Hackers Blamed For MessageLabs Spam Blunder 44
littlekorea writes "MessageLabs claims to have discovered that the systems of one of its customers were hacked by spammers after an entire block of MessageLabs IP addresses was blocked by antispam service SORBS. Customers of the managed email service had problems with outbound mail last week after MessageLabs' IP addresses were included in SORBS' block list. The Symantec-owned service provider has assured customers it has systems in place to prevent such incidents from happening again."
Please don't use SORBS blocklist (Score:5, Interesting)
Sorbs is a really poor block list which I don't think anyone should use.
I found that my mail server is listed in their list, because 3 years ago the same IP range was allocated to a dynamic IP range.
Even though it is now a static server address and the whois IP allocation records were long ago updated, and even has the reverse dns saying "static" in the format that sorbs demand, because the ENTIRE /24 network where my server lives doesn't confirm to their demanded reverse DNS standard, they refuse to delist it.
Their web service is a total nightmare and even their auto responder takes two weeks. As someone who has been working with mail servers on the internet since 1992, I would say please for the love of god, do not use sorbs as an email blocking list.
Check out Wikipedia for more info on them, they also solicit payments for some delisting which seems completely unethical.
Re: (Score:3, Informative)
Seconded. I tried using them a few years back and balked at the appalling quality of the data.
In any case, using greylisting, some basic header sanity checking and spamhaus kills 99%+ of the spam so there is really no technical need to use such an aggressive list.
Please don't use ANY blacklist (Score:5, Informative)
In addition to the complaints specific to SORBS, here [acme.com]'s what the acme.com owner (who, more than half a decade ago, received an the order of a million spam mails per day) has to say about DNS-RBLs in his write-up on how to efficiently and effectively filter spam:
DNS-RBLs - Domain Name System Realtime Black Lists. In theory the idea is fine. You have a set of sites that you blacklist, and you want to let other folks use the same list so you distribute it using DNS, which is a nice efficient de-centralized database. What's not to like?
Well, I don't know why, but in practice every single DNS-RBL eventually comes under the control of power-hungry weenies. They start listing sites unreliably, and if you complain you find yourself listed. And there's usually no way to get off the list.
A lot of people tell me I'm wrong about this. They say that certain DNS-RBLs are ok, with objective criteria for inclusion and simple procedures for getting off the list. The thing is, they give conflicting recommendations for which lists are good and which are bad. Some of these folks recommend lists which I know from personal experience are bad.
This problem is really inherent in the way DNS-RBLs are set up. You cede control of your mail system to a third party, with no real possibility of checking how they are doing. The people running the lists get overwhelmed with bogus feedback from spammers and/or idiots, to the point where they assume all their mail about the lists is from spammers and/or idiots.
If the lists you use have not yet descended into corruption and chaos, consider yourself temporarily lucky.
Do not use DNS-RBLs.
As you can see, he addresses the specific problems with SORBS ("in practice every single DNS-RBL eventually comes under the control of power-hungry weenies. They start listing sites unreliably, and if you complain you find yourself listed. And there's usually no way to get off the list"), gives a reason for why this is ("the people running the lists get overwhelmed with bogus feedback from spammers and/or idiots, to the point where they assume all their mail about the lists is from spammers and/or idiots"), draws his conclusions ("this problem is really inherent in the way DNS-RBLs are set up. You cede control of your mail system to a third party, with no real possibility of checking how they are doing") and arrives at a recommendation ("do not use DNS-RBLs").
Re: (Score:3, Insightful)
and arrives at a recommendation ("do not use DNS-RBLs").
This entire analysis is spot on, but the reason blacklists are so popular is that they tend to work - you use one, the spam goes down, your users are happy. (Right up to the point where they discover a false positive that the RBL is blocking them from getting, anyway.)
In light of that, "do not use DNS-RBLs" is kind of throwing the baby out with the bathwater. The obvious middle ground, of course, is "don't use DNS-RBLs to make a binary accept/reject decision." Instead, use them as a weighted input to a
Re: (Score:1)
That's too absolute. There are certainly reliable RBLs operated by individuals. It is also certainly the case that any mail admin can, at any time, cease using an RBL that has become unreliable.
There are also reputation-based blocklists (don't know if any are free or not) that both remove the possibility of human capriciousness from the equation and allow more finely-grained judgments. A traditional RBL is a binary decision: accept or block. With a reputation-based RBL, you can say "OK, I will not accept an
Re: (Score:1)
Re: (Score:2)
SORBS does create problems, but in this case, they got it right. ML was passing spam through their network. SORBS identified it and blacklisted them. There are plenty of reasons to speak badly of SORBS, but this isn't one.
