Spamming Trojan "Proxy Guzu"

squiggleslash writes "El Reg has the scoop on a trojan that actually turns your machine into a spam sending proxy. Called "Proxy Guzu", the proxy arrives in your mailbox in the usual "Outlook virus" way (ie disguised as something else so you'll run it.) It then sends an email to a Hotmail email account reporting the IP address of the infected machine and port it's running on. The spammer then merely transmits spam to the infected machine which in turn forwards it on. There's a bright side to all this: Spammers are doing this because they're desperate, with fewer and fewer spam friendly havens. And what they're doing is illegal and opens them up for prosecution."

Comments

Uhh

[cscx]

Hotmail disables said account. Case closed...?

Re:Uhh

[fidget42]

After the spammer harvests IP addresses of newly opened relays. Case is still open...

Re:Uhh

[Anonymous Coward]

If I were going to design this, I would make it look up freshly posted email addresses on some public forum that I had cleverly and anonymously posted, rather than some single fixed address. That way when the first one gets closed, I could post another. Or some other scheme along those lines.

Re:Uhh

[Anonymous Coward]

Err, I'd have it post to somebody else's slashdot journal.

Re:Uhh

[sinergy]

The virus writer would have been smarter to send notices to IRC, or muliple email addresses. Or use broadcasts a la the SQL worm.

More clever thought behind things like these would make them much more devistating.

Re:Uhh

[MrLint]

Mind you this is only the first step. Jus wait for the unholy alliance between spammers and vrius writers. You rember how bad nimda was? Its not going to be hard to make these thigns that report the IP via irc/http/email. Hell you could even setup a listener and just see how makes bad pop3 connections. This is gonna get really ugly. And just think.. these are gonna be zombies we know are being used. Zombies that spread at the speed of spam. Zombies that may be hijacked to do more than spam.

Re:Uhh

[MrNemesis]

Chances are, if the virus writer is any cop, he'll be able to reconfigure the virus remotely and get it to send to a different account.

At least, that's what I would do...

Re:Uhh

[cscx]

Assume they're a limited number of users. If they have a virus scanner it will be rounded up in the next batch of scans, hopefully.

Re:Uhh

[pohl]

Somewhere in the world, a virus author adds a couple of bullet points to his TODO file.

Re:Uhh

[Corporate Troll]

Wait a second... you assume that the lusers that use Outlook, are running a virrusscanner and on top of that keep it up to date?
Boy, are you living in a happy world!

Re:Uhh

[jellomizer]

Why not have Hotmail just disable all OutLook send e-mails. That way Microsft doesnt have to worry about getting Spamed thew their servers. By those virus prone MS Outlook application. With Microsoft backing up blocking Outlook sent email it could help change the directon of e-mail clients to the more efficient and virus free ones.

Re:Uhh

[blibbleblobble]

"Assume they're a limited number of users. If they have a virus scanner it will be rounded up in the next batch of scans, hopefully."

Assume some of those billions of dollars of homeland security money is actually being spent at the FBI, instead of squandered on kickbacks, the spammers will hopefully be rounded up in the next bunch of scans and executed.

When the direct marketing industry resorts to cracking computers, these people need to be taken out of contact with the internet. If only the FBI spent as much time looking for criminal spammers as they did looking for Mitnick, we'd actually have a more secure infrastructure.

Re:Uhh

[Anonymous Coward]

Nobody capable of clever thought would write something like that.

Re:Uhh

[Guppy06]

"The virus writer would have been smarter to send notices to IRC, or muliple email addresses. Or use broadcasts a la the SQL worm."

If the spammer had two braincells to rub together to figure that one out, would they be in the spam business to begin with?

Re:Uhh

[ceejayoz]

What incentive would Microsoft have to block e-mails coming from their own e-mail program?!?!

Your proposed solution would be like making Microsoft Office stop working with Microsoft Windows... hardly good for business!

Re:Uhh

[Realistic_Dragon]

Then anyone could have harvested and used those addresses, diluting the value of the investment.

Re:Uhh

[dougmc]

If the spammer had two braincells to rub together to figure that one out, would they be in the spam business to begin with?

Possibly. Spammers do seem to make money, don't they? And there are many intelligent people out there who like money. Smart people do morally wrong things to make money just like dumb people do.

The way to stop spam is to remove the profit motive. PEOPLE NEED TO STOP BUYING STUFF THAT THEY GET SPAMMED ABOUT! Once they stop, people will stop paying spammers to advertise their wares, and the spammers will then stop spamming.

Yes, most spammers do seem pretty stupid. But if it makes money, and it's not illegal, many people, even smart people, have no problems with doing it even if it's morally reprehensible.

Re:Uhh

[Guppy06]

"Spammers do seem to make money, don't they?"

Just because they think they're making money doesn't actually mean they're making money. Part of the reason spammers are suing their ISPs and such is that they're not really making money ("I would have turned a profit this quarter if it weren't so hard to find an ISP...")

Re:Uhh

[arivanov]

PEOPLE NEED TO STOP BUYING STUFF THAT THEY GET SPAMMED ABOUT!

Correct. That is the reasom I have cancelled all Amex accounts in my household, do not buy anymore from play.com, etc. But IMO what I have done is an exemption, not the rule. After all there are still people who believe in Nigerian SCAMs out there ;-)

Re:Uhh

[alkali]

>>If the spammer had two braincells to rub together to figure that one out, would they be in the spam business to begin with?

Possibly. Spammers do seem to make money, don't they?

Unclear. People participate enthusiastically in pyramid schemes that will never make money, even if the participants don't realize it. I would guess that at least some spammers make money. But I would also guess that a lot of spammers are people with free or very-low-cost internet access and lots of free time (e.g., university students in formerly-Communist and Third World countries) who believe that they will make money spamming, but who will never see any actual return on their time. It would be interesting to know the actual facts, but I doubt there's any way of knowing for sure.

Re:Uhh

[plugger]

I thought he was joking.

Re:Uhh

[dougmc]

Unclear. People participate enthusiastically in pyramid schemes that will never make money, even if the participants don't realize it. I would guess that at least some spammers make money.

Remember a few years back when Rodona Garst's (a notorious spammer) computer was broken into? ICQ logs and such were taken from her computer, and they were very interesting reading -- and she seemed to make pretty good money spamming, and even had a team of people spamming for her.

I suspect that it's pretty easy to make money spamming if you've got half a brain and some programming experience. You could write your own simple address-collection and spam-blasting programs in under a day, and then all you need is to find some customers -- and apparantly they're out there.

If you're clueless and you spend a few hundred on somebody's CD of email addresses, and a few more hundred on a CD of spam software and don't know anything more about your computer than how to click on things, then you're right -- you're just going to make other spammers rich and not yourself -- and it's obvious that spammers are perfectly happy to prey upon other would-be spammers.

There's definately a lot of `spam MLM' (MLM = Multi Level Marketing) going on -- but unlike your traditional MLM, there is money to be made outside of the MLM. Kind of like Amway -- yes, it's a MLM but they do sell a real product.

Re:Uhh

[MrTangent]

People start using Eudora or some other email client that isn't so susceptable to macrovirus infestation. Case closed...?

Better yet, don't use Windows. Windows IS a virus as far as I'm concerned.

Re:Uhh

[jellomizer]

You are right this was ment as a joke. Although I didnt expect it to be really funny. It was a small joke to get a chuckle. I guess some people can't see these small jokes in life.

Re:Uhh

[wannasleep]

nope.... you do your homework, report it to abuse@hotmail.com including headers etc. etc., they tell you that tracking spam is hard, they give you a list of useless hints (like if I used window$ in the first place...), don't do anything, case closed, account opened.. this is a real life experience....

Re:Uhh

[wannasleep]

you are telling people how to write a better virus.. this is an official notice! The secret police will come get you, criminal!!!! signed,

Re:Uhh

[hughcharlesparker]

Interesting point. I think your pyramid scheme example may be more pertinent than you realise. Although the scheme overall cannot make a profit, the first tier or two might well do. An unscrupulous person wanting to make some quick money could cash in on his reputation by joining such a scheme and praising it to his foolish peers, who he sells on to.

Re:Uhh

[jafuser]

This is a good page. I especially learned a lot from reading the ICQ Chat Logs.

Sometimes I wonder if the companies who finally benefit from the spam even know just how scummy their sources are. If you read this chat log, you will see a guy, Jeff, is gathering leads for mortgage loans from a "very professional company".

In situations like this, I wonder how effective it would be to subvert the spam network by using decoy identities to make contact with these companies and hold them liable for their sources so that the people responsible for setting up the chain of communication to the spammers will be fired.

Re:Uhh

[jafuser]

Jeff, is gathering leads for mortgage loans from a "very professional company".

Should read:

Jeff, is gathering leads for mortgage loans for a "very professional company".

Virus...?

[MrNemesis]

Are there any AV vendors out there with fixes for this yet? I didn't see any in the article.

Re:Virus...?

[Anonymous Coward]

well here's at least one that seems to have sorted it

Re:Virus...?

[Anonymous Coward]

I believe Mozilla.org have a program that will protect you from the virus.

Spammers doing something illegal?!

[Anonymous Coward]

I am shocked! They seemed like such good upstanding members of society.

Re:Spammers doing something illegal?!

[gilesjuk]

Don't tell the politicians, they will be arguing for decriminalising spamming to get rid of the criminal element :)

Proxies & broken e-mail

[greyrax]

Great. First we have the trojan that downloads kiddie porn (has anyone else ever heard of this one?) and now this.

Let's face it: SMTP is broken and it needs to be fixed. There has to be some way of authenticating senders and attachments to messages?

I'm not talking about some of the (innovative) kludges that people have come up with for SMTP, I'm talking about a bare-metal rebuild of the entire system. Sure it will be a pain, but when you move to a new place, you have to give your friends the new phone number and address -- giving a new e-mail address (on the new e-mail system) won't be all that bad will it?

Re:Proxies & broken e-mail

[Anonymous Coward]

-> There has to be some way of authenticating senders and attachments to messages?

Uhh... Pop before SMTP? SMTP AUTH? I'm sure there's more. Which one are YOU using?

Re:Proxies & broken e-mail

[DarkOx]

UMM there is no need to develop a new system to authenticate mails. Its called PGP and its been around for years, when needs to happen is people need to be made to use, ISP terms of service would be a good place to start.

Re:Proxies & broken e-mail

[Anonymous Coward]

I'm using Sylpheed and it appears to be just find. Outlook is broken and needs to be fixed, leave the rest of us the f*ck alone!

Re:Proxies & broken e-mail

[42forty-two42]

Let's face it: SMTP is broken and it needs to be fixed. There has to be some way of authenticating senders and attachments to messages?

There is - it's called PGP. SMTP is only intended to transport mail, not to authenticate it. It's the client's job to determine if it should be accepted.

Re:Proxies & broken e-mail

[BurritoWarrior]

Sure it will be a pain, but when you move to a new place, you have to give your friends the new phone number and address -- giving a new e-mail address (on the new e-mail system) won't be all that bad will it?

Hell no, it's easier. I will just set up a script to send thousands of emails with my new address to everyone. I might even include a few pointers on male enhancement products at the same time so I don't clog up the system with a second mail.

Re:Proxies & broken e-mail

[Anonymous Coward]

How does PGP prevent a dictionary attack on my mailserver? Can you point me to a HOWTO.

Re:Proxies & broken e-mail

[Anonymous Coward]

Mail arrives.
Mailserver finds invalid or no PGP signature
Mail bounces.

Re:Proxies & broken e-mail

[dasunt]

SMTP is broken? Maybe, but lets look at this logic.

1. An email attachment pretends to be something it isn't, people click on it.
2. The email attachment opens up a relay, sends email back to an hotmail account.
3. Spammer uses email account to spam other email accounts.

Now lets look at this with $SMTP+1 (With spiffy authentication).

1. An email attachment arrives from a trusted source/new source. People click on it.
2. The email attachment opens up a backdoor, sends email back to hotmail.
3. Spammer uses email software on that machine to spam other machines. Since we have email authentication now, the other users either get "from a trusted source" (if they already knew the person) or "from a new source (Key matches Joe Outlook Idiot)".

Yep, that sure fixed the problem.

Re:Proxies & broken e-mail

[mark_space2001]

Let's face it: SMTP is broken and it needs to be fixed. There has to be some way of authenticating senders and attachments to messages?

SMTP is not broken and does not need to be fixed. For example, this virus would never succeed on my windows system. First, my IP address, 10.0.0.11, would not be of much use to the spammer. (And if you know anything about networks, you know why, and why I can post it and not worry.)

Second, in between my windows machine and the rest of the internet I have a firewall. THAT'S what really renders the virus moot. Nobody connects to any machine I have from the outside, period, ever. (Now of course there's ways to defeat a firewall, but that's also a much more difficult task.)

