Spammer DDoS-By-Virus On spamhaus.org

McDutchie writes "Steve Linford of Spamhaus announced in a press release that the latest Wintel virus, W32/Mimail-E, was created by spammers for the specific purpose of DDoS'ing Spamhaus, Spamcop, and SPEWS. It's becoming more and more clear that the spambags are the ones behind the recent mess with the Windows viruses. They must really be getting desperate."

Comments

Spam is dying

[GotAnMP3]

Seriously, I've been getting less spam lately thanks to filters. Sure, it's not gone entirely, but it's a lot less of a hassle than it used to be. I sure hope this is a sign of things to come... If they're this desperate to stop anti-spammers, they gotta be in their throws of death.

Re:Spam is dying

[kfg]

Seriously, I've been getting less spam lately thanks to filters.

Getting less spam lately or seeing less spam?

The distinction is critical.

KFG

End of the line:

[eliza_effect]

Ironically, the spammers who try to "get tough" in this way will probably end up putting themselves out of business. They've only survived this long because of relative obscurity, but once these extra-malicious spammers are caught, there won't be much in the way of goodwill for the other, questionably legal ones. Good riddance.

Re:End of the line:

[DNS-and-BIND]

This isn't spammers, it's organized crime. And they won't be caught, either, until law enforcement infiltrates someone in, or someone gets caught for something else and agrees to turn the rest of them in for leniency.

Computer Crime

[silentbozo]

I've said it before, the feds should stop looking for super-uber-mega crackers. The biggest, most expensive, and most damaging ONGOING computer crime is spam. They're not idiots, and they're not harmless nuisances. They're quite capable, and have hired on many technically proficient guns to do their dirty work, cracking systems, running hordes of zombies, and trying to find exploits in every commercial and non-commercial system so they can send out ever more spam.

Get to work on eliminating spammers and much of our current crop of computer-related woes will just GO AWAY. The only people who would hate for this to happen are the spammers, the hired guns, and companies like Symantec...

A good thing really

[Ezza]

Anything that brings "spam" and "viruses" closer together in the public eye is bad for spammers in the long run.

And fortunately for the rest of us (or unfortunately depending on your point of view), this type of behaviour just makes spammers more of a target for legislation and law enforcement.

This may actually be good

[Kevinb]

These sites should turn their evidence over to the FBI. There's now good reason to go after the handful of individuals responsible for most spam.

Re:This may actually be good

[Eggplant62]

you really think the FBI (aka Fascist Bureau of Instigation) would lift a damn finger? They certainly didnt when osirusoft got taken all the way out. The FBI only cares about Thoughtcrime and crimes against major campaign donors. Anyone else simply doesnt matter. We're on our own here, and we're gonna have to fix this problem ourselves.

Y'all need to have a talk with Ron Guilmette, owner/operator of monkeys.com. Ron was running a very extensive network of proxy honeypots and using it to collate and publish data about various ISP's harboring proxy-abusing spammers. His data proved essential in identifying the outfits responsible for the virus-related abuse that we're seeing now. Ron also ran the proxies.monkeys.com blocklist, which was terribly good at filitering spam for me and many others.

Back at tail end of August, beginning of September, he was knocked off the net when monkeys.com came under dDoS attacks, most notably from machines known to be infected by viruses, all harboring open proxy software installed by the virus. He called the local police, who had to be coerced, he says, to come out and take a report. The FBI wasn't even interested enough to come out and take a look at his data. If you cannot prove a minimum of $5k worth of damages, you're shit out of luck.

They are winning

[WindBourne]

based on the number of spams that are getting through. It has jumped up again (doubled) in the last 1-2 months.
The spamers are not desperate. They have simply figured out nice openings and are bulldozing a near infinity lane highway.

Remember when?

[jcr]

Remember how every spammer that got interviewed would claim that he wasn't doing anything illegal?

Well, when these viruses get traced back to the spambags, it's going to be sweet to see those bastards doing time.

-jcr

Re:How to make the services more spamproof

[ArsonPanda]

I'd rather have a centralized db in this case. Case in point: You called me a n00b in a CS game, so I just throw your IP(&|)Domain onto Gnutella, all of a sudden you can't email anyone. Seems problem prone.

Re:Desperate like a fox

[jmv]

Well, it doesn't prove they're desperate, but it shows that spamhaus and others hurts them (otherwise, why attack them).

