Spammer DDoS-By-Virus On spamhaus.org

McDutchie writes "Steve Linford of Spamhaus announced in a press release that the latest Wintel virus, W32/Mimail-E, was created by spammers for the specific purpose of DDoS'ing Spamhaus, Spamcop, and SPEWS. It's becoming more and more clear that the spambags are the ones behind the recent mess with the Windows viruses. They must really be getting desperate."

Comments

Spam is dying

[GotAnMP3]

Seriously, I've been getting less spam lately thanks to filters. Sure, it's not gone entirely, but it's a lot less of a hassle than it used to be. I sure hope this is a sign of things to come... If they're this desperate to stop anti-spammers, they gotta be in their throws of death.

Re:Spam is dying

[kfg]

Seriously, I've been getting less spam lately thanks to filters.

Getting less spam lately or seeing less spam?

The distinction is critical.

KFG

Re:Spam is dying

[Eggplant62]

Seriously, I've been getting less spam lately thanks to filters. Sure, it's not gone entirely, but it's a lot less of a hassle than it used to be. I sure hope this is a sign of things to come... If they're this desperate to stop anti-spammers, they gotta be in their throws of death.

No, I cannot concur here. In the last two weeks, I've noticed that the reject rate on my filters has gone up by a surprising amount. I use a custom access table, backed up by several RBL lookups done by postfix, with SpamAssassin on the backend to catch anything that does make it through the initial gauntlet.

Looking back through my logs, I've only got three weeks saved, but here's the breakdown of rejects for each week:

Week ending Oct 18 - 122
Week ending Oct 25 - 250
Week ending Nov 1 - 214
0400 Yesterday through now - 37

Note that I'm seeing hits on addresses that have never existed here, i.e. webaster@$mydomain (yes, the spelling mistake in webaster is theirs, not mine), spammers_lie@$mydomain (non-deliverable, harvested from my usenet posts), mers_lie@$mydomain (trying to remove the obfuscation I might have put in), and now I'm seeing the idiots try to get their crap through by using a non-existent address, john@$mydomain, as the "mail from:" value to attempt to get their crap through.

Yes, they've become so desperate that criminal methods aren't below them. All the filtering that's being done has lowered their response rates to where it's no longer as profitable as it used to be. Of course, the mindset of these idiots is that they'll just crank out the spam all that much harder, in all that much more quantity, in order to get the rates back up to something manageable. Of course, it's beyond them to think that if people are no longer interested in their pitches, they might check employment opportunities at the local McDonald's, as that might be more a more lucrative situation for them.

End of the line:

[eliza_effect]

Ironically, the spammers who try to "get tough" in this way will probably end up putting themselves out of business. They've only survived this long because of relative obscurity, but once these extra-malicious spammers are caught, there won't be much in the way of goodwill for the other, questionably legal ones. Good riddance.

Re:End of the line:

[DNS-and-BIND]

This isn't spammers, it's organized crime. And they won't be caught, either, until law enforcement infiltrates someone in, or someone gets caught for something else and agrees to turn the rest of them in for leniency.

DDoS

[Anonymous Coward]

I wonder if this will be quickly followed by a press release on being slashdotted..? The world's friendliest DDoS attack..

Chris, taffie down under..

This is nothing new

[Anonymous Coward]

Spammers have been DOSing internet email for years. Now they're simply adding their attacks to another protocol. Think about it.

I like this one better...

[jollis]

I like this NANAE post by Steve Linford much better. Especially the last paragraph.

Re:I like this one better...

[McDutchie]

FWIW, I linked to that thread in the original submission but it was edited out. (Which is good for you - enjoy the karma. ;) )

This oughtta help

[_LFTL_]

W32/Mimail-E, was created by spammers for the specific purpose of DDoS'ing Spamhaus, Spamcop, and SPEWS.