SMTP is not the issue. Naked machines on the 'net and crappy mail readers are. If a virus can take control of your machine, what authentication process can you devise that the virus can't duplicate now that it has control of the very same program you use to send email in the first place?

Even typing a password with every single email you send wouldn't work, because all a virus has to do is pop up a fake password box once, record what you type, and it can send all the authenticated email it wants. PGP and cookies don't help either, becuase that virus still has control of your machine. It can run your email program directly and just send mouse clicks to drive your email program. (Yes, this is done all the time for automated testing of windows programs.)

Basically, what's really needed is to put some or all of these SOBs in jail. And technical measures like SECURITY are the ticket, not just SMTP. This must be automatic for home users--ISPs must get involved as well as MS (and desktop Linux) to ensure that home users are adequately protected. And Outlook should just plain be made illegal. Period. Scrub that POS off the hard drive and forget it.

/rant

Sorry if I went off too much there. Laters.

Re: Proxies & broken e-mail

[Black Parrot]

> Great. First we have the trojan that downloads kiddie porn ... and now this. Let's face it: SMTP is broken and it needs to be fixed.

Or just let it stand for Send Me The Porn, and find another protocol for e-mail.

Re:Proxies & broken e-mail

[nightcrawler77]

Unfortunately, that does nothing to address the bandwidth used by all of the unwanted email. If it still has to arrive at its destination in order to be rejected, then we've only solved part of the problem.

Re:Proxies & broken e-mail

[Anonymous Coward]

You don't ever need to worry about posting IP addresses, whoever made up that myth needs to be shot.

Mine is 80.5.155.194, and I hereby challenge all of Slashdot's 31337 hackers to do anything to me at all. It's a Windows XP machine and everything.

There is simply no reason to ever be scared of posting an IP address, unless you've been listening to that idiot Steve Gibson, master propagandist for ZoneAlarm.

Re:Proxies & broken e-mail

[Guppy06]

The trojan relies on the "added features" of certain SMTP clients to install itself. So it seems the problem isn't with SMTP itself so much as any e-mail client that does anything more than display text messages.

Turn off HTML, turn off references to external files, turn off scripting, and don't click on suspicious-looking files. Much easier than trying to redefine SMTP if you ask me...

Re:Proxies & broken e-mail

[Anonymous Coward]

"invalid or no PGP signature" ? Doesn't that mean you'd have to read the entire mail message in order to check it? Isn't the point to block mail and preserve the bandwidth?

Re:Proxies & broken e-mail

[dougmc]

Great. First we have the trojan that downloads kiddie porn (has anyone else ever heard of this one?)

I suspect that we weren't given the whole story.

What seems much more likely is that some trojan was installed on this person's computer that allowed an attacker to take control -- nothing more (and there's a lot of such trojans out there.) Then the attacker took control and put the porn onto the computer, perhaps so it could be distributed, or perhaps just to see if he could get this guy in trouble, or shock him when he found it -- who knows?

It's certainly possible to write a trojan that looks for kiddie porn, but there's plenty of other more plausable explanations that fit the (limited) information that we have as well.

Hell. It's possible that the `trojan' installed merely pulls images off of Usenet and saves them to the hard disk for the attacker to collect later, and it just happened that somebody had posted some kiddie porn to Usenet so this program captured it -- so there's six thousand `normal porn' images, and three `kiddie porn' images on the disk. Who knows?

Re:Proxies & broken e-mail

[42forty-two42]

There's no good way to prevent this. If a new company gets a domain name, should they have to wait for every sysadmin in the world to mark their key trusted before they can send email? If so, sysadmins will disable the functionality. If not, the problem isn't solved and better than the blacklists do it.

Re:Proxies & broken e-mail

[FyRE666]

SMTP is not broken and does not need to be fixed. For example, this virus would never succeed on my windows system. First, my IP address, 10.0.0.11, would not be of much use to the spammer. (And if you know anything about networks, you know why, and why I can post it and not worry.)

Second, in between my windows machine and the rest of the internet I have a firewall. THAT'S what really renders the virus moot. Nobody connects to any machine I have from the outside, period, ever. (Now of course there's ways to defeat a firewall, but that's also a much more difficult task.)


I'm sorry, but you're so unbelievably wrong here, it's difficult to know where to begin...

Firstly, it doesn't matter what your machine's IP is on your local network; 10.x.x.x, 192.168.x.x or anything else. If your machine can reach the net, then (obviously) so can a piece of software running on your machine (ie, a virus).

Secondly, you can have the best firewall in the world, but if a trusted host behind it is compromised then it's "game over". The attacker doesn't have to connect to your machine through your firewall. The compromised machine can connect out and initiate a backchannel - literally punching a hole through the firewall. This would normally be to an IRC server, but could be anywhere really, using any protocol allowed out by the firewall.

So, to sum up; a firewall and local network is not going to protect a machine from a stupid user opening a virus on the machine.

Re:Proxies & broken e-mail

[icedivr]

First, my IP address, 10.0.0.11, would not be of much use to the spammer

The executable might report your inside IP address, but the routable source IP would be visible within the headers the smtp server it connects to prepends to the message. Knowing this wouldn't get them thru your firewall, but they'd be one step closer.

Re:Proxies & broken e-mail

[satch89450]

Secondly, you can have the best firewall in the world, but if a trusted host behind it is compromised then it's "game over". The attacker doesn't have to connect to your machine through your firewall. The compromised machine can connect out and initiate a backchannel - literally punching a hole through the firewall. This would normally be to an IRC server, but could be anywhere really, using any protocol allowed out by the firewall.

You are right, the spam-virus can try to initiate a connection to something on the other side. Of course, I don't forward smtp traffic, so a spam virus would find little happiness running on any of my computers, because it will find itself in a little jail -- and the discussion was a spamming SMTP zombie.

No host behind my firewall is "trusted". One of the beauties of my firewall implementation is that perimeter protection is both ways: protect my computers from bad-boy Internet packets, and protect the Internet from any nastiness that might creep into my computer.

That's the power provided by IPTABLES under Linux. I can filter traffic independently in both directions, using the stateful capabilities of IPTABLES, so that my sieve can handle in-bound SMTP separately from out-bound SMTP, passing one and blocking the other. And I do, because I can.

(N.B.: that's not to take anything away from firewall products for Windows, Macintosh, BeOS, and other systems that implement stateful filtering. There are $50 software packages that afford the same protection, if you elect to use it. The problem, of course, is that a computer virus may be able to "sneak around" a same-system firewall implementation. That's why I like separate firewall computers, and firewall appliances such as the SonicWall. A virus would have to work very hard indeed then to get past the protection.)

In short, my firewall does protect other machines on the Internet from a stupid user opening a virus on a local machine.

Re:Proxies & broken e-mail

[Anonymous Coward]

Bounced where? To the from: header? Right.

Re:Proxies & broken e-mail

[NetGyver]

Hell. It's possible that the `trojan' installed merely pulls images off of Usenet and saves them to the hard disk for the attacker to collect later, and it just happened that somebody had posted some kiddie porn to Usenet so this program captured it -- so there's six thousand `normal porn' images, and three `kiddie porn' images on the disk. Who knows?

That could quite possibly be the case. The more porn volume on your HDD, the more chances you could have 2-3+ `kiddie porn' pictures on you're system as well.

Authorities aren't lax on what they deem `kiddie porn' either. Didn't one of those child porn laws also include computer-rendered pictures of kids doing some sexual acts? Not only that but I've also heard that some pictures parents take (little girls all dolled up, bathtub pictures) could be grounds for violation of that law as well.

But you're right with that, there's probably more then meets the eye there.

Re:Proxies & broken e-mail

[Anonymous Coward]

or "from a new source (Key matches Joe Outlook Idiot)".

Wow, way to make yourself look like a zealot. For your information, I have used Outlook daily for years and never gotten a virus through it. Maybe, just maybe, it has something to do with who's using the software?

Try to wrap your fanatical little head around that.

Re:Proxies & broken e-mail

[mpe]

There is - it's called PGP. SMTP is only intended to transport mail, not to authenticate it. It's the client's job to determine if it should be accepted.

Mass use of such encryption would certainly make things harder for spammers. Since it would stop them being able to easily send one message to lots of recipients. Which is really what is at the heart of the problem.

Re:Proxies & broken e-mail

[loucura!]

Notice how he has Joe Outlook Idiot? That means he is distinguishing from the Outlook using morons and the Outlook using intelligent people.

Unfortunately, you fall into the latter.

Re:Proxies & broken e-mail

[dasunt]

First of all, if you haven't gotten a virus through your MUA, you either don't get a lot of email, or have a relatively obscure email address. Before you flame away, please note that there is a difference between receiving an email virus and being infected. I am receiving a lot of the "Fake MS Update Virus" lately, but I'm not infected.

That being said, one of the reasons why people are so against Outlook and Outlook Express is that its security model is broken: It is possible to be infected by certain viruses just by reading a message. Some viruses just need the document viewed in the preview pane. Quite frankly, that's a hell of a security risk. (To be fair, Outlook/Outlook Express's latest releases have been getting better at the security game, and Unix MUA are not immune from security problems, although Unix MUAs tend more towards mail bombs then viruses being spread.)

A good virus scanner will help protect you against email viruses, especially if the scanner acts like a pop3/smtp proxy (most of the popular modern ones do). But I'm not going to rely on AV software getting the virus definitions updated with the latest "virus of the moment" before my email client polls the pop3 server in the morning.

There are other free email clients for windows, so cost is not an issue. I've used several non-Outlook clients for windows, and as a general user, their performance and features compared to Outlook. (Although, if you need to poll a hotmail account, Outlook Express under windows is the only free win32 email client that I know of that can do it.) So, assuming that a free client will do everything you need, why not break the virus trilogy of Windows-IE-Outlook and use it?

Btw, the reason I said "Joe Outlook Idiot" is twofold. First, notice the "Idiot" - No MUA can protect a person from their own stupidity. Second, if your virus is going to target idiots and use their MUA to mail outgoing viruses, you are going to choose the MUA that most idiots use - which is Outlook/Outlook Express. (Note that while all Greeks are Human, not all Humans are Greek - or, although most of the idiots out there use Outlook/Outlook Express, not all Outlook/Outlook Express users are idiots). Therefore: "Joe Outlook Idiot"

Re:Proxies & broken e-mail

[muzzmac]

The only way I can think that you can get away without opening some REALLY basic ports eg HTTP, HTTPS and SMTP is if you are using some sort of local proxy to do the work and quite frankly malicious software can quite easily exploit these as well.

Yes it's true a good stateful outbound firewall helps you against some things eg IRC robots if you don't use IRC but you HAVE to open something or I can show you a brick which does the same job as your firewall.

When you open something you open it for better or for worse. Quite frankly I would be interested to know how you send an outbound email message if you don't allow an SMTP connection to something. Web clients only?

Re:Proxies & broken e-mail

[satch89450]

But, but, but... we are talking about spam-spewing viruses in this discussion, not just any virus. Let's try to stay on topic, OK?

Sure, I forward a number of well-known ports to the Internet from my LAN, but not smtp. This is all NetAdmin 101. I run an MTA (PostFix) that handles all outgoing mail -- all systems on the inside network send their mail there to be relayed to the outside world.

Could the spew-virus use my MTA? Only if it is very, very careful. (No, I'm not going to give away all my secrets on a public forum.) Suffice to say that a virus writer would have to be very clever indeed to find a way out. In addition to other measures, the MTA box has IPTABLES with a custom configuration that would further slow down any virus that does get inside and worms around the protections in place.

You bet I'm a paranoid son of a bitch. I visited a company just after a virus swept through its 150-system intranet, and that company lost more than $2 million in recovery efforts and lost productivity. I also remember that Microsoft found itself with the SQA thingie loose on its internal network. It happens. You plan for it. Indeed, in company intranets your inside systems are more of a hazard than anything from the outside. NetAdmin 102.

I also do not allow Outlook or Outlook Express to be used on my internal network. Period. NetAdmin 301.

How to configure PostFix, and possibly some other software, to stop a virus running on an authorized system/IP is an exercise left to the student. Term project for NetAdmin 401. Hint: think about authorization.

Re:Proxies & broken e-mail

[mrmud]

-- giving a new e-mail address (on the new e- mail system) won't be all that bad will it?

Think of it from a company's perspective. Exactly how do you tell the less-then-computer smart that your email address is A, unless they are on B, in which case your email adderss is B. Unless they are B compatable with their A email client.

Don't forget, the original idea behind email was that you could email anyone at anytime from anywhere. If you change that, it ceases to be email. (Not that that is really a bad thing...)

Re:Proxies & broken e-mail

[muzzmac]

OK. I wish you the best of luck. It sounds like you are at least doing something about the problem.

I am challenging the feeling I get from your post that what you are doing is the technical silver bullet to protect against threats like this. I've seen NO REAL silver bullets with malicious software.

