Spammer DDoS-By-Virus On spamhaus.org

McDutchie writes "Steve Linford of Spamhaus announced in a press release that the latest Wintel virus, W32/Mimail-E, was created by spammers for the specific purpose of DDoS'ing Spamhaus, Spamcop, and SPEWS. It's becoming more and more clear that the spambags are the ones behind the recent mess with the Windows viruses. They must really be getting desperate."

Comments

Spam is dying

[GotAnMP3]

Seriously, I've been getting less spam lately thanks to filters. Sure, it's not gone entirely, but it's a lot less of a hassle than it used to be. I sure hope this is a sign of things to come... If they're this desperate to stop anti-spammers, they gotta be in their throws of death.

Re:Spam is dying

[kfg]

Seriously, I've been getting less spam lately thanks to filters.

Getting less spam lately or seeing less spam?

The distinction is critical.

KFG

End of the line:

[eliza_effect]

Ironically, the spammers who try to "get tough" in this way will probably end up putting themselves out of business. They've only survived this long because of relative obscurity, but once these extra-malicious spammers are caught, there won't be much in the way of goodwill for the other, questionably legal ones. Good riddance.

Re:End of the line:

[DNS-and-BIND]

This isn't spammers, it's organized crime. And they won't be caught, either, until law enforcement infiltrates someone in, or someone gets caught for something else and agrees to turn the rest of them in for leniency.

Computer Crime

[silentbozo]

I've said it before, the feds should stop looking for super-uber-mega crackers. The biggest, most expensive, and most damaging ONGOING computer crime is spam. They're not idiots, and they're not harmless nuisances. They're quite capable, and have hired on many technically proficient guns to do their dirty work, cracking systems, running hordes of zombies, and trying to find exploits in every commercial and non-commercial system so they can send out ever more spam.

Get to work on eliminating spammers and much of our current crop of computer-related woes will just GO AWAY. The only people who would hate for this to happen are the spammers, the hired guns, and companies like Symantec...

A good thing really

[Ezza]

Anything that brings "spam" and "viruses" closer together in the public eye is bad for spammers in the long run.

And fortunately for the rest of us (or unfortunately depending on your point of view), this type of behaviour just makes spammers more of a target for legislation and law enforcement.

They are winning

[WindBourne]

based on the number of spams that are getting through. It has jumped up again (doubled) in the last 1-2 months.
The spamers are not desperate. They have simply figured out nice openings and are bulldozing a near infinity lane highway.

Remember when?

[jcr]

Remember how every spammer that got interviewed would claim that he wasn't doing anything illegal?

Well, when these viruses get traced back to the spambags, it's going to be sweet to see those bastards doing time.

-jcr

Re:Desperate like a fox

[jmv]

Well, it doesn't prove they're desperate, but it shows that spamhaus and others hurts them (otherwise, why attack them).

Re:How to make the services more spamproof

[pjrc]

It is critical for anti-spam blocklists to operate in real time. The lists are not "distributed" like software, movies or other media. The blocklist must be queried, and those queries must operate close to real-time. This is essential so that updates to the list can stop a spam run while it is still in progress. Also, operating in real-time is important to support removal from the list (and potential legal problems associated with being unable to remove someone promptly).

Quick to judge

[Jesus IS the Devil]

People shouldn't just jump to the conclusion that the perpetrator of this is some commercial spammer. I visit some webmaster forums and many have commplained that some of these sites like SPEWS often go overboard in their blackholing, ending up block innocent bystanders who have a tough time getting out of these blocks.

I say it could have been the work of some pissed-off admins who were frustrated.

Re:Quick to judge

[AKnightCowboy]

For example, I HEAVILY firewall off large isps that have major spam problems, you should see my ruleset for blocking. Not counting the geographic bans, its at 944 entries, and each entry drops a /24 at a minimun, with most entries taking out a /16 to /20. And I know i am not the only one doing this.

Unless you're running the firewall for AOL, Earthlink, MSN, or Yahoo I really doubt Verio or C&W gives a shit if you just fell off the face of the earth completely, much less blocked a couple of their networks. If you did work for such a large company you wouldn't be blacklisting like that for long as you'd lose your job.

But they CAN do these viruses ...

[MAFIAA]

What beggars belief more is that a corp with the near-infinite resources of Microsoft still gives people a near-perfect vector for virus distribution. I'm sure if any one of us had 40Bn cash and 8 years (is that how old LookOut Express is now?) we could either code or hire programmers to code an email client that wasnt broken.