Re:How to make the services more spamproof

[pjrc]

It is critical for anti-spam blocklists to operate in real time. The lists are not "distributed" like software, movies or other media. The blocklist must be queried, and those queries must operate close to real-time. This is essential so that updates to the list can stop a spam run while it is still in progress. Also, operating in real-time is important to support removal from the list (and potential legal problems associated with being unable to remove someone promptly).

Quick to judge

[Jesus IS the Devil]

People shouldn't just jump to the conclusion that the perpetrator of this is some commercial spammer. I visit some webmaster forums and many have commplained that some of these sites like SPEWS often go overboard in their blackholing, ending up block innocent bystanders who have a tough time getting out of these blocks.

I say it could have been the work of some pissed-off admins who were frustrated.

Re:Quick to judge

[AKnightCowboy]

For example, I HEAVILY firewall off large isps that have major spam problems, you should see my ruleset for blocking. Not counting the geographic bans, its at 944 entries, and each entry drops a /24 at a minimun, with most entries taking out a /16 to /20. And I know i am not the only one doing this.

Unless you're running the firewall for AOL, Earthlink, MSN, or Yahoo I really doubt Verio or C&W gives a shit if you just fell off the face of the earth completely, much less blocked a couple of their networks. If you did work for such a large company you wouldn't be blacklisting like that for long as you'd lose your job.

But they CAN do these viruses ...

[MAFIAA]

What beggars belief more is that a corp with the near-infinite resources of Microsoft still gives people a near-perfect vector for virus distribution. I'm sure if any one of us had 40Bn cash and 8 years (is that how old LookOut Express is now?) we could either code or hire programmers to code an email client that wasnt broken.

Of course.. if they ever mended LookOut the AV guys would go out of business overnight but that's a whole new consipracy theory involving large cash backhanders and deliberately broken coding there... :o)

Actually, This Could Be Good

[TheWanderingHermit]

If spammers are really behind these virii, and we're able to verify it, then it is probably that even the blind and computer-ignorant gov. offices, like FBI, or whoever, will eventually get the same info others have.

Whereas before their only offense was spam (which is gradually being outlawed), now they have done something for which people have been indicted and sent to jail for.

Spammers are evil -- we all know that -- and this just means the gov. (if they're awake) will finally have a tool to put the worst of them in jail once they can prove who's spacking and creating anti-anti-spam virii.

Re:Bayesian filtering

[Indy1]

and the spammers will continue to waste your network bandwidth and resources. Content based filtering is
a inperfect solution at best, and one that does NOTHING to discourage the spammers. Only heavy blocking of spam friendly countries and isps seems to do much to discourage more spam.

Re:They're annoying

[0x0d0a]

Ahh, I see. Everyone in the world must jump through the painful, non-functioning hoops of whitelisting, just because you don't want the minor inconvenience of relaying.

No. If IP lists really were an effective solution to spam, then you wouldn't hear a peep out of me.

However, IP listing is an extremely poor solution to the problem. It takes an approach that is simply not tenable in the security world -- attempting to secure *everyone else's system* rather than your own (you have a list of evil servers, and then trust all the non-evil servers to allow in mail), and then letting the system break if any of these trusted systems are successfully used by spammers. *That* is my problem with it. IP lists cannot possibly be a workable long-term solution to spam. The sort of people that promote IP listing are either fanatical antispam folks to the point of ignoring reason or have no security experience. In the meantime, they destroy the peer-to-peer nature of the Internet and produce network headaches for people to deal with.

*That* is why I dislike IP lists.

Re:I don't see what the problem with spam is

[McDutchie]

If it is useless, I delete it (it takes all of 2 seconds). Whats the problem?

Two hundred thirty-five gazillion times two seconds is the problem.

Re:Legislation and TLD's

[vidarh]

The flaw with this is exactly that it allows easy filtering. Spammers want to reach you regardless of whether you are filtering or not, so would likely not care about *.spm.

And for porn sites: If they are all on *.xxx they will be filtered, but much of that filtering would happen by people apart from their clients themselves. Yes, it would remove children (which I'm sure the porn sites would be very happy about - if you're in a business that require credit card signups and where your primary cost is bandwidth, would you like to have an underage person with no credit card but all the time in the world to download your preview content over and over again and wasting your bandwidth accessing your site?), but it would also remove people surfing from work (you'd be surprised - I've run several networks where all traffic went through a Squid proxy, and the traffic stats were "interesting" considering it came from people working in glass cubicles), from any country that decides to stop the "immoral" porn sites, from any municipality or state with powers to order ISP's to filter, and a wide variety of other situations.