I'm sure you could imagine exactly what a malicious piece of code (with the purpose of SMTP spamming) would have to do to get around your controls. I'm even betting it would not be THAT hard to actually write. I would take this further to say that it could be made generic enough to compromise other organisations corporations systems as well.

I strongly doubt the measures described fix many of the other threats we will no doubt get exposed to. (But that is off topic and you doubtless have other control measures not described)

They are strong mitigants however and would probably do your company well. In a smallish environment (I'm making a big assumption) you can probably exert that level of control over your systems and run a fairly tight ship with some fairly innovative controls. As your environment grows people like yourself move on, admins change and the threats migrate to other platforms etc some of these point solutions get lost in the mix.

My experience is with system and security admin in a growing organisation (now 10 000 staff. 1000 work in IT). We run similarly paranoid systems, in different ways, but I do not suffer the delusion that we are in any way safe from any number of threats. We have remained reasonably unscathed over the years due to some good planning and luck however the reality is you don't know where the next threat comes from or what it will target. Nimda was a classic example of that.

Mitigants like Outlook bans, paranoid MTA's and stateful firewalling aside, you MUST, in doing business, open your networks to threats. These can and will be exploited. There are no silver bullets. There is only a growing technology arms race and hopefully vigilant people.

I wish you luck and a bit of fun. :-)

Re:Proxies & broken e-mail

[Anonymous Coward]

me@myhost:~$ ping 10.0.0.11
64 bytes from 10.0.0.11: icmp_seq=0 ttl=64 time=0.2 ms
64 bytes from 10.0.0.11: icmp_seq=1 ttl=64 time=0.2 ms
64 bytes from 10.0.0.11: icmp_seq=2 ttl=64 time=0.2 ms
64 bytes from 10.0.0.11: icmp_seq=3 ttl=64 time=0.2 ms

--- 10.0.0.11 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
me@myhost:~$

Hey, you're on my network!

(kidding).

Re:Proxies & broken e-mail

[mark_space2001]

1. Err, actually, I have a hotmail account, and if there's a way to view the headers on hotmail, I can't find it. Hotmail appears to strip all header information when it stores the htmlized version for your webpage view (pop access or something might be different, I haven't tried that.)

2. My firewall is on a DHCP connection to my ISP, so tomorrow, the IP different is gona be different. Curses, foiled spammers again! ^_^

Filter egress port 25!!

[RT Alec]

If you are running a network, it behooves you to filter outgoing port 25. SMTP is a lousy protocol, and there is no successor to replace it (anytime soon).

E-mail server admins: Please lock down your servers! Only allow initial mail submission by authorized and authenticated clients, and only allow such subissions on a port other than 25. It's not that tough, and it's your job. Do it.

• Sendmail tips
• Qmail tips
• Exchange tips

There, no excuses.

Re:Filter egress port 25!!

[Webmonger]

Why would it matter whether users submit their email on the standard SMTP port?

I can see why you'd want to block port 25 outgoing on your firewall so no one can bypass your SMTP server, but configuring your SMTP server to accept mail on port 8025 or something... what's the point?

Re:Filter egress port 25!!

[RT Alec]

The point is that as responsible networks start to filter egress port 25 traffic, people on that network still need to send mail. If a user is not using their ISP's mail server (and there are many reasons why someone would choose not to), and the ISP is blocking outgoing port 25, then they can't send mail.

However, if that same user wishes to use a remote SMTP server (e.g. their company's server) that accepts initial mail submission on a different port (mine is set to use SMTP + AUTH + SSL, and runs on port 465), then all is well. See my previous links for tips on setting that up.

Re:Filter egress port 25!!

[WindBourne]

The sad part is that the number of servers just went from low millions to hundred of millions and your suggestion will not help out on the huge number of servers that will be coming down the pipe line.
BTW, I would love to find a stat that shows which systems (hardware, OS, server) is allowing the bulk to occur. I routinely check where my spam comes from and I routinely find exchange as the entry point (not always). I would much rather focus on getting the bulk done as opposed to simply shutting down everything.

Re:Filter egress port 25!!

[Anonymous Coward]

There's nothing wrong with SMTP. Why do you think switching to a new protocol will magically eliminate spam? What flaw of SMTP is required for all spam to be sent, and can be conclusively resolved by changing the mail protocol?

If you haven't thought through the design of the new protocol, and determined exactly how it will eliminate spam, don't spout this suddenly-popular Slashbot "SMTP is killing the Internet" crap.

Re:Filter egress port 25!!

[RT Alec]

What flaw of SMTP is required for all spam to be sent

The flaw is that it allows completely unauthenticated mail to be submitted. Perhaps I should have been more clear-- SMTP as it is commonly implemented is lousy. However, sys admins are lucky that the protocol has been enhanced. Using SMTP + AUTH requires a user name and password to ensure that only authorized users are using that server to send mail. Add SSL, and the user named and passwords are protected (and it uses a different port, 465).

As noted before, please see my initial post for tips on how to implement this. Most e-mail clients support these enhancements (Outook, Mozilla, IMail (Mac), etc.).

Re:Filter egress port 25!!

[Anonymous Coward]

Not quite. Using SMTP + AUTH (or other authentication mechanisms) ensures that only authorized programs are using a server to *submit* mail - that is, to send it into the murky depths of the network. All mail servers that have clients still have to accept mail from other servers destined to their clients, and they have no reliable way to make sure the remote server is a legitimate MX.

Authenticated SMTP would prevent some open proxy problems (i.e., people using open proxies to connect to the computer's designated MX and spam through it.) It wouldn't fix direct-inject-from-proxy spam, open relays, formmail scripts, or trojans like this one that could easily grab the SMTP AUTH info from the MUA. Hardly a panacea.

Re:Filter egress port 25!!

[blibbleblobble]

"Using SMTP + AUTH requires a user name and password to ensure that only authorized users are using that server to send mail."

But SMTP+AUTH doesn't require that the "From:" field be correct, does it? So it may help those who are prepared to trace IP addresses and proxy logs, but it doesn't help those people who send me hundreds of bounce messages per day because I appear in the From: address.

Re:Filter egress port 25!!

[Corvaith]

But you don't seem to have explained, here, how that solves anything, really. As more places start doing that, more other places will start providing mail on nonstandard ports, and inevitably you'll end up with poorly-secured mail servers running on all *kinds* of ports.

And not all of us using third-party email servers have any control how the admins of those servers set them up. The one I use--because my ISP server has been known to lose messages entirely--happens to operate on port 25. I am not able to just tell the people who run that server, despite being a paying customer, that they must operate on a nonstandard port just to please me. Most people--whether they are customers of other providers or employees using work emails--are not in a situation to arrange for different ports.

So blocking outgoing traffic on port 25 blocks a good number of people from getting to servers they have a legitimate right to use, and a *few* people from spamming. And the spammers will quickly pick up an ISP that doesn't do this, so pretty soon you'll be left with *only* legitimate customers being inconvenienced.

So why is blocking this port outgoing a good thing again?

The idea is almost as dumb as the places that block ports outgoing that have been known--in the distant past--to have been used by trojans and the like, despite having a good number of valid and current uses. (MUDs are beginning to see some of this.) For whatever slim benefit it might provide, it's not in any way worth the hassle.

Re:Filter egress port 25!!

[mpe]

There's nothing wrong with SMTP.

The basic problem is that many SMTP implimentations supported third party relaying. If would be a lot more difficult for send spam if the only way of doing it was to perform DNS lookups and make a TCP connection for every recipient. As opposed to being able to send a list of recipients and the body of a message to someone elses relay. However what really makes things bad is the amount of software now out there which requires a third party relay to work at all. Combined some anti-spam schemes to force use of third party relays, even on people running software which dosn't need them.
The biggest irony is that there is no requirement to support third party relaying at all in any of the relevent RFCs.

Re:Filter egress port 25!!

[Skapare]

And be sure to boycott any business or ISP that refuses to take all the appropriate steps. And don't listen to their whining about collateral damage, since they can avoid that by doing the right things with their mail servers.

Re:Filter egress port 25!!

[jdoeii]

Yes, SMTP is hopelessly broken, I can agree with that, but the rest of your comment is mistargeted.

Open relays are no longer the primary mechanism of spam delivery these days. Spam propagates through open proxies and tojaned hosts (jeem & friends).

Careless e-mail admins are not responsible for the bulk of spam. It's large DSL ISPs like rr.com and chello.nl. They run huge pools of home/small business DSLs. They absolutely do not care what happens on those hosts as long as customers pay. Probably as a matter of policy.

Why not

[shades66]

find out the hotmail address and send it loads of dummy IP addresses...

Re:Why not

[Anonymous Coward]

That's not what you do. Find the hotmail address and explain it to the FBI. This is something they would probably investigate. There's a log for the hotmail account that might be linked to the spammer.

I'm done, Cowboy! Please don't make me wait another minute.

Re:Why not

[Anonymous Coward]

[Why Not] find out the hotmail address and send it loads of dummy IP addresses...

Not necessarily a perfect idea, if you think about it.. this would mean lots of random machines getting clobbered by spammers on port (random / whatever the Guzu trojan had chosen). True, it'd reduce the amount of spam that they were able to send, but would the increased annoyance of other people being effectively port-scanned be worth it?

Re:Why not

[Anonymous Coward]

192.168.*
10.1.*
127.0.0.1

i imagine these folks are probably too stupid to filter it...

Re:Why not

[Micah]

Actually, if it's a single Hotmail address they're using, it should be easy to simply get MS to shut the address OFF! Then all their work is for nothing!

But like a previous reply said, reporting to the FBI might also be a good idea.

Why can't

[Anonymous Coward]

The virus writers write a virus that installs linux. My linux system dosen't get viruses or spam. Emerge the power!

This isnt desperation...

[acehole]

Desperation is when they start selling the penis enlargers door to door.

Seriously, has anyone actually *seen* one?

Re:This isnt desperation...

[Anonymous Coward]

Ever watch "Austin Powers"?

Re:This isnt desperation...

[MrNemesis]

With any luck, the 419ers'll start selling door to door as well. Then they'd actually have to give you the untold millions then and there, right?

Cos obvisouly, no-one is greedy or gullible enough to fall victim to the 419ers these days...

Re:This isnt desperation...

[WindBourne]

The real question should be: has anybody bought one or had a girlfriend/significant other that gave them one.
Now, you have problems.

Re:This isnt desperation...

[Jucius Maximus]

" Desperation is when they start selling the penis enlargers door to door. Seriously, has anyone actually *seen* one?"

What? You haven't seen Austin Powers?

Re:This isnt desperation...

[Phroggy]

Yeah, that's the only time I've ever seen anything like that too. Although, that was a pump, and although I have seen spam for pumps, I think most of it is for pills or something else?

Of course there was SNL Celebrity Jeopardy with Sean Connery and "The Penis Mightier", but that doesn't really count.

Re:This isnt desperation...

[tigress]

Oh, they come in pills now. My boyfriend tried them out for a month and he gained an amazing eight inches to his penis. Unfortunately, he also gained two cupsizes, lost 60 pounds and started receiving NBC and FOX.

I think I've seen something like this...

[Saint Aardvark]

I think I might have seen something like this. In my previous life as helpdesk/abuse guy at a small ISP, I was in charge of locking accounts for spamming. (Fortunately, it never happened very often.) So one day I get this complaint from SpamCop about a dialup customer of ours -- typical pr0n spam. Check the logs, find the account and lock it -- nothing that unusual, except for what happened next: the customer called in.

See, almost any time we've had people spam before, it's been someone who has signed up for an unlimited dialup account, then goes and spams right away before they get cut off. It got to the point where I was able to guess that someone was going to do this when I was taking down their details for an account; this happened with someone signing up for this guy, and I locked the account before it was even active. This person, like every other spammer I'd dealt with, never called back: they knew exactly what they were doing, and what I would tell them. But this customer did.

Furthermore, she was extremely convincing when she told me she knew nothing about spam. To all appearances she was nearly clueless about computers (no offense to her -- I'm sure I couldn't do her job), could not believe her computer had done anything wrong, and was offended by the spam her computer had sent when she saw the complaint from SpamCop. She didn't argue that it wasn't really spam, or say that she didn't know that it was wrong, or that everyone had opted in, or that it was just an experiment, or anything: she didn't know what she had done, and was confused and astounded when I told her. I ended up letting her back on, against my better judgement, with a warning that if it happened again I'd close her account and that would be that. We changed her password just to be sure that no one else was using her account; unfortunately, the modem she'd dialed in on didn't have caller ID, but she swore blind that no one else knew her password or used her computer.

So a month goes by and I get another complaint from SpamCop -- and it turns out to be the same customer. "Teach me to be nice," I thought, and locked her account. Caller-ID was recorded this time, and it was her number. I told the guy at the branch office where she lived that I'd locked this customer's account -- he had dealt with her the last time -- and he gave her a call. Again, he was convinced that she couldn't be spamming, and he convinced me that we should at least look at her computer. We brought it in to the branch office for a look.