Of course.. if they ever mended LookOut the AV guys would go out of business overnight but that's a whole new consipracy theory involving large cash backhanders and deliberately broken coding there... :o)

Re:Bayesian filtering

[Indy1]

and the spammers will continue to waste your network bandwidth and resources. Content based filtering is
a inperfect solution at best, and one that does NOTHING to discourage the spammers. Only heavy blocking of spam friendly countries and isps seems to do much to discourage more spam.

Re:I don't see what the problem with spam is

[McDutchie]

If it is useless, I delete it (it takes all of 2 seconds). Whats the problem?

Two hundred thirty-five gazillion times two seconds is the problem.

Re:Legislation and TLD's

[vidarh]

The flaw with this is exactly that it allows easy filtering. Spammers want to reach you regardless of whether you are filtering or not, so would likely not care about *.spm.

And for porn sites: If they are all on *.xxx they will be filtered, but much of that filtering would happen by people apart from their clients themselves. Yes, it would remove children (which I'm sure the porn sites would be very happy about - if you're in a business that require credit card signups and where your primary cost is bandwidth, would you like to have an underage person with no credit card but all the time in the world to download your preview content over and over again and wasting your bandwidth accessing your site?), but it would also remove people surfing from work (you'd be surprised - I've run several networks where all traffic went through a Squid proxy, and the traffic stats were "interesting" considering it came from people working in glass cubicles), from any country that decides to stop the "immoral" porn sites, from any municipality or state with powers to order ISP's to filter, and a wide variety of other situations.

The porn industry would likely hate *.xxx for those reasons: It makes it easy to censor them.

And we should be vary of any attempt to force controversial content to be labelled for exactly that reason.

Another problem is who sets the standards. In some countries kissing publicly is considered obscene. Some countries consider bare womens limbs obscene. Some countries are pretty liberal about underage nudity as long as it's not in a sexual setting (some places parents taking pictures of their children playing naked on the beach would be ok on a page with their holiday pics, but would be considered child porn if they were put on a porn site, for instance)

This is why the .kids proposal was altered to .kids.us - it restricts the above problem to standards within a single country. But in the .kids.us case it's about positive labelling: Label what you explicitly want to allow rather than that which some people will want to restrict, so the problem was smaller to start with.

A .spm would have some of the same problems. As long as the criteria would be made purely based on delivery method and volume I wouldn't be too concerned, but again the question would be in what cases mass distribution could be made outside of .spm, and how to verify that it taken place.

Also, a .spm would need more than just that - a major problem of spam is the cost of handling it for ISPs. Making it harder to reach users, but giving spammers a specifically legal way of delivery, would likely exacerbate that by forcing spammers to massively increase their volume to make up for reduced reach.

Why it won't happen

[swb]

• The government is too busy busting bong makers and other "terrorists" destabilizing the American Way of Life.
• Big business has done a great job of undermining all aspects of government regulation of business activity -- it took outright criminal theft at Tyco, Worldcom and Enron before the government cared. Microsoft is allowed to run an illegal monopoly with no penality. Fraud, churn and deception at almost every investment bank and mutual fund. The examples go on, but the basic idea is that the government is unwilling to go after massive corporate fraud unless there's a PR risk to the President.
• More insidious I think is the level of "responsible" corporate complicity in spam. There was a great article in Sunday's Minneapolis Star Tribune about the level of involvement by businesses one would assume have too much at stake to get involved in spam; they don't spam directly, but they're more than willing to deal in email info, which ultimately leads them to deal with spammers. Equifax, Experion and so on are willing participants in linking email with credit information and other personal data. Anyway, these people are "Platinum Club" members of the Republican political machine. Exposing them to news articles about spam and black-hat activities, even with a degree or two of seperation, is a major political problem for the Republicans. Republicans also depend heavily on the "car dealer" economic-level entrepenuer, the local bigshots who bankroll house seats. This socioeconomic group more than likely has a lot of involvement in the direct marketing game, and they can't be pissed off, either.
• There's also some "legitimate" ideological rationalization. The Republicans are staunch allies of anything associated with corporate free speech. Any limitation on what or how a corporation can send its message runs into a whole gauntlent of Republican ideaologues who insist on the corporation's "right" to free speech in all realms, including the commercial.

The basic problem is that the DOJ is a political institution. It's not a neutral enforcement institution seeking to punish lawbreakers. Who and how it decides to punish people are political decisions, deeply influenced by the political needs and goals of the administration. Spam and spammers have too many growing ties to people important to the Republican administration and its pro-corporate, pro-business financial backers. A real crackdown on spam would have shockwaves that would hurt them financially and politically, and with the election only a 366 days away, you can bet that pissing these guys off is something they don't want.