The porn industry would likely hate *.xxx for those reasons: It makes it easy to censor them.

And we should be vary of any attempt to force controversial content to be labelled for exactly that reason.

Another problem is who sets the standards. In some countries kissing publicly is considered obscene. Some countries consider bare womens limbs obscene. Some countries are pretty liberal about underage nudity as long as it's not in a sexual setting (some places parents taking pictures of their children playing naked on the beach would be ok on a page with their holiday pics, but would be considered child porn if they were put on a porn site, for instance)

This is why the .kids proposal was altered to .kids.us - it restricts the above problem to standards within a single country. But in the .kids.us case it's about positive labelling: Label what you explicitly want to allow rather than that which some people will want to restrict, so the problem was smaller to start with.

A .spm would have some of the same problems. As long as the criteria would be made purely based on delivery method and volume I wouldn't be too concerned, but again the question would be in what cases mass distribution could be made outside of .spm, and how to verify that it taken place.

Also, a .spm would need more than just that - a major problem of spam is the cost of handling it for ISPs. Making it harder to reach users, but giving spammers a specifically legal way of delivery, would likely exacerbate that by forcing spammers to massively increase their volume to make up for reduced reach.

Re:They're annoying

[Reziac]

Sooner or later, every arbitrary limit comes back and bites legit users. Your comment is akin to saying that no email ever needs to be more than 50 lines long, so anything longer should be dropped. Or that no one ever needs to send more than 3 attachments with a single message, so any message with 4 or more should be dropped. (Which is exactly what AOL does, making attachments to/from AOL users an Adventure. Ditto for email over 20k in length, tho that "feature" seems to have mostly gone away.)

Here, you're assuming that everyone who has an occasional need to BCC more than 30 people must also have enough need and savvy to run mailing list software, and that's just not so. Occasional personal announcements are probably the leading realworld use of large BCC sets. And a BCC set may change from one use to the next -- why have to admin a mailing list for something that changes every time you use it? Why make life difficult for ordinary users just because spammers abuse the system?

Besides, most of the spam I get IS sent by mailing list, not by BCC.

Your solution would be be like if since one guy pees in the pool, EVERYONE has to wear diapers.

Why it won't happen

[swb]

• The government is too busy busting bong makers and other "terrorists" destabilizing the American Way of Life.
• Big business has done a great job of undermining all aspects of government regulation of business activity -- it took outright criminal theft at Tyco, Worldcom and Enron before the government cared. Microsoft is allowed to run an illegal monopoly with no penality. Fraud, churn and deception at almost every investment bank and mutual fund. The examples go on, but the basic idea is that the government is unwilling to go after massive corporate fraud unless there's a PR risk to the President.
• More insidious I think is the level of "responsible" corporate complicity in spam. There was a great article in Sunday's Minneapolis Star Tribune about the level of involvement by businesses one would assume have too much at stake to get involved in spam; they don't spam directly, but they're more than willing to deal in email info, which ultimately leads them to deal with spammers. Equifax, Experion and so on are willing participants in linking email with credit information and other personal data. Anyway, these people are "Platinum Club" members of the Republican political machine. Exposing them to news articles about spam and black-hat activities, even with a degree or two of seperation, is a major political problem for the Republicans. Republicans also depend heavily on the "car dealer" economic-level entrepenuer, the local bigshots who bankroll house seats. This socioeconomic group more than likely has a lot of involvement in the direct marketing game, and they can't be pissed off, either.
• There's also some "legitimate" ideological rationalization. The Republicans are staunch allies of anything associated with corporate free speech. Any limitation on what or how a corporation can send its message runs into a whole gauntlent of Republican ideaologues who insist on the corporation's "right" to free speech in all realms, including the commercial.

The basic problem is that the DOJ is a political institution. It's not a neutral enforcement institution seeking to punish lawbreakers. Who and how it decides to punish people are political decisions, deeply influenced by the political needs and goals of the administration. Spam and spammers have too many growing ties to people important to the Republican administration and its pro-corporate, pro-business financial backers. A real crackdown on spam would have shockwaves that would hurt them financially and politically, and with the election only a 366 days away, you can bet that pissing these guys off is something they don't want.