Unfortunately, neither one of us really knew what to do beyond the obvious. It was running Windows 98, no updates; the guy at the office knew Windows, and I know Unix, but neither one of us had experience with this sort of thing. I did a portscan and found one port open (1234), but it the banner said "Express Search"; eventually found this link, which didn't seem to offer much. Meanwhile, the guy in the office ran Trend Micro's HouseCall and Panda's online virus scanner, and didn't find much of interest.

He ended up reinstalling Windows on her computer, adding a firewall, doing all the updates, and letting her back on; we didn't know what else to do. We kept looking around for some mention of a virus or trojan with an SMTP engine (beyond something like Klez, I mean), but couldn't really find anything -- just lots of "This is weird, anyone seen anything like this?".

Sorry to be so vague on the details, but like I said, I really don't know Windows and I'm really not a security guy. But I'm still fairly sure that either she was a wonderful actress, or some 133t haX0r had rooted her box to send spam. Needless to say, this is going to wreak havoc with anyone who has to be the abuse guy -- "Innocent victim of a virus or spammer scum? Hm..."

ObRant: Fucking goddamned spammers anyway. Fuckwads.

Re:I think I've seen something like this...

[Saint Aardvark]

Sorry, express search link here:

http://archives.neohapsis.com/archives/bugtraq/199 9-q4/0317.html

And I meant to mention that the first incident was at the beginning of March this year, and the second at the beginning of April.

Re:I think I've seen something like this...

[Jim_Hawkins]

I think I might have seen something like this. In my previous life as helpdesk/abuse guy at a small ISP, I was in charge of locking accounts for spamming.

In order for you to be a help-desk abuse guy at an ISP, you would have had to been around in say the early 90s when that was becoming popular.

So let's say that's true. That meks you around 13 now.

Is that true? ;-)

Re:I think I've seen something like this...

[Anonymous Coward]

That was an absolutely wonderful story. Make sure to tell the grandkids that one, they'll be absolutely enthralled.

No really. I mean it.

Re:I think I've seen something like this...

[Caveman Og]

Well, since I'm not only an abuse guy in a previous life, but also a present and future abuse guy (for big networks, even), I can give some further insight into this sort of thing.

1234 seems appallingly close to one of the ports sub-7 uses (1243). I would suspect some sort of back-door root-shell, and BEHOLD (through the power of Google):

http://www.itsecurity.com/asktecs/jun1901.htm
h ttp://www.iss.net/security_center/advice/Exploits /Ports/1234/default.htm

There are MANY trojans which use this port. "Ultors Trojan", is perhaps best known. There's also "SubSevenJavaclient". Nasty, nasty.

UDP traffic on port 1234 is indicative of "Infoseek Search Agent", which is the legit use for this port. The trojans do not produce UDP traffic.

Check out http://www.neohapsis.com/neolabs/neo-ports/

I would think that your experience predates the current round of spammer-specific trojans. This is, however, only the tip of the iceberg. Spammers are now creating entire zombie IP address allocations from abandoned or otherwise unused network space. A spammer with his own ASN and spammer-controlled BGP can create ENDLESS havok.

Zombies on the Register of Known Spam Operations:

http://www.spamhaus.org/rokso/search.lasso?evide nc efile=2493

Below are the lists of DIRECT ASNs owned or pirated by spammers, including many of the zombie netblocks:

APNIC zombies
http://spamhaus.org/sbl/listings.lasso?is p=apnic

ARIN zombies and spammer allocations
http://spamhaus.org/sbl/listings.lass o?isp=arin

RIPE zombies and spammer allocations
http://spamhaus.org/sbl/listings.lass o?isp=ripe

--Og

It opens them up to....

[sogoodsofarsowhat]

(sees seens from commercial of guy getting on plane to go visit telemarketer in person) to a brutal beat down :) (one must also be careful of the submit button early on a sunday morning ... doh)

Untraceable?

[Old Uncle Bill]

"It's untraceable. I hate to put that in print, but it's the truth."

So, if I'm running a sniffer while they are sending email through my PC I won't be able to find the source? I musta missed something in IP 101.

Re:Untraceable?

[Anonymous Coward]

That's what you get for skipping classes...

Re:Untraceable?

[cdrguru]

What a lot of people have suggested (and some have implemented) is to whitelist their incoming email. If you aren't on the list, they aren't interested.

Unfortunately, that does precisely what the anti-spam crowd wants. It makes email useful for friend-to-friend note-passing and useless for anything else. Why put your email address on a business card when nobody can send you email?

Absolutely, the spammers have to be dealt with. But "whitelisting" all email traffic isn't the solution. Neither is treating any email sent for any commercial purpose as SPAM.

Most of the spam I get comes directly from cable and DSL customers. I think we are going to see some new trends:

- Make $100 by sending a million emails from home.

- This kind of proxy that lets "contractors" use other people's machines.

This is a different kind of bounty for spam.

Re:Untraceable?

[rodbegbie]

No -- you'll just find the next proxy down the chain. And unless *they*'re running logging, that's no help

rOD.

Re:Untraceable?

[djmurdoch]

What a lot of people have suggested (and some have implemented) is to whitelist their incoming email. If you aren't on the list, they aren't interested.

Unfortunately, that does precisely what the anti-spam crowd wants.

Huh? The anti-spam crowd wants to make email useless? That's nonsense. For one thing, "the anti-spam crowd" is meaningless: *everybody* is anti-spam. Even spammers are anti-spam: they just claim that their spam isn't spam.

If you're talking about anti-spam activists, then you're right that some people suggest whitelisting, but I think a lot more activists are in favour of blacklisting and various methods of filtering. They're activists because they want to use email, and spam is making that harder.

Good blacklists and filters make it a lot better. For example, I get around 50 spams a day to my inbox, but only 2-3 a week make it past the SpamAssassin filter and SpamCop filtering service. SpamAssassin gets a few false positives each week; SpamCop gets almost none.

Re:Untraceable?

[Anonymous Coward]

I musta missed something in IP 101

not only did you apparently not go to class, you obviously couldn't program your way out of your ass.

Raw sockets, they're not just for breakfast anymore...

Re:Untraceable?

[Mike1024]

Hey,

So, if I'm running a sniffer while they are sending email through my PC I won't be able to find the source?

They could put a proxy function in. The spammer contacts one computer, and that computer contacts another. Thus the second computer couldn't locate the spammer, but any e-mail messages would only have the second computer's IP address.

If they were really crafty, they could have a web-like feature. Each infecteed system could scrape web pages for, say, 15 e-mail addresses (Could use IE's cache), and port scan computers for 5 different computers with the virus. The spammer injects one message into the network, and the infected computer forwards it to all 5 on the list, which forward it to all the systems on it's list, and so on. One day later, the network switches to 'send' mode, and each node sends out the message to it's 15 e-mail addresses.

A sort of Gnutella network + Code red port scanning + web page scraper + mail program virus.

Of course, such a program would get zapped by port blockers and virus scanners pretty fast.

Just my $0.02,

Michael

Your Analogy would be more appropriate if:

[Anonymous Coward]

We were to say an entire nation was to *move* to a new place.

There's nothing to say though, that a few people can't set up a secure protocol and start using it. If it catches on, then there you go.

But things like that are gradual.

Re:Your Analogy would be more appropriate if:

[greyrax]

True, it would be nice if the entire nation (actually, the entire world) would move.

It's probably more like switching from black & white TV to color TV. Or maybe moving from analog cell phones to digital ones, or...

Analogies are never perfect (TM)

Re:Your Analogy would be more appropriate if:

[Anonymous Coward]

If it catches on, it'll get implemented in Lookout! and we're back to square one...

an ounce of prevention...

[WegianWarrior]

...beats a pound of medication (or something like that - I'm not to good at english proverbs).

Don't run attachments from mails if you don't trust the sender. Do get a firewall that lets you block both ways (ZoneAlarm from ZoneLabs is my free favorite).The result? You won't get caught by this trojan, and if you should break the first rule of thumb, the second won't turn your PC into a spam-factory.

Re:an ounce of prevention...

[berzerke]

Don't run attachments from mails if you don't trust the sender...

And don't run strange attachments from emails if you DO trust the sender. After all, unless you're both using gpg (I've got only one person I talk with that does), the email address could be faked. Then there are the trojans...

Re:an ounce of prevention...

[scrain]

There's trojans out there now that disable anti-virus protection, and disable/reconfigure zone alarm to let themselves in and out.

Cheap, mass-market software firewalls will not protect you.

Only common sense and not opening mails/attachments and downloading files from untrusted sources will.

Unfortunately, far too many users are lacking in the common sense part.

No scoop here...

[Anonymous Coward]

"...has the scoop..."

Um, no, there wasn't any info in the article that was of any use. It would be nice to know a bit more detail, or at least the article could have pointed some links at a technical site with more info. The Slashdot intro. paragraph had just about as much detail as the entire article.

Security through Obsecurity...

[Anonymous Coward]

Doesn't have to be logical.
Just confusing.

And it's probably written

[xintegerx]

in Visual Basic, too, like most trojans seem to be. It's a very easy thing to make... that's not even counting that there is an abundance of source code for trojans and smtp examples. After all, it's 15 year olds that use trojans, 16 year olds that make them, and 22 year olds that make viruses.

Then funny thing is, after every mass-media-hyped outbreak, people are always surprised when computer experts say in an interview how making a basic trojan or .VBS script is easy. (After all, trojans just open up a winsock connection and scripts can be based on previous scripts, either.) They think it's something hard when it's something lame.

Okay I will have to end this rant without getting to the point, due to an incident. As I paused to help someone, they saw the "it's 15 year olds that use trojans," line and probably misunderstood as they were leaving. Geez. .. ..
Fine, I'll finish the point: If you are unemployed, get cracking on trojans! Windows trojans! Employers will love to see that you are smart enough to make one. JUST KIDDING! Although, probably true.....

Gimmie your addy

[UberLord]

I can arrange a rep to pop around and give you a personal demonstration :p

What would be even more worrying is...

[Anonymous Coward]

...if the trojan started sending out copies of itself, probably giving the spammer an exponential amount of IPs.

Now where have I seen this before?

[arvindn]

Seriously, your honor, it wasn't me - it was the virus!

I don't get The Register

[Anonymous Coward]

It looks like they have "the scoop", but really they just cut and paste the original Security Focus article two days after the fact. Why don't they bother mentioning that? Do they have a partnership? Am I supposed to just know?

Re:I don't get The Register

[UberLord]

Maybe you didn't check the author credited at the reg story

Rise of the Spam Zombies
By Kevin Poulsen, SecurityFocus

Re:I don't get The Register

[AndrewRUK]

They do mention it. At the top, where it says "By Kevin Poulsen, SecurityFocus", and at the bottom with "© [SecurityFocus logo]" as a link to www.securityfocus.com. Clearly you did read it, so how did you manage to miss that?

No, don't limit the Internet!

[fmaxwell]

If you are running a network, it behooves you to filter outgoing port 25.

Why? So that I can't test to see if the spam I received came from an open relay? So that I am forced to answer confidential e-mail from client A through client Y's SMTP server when I am at client's Y's site?

I agree that port 25 should be, by default, locked down on residential dial-up accounts (which spammers use as throwaway accounts), but don't lock it down everywhere. It breaks too many things.

Only allow initial mail submission by authorized and authenticated clients, and only allow such subissions on a port other than 25.

At the HELO/EHLO, an SMTP server doesn't know if the mail coming into it is "an initial mail submission" or just a message destined for an address served by that user.

If you set up an SMTP server on a non-standard port, then no one's mail gets there. AOL is not going to talk to your server on port 20025.

What happens when lots of mail servers are available on non-standard ports? Suddenly your port 25 block does not work any longer. Then the spammers will look for open relays on non-standard ports. You know that there will be a lot of them because there will be the "security through obscurity" crowd who believes that, because their SMTP server is running on port 31172, they can safely leave it open.

You're headed in the right direction, but leave port 25 alone. My SMTP server is configured to require identification and authentication to send e-mail outside of my domain. All mail servers should be configured that way. This crap of allowing anyone to send e-mail without a username and password is ridiculous.

Re:No, don't limit the Internet!

[RT Alec]

My suggestion is to leave port 25 open, but only to allow incoming mail from other SMTP servers-- and only for your local users (by definition, it will not relay mail). So how does a user relay mail (i.e. initial mail submission)? The responsible admin of the user's SMTP server has set up SMTP + AUTH + SSL on that server (or perhaps a different server altogether-- an even better idea). Now this user can send mail (i.e. relay mail, or use the server for initial mail submission-- different terms for the same thing in this case). However, other people (unauthorized people) cannot. Spammers may port scan to their heart's content, but will still be unable to relay any spam.

