sent over a 24 hour period or so, adding up to (typically) around a million attempted emails to random addresses at the domain name(s) for which I administered.
We used greylisting to stop these attacks, but it was *very* taxing - in a typical attack, I logged well over 10,000 source IP addresses.
These so-called "snow-shoe" spam attacks are pretty much exactly what I saw some 8 years ago.
Everything old is new again...
Keyword is STATIC IP sources. (Score:2)
I actually browsed the article... it refers to static IP's in ranges that have no "history" on the Internet. I.e. it's not zombie'd home PC's on ADSL or Cable from dynamic IP address ranges.
I'm not sure I understand it, though, wouldn't those be easy to track down to real people?
Re: (Score:2)
Wha?
You think I didn't block home PCs and dynamic IP address ranges via DNS RBL? I'm talking about what got *past* those obvious filters...
Re: (Score:1)
Spot on. I rather doubt that ISPs are selling this. Spamhaus offers no evidence of that. Furthermore, it would take a ton of IP resources, which would turn into big costs for the ISP. The big money to ISPs is in genuine commercial bulk emailers, not the scammers who already use botnets. There is never going to be big money in scam sites (those that change names every day). Such scam or no-reputation sites are just modern grifters using the internet. This just another media hack from the Spamhaus/SORBS
This is the next escalation in the spam war (Score:2, Insightful)
Re: (Score:1)
Once the sender is blocked because their outsourced email provider is letting the zombies through, they need to be informed and get pissed at their provider - not the one who blocked it. The dimwit CEO just needs to be informed of his ignorant decision to use smartemailforeveryoneontheplanet.com for $2.99 a month. Problem solved!
Re: (Score:2)
i see 2 sides to this debate. one side that has a clue and recognises the potential DISASTER of blocking legit emails, and the other side who don't have anything important being emailed to them so can't see the fuss.
Re: (Score:2)
Re: (Score:2)
The problem is that the scorched earth approach is the only one that truly works. You don't block by domain, you block by client IP. You whitelist regular correspondents, and large mail farms like Hotmail, or Yahoo!.
You end up with very few false positives and large bandwidth savings, especially from an ISP perspective where Bayesian filtering doesn't scale.
The way to stop it... (Score:2)
As expected, spammers keep becoming smarter.
The way to stop spam is to eliminate its value, not its source. Spammers send this crap to make money. So who pays them?
If it's a business, then that business is doing a pretty poor job of analyzing its marketing success rates. Just because you can "reach" the whole world, doesn't mean it's worth the money: everyone will delete your "flyer" and make a mental note to hate your brand for eternity (and tell their friends). So, one step is to convince businesses t
Buyer beware = fraud and crime (Score:3, Interesting)
I don't think you realize just how protected you are from fraud and similar crimes by the fact that they are crimes. You can knock our justice system for being imperfect, but you can't knock it for being ineffective. ('cepting the "war on drugs", of course)
The truth is that we have a first-rate police force and criminal investigation system that is quite effective at enforcing laws of commerce - protections that provide you with a refund if the item purchased didn't work out, etc - that you use so casually,
Re: (Score:2)
Your other point is well made - at the moment, law enforcement can't legally respond to a spam email, pay for the product, and then follow the money trail. There are sound legal reasons for this but I reckon there is a good case for narrow legislation to deal with this specific problem. The answer isn't educa
balkanization (Score:2)
The spammers are in cahoots with those who want to balkanize the internet.
We have to come up with new e-mail standards that avoid balkanization before they can push their next attempt.
One thing is to refrain from requiring all e-mail traffic to use whatever tech we invent to ID the sender effectively.
Hacked accounts too (Score:2)
I've seen a huge increase of phishing emails to my users to get their credentials, then use those credentials to send out spam through our email server.
It's a real pain, and we send out repeated notices to our 50,000 users that we'll never ask them for their password, but inevitably there's always a few that respond anyway.
And since our system can handle 400 errors just fine, it gets past greylisting -- but sites that greylist actually help us out because I can look at the outgoing mail queue and catch
We catch a lot of this via greytrapping (Score:3, Informative)
What's the problem (Score:2)
Hmm something seemed to change a few years ago. Spam used to be overwhelming.
Since we use the free Msf spam plug in for exchange, and I can't even rememember the last time I got genuine spam.
Same with my gmail account.
Are the filters just that effective, or are the spammers giving up?
Re: (Score:3, Informative)
I'm getting 1000+ spam messages a day going to my Gmail spam folder.
Spammers are not giving up.
spread spectrum spam (Score:1)
Here is a rehash of my subject to beat the lameness filter.
Yeah, but most of my spam is coming from Yahoo... (Score:2)
My biggest problem, by probably close to 10x, is the Nigerian scams, usually coming from Yahoo, Hotmail, and gmail, in order of descending frequency.
I've been thinking of forcing addresses from these domains which are not in our whitelist to bounce with a "re