And in phase two of the attacks spammers craftily create stories containing links to the target spam lists and post them on slashdot. LFTL

Computer Crime

[silentbozo]

I've said it before, the feds should stop looking for super-uber-mega crackers. The biggest, most expensive, and most damaging ONGOING computer crime is spam. They're not idiots, and they're not harmless nuisances. They're quite capable, and have hired on many technically proficient guns to do their dirty work, cracking systems, running hordes of zombies, and trying to find exploits in every commercial and non-commercial system so they can send out ever more spam.

Get to work on eliminating spammers and much of our current crop of computer-related woes will just GO AWAY. The only people who would hate for this to happen are the spammers, the hired guns, and companies like Symantec...

Great News!

[Anonymous Coward]

This is great news!

Now we're once step closer to linking spam to al Qaeda. These viruses are terrorist actions, and are more demonstrably more dangerous even than Iraq's nukes!

Once we somehow link spammers to September 11, we can invade them (or maybe just throw them in jail where the other inmates can do the "invading").

Re:Great News!

[pchown]

Have a look at the Terrorism Act 2000 (the latest UK anti-terrorist legislation). It's getting close... If the DoS attack can be said to be for the purposes of intimidating supporters of anti-spam legislation, they are probably caught.

By section 56, someone directing an organisation carrying out such a DoS attack is liable to life imprisonment.

How to make the services more spamproof

[Ed Avis]

So how about using Bitkeeper or Freenet or Gnutella to distribute spam blacklists and other information?

Re:How to make the services more spamproof

[ArsonPanda]

I'd rather have a centralized db in this case. Case in point: You called me a n00b in a CS game, so I just throw your IP(&|)Domain onto Gnutella, all of a sudden you can't email anyone. Seems problem prone.

Re:How to make the services more spamproof

[pjrc]

It is critical for anti-spam blocklists to operate in real time. The lists are not "distributed" like software, movies or other media. The blocklist must be queried, and those queries must operate close to real-time. This is essential so that updates to the list can stop a spam run while it is still in progress. Also, operating in real-time is important to support removal from the list (and potential legal problems associated with being unable to remove someone promptly).

Re:How to make the services more spamproof

[pjrc]

The best ones allow you to make a zone transfer for yourself. This could be used with a P2P delivery method to distribute a DNSbl. Maybe it could have a push instead of a pull stream.

Quoting from the MAPS RBL website, with some emphasis added:

In transfer mode, you copy the entire MAPS RBLSM to some host of yours, using a network protocol such as DNS or BGP which allows you to be updated instantly whenever changes (and most importantly, deletions) occur. Because of the risk of damage to parties who are listed in the MAPS RBLSM, we require that you sign and return a simple indemnification agreement before we will allow your host(s) to transfer the entire MAPS RBLSM. This agreement also contains a license whose only terms are that you not transfer the MAPS RBLSM to a third party who has not signed and returned (to us) a copy of the same agreement, and that you never subject any user to the effects of the MAPS RBLSM unless they have asked you to do so (either explicitly, or implicitly by purchasing internet related services from you).

I don't see how a p2p network will work.

A good thing really

[Ezza]

Anything that brings "spam" and "viruses" closer together in the public eye is bad for spammers in the long run.

And fortunately for the rest of us (or unfortunately depending on your point of view), this type of behaviour just makes spammers more of a target for legislation and law enforcement.

They're annoying

[0x0d0a]

Filters, yes. Spamassassin, yes. Antispam registries (think SPEWS), no.

Lists of IPs for "antispam" purposes, drive me bananas. I normally run an MTA on my machine, and don't see any reason to relay mail (slower notification of problems, have to remember to change the relay whenever moving from network to network, etc), and there are groups like the DUL that just block swaths of IPs from sending email.

I hate getting spam too, but not as much as I get screwed over by stupid antispam "fixes".

I'm all for antispammers and spammers beating each other up. They both suck.

This whole thing is just a massive upheaval over the fact that Free Email Everywhere Just Doesn't Work. It's whitelists sooner or later, anyway.

Re:They're annoying

[phaze3000]

Except, of course, that part of SpamAssassin's checks are to use the 'antispam registries' you are complaining about.