My server is port scanned all the time. Many have found my port 465 open, and many have found that it is running an SMTP server with SSL. However, they don't have a user name and password, and thus their attempt to spam is blocked.

Re:No, don't limit the Internet!

[Anonymous Coward]

Dialup users seem to become second class internet citizens. If my internet provider starts blocking ports, I LEAVE. I'm paying for unlimited and unthrottled ip, all protocols, all ports, in- and outbound. What's the obsession with blocking ports? It's ridiculous. There are millions of poorly administered systems on the internet, many on leased lines with fixed ip addresses. They're not going to go away, no matter how much people bitch that the owners deserve to be LARTed. There will always be ways to contact any one of your server ports with ABSOLUTE anonymity. DEAL WITH IT! In other words: Secure YOUR systems and stop telling others what they're supposed to do with theirs.

Re:No, don't limit the Internet!

[krray]

Don't limit the Internet? I think ALL ISP's should block outbound traffic on port 25 coming from their dialups EXCEPT to their SMTP server.

UNLESS you are a dedicated customer with a rented fixed IP -- those are left to the customer to maintain. I have purposely _always_ gone for a static IP knowing this is how it will ultimately be.

Now, if the ISP won't allow said traffic on a static IP then yes, it's time to find another provider. The ability for spammers to quickly/easily change providers and get another fixed IP will slow them down seriously.

All the hacked Windoze boxen around the world could then be used to just send outbound email, say 5 at a time every 20 minutes to the SMTP relay in the registry and probably not set off any bells, alarms, or whistles...and with 100,000 hacked boxes the spam WILL keep coming...

I personally think making it harder to move around and freely send email is option 1, with option 2 coming into place being the bounties, and my option 3 of pick a spammer a month and, well, take him out (it's fun sometimes :) -- they'll get the hint that MY bandwidth and MY server and MY client(s) is not their billboard.

If you happen to meet a spammer in passing I'd also appreciate it if you beat the shit out of them for no particular reason. I have. :)

Re:No, don't limit the Internet!

[Realistic_Dragon]

If you are sending confidential email unencrypted then you deserve everything you get. The chance of your plain text mail not being echoed _somewhere_ is essentially zero, and if you have PGP and/or VPN software installed what they do to port 25 is really none of your concern.

However, I am against blocking ports as I believe a much better solution would be to execute every stupid person on the planet. That should sort things out nicley.

Re:No, don't limit the Internet!

[Anonymous Coward]

I work for an ISP, and I absolutely agree. We will absolutely never be able to stop spam as long as we are forced in to the role of reacting to spammers after they have already sent their emails. We have to act proactively; which is to say we have to prevent spammers from accessing other mail servers before they start spreading their spam. One way to do this is for ISPs to block all outgoing traffic to port 25, except for access from machines which their customers register with the ISP as valid and legitimate mail servers (note: the ISP where I work is tier 2...we provide access to other businesses, mostly outside of the US). If spam comes from one of these servers, we know exactly who is responsible and we can deal with the offender.

Re:No, don't limit the Internet!

[fmaxwell]

If you are sending confidential email unencrypted then you deserve everything you get.

I've got years of experience in the computer field, much of it in coputer security, and I understand the concept of having security that is appropriate for the information being protected. Sending a confidential price quote to a client is not the same as processing a VISA transaction or transferring data related to national security. I would rather that client A did not see client B's price quote, but it's not a tragedy if it happens. Putting it on client A's server is simply stupid, though.

"Confidential" is not the same as "Top Secret."

Re:No, don't limit the Internet!

[Anonymous Coward]

I use three different mail providers, because, while my ip-connectivity provider is mostly excellent, their outbound smtp-server could be improved, to put it mildly. Blocking outbound port 25 means that providers can lock their users into using their provider specific addresses, which adds one reason not to switch providers even if you're not satisfied. That's bad for consumers; Dialup users become second class internet citizens. Take this and the important realization that spam will be sent distributedly through hacked/infected systems and there can only be one conclusion: blocking ports is stupid, at least from the user's point of view (because it doesn't solve the problem and creates new problems). It makes perfect sense for the network provider though as it furthers the AOLification of the internet.

Re:No, don't limit the Internet!

[fmaxwell]

Dialup users seem to become second class internet citizens.

You are. That's what happens when you go for $9.95/month residential, dial-up Internet access. You're probably also pissed off that you can't get a First Class meal when you fly in Coach. Want to be a first class Internet citizen? Then pay for it like I do: buy business-class access.

What's the obsession with blocking ports?

In case you hadn't noticed, spammers choose dial-up ISPs with all-ports-open for their spamming runs. When the access gets shut off, they are out $9.95. They are much less likely to do that with DSL or cable because there are very few providers (exactly one at my location) and the service is not $9.95/month.

Secure YOUR systems and stop telling others what they're supposed to do with theirs.

Get bent. My system is secure and spammers still send me crap. Running a secure SMTP server hasn't made a dent in the amount of spam I receive. The problem is asshole dial-up ISPs that leave port 25 open and act as a conduit for much of the spam on the Internet. There is no practical way for my mail server to to know if the system that sent the EHLO is a legit mail server or some low-life spammer using a dial-up account (yeah, I know about the dial-up blacklists and they are incomplete and inaccurate).

Re:No, don't limit the Internet!

[fmaxwell]

Blocking outbound port 25 means that providers can lock their users into using their provider specific addresses

Untrue. The SMTP server used to send the mail does not determine your address. I could send mail from my server and have a From: or Reply-To: address on yahoo.com. If they limited your access on port 110 so that you could only access their POP3 server, then what you are claiming would be true.

Take this and the important realization that spam will be sent distributedly through hacked/infected systems and there can only be one conclusion: blocking ports is stupid

Okay, your hacked/infected system is connected to a dial-up ISP that blocks port 25: How will it connect to mail servers all over the world to deliver the spam with port 25 blocked?

It's not the concept of blocking ports that is stupid...

Re:No, don't limit the Internet!

[Anonymous Coward]

The SMTP server used to send the mail does not determine your address.

It does not have to, but if the provider so desires, it does. The biggest provider of dialup internet access in Germany doesn't allow arbitrary FROM unless you pay extra for access to a different SMTP server.

How will it connect to mail servers all over the world

It doesn't have to. If the machine can send normal mail, then the trojan/worm can send mail too.

Re:No, don't limit the Internet!

[Realistic_Dragon]

Encryption is easy - KMail+GNUPG makes it easier to encrypt email than not to bother selectivly. You should already be signing all of your mail (especially a quote!) anyway.

In addition to this if you are going to encrypt anything you need to encrypt everything (or as much as is possible) as that way the stuff that you do send encrypted will not attract undue attention.

Re:No, don't limit the Internet!

[homer_ca]

"In case you hadn't noticed, spammers choose dial-up ISPs with all-ports-open for their spamming runs. When the access gets shut off, they are out $9.95. They are much less likely to do that with DSL or cable because there are very few providers (exactly one at my location) and the service is not $9.95/month."

They rarely spam directly from dialups because it's slow. What they will do is exploit open proxies on cable or DSL lines. It might be an insecure Wingate proxy, one of these Trojan zombies, or they'll even pay a college student to deliberately run an open proxy. An open SOCKS or HTTP proxy will thoroughly anonymize the mail headers of anything sent through it, so well that you probably wouldn't need throwaway dialup accounts anymore. It's a very good reason to block email from dynamic DSL and cable modem IPs.

Re:No, don't limit the Internet!

[fmaxwell]

They rarely spam directly from dialups because it's slow.

Untrue -- and I run the domain anti-spam.org, so I know a bit about the problem. By using the BCC mechanism, they are able to find an open relay, send the message once and BCC a hundred or more recipients. The open relay SMTP server then sends a copy of the message to each BCC recipient. Thus, the spammers get bandwidth multiplication.

It's a very good reason to block email from dynamic DSL and cable modem IPs.

Now you're grasping at straws.

Re:No, don't limit the Internet!

[fmaxwell]

It does not have to, but if the provider so desires, it does.

Okay, so that's a different problem and not the one we are discussing. Simply forcing a dial-up user to go through their ISP's SMTP server does not force the user to use an e-mail address in that domain.

It doesn't have to. If the machine can send normal mail, then the trojan/worm can send mail too.

Untrue. The trojan horse spam programs directly connect to the recipients' SMTP servers to deliver the messages. They do not go through the SMTP server of the infected machine's ISP. Why? Because many ISPs monitor their servers for abnormal traffic volumes to catch spammers. The programs would be automatically shut down in minutes on many ISPs.

Re:No, don't limit the Internet!

[fmaxwell]

Encryption is easy - KMail+GNUPG makes it easier to encrypt email than not to bother selectivly.

Only if you are running Linux. I do not. Nor do my clients. If I send them something encrypted, then they can't read it. I appreciate the suggestion, but it's a non-starter.

You should already be signing all of your mail (especially a quote!) anyway.

Why? The people at the client sites can call me if they are not sure mail is from me. Besides, most of them would not know how to verify a cryptographic signature anyway. No one has any great desire to forge e-mail from me -- quotes or otherwise. Do people often forge e-mail to your clients to make it look like it came from you?

In addition to this if you are going to encrypt anything you need to encrypt everything (or as much as is possible) as that way the stuff that you do send encrypted will not attract undue attention.

If you use strong encryption, you don't need to worry about how much attention it attracts, do you?

Re:No, don't limit the Internet!

[Realistic_Dragon]

Some rather backwards and opressive countries force you to hand over your encryption keys on request.

If there is so much encrypted traffic the SnR ratio becomes too high for this to be useful, and your ability to communicate without the worry that you will be listened to is preserved.

Re:No, don't limit the Internet!

[Anonymous Coward]

Okay, so that's a different problem

No, it's not. Once it becomes common practice to block certain ports, users can no longer demand that they get access to outside mailservers. ISPs will use that to their advantage. If you're happy with paying extra for every standard port and being babysitted, get AOL.

many ISPs monitor their servers for abnormal traffic volumes

Again, they wouldn't have to pump out as many mails as they can push through the pipe. It's a distributed system.

And after all, don't forget that blocking outbound port 25 is one of those ideas which only work if almost everybody implements them. I could list a dozen ideas that would eliminate spam completely if everybody played by the same rules. Not going to happen. It's a hard lesson, but the internet teaches us that you MUST deal with unwanted behaviour at YOUR end of the connection. You simply can't force everybody to behave according to your preferences.

Re:No, don't limit the Internet!

[fmaxwell]

No, it's not.

Yes, it is a different problem. Making you use your ISP's SMTP server is not the same as making you use an e-mail address on their system.

I'm not interested in your predictions about what ISPs will do in the future. In fact, I believe that you are simply wrong and can point to dial-up ISPs that block port 25 and don't care what your From/Reply-To address is when you use their SMTP servers.

If you're happy with paying extra for every standard port and being babysitted, get AOL.

I'm the one paying for commercial broadband Internet access and running a mail server, web server, FTP server, IDENT server, and VPN while you're whining about your residential dial-up. It sounds like you're a lot closer to an AOL customer than I am.

Making you happy with your cheap dial-up service is not nearly as important as reducing spam.

Again, they wouldn't have to pump out as many mails as they can push through the pipe. It's a distributed system.

You're talking theory and I'm talking reality. The existing programs rely on the infected machines having port 25 access. Take that away, and the programs stop working.

And after all, don't forget that blocking outbound port 25 is one of those ideas which only work if almost everybody implements them.

That's as stupid as saying "it's okay to run an open relay because you can't stop everyone from running them."

If half of the ISPs blocked outbound port 25, then only half of the infected machines would be sending spam. And spammers would have fewer ISPs from which they could get throwaway accounts for spamming.

Re:No, don't limit the Internet!

[homer_ca]

I meant spam directly from dialup to the recipient's MX, not through an open relay. I know open relays can send multiple copies and amplify the bandwidth of a dialup. A normal mail server that's an open relay would have Received: headers with the spammer's source IP, and there's still a chance you could get their dialup account killed. If they spam through an open proxy, there's no way to find their IP except with forensics on the open proxy computer.

Re:No, don't limit the Internet!

[Anonymous Coward]

I assume that jaywalking and people getting run over by cars when they cross a red light are different problems too? Port blocking is short-sighted activism. It solves problems for a few months, only to stick around much longer and cause other problems.

I am paying for residential dial-up internet access. You're the one who advocates crippling the net. You seem to be happy about having to pay for a business account just to use the internet. Maybe we should only allow cars which cost more than the 85 percentile to use the highways during rush hour. That sounds like a traffic jam solution you would support. And it would work too!

PS: IDENT server? You've got to be kidding... Explains your elitism though.

Re:No, don't limit the Internet!

[fmaxwell]

I assume that jaywalking and people getting run over by cars when they cross a red light are different problems too?