Re: (Score:2)
It's less of being added to a blocklist, and more of being unable to get removed without paying and going though the other hoops.
Re: (Score:2)
Yup. Blacklists are questionable at the best of times, and SORBS has long been one of the worst.
Re: (Score:2)
Re: (Score:1)
Love that Symantec owns the hosting (Score:2)
Of all the companies that should have been most aware of the threat of spammers and hackers, it should be one of the ones who profit the most from selling anti- and counter-measures against their activities. They are the "experts" on the subject aren't they?
Re: (Score:2)
You are missing the point of marketing through fear and the difference between marketing through fear and marketing on technical spec and merit.
The first is easy, the second requires the spec and the merit to be there in the first place. Judging by the way this incident has proceeded it is not there. It takes about 5 lines of code in perl using Net::DNS to walk your address blocks and check them vs the known blacklists. It takes about 5 lines of code in perl to parse a log and pick up a 5xx SMTP bounce. It
Scum of the earth? Or from Hell? (Score:2)
Sullivan said the email was "quite patently designed to mislead users of SORBS into believing that MessageLabs are the good guys and SORBS are the scum of the earth."
In my experience they are a bunch of bastards, the BOFH probably leads the SORBS team... :-)
Then again, we need them to be tough and love it when they give spammers crap. In a way they are the lone bad cowboys from the internet, fighting injustice in their own way and keeping it a little safer, but don't expect them to be polite or helpful. And when you are standing near a bad guy with a black hat when the cowboys show up, expect to be shot down in a heartbeat western style... real cowboys don't mess aroun
Re: (Score:2)
Ditto. I have yet to see SORBS receive criticism they haven't earned.
This all sounds backwards (Score:4, Informative)
Doesn't it seem much more likely that the hack is what lead to the spam being sent, THEN the site got blocked as a result?
Re: (Score:3, Interesting)
I think that's just bad phrasing. My reading is that they only found out that the customer had been "hacked" because they were blacklisting (i.e. 'hacking' occurred, blacklisting occurred, awareness of blacklisting occurred, and finally awareness of 'hacking' occurred).
Re: (Score:2)
I think that's just bad phrasing. My reading is that they only found out that the customer had been "hacked" because they were blacklisting (i.e. 'hacking' occurred, blacklisting occurred, awareness of blacklisting occurred, and finally awareness of 'hacking' occurred).
Exactly - and isn't this the whole idea on how this is supposed to work?
Re: (Score:2)
How what is supposed to work? I thought the whole idea of MessageLabs was that they were supposed to be "anti-spam" in some way and so should stop the messages before they get flagged as being evil.
Even if they assumed that all activity was legit, it'd still be good to have noticed you had unusual behaviour before you get blacklisted (or at least before people notify you that you've been blacklisted).
Re:This all sounds backwards (Score:5, Insightful)
Knowing how Messagelabs works myself, just to refine it, it probably went something like this.
Emailserver1 is setup to relay outbound through Messagelabs all of the email. /24 on their lame block list in response and because they suck as a service take forever to remediate bad blocks
Emailserver1 is compromised and used as a mail relay itself
Messagelabs receives spam generated by Emailserver1 and because all outbound email is filtered, they recognize it after a few hundred pieces of mail and begin to throttle/stop connections from the server
A few pieces of the hundred are delivered to destination recipients
SORBS places the entire Messagelabs
The answer to all this is Messagelabs IP ranges should never end up on SORBS' list because of what they are, an output pool for tens of thousands of people which is maintained by a company with a repuation. The fact SORBS feels it within their power to blacklist Messagelabs IP ranges shows how much power they feel that they have, power derived merely from the fact that some people use them.
This should prove to people who use SORBS why not to use them. It's SORBS fault, not Messagelabs. The whole idea of a list like SORBS is to be a well maintained list of "bad ip's". If they add Messagelabs' /24's to their list, this proves it is not well maintained. The act of sending a small number of spam emails is inherently unpreventable almost by definition, and ML has the infrastructure in place to protect against 99.9999% of it.
Re: (Score:1)
Yeah, I worked for an ML competitor a few years ago, and had the same sort of problem with SORBS from time to time (same business/network model as ML, making these incidents somewhat inevitable; outbound spam filtering is WAY harder than inbound filtering). I, too, am sure that's what happened.
I still work in email security, but not for the ML competitor mentioned above.
anon (Score:3, Interesting)
Having been caught in exactly this situation between these two companies before left me with a very bitter taste in my mouth towards SORBS
SORBS "require" a "donation" ( to a charity ) to get delisted.
Type SORBS and charity onto google and have a peek at what comes back.......
