Slashdot Mirror
Sobig Worm Attacking RBL Lists?
Ubi_NL writes "According to the Register there is a close correlation between the DDOS attacks on a number of anti-spam lists and the presence of the Sobig virus. Now that Monkeys.com is gone, and spamhaus.org is taking heavy blows, are the spammers actually winning the battle by using viruses?"
Why do you have put a link to spamhaus into this story? Readers might expect something new, special on their page, click on it and help using up spamhaus' valuable bandwidth.
No point in providing useless links..
If they 'win', people will stop using SMTP email as it would be useless. So even if they 'win', they 'lose' in the end anyway.
are the spammers actually winning the battle by using viruses?"
I most certainly hope so! Blacklists are a cure far worse than the disease, and I'm completely rooting for the spammers here. What with bayesian junk filtering and using uniquely generated email addresses whenever I give them, I never see any spam, and the bandwidth it's costing me is minimal. Blacklists however make it nearly impossible for me to communicate with quite a few people (my ISP has found itself on one blacklist, and no matter what they're doing, they can't get off).
And of course, if the spammers are indeed using viruses, afterwards whn the blacklists are gone, we can nail them for having used those viruses, and we'll be rid off to pests, with an internet that's once more in nearly pristine condition.
Look what I got yesterday (with forged headers):
---- quote --------------
Dear Internet user.
We are an organization dedicated to stopping spam. Please help us as we are
funded solely by private donations.
visit www.spamcop.net for full details. Or you can send your donations to:
Julian Haight
PO Box 25732
Seattle, WA
98125-1232
As you can see by this message unsolicited e-mail is an invasion of your
privacy. As you can also see it can be sent anonymously
We will continue our efforts until all spam is eliminated.
To join please visit www.spamcop.net or contact
jkdom@mail.julianhaight.com
We will continue to send out this message until we convince all ISP's to
stop all spammers.
!!!Stop low-lifes from invading your inbox with their junk!!!
---- end quote ------------
If they spew out fake spam which can only be meant for slanderous purposes, would you really expect them to *not* be in the virus game. Almost all these Windows viruses, if you hexdump them, have smtp capability. It's quite thinkable that a fair amount of them are really experiments rather than 'bad things done to innocent users because the virus writer likes doing that'.
There must be a lot of money involved in the art of spamming still. I wouldn't be surprised if spamhauses are partially means of laundering money as well (think about it). Either way, these people *are* criminals and one should consider them as such.
If the sobig worm were attacking RBLs, wouldn't someone have done a "netstat" on an infected machine and found it? I've netstatted a couple of infected machines; seen nothing even close. Maybe it's just the mail _servers_ killing the RBLs, checking all those thousands of spam mails (sometimes 4 or 5 per server PER SECOND).
Dependable, Reliable Furnishings
"the blacklist owners claim that spam costs people moeny, but what about the money people lose do to inaccurate or overzealous blacklisting?"
This from the country which bombed three whole countries because of the actions of a handful of people?
I don't know if spammers are responsible for the SoBig virus, I would guess that they aren't but I can seriously believe that they are in control of a number of zombies and are capable of "defending" themselves using DoS attacks.
But this can be fixed through cooperation. All we need is a few hundred, or peraps a couple of thousand blocklist hosts and a method of coordinating them.
This is easier than it seems. The method already exists. It is called Newsgroups. The only problem that needs to be solved is a method of proving authenticity. Those solutions are also already available.
List updates could be delivered quickly via IRC too. May as well use the enemy's weapons against him.
Finally this is our chance to make Congress liken spammers to cyber-terrorists, and for a reason politicians fear and know well enough to do something about it: "Now some of the spammers are even building a network of worm-ridden computers, possibly at the fingertips of a madman who is willing to do anything for money, and may only be waiting to turn them into Weapons of Mass Disruption, wreaking havoc to the Nation, the Internet, and e-mail as we know it..." (spooky, huh? ;-))
Outlaw spammers, put an end to spam. Sometimes it's as simple as that. (And it works: Haven't seen much fax spam for years...)
Just be "Mr. Concerned Citizen" for once and send articles like this to your congresscritter now. Let them know what spammers have already done "to your kids" (rather omit the "to your p...s" part even if you've ordered their pills and pumps) "and to your computers".
I most certainly hope so! Blacklists are a cure far worse than the disease, and I'm completely rooting for the spammers here.
Publishing spam blacklists is a form of free speech and what you're advocating is the use of illegal means (DDoS) to suppress free speech. You suck.
What with bayesian junk filtering and using uniquely generated email addresses whenever I give them, I never see any spam, and the bandwidth it's costing me is minimal.
Grandma isn't going to be able to install and use bayesian filtering or generate unique e-mail addresses, so your solution sucks. Any "solution" which doesn't keep the spammers from getting their messages to the vast majority of people is just some geek doing mental masturbation. The spammers will continue to spam, using up bandwidth and storage, while costing ISPs, their subscribers, and businesses huge sums of money. And you'll sit there at home patting yourself on the back (or elsewhere) even though the spammers used your bandwidth, your ISP's bandwidth, your ISP's storage, and your storage. Not seeing the spam means that you can't complain about it, so that means that the spammer has less chance of being shut down.
You're just a spam ostrich. You have your head buried in the sand so that you don't see the spam -- even though it's still there.
English ?
And if such a site is under attack, why on earth are you linking it on slashdot's front page ?
Sunny Dubey
The main problem here is that we have millions of hosts connected to the Internet that just aren't robust or secure enough to be connected to a public network (I'm mostly talking about Windows machines here, if you hadn't guessed).
There was a discussion last week on slashdot about ISP's doing egress filtering home users's connections and I'm all in favour of that.
Unless you're hell-bent on running a mailserver on your DSL line, there's no reason for you to go out on port 25. Even if you do run a mailserver, you should have your box forward all outbound mail to your ISP's mail relay. AOL and some other large ISPs won't accept mail from you if you don't anyway.
IMHO ISPs have a responsibility to protect the backbones from their lame-ass customers with compromised machines.
Reply rather than mod if you think I'm talking out of my outbound relay.
Like tinyurl, but one letter less! http://qurl.co.uk/
You make it sound like the spammers were so shrewd as to design this ingenious "attack" scheme into the virus from the start. I highly doubt that.
There is no evidence that the SoBig virus was written by spammers, or even that the RBL DDOS is intentional. To me it looks like the RBLs simply can't handle the load from trying to filter out this virus, plain and simple.
Perhaps an improvement to filtering tools would be to rely as much as possible on bayesian and rule-base filters, and only contact an external RBL (or other rule) if the score is borderline. Right now they're hitting the RBLs for every single message even if it would fail the most simple filter. I imagine the problem is just that everyone's mail server can easily handle 1000x the current level of crap, but the RBLs can't.