No, but that's a poor analogy to this situation since neither carelessness or accidents are involved in implementing an outbound port 25 block. Again, forcing you to use your ISP's SMTP server does not force you to use an address within their domain. There are dial-up ISPs that already block outbound port 25 and do not force you to use an e-mail address within their domain. You are beating a dead horse.

You're the one who advocates crippling the net.

Not the net, just your dial-up residential access to it. The benefit to you of having outbound port 25 open does not outweigh the risk and cost of spam to the rest of us.

You seem to be happy about having to pay for a business account just to use the internet.

As I said before, you're probably the type who pays for a coach ticket and then gets pissed off that because you don't get a first class meal. Well, get over it. Residential dial-up accounts are widely used by spammers as throwaway accounts for spam runs. PCs infected with the spamming proxy that we're discussing here are often hooked up to residential dial-up Internet accounts.

Maybe we should only allow cars which cost more than the 85 percentile to use the highways during rush hour.

Yet another ill-conceived analogy. I would be willing to bet that over 99% of dial-up Internet customers exclusively use the SMTP server provided by their ISP. Thus, blocking outbound port 25 would inconvenience maybe 1% of the users. That's insignificant if it reduces spam.

PS: IDENT server? You've got to be kidding... Explains your elitism though.

If you knew much about the Internet (which you clearly don't), you would know that many SMTP servers do an IDENT query. If you don't have an IDENT server, they wait until they time-out, adding a lengthy delay to e-mail delivery and leaving the session open longer.

Re:No, don't limit the Internet!

[fmaxwell]

I meant spam directly from dialup to the recipient's MX, not through an open relay.

Proxy-Guzu uses its own SMTP engine to directly contact the spam recipient's SMTP server to deliver the spam. It does not go through either an open relay or the MX host assigned to the infected machine.

A normal mail server that's an open relay would have Received: headers with the spammer's source IP, and there's still a chance you could get their dialup account killed.

My time is worth something. I already spend many hours every week fighting the spam problem. If the computer infected with the spam proxy was on a dial-up ISP that blocked outbound port 25, they could not connect to my mail server. I would not have to interpret headers and write spam complaint e-mails. That would be a good thing.

Re:No, don't limit the Internet!

[Anonymous Coward]

I don't expect a first class meal. I just don't want you to sabotage the net I *already* *have*. My computer has a routable IP address, it's part of the net. Don't give me that "your ... access to it" bullshit.

That sort of elitist crap is the reason why I stopped believing in tech-people's ability to solve the spam problem. Now the lawyers will have a go at it, because you can't think of a way which doesn't rely on a few priests guarding the manna of true ip connectivity and treating the majority of internet users like unworthy beggars. BOFH days are over.

"If it reduces spam". That's exactly the point. It doesn't, not significantly enough in the short term and certainly not in the long run. But it creates precedent for further service reductions. 99% of the users would be perfectly happy with a web-only internet plus maybe some ports for online games. Let's block the rest and reserve the real internet for the gurus who don't know that instead of setting up a meaningless IDENT-server, you can just as well send the proper ICMP message to servers which still use this bogus authentification scheme. News for you: "Only root can use ports below 1024" is a thing of the past.

Re:No, don't limit the Internet!

[fmaxwell]

I just don't want you to sabotage the net I *already* *have*.

Too bad. Dial-up access to port 25 is leading to a tremendous quantity of spam -- regardless of your claims to the contrary. I know that it is: I have the server logs and IP look-ups to prove it.

Don't like my solution? Then propose another solution. How about one-year, non-refundable contracts for dial-up? That way, the spammer is out for twelve times as much money if he gets booted. But then I suppose you don't like that either. You would rather just whine about wanting to pay $10 at a time and have all ports open at all times regardless of the costs and risks to everyone else on the Internet.

because you can't think of a way which doesn't rely on a few priests guarding the manna of true ip connectivity and treating the majority of internet users like unworthy beggars.

The "majority of internet users" on residential dial-up don't connect to SMTP servers other than the one provided by their ISP. Quit acting like a port 25 block is such a major imposition on the average dial-up user. It's not. Mindspring/Earthlink, MSN, AT&T, Verizon, Bellsouth, and other major players block outbound port 25 and it's a damned good thing that they do or the spam problem would be even worse than it already is. The the people who sell spamming software hate port 25 blocking, so it's obviously affecting their business.

Let's block the rest and reserve the real internet for the gurus who don't know that instead of setting up a meaningless IDENT-server, you can just as well send the proper ICMP message to servers which still use this bogus authentification scheme.

If this is typical of the messages you post, it's no wonder that you post anonymously.

Short version: You don't understand IDENT or how widely it is used on the Internet (not a surprise given your use of dial-up). I don't have time to whine to every sysadmin in the world that runs a server that requests information from IDENT. It's easier and smarter to run an IDENT server than to firewall packets on port 113 since many servers (FTP, IRC, SMTP) will have fewer delays when they get an answer for IDENT than when they get an RST.

Re:No, don't limit the Internet!

[Anonymous Coward]

Too bad indeed. You're the definition of "anti-spam zealot". Your activist mind can't grasp that once you close port 25, spammers will simply move on to other ways of delivering their crap. They are used to getting around obstacles, and -- I hate to say it -- in that respect they're MUCH closer than you to the ideal of the internet as it once was. This article is ALL ABOUT that next step, how blind can you be? I'm really looking forward to widely implemented ip-level encryption. Maybe when port numbers are hidden from routers, the whole port blocking crap will stop looking like a viable way.

Re:No, don't limit the Internet!

[fmaxwell]

You're the definition of "anti-spam zealot".

Thank you. I am proud to be "one who is zealous; one who engages warmly in any cause, and pursues his object with earnestness and ardor" as Webster's Revised Unabridged Dictionary defines "zealot."

They are used to getting around obstacles, and -- I hate to say it -- in that respect they're MUCH closer than you to the ideal of the internet as it once was. This article is ALL ABOUT that next step, how blind can you be?

This article has been about how they are still using the same old open-port-25-hole and stealing from other Internet users. They haven't found some clever new way to get their spam delivered. It's all still going through port 25 via SMTP just like it always has. All they are doing is making their own open relays.

I'm really looking forward to widely implemented ip-level encryption. Maybe when port numbers are hidden from routers, the whole port blocking crap will stop looking like a viable way.

It's not "crap" and it is a viable means of combatting the spam problem. If port blocking was not effective, there would not be so many large ISPs using it to stem the flow of spam.

I don't like port blocking on any service and I only reluctantly support it for dial-ups on outbound port 25. I have been pretty vocal when ISPs block incoming 80 (HTTP) and 21 (FTP) just to prevent their customers from running servers on their so-called "unlimited Internet access." But, in the short term, I don't see any other reasonable alternative to port 25 blocks. Every Proxy-Guzu server that's behind a port 25 block is not sending spam. Every time that a port 25 block stops some spammer from relay-raping some server it's saved a lot of people from a lot of cost, aggravation, and time. Whether you or I like port blocking, it's effective in combatting the spam problem right now.

My fear about reinventing SMTP is that the result will, inavariably, involve some kind of authentication credentials. I can easily envision some kind of system where anyone running a mailserver has to pay Verisign or some other Certificate Authority for a cryptographic certificate. Anyone wanting to e-mail anonymously will be out of luck. Anyone who does not want to pay for an ID will be out of luck. You think I'm elitist, try running an SSL web server. You practically can't run an e-commerce site without paying big bucks every year for a certificate. That's where I'm afraid e-mail might be headed.

I reread some of my earlier posts in this thread and I apologize for slinging insults rather than sticking to the point. I'm not going to play a who-started-it game with the insults. I engaged in it and was wrong to do so. Sorry.

Untraceable Really ??

[Crashmarik]

Every Spam is selling something. Someone is paying to have it sent out. Don't trace the spammers. Hit the advertisers. Subpoena for who they are paying to send out the stuff, and then go after them criminally.

The people that actually have their capitol tied up in penis and breast enlargers, sure as heck don't want it seized.

Re:Untraceable Really ??

[Anonymous Coward]

They all say the same thing, "Spam? What spam? I didn't know anyone was advertising my products with spam. Those bastards!"

Re:Untraceable Really ??

[ctishman]

Well, has anyone actually ORDERED a product they've been spammed about? I seriously doubt these people would do anything but identity theft.

Re:Untraceable Really ??

[JaredOfEuropa]

Exactly the right approach. Hey, if they can charge investors in Napster with aiding illegal file-sharing, the case against spamvertising scum in court should be a walkover.

Re:Untraceable Really ??

[Anonymous Coward]

It DID take more than a year to shut down that Berrytrim spammer, (he blames everything on his "affiliates") but he did get shut down. Some things can only be sold by spam: impossible weightloss, penis/breast enlargement, Norton Systemworks... excuses from such "legitimate vendors" are obviously just that -- excuses for their spamming. It does not take a rocket scientist to sort the legit guys out.

Re:Untraceable Really ??

[nd]

Except with this approach, you give people the motivation to harm companies by actually spamming for them against their will. How would you determine if they were really responsible for the spam or if it was an enemy of the company trying to get them in trouble?

Yes, realistically speaking, it's still untraceable.

Re:Untraceable Really ??

[MCZapf]

There has to be evidence somewhere of the transaction with the spammer. The company has to pay him somehow.

Re:Untraceable Really ??

[isomeme]

I suspect that in many cases there is no real product (or even 'real' company) behind the sleazier spams. The whole thing is a trick to get your money, and probably your CC number for further fun and games. After all, most people will be too embarrassed to complain to the cops that their penis enlargment pills never arrived.

Re:Untraceable Really ??

[Anonymous Coward]

Every Spam is selling something.

Not true.

Haven't you seen the Norton Antivirus credit card scam? They send you an ad for it, give you a link to order it on an insecure site which is obviously not associated with Symantec.

Re:Untraceable Really ??

[rizawbone]

well, in terms of porn spam, you just link analfistingsluts.com members only backend to some fake addressed/sketchily homed fistingfistingsluts.com signup frontend. now you have this 5-10 meg frontpage hosted with some little old lady in iowa who has no idea about what the fuck is about to happen. if you get shut down, who cares? the only way for spamhunters to find out your real address is to sign up for your services, and no one will do that that yet.

Re:Untraceable Really ??

[Anonymous Coward]

The money has to go SOMEWHERE. And unless you're paying cash (kind of hard to do by email), the wonderful orwellian tracing and accountability of our credit card system should be able to track down that fucker in a jiffy...

Re:Untraceable Really ??

[Drgnkght]

Speaking as someone who has worked in the Loss Prevention dept. of a credit card company, it isn't that simple (assuming of course the fraudster has the common sense of at least a turnip).

In all likelihood they will never submit a charge to your account for the penis enlarger/whatever. It is far more likely that they will use your card number to purchase easily liquidated items from other merchants. It wouldn't be that difficult. After all, you just gave them all the information that any legitimate merchant would need. I'd be more concerned about identity theft. That is a pain to get resolved.

Re:Untraceable Really ??

[podperson]

There's always the folks who're just trying to validate mailing lists or who are out-and-out con-men (the Nigerian swindle, for example). These folks don't need assets or physical capital, and they're every bit as annoying as someone selling fake viagra.

For that matter, trying to put an already marginal mail order business operating from a post box and email account in Venezuala out of business is probably tougher than you think.

No, actually..

[Lord Bitman]

This is more to say "Not everyone who gets blocked deserves it"
Prove me wrong.

Re:No, actually..

[Dimensio]

How do you mean?

Re:No, actually..

[frankie]

Not everyone who gets blocked deserves it

No. Anyone who gets infected by a Spam Trojan deserves to be blocked, until they clean up their PC. You are a threat to your fellow internet users, in much the same way that people infected with SARS should be quarantined.

Re:No, actually..

[Lord Bitman]

Okay, I guess you're some kind of magical super-genius with the ability to block only invidividual connections, for only the ammount of time that particular user is using that particular connection. Nevermind, I guess all the reports of thousands of innocent people being blocked when a spammer forwards through a mail server on the same subnet were just completely false, made-up bullshit, and that this whole issue is obviously (thanks you for pointing it out) completely one-sided and no one ever gets hurt who isn't actively spamming or actively supporting spammers.

Thick Sarcasm exists to be used.

Re:No, actually..

[Lord Bitman]

read reply to "frankie" in this thread

Re:No, actually..

[frankie]

thousands of innocent people being blocked when a spammer forwards through a mail server on the same subnet

Full stop. I was talking about blocking of individual IPs. That's entirely doable and practical except for DHCP groups, which should not send their own mail anyways. They should connect to a dedicated server.

Subnet blocking is a separate debate. I agree that it's a shame for all the more-or-less innocent neighbors who lose some connectivity. It's happened to me (and the other few thousand users at JHU) more than once. But experience has shown that wide blocklists get the spam shut down much more quickly than a narrowly tailored one. Squeaky wheel.