On the SORBS site ( I don't remember exactly where, but I do remember reading it last time I went through this crap ) they say that ( me paraphrasing ) they are probably not allowed to charge a fee for delisting for legal reasons, so the "require" a "donation" instead. Ohh yeah you can choose a SORBS approved charity and jump through hoops to prove your donation OR rather conveniently they have a charity that you can donate to which will place less hoops in your way. Which one you gonna choose considering people are yelling at you that their mail aint getting through?
Do a bit of googling and there are reports of people blacklisted by SORBS being asked to buy hardware for SORBS as the "donation" to get unlisted.
See much info on the SORBS site on what measures they take to prevent and deal with false positives? No? Well that's probably because when they are charging for delisting it's in their intererests to generate as much paying custom as possible.
Seems like a form of extortion to me........
unbreakable (Score:2)
> it has systems in place to prevent such incidents from happening again
care to put a bounty on that ?
extortion by SORBS (Score:5, Informative)
Re:extortion by SORBS (Score:5, Informative)
Similar nightmare for a project website started awhile back. We registered with the host, a VERY BIG host I'll add, and suddenly found our assigned IP addresses were all blocked. SORBS said it was the provider's fault, they gleefully hosted spam sites so must be punished. It would sure be nice to have group related e-mail for organizational purposes. Unless our host paid to play, it was game over. No big deal, we moved to an even BIGGER, more expensive, host (currently a publicly traded company with some big 'cloud' options) and yet again found our new IP addresses blocked, oddly though, only after our domain was updated with the new DNS addresses.
It boggled the mind how a brand new, never registered previously before domain for a research project related to a small scientific group studying x-ray deep surface x-ray diffraction could be the root cause of a huge criminal enterprise. One might think SORBS took offense to a previous email relaying certain concerns and blocked the domain out of spite. Fortunately when we relayed those fears SORBS corrected us, and proved with some very convincing records that 2 chemists and a physicist were really responsible for the downfall of humanity, and all it would take is a donation to their legal fund. (Oppenheimer eat your heart out).
The advantage of toiling for a university day and night is access to a rather sophisticated legal department that loves crushing tiny people like Kevin SORBOS playing Hercules. Needless to say, the SORBS legal defense fund suddenly looked like it was going to get a real workout, and magically, an error was found and corrected. We were unblocked.
Let me say it one more time...Nightmere.
Re: (Score:2)
Pro-tip: Starbucks also sells decaf.
don't panic...they fixed it (Score:2)
Re: (Score:2)
Considering one of MessageLab's clients is currently sending me spam with no way of opting out, I'm going to be a lone supporter of SORBS :)
Hell, yes! I'm gonna go one step further and turn off my mail servers. Good bye spam problem!
Bad article (Score:2)
This is a very poorly written article which seems to cast Symantec's Messagelabs in a bad light when infact it should be SORBS.
SORBS is a horrible black list and no one should use it. They are slow to de-list unless you pay an extortion fee. They probably put Messagelabs on their block list at the slightest provocation. I work with Messagelabs frequently and I have seen first hand how Messagelabs throttles connections from IP's and shuts them off automatically when they detect spam. I think the scope of the
We've used Message Labs for years (Score:2)
I can't think of another internet product or service that has improved my quality of life as much as Message Labs has.
I have not gotten a single email with a virus/trojan attached since we signed up for their service several years ago.
I get maybe up to a dozen spam messages a day (probably half of them semi-legitimate attempts to sell me stuff as opposed to pure broadcast drug spam etc.) but the Message Labs stats show they're deleting hundreds and hundreds of spam messages a day directed at me. I never nee
Messagelabs spam is real (Score:1)
This is the response I got from ML when complaining about a 100K image laden pile of HTML tag soup one of thier customers had sent to my address as well as three of my spamtraps. Note ML first asked if I would provide the domain(s) of my spamtraps so they could ask thier cleint to add my spamtraps to thier stoplist.
full discussion on the now defunct spam-l list - note that NOONE stodd up for ML.
Pretty much every commenting stated that ML are hot on inbound spam and dont give a shit about outbound.
They consi
Good for SORBS. They're doing it right. (Score:2)
I agree with SORBS on this. If you run email through a provider which allows any form of "bulk email", "opt-in" or otherwise, once in a while, some spam will come out of their system. That apparently happened here, and SORBS, correctly, blocked them. That's the risk you take if you sign up with an email provider that isn't sufficiently aggressive about spam.
Notice how fast MessageLabs cut off the spam source, and how much effort they put into fixing the problem. Without punishment from an external ch
SORBS sucks (Score:1)
LONG LIVE SORBS
Worst block list ever.
As a service provider - we have given up - if an address is listed we send an email off and then move about our path in life.
Always sucked, always will, users who use SORBS deserve what they receive, unfortunately.