Re:No, actually..

[Lord Bitman]

If you, personally, are blocking them, that's all fine and dandy. Unfortunatly, you do not control the internet.
Not everyone who gets blocked as a result of this Trojan will deserve it.

Spamming

[-Rainer38-]

Next up: Distributed Spamming

What would be worrying is...

[Anonymous Coward]

...if the trojan starting sending itself out, giving an exponential supply of infected machines.

limited storage

[shione]

hotmail accounts only have 2-3 megs of storage and they get canned every month. The spammer is gonna get a lot of mail... and have his account overflow. hmm one could even see that as him being spammed....

A simular program used by spammers...

[Anonymous Coward]

Is AnalogX Proxy, which is quite popular with spammers.

As for the not traceable, well I wouldn't count that out. What if someone really knew what was happening, deiced to download, and isolate the program with the intent of finding them?

Yes I know they could use anon proxys, but then there is the chance that the anon proxy is not an anon proxy. I wouldn't be surprised if just like honeypots fake anon proxys start popping up with the intent of catching their real ip.

Only problem I see is that the spammers are willing to take the risk and also start using chains of proxys. But wouldn't doning that make things too slow?

Re:A simular program used by spammers...

[Anonymous Coward]

Some of them are already "chaining" to some degree. When I get scanned for formmail exploits, they typically arrive from a dozen different machines over the course of 5-10 minutes. Most of them are usually listed in things like the monkeys.com open proxies list, so there's your chaining.

They use open proxies to look for other holes, and they would probably bounce through a few to do the actual spamming. As long as they don't hit a honeypot as the first hop, then they're relatively safe.

Now, tie this in with the trojan scheme mentioned in this story, and they can have a fairly large number of first hops that are running their own software. Unless/until someone manages to spoof *that*, then there's no point in trying for honeypot action.

Re:A simular program used by spammers...

[rizawbone]

Spammers are currently pooling thier efforts into making 'anonymous for us' proxies. Groups will split the cost of a T1 on a failing provider and spam the fuck out of it for a few days, then buy another one or two.

Seriously though, these people are still sending out millions of spams a day per company.

Prosecutable?

[Newtonian_p]

If they ever get sued for doing this all they have to say is that they're not the ones who sent the trojan, they just tought the plaintive was your usual open relay.

Run by someone who will gladly have his server foward any message you send.

Turn yourself in

[Anonymous Coward]

And what they're doing is illegal and opens them up for prosecution. Hello, FBI? Come take my computer away as evidence for months/years/eternity while you conduct an investigation into this trojan email spam thingy. What? Illegal porn and warez on my computer? Suspicious letters in My Documents? Hey, why are you arresting me?!?

Re:Here's someone who might be able to help

[Drgnkght]

Easy way to do this is with VMware. Setup a firewall on your test computer which logs all IP traffic going in or out. Then install VMware on it. Setup a virtual machine and install Windows on it. Set the virtual machine's file system so that changes are lost when it is powered off. Start it up and launch the virus inside the virtual machine. All network traffic from the virtual machine will be in your firewall's logs. SMTP (and IRC too, btw) is plain text. Just look for an unfamiliar hotmail address.

This works well for tracking down IRC trojans too.

Ok, so it isn't hacking but it gets the job done.

This spammer uses proxies

[Animats]

The "girslwhocry" spammer I mentioned yesterday makes heavy use of proxy servers. The spams come from a large number of different IP addresses. Some of the IP addresses from which they send spam are running Telnet proxy servers which answer ordinary Telnet requests. Others, though, are DSL ports from all over the world. Here are some typical "received" lines:

• Received: from cpe-203-51-210-143.qld.bigpond.net.au ([203.51.210.143] helo=downside.com)
• Received: from dsl-200-78-25-58.prodigy.net.mx ([200.78.25.58] helo=downside.com)
• Received: from kawij-aw-5452.mxs.adsl.euronet.nl ([212.129.212.82] helo=downside.com)
• Received: from 80-24-219-243.uc.nombres.ttd.es ([80.24.219.243] helo=downside.com)
• Received: from abn134-41.interaktif.net.tr ([195.174.134.41] helo=downside.com)
• Received: from wd-c-68dd.mxs.adsl.euronet.nl ([62.234.136.221] helo=downside.com)
• Received: from host-148-244-79-22.block.alestra.net.mx (HELO downside.com) (148.244.79.22)
• Received: from elog-lab.ret.forthnet.gr (HELO downside.com) (193.92.145.218)

Those are all from a sequential block of spam bounces that we received. Look at the locations: Spain, Greece, the Netherlands, Maylasia, Turkey. That has to be some kind of distributed attack.

They're using our name. I operate Downside, a respected financial information site, and own "Downside" as a registered US trademark. I want to find out who's behind this. They're making us look bad. I get hate mail, because this spammer is advertising "extreme rape" sites.

Insights on how they're doing this would be appreciated. If this spammer can be clearly tied to felony computer intrusions, that would give me something solid to give my attorney.

Re:This spammer uses proxies

[Anonymous Coward]

he's using sockschain

Re:This spammer uses proxies

[h00pla]

Sounds like the same thing that happened to Linux Online

Re:This spammer uses proxies

[stefanb]

Some kinds of porn are illegal in at least the European Union. If you can convince the appropriate authorities, there might be a chance to get the dial-up machines seized and analysed, and getting a trace back to the original perpetrators. This would also be your chance to hit them with civil charges.

However, I would be surprised if these people only had a single layer of indirection...

Re:OE Question.

[Meowing]

That's why they call them trojan horses. The recipient is told that the program will enable access to unlimited free prawns or a faster internet connection or some other crap along those lines.

Does this virus affect Evolution?

[TooLazyToLogon]

or other Oulook like unix mail programs

Re:Does this virus affect Evolution?

[Meowing]

It's generally not going to be worth the spammer's bother with a program that targets much else than Windows, since that's what the vast majority of people are running. But, stuff of this nature doesn't necesarily need to encounter specific mail programs, anything that will save attachments will do the job.

All the scammer needs to do is convince a few of many recipients that they'll get something for nothing, and they will gladly save and run the program by hand if necessary. If that seems hard to believe, just remember that people do fall for the Nigerian banking scam, and the stakes for this spam deal are going to be a lot lower.

Iraq

[telstar]

I just wish there was a way to get them to stop trying to sell me those damn Iraqi playing cards.

Activists vs. anti-spam crowd

[cdrguru]

Maybe everyone is anti-spam. Probably even.

The "anti-spam crowd" are those that firmly believe that email is for their personal communications only. Any commercial use violates the terms of how the Internet was created and that is exclusively for the benefit of the user community. After all, the US taxpayers (and Al Gore) created it - it should be free of all commercial interests.

So, if a company sends an email newsletter they are spamming. If it has an advertisement in it, it is evil spam and must be stopped.

Re:Activists vs. anti-spam crowd

[etrnl]

No. The antispam crowd believes that it boils down to consent. It is fine for companies to send me newsletters... only if I have given them the permission to do so. If I have not given them permission, then it's UCE.

There is a difference between CE and UCE, and only the latter is bad.

Don't mix Stallman's ideas about commercial interests with the antispam crowd. None of us are as rabid as he is.

--etrnl

Re:Activists vs. anti-spam crowd

[Steve B]

The "anti-spam crowd" are those that firmly believe that email is for their personal communications only. Any commercial use violates the terms of how the Internet was created and that is exclusively for the benefit of the user community.

Where's the "-1: Propaganda That Baghdad Bob Couldn't Deliver With A Straight Face" option?

Re:Activists vs. anti-spam crowd

[djmurdoch]

The "anti-spam crowd" are those that firmly believe that email is for their personal communications only. Any commercial use violates the terms of how the Internet was created and that is exclusively for the benefit of the user community.

I believe that there are people like that, but calling them the "anti-spam crowd" is bizarre. Look on the anti-spam websites listed on Spamlinks. I haven't looked at all of them, but I still doubt you'll find *anyone* there espousing the view above.

Duncan Murdoch

Re:Activists vs. anti-spam crowd

[runderwo]

Don't mix Stallman's ideas about commercial interests with the antispam crowd.

And what, pray tell, would those "ideas" be? That people are encouraged to commercialize software as long as it does not become proprietary? Oh, the horror!

Taking completely unrelated cheap shots at rms is probably not a good way to argue your point about spam.

Re:OE Question.

[Anonymous Coward]

The recipient is told that the program will enable access to unlimited free prawns

How extremely shelfish of them..
*ducks*

Spamming Trojan Honeypot...

[bluelarva]

... might be something that can be used to catch the spammer. Set up a box on some dialup disguised as a compromised box and study the behavior of the spammer and then track down the slimebag.

No! Don't filter port 25!

[Fefe]

The major innovation that sets the Internet apart from other networks is that it is a peer to peer network! Every IP is equally important, and everyone is client and server.

NAT and proxy-only access are already threatening that. Don't give up the non-centralized nature advantage of IP or the future looks bleak!

Sending email through my ISPs relay has several important disadvantages. First and foremost, I cannot see whether the mail was already delivered to the recipient's SMTP server or whether it still is rotting in my ISP's queue. Also, my ISP might have a disk crash and lose my mail in his queue. This danger is completely eliminated if I send my emails directly. And why wouldn't I? It is faster and my ISP has less cost to burden and consequently less money to charge me.

In the grand tradition of Slashdot, also consider the "free speech" aspects of this ;-)

The even brighter side...

[Anonymous Coward]

I'm running t3h Lunix! Suck on dat, bizn0tch35!!!!

New strain seen in the wild...

[joejoejoejoe]

There is a new strain of this virus in the wild now...

The slashdot editors' 'puters have almost all been infected. A source who agreed to comment on the grounds of anonyminity said: "yeah, they got Taco a while ago, but now Timothy and a few others are competing for most Dupes posted to the front page..." He went on to say: "Taco has really been hurt by this. He has admitted in private he can't tell the difference between news and news that was already reported [on his site]."

This has been confirmed by another source: "yeah, they got Taco a while ago, but now Timothy and a few others are competing for most Dupes posted to the front page..." He went on to say: Taco has really been hurt by this. He has admitted in private he can't tell the difference between news and news that was already reported [on his site].

For proof, please reference these links: Catching up with Wine,World of Ends Public Draft, TarProxy Creates Tar Pit... For Spammers , Toms Hardware Reviews 65 CPU's, Past & Present , Linux on the iPod , Why VHS Was Better Than Betamax , Environmental Impact of the Ubiquitous Microchip , Toner Cartridges new DMCA victim , Ogg Vorbis in Quicktime 6.0.2 , Sony, Matsushita Back Linux For Consumer Goods , When Personalization Runs Amuck , Spam King Lives Large off Others' E-Mail Troubles , Ogg Vorbis For Hardware Makers , When Spun Really Fast, CDs Explode.

Or just check this site: SlashDupes.com

Or just check the home page of www.slashdot.org on at any given moment, and there is a 63% chance you will see a dupe in the active stories, and a 79% chance there will be a dupe in the current and older stuff links.

Taco could not be reached for comment, apparently having made a 'run for the border'

Linux Online has this problem

[Animats]

Linux Online didn't look very hard. Their big problem is with "Casino of the Sun", which is operated by Grafix Softech in San Juan, Puerto Rico. They're a real company with real assets, run by Tej Kohli and Juan Bonilla. They're even hiring sysadmins.

Re:Linux Online has this problem

[TheMidget]

Hilarous. If you read the first link, you'll notice that they ran MS SQL Server (with all its security holes...) before the incident. And the job posting is for Unix sysadmin. Looks like they learned something ;-)

Are they really that desperate?

[mlush]

Spammers are doing this because they're desperate, with fewer and fewer spam friendly havens. And what they're doing is illegal and opens them up for prosecution.

Is it the writing of viruses or sending the spam that is illegal and opens them up for prosecution? Either way writing a virus that says 'Hey the writers has some link with that web page over there!!!!!' does not sound like an act of desperation more like stupidity

<conspiricy>
Unless the virus was written by one of the more rabid Anti-Spam types as a method of harrising an 'innocent' spammer/dodgy webpage
</conspiricy>

Re:Are they really that desperate?

[Todd Knarr]

Actually it's the hijacking of a non-consenting third party's computer that's the illegal part. How they got into it and what they did with it can increase the sentence, but it's the breaking-in part that's criminal.

Have your attorney attack indirectly

[ArsSineArtificio]

Why don't you have your attorney sue the proprietors of the 'extreme rape' sites, as well as parties unknown who act as their mass-mailing advertisers?

Then, you can force the site admins to turn over their records during discovery, find out who exactly the spammers are, and go after them directly as well.

ABW

Re:Have your attorney attack indirectly

[Anonymous Coward]

So... how exactly would *YOU* go about suing a Chinese spammer, Mr smartass? Through the US court system?

Re:Have your attorney attack indirectly

[Anonymous Coward]

The rape/lolita/farmsex people are in Poland not China.

Meh.

[BoneFlower]

Try connecting to 192.168.1.102:25 and see how far that gets you.

How about outgoing spam filtering?

[Nogami_Saeko]

Would it be possible to set an ISP's router to automatically re-direct any TCP packet with a port-25 destination through a spamassasin-type filter to check it before it continues it's journey?

Basically having a router that intercepts anything going out to port 25 from any port and pre-check it before allowing it to continue on?

N.

Re:How about outgoing spam filtering?

[Helle]

The software for this task is called echelon

sig-fault

Untraceable

[httptech]

"It's untraceable. I hate to put that in print, but it's the truth."

If the spammer uses the proxy/trojan installed by Sobig.a which listens on port 1180 (socks) and 1182 (http), it's very traceable. You need only the password to the proxy management station (it's "zaq123") and you can watch the traffic or shut it down altogether.

See this analysis of Sobig and Spam for more details.

Of course, this MBIWYL (may be illegal where you live)

Other Methods

[NetGyver]

I've had a weird instance with email going out my mail client (Outlook, but I switched to Mozilla Mail now) without knowing it. Here's the story:

1. Just opened up outlook and looked in the "sent" folder to re-read an email i sent to a friend.

2. I find 4-5 emails that were mailed to addresses I never heard of, with the messages saying something to the effect of: "please remove me from your mailing list." (The messages were all identical to each other).

3. This has only happened twice, and then stopped.
I haven't found any more suspicious sent email in my "sent" folder.

FYI: This is a personal computer, no one else uses it but me.

Now, i don't send alot of email, and when I do I know who i sent it to. I also know not to write emails back to spammers even with a "remove from list" message enclosed, because it just sends the spammers the signal that my email account exists and is active, which results in even more spam. (so i've heard at least)

Any idea what caused this?

I've also heard that the main reasons one gets an email trojan is by clicking on a link in a email, or downloading/running an email attachment.

I also know about "drive-by downloading" that happens while visiting websites. The next thing you know you got spyware coming out the ass because of this. (and of course certian programs sneakily install them as well.)

My second question is, could it be possible for a website to install this trojan on your computer without you knowing it? I mean, they do it with spyware, I don't see why they couldn't do this with email trojans as well.

Re:Other Methods

[Anonymous Coward]

A possible cause - the Klez virus would harvest all kinds of email addresses from infected machines (From the address book, browser cache, that kind of thing) and then spoof sent emails to appear to come from these addresses. So if anybody that knows you got infected, they could conceivably have ended up sending a bunch of virus-infected mails that looked like they were from you.

Re:Other Methods

[Reziac]

While back I received a spam that looked like the usual junk, but struck me as odd... inspected docsource and found it contained javascript that as best I could guess, was intended to contact a download site to fetch and install a trojan. The user would never know it had happened, and it would have only needed the few seconds in the preview or viewing pane of an email client that executes javascript.

I use a braindead mail client that doesn't do js, so naturally nothing happened here. But if it hit an Outlook user with everything turned on... ooops!

This IS traceable

[Anonymous Coward]

1. The spammers are doing this because they get paid to do it.
2. Someone is paying them; paying them to advertise a product and contact the payer (somehow) to sell a product.
3. The person paying them knows who they paid to email this crap.
4. If the email was sent via this trojan, just follow the trail from the email sent to the payer and, from there, to the spammer.

Even if the spammer claims that someone else (riiiight) must have sent the trojans on their way, he got paid for it and should be levied with fines equal to (or greater than) the payment. A few cases of this should stop the use of this trojan.

Actually, given that spammers would not be doing this unless they made money, why aren't the people who pay for spam to be delivered being held responsible for spam? They do it with drugs and prostitution.

Re:This IS traceable

[Anonymous Coward]

Yeah, but some of the stuff being sent IS crap. It is not intended to sell a damn thing, but rather to promote some site, or get CC numbers.

You also might want to account for those sites being promoted because the spammer wants to cause them a lot of trouble.

Re:No! Don't filter port 25!

[mpe]

Sending email through my ISPs relay has several important disadvantages. First and foremost, I cannot see whether the mail was already delivered to the recipient's SMTP server or whether it still is rotting in my ISP's queue. Also, my ISP might have a disk crash and lose my mail in his queue.

You also have no idea how big a queue your ISP's third party relay or if someone has just uploaded some spam to that relay. Even if an ISP restricts their relay to the IPs of their customers this isn't much good unless they only allow access after verifying the identity of every customer

This danger is completely eliminated if I send my emails directly. And why wouldn't I? It is faster and my ISP has less cost to burden and consequently less money to charge me.

The only situation where using a third party relay does help is sending the same email to lots of people... The really interesting thing is that the SMTP spec dosn't require any support for third party relays.

Actually, it does fix the problem

[Kjella]

Now lets look at this with $SMTP+1 (With spiffy authentication).

Spammer uses email software on that machine to spam other machines. Since we have email authentication now, the other users either get "from a trusted source" (if they already knew the person) or "from a new source (Key matches Joe Outlook Idiot)".

One of the key things to fix if you redo SMTP is fakemail. In other words, you'll not be able to send email unless you a) either have a real domain that you can send email from (like with MX server etc.), or b) use the JoeOutlookIdiot@hisisp.com account. In the first case you'll know who the company is since they use their own domain, in the second case you'll know exactly who was hacked and can take countermeasures. Unlike now, where most of the SPAM I get is from an invalid address, and the company will likely claim not knowing about the spammer.

Your idea of a "trusted source" won't work. It's simply not feasible for me to hold a whitelist (or blacklist) of all the spammers out there. You need to stop relaying and fakemail.

Kjella

Re:Actually, it does fix the problem

[schon]

you'll not be able to send email unless you a) either have a real domain that you can send email from (like with MX server etc.), or b) use the JoeOutlookIdiot@hisisp.com account. In the first case you'll know who the company is since they use their own domain

And how (exactly) will that stop spam? Domain names are $8 a year - you seriously think that an additional $8 every few months will deter a spammer?

A solution?

[Anonymous Coward]

http://www.martiansoftware.com/tarproxy/

yes I am on a proxy spammer list as well

[Matt Ownby]

Every day I get a spam with a poorly worded subject line (with offensive words intentionally misspelled) and a single URL in the body. Since mozilla was having a hard time identifying these messages as spam, I eventually began looking at the IP addresses of these messages and found that they were all different and didn't seem to relate to one another at all. At this point I realized that there was some kind of distributed spam attack going on and I was the recipient. Just for the heck of it, here are some of the URL's that it is advertising:

http://coorourav.homethrill.biz
http://veemeemu s.lewdmother.biz
http://xaboasot.incestuals.com/
http://loufagaw.scaredgirls.com
http://peehuqov. stopspy.info
http://zeagiseit.incestuals.com/
ht tp://heevavam.lewdmother.biz/
http://xoohouc.immo ral-moms.biz/
http://toobabat.homethrill.biz
htt p://qeimeileig.incestuals.com/

So there are some repeats in there. Man I'd love to see the person sending me this crap thrown in jail for 12 months to ponder their wretched existence.

Set Up a Feedback Loop

[Anonymous Coward]

Ever sign up ever "opt-in", "permission-based" marketer or "submission-based" marketing junk, garbage?

I didn't think so.

I'm attempting to set up a feedback loop with "opt-in" by signing each "opt-in" marketer with other "opt-in" marketers.

I'm also trying to P.O. their access points by signing signing them up to their customers "opt-in" list.

That's the same spammer.

[Animats]

Notice that all those sites bill through "profitabill.com", which is currently hosted by "diveo.net.br". (They've switched ISPs twice in the last two weeks.) Most of the porno sites are hosted by Diveo in Brazil, although at least one is hosted by AT&T, out of Milwaukee, Wisconsin. (Try a traceroute to "immoral-moms.biz" [216.243.240.198].)

"profitabill.com" is currently refusing connections from some IP addresses, but it's not down.

Spamming legality?

[mabu]

Pressed by increasingly effective anti-spam efforts, senders of unsolicited commercial e-mail are resorting to outright criminality in their efforts to conceal the source of their ill-sent missives, ...

Ahem, what's new about this? Since day one, there's almost always been an illegal component to most spammer's activities, the most obvious of which has been the hijacking of third party mail relays.

Another nasty trick spammers are now using involves the exploitation of form mailing scripts on web servers. If you see references in web server logs to files such as "formmail.*", these are spammers probing for vulnerable versions of the Matt's Script Archive form mailing script that could be repurposed to overload the headers and effectively turn your web site into a spamming machine.

While spam continues to become an ever-increasing problem, the solution, in my opinion, has always been the same: vigoriously prosecute the criminal aspects of the spammer's activities which include breaking into computers, networks, and exploiting third-party relays. The sad truth is that there are laws already on the books criminalizing the activity of 99% of spammers, but the various governments consistently refuse to enforce these laws. We don't need more anti-spam legislation; we don't need more elaborate filtering. We need people to rally the government to crack down on the spammers by enforcing laws already on the books, and not put a requirement of a certain amount of monetary (or publicity) damage before they'll decide to take action against someone who has broken the law.

Not necessarily desperate...

[Pendersempai]

There's a bright side to all this: Spammers are doing this because they're desperate, with fewer and fewer spam friendly havens.

Maybe I'm being overly cynical, but I think the reason spammers are doing this is only because it's more profitable than not doing it. I mean, they're using other people's bandwidth, and bandwidth is really the only variable cost associated with spamming. Whether or not they're desperate is an independant and unrelated issue.

But we already undestand how it works...

[knowledgepeacewi]

I'm all for research and cool uses of computers...

but when we know who's doing it, where they can be reached, and who's employing them...the next step isn't "more research", its "legal action".

Mod Up

[Crashmarik]

The parent is very usefull information

That's all well and good ..

[neuph]

But where will I get my penis and breast enlargement supplements?!

Possible SPAM defense...

[Anonymous Coward]

Spammers scrape e-mails from posts. Post emails with billions of bogus email addresses. Then the valid email addresses will be sparse. Spammers will waste time sending to bogus addresses.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Trojan may be sending itself out

[Scorchio]

For the past week, I've been swamped with junk mail. I can't say for sure, but I wouldn't be surprised if it's coming from machines infected by a spam relaying trojan. Many other Demon Internet users are receiving similar junk. The even more annoying part is that the mail is being sent to random user names @myhostname.demon.co.uk, so I'm getting dozens of copies of each message. As I'm on dial-up at the moment, this is a major problem.

Many - but not all - of the messages are originating from AT&T broadband users. A few days ago, I received a message from another AT&T machine, with a 200kb executable attached, pretending to be a security patch sent directly from Microsoft.

Could this be the trojan sending out copies of itself, to create new relays? Maybe not, but I wouldn't be overly surprised.

More Proxy Trojans

[Nishi-no-wan]

The trojans that are being distributed to unsuspecting Lookout users do more than bounce SPAM. They're also being used as HTTP proxies to run FormMail.pl scans and abuse the few open FormMail relays that are still out there. And judging by the increased number of formmail scans I get lately, spammers are really getting desparate.

On the bright side, every scan I get closes one more proxy as I report them all to their ISPs, universities, small companies, etc.

Has anyone else noticed that Texas has surpassed China lately as the number one SSH and FormMail scanning origin? Is that because Texas is the most infected? Or home to the most cracker wanna-bes?

Excellent point

[Andy Dodd]

A VERY significant percentage of my spam (90% plus) actually comes from legit addresses from various "opt-in" companies. Like Azoogle.

Having a fake return address means that you can't verify the existence of the destination address.

I do domain-based blocking on 4-5 different header fields. It's pretty effective, but I average 4-5 new spammer domains per week. Once a new one crops up, I'll see many messages from the same domain until I block it.

[HACKERS/SPAMMERS]

[Anonymous Coward]

For the past five days I have been dealing with my local ISP to resolve connection issues. My DSL using static IP's had been working great for six months. They tried everything to resolve the issues and recommended I use a packet sniffer to determine why I was having so much traffic. It would appear that my machine was sending out massive amounts of spam. If I removed services and dll files and rebooted they would return. If I killed the spool task in XP it would reboot the machine.

These problems did not appear to be stemming from Outlook but rather some sort of service on my machine. I am also positive I didn't click any applications from any emails as I am very weary of this type of activity. I also have Cloudmark and it is very good at removing unwanted emails.

I can only imagine they got into my machine because I was not current on my XP updates and I hade my firewall setup on it's lowest setting for AIM. In the process of trying to eliminate the problem I ended up corrupting my XP install and have reverted to 2k.

I just wanted to share my experience with everyone as these folks are very malicious and a warning to all to update your OS.