Quite frankly, with the current volumes of spam it is impractical to try and run a mailserver for more than a few thousand users without some form of blocklist or having extremely deep pockets. The problem with SpamAssasin is that it actually increases the load on ones mail servers - a variety of checks have to be run on every single mail. By contrast, using a blocklist means that spam can be rejected before the DATA stage, reducing the load on the server, and the bandwidth consumed by spam.

Re:They're annoying

[Analysis Paralysis]

Spamassassin, yes. Antispam registries (think SPEWS), no.

Hate to rain on your parade here, but SpamAssassin does use blocklists by default (as described in the FAQ). It is the existence of such blocklists that has forced certain major ISPs to stop writing "pink contracts" to known spammers and they are the only anti-spam measure that reduces the cost that ISPs have to bear in terms of mail-server storage and excess bandwidth that spam causes. Rest assured that the spam epidemic would be far worse without DNSBLs and the cost of Internet access far higher.

Whitelists may work for some people, but others may need to keep their inboxes open (e.g. vendor support).

Re:They're annoying

[gowen]

I normally run an MTA on my machine, and don't see any reason to relay mail ... Free Email Everywhere Just Doesn't Work.

Ahh, I see. Everyone in the world must jump through the painful, non-functioning hoops of whitelisting, just because you don't want the minor inconvenience of relaying.

Thats really grown up of you.... People like you should be forced to use carrier pigeons.

Re:They're annoying

[Nogami_Saeko]

Spamassassin is great for ISPs and other companies that need rule-based spam checkers that are sort of "generic".

For personal filtering, nothing beats a good bayesian filter. I use POPFile myself and it's approaching 99% accuracy and I _LOVE_ it.

Spam very, very rarely makes it past, and if it does, it's the generic "check out this site" type message with no other information. Even spammers trying this technique aren't having much success as I'm seeing less and less of it (maybe 1 or 2 message a month make it past the filters).

The next step in anti-spam evolution will be spam-scanning software that automatically follows links back to webpages and looks for "spammy" content and tags the message as spam in the email system.

For those out there that havn't tried a bayesian form of filtering yet, give POPFile a try: (http://popfile.sourceforge.net/). Just be sure to read the instructions.

Re:They're annoying

[0x0d0a]

Ahh, I see. Everyone in the world must jump through the painful, non-functioning hoops of whitelisting, just because you don't want the minor inconvenience of relaying.

No. If IP lists really were an effective solution to spam, then you wouldn't hear a peep out of me.

However, IP listing is an extremely poor solution to the problem. It takes an approach that is simply not tenable in the security world -- attempting to secure *everyone else's system* rather than your own (you have a list of evil servers, and then trust all the non-evil servers to allow in mail), and then letting the system break if any of these trusted systems are successfully used by spammers. *That* is my problem with it. IP lists cannot possibly be a workable long-term solution to spam. The sort of people that promote IP listing are either fanatical antispam folks to the point of ignoring reason or have no security experience. In the meantime, they destroy the peer-to-peer nature of the Internet and produce network headaches for people to deal with.

*That* is why I dislike IP lists.

Re:They're annoying

[Surreal_Streaker]

The next step in anti-spam evolution will be spam-scanning software that automatically follows links back to webpages and looks for "spammy" content and tags the message as spam in the email system.

Yes! Yes! Yes!

Although this would probably have the unfortunate benefit of allowing the spammers to know that they had found a live email address, it would also increase their cost of doing business dramatically. For each spam they sent they would have to support, and pay for, a page load. The more spam they sent, the more of a DDOS against themselves ( or more troublingly others ) they would create.

Re:They're annoying

[0x0d0a]

Quite frankly, with the current volumes of spam it is impractical to try and run a mailserver for more than a few thousand users without some form of blocklist or having extremely deep pockets. The problem with SpamAssasin is that it actually increases the load on ones mail servers - a variety of checks have to be run on every single mail. By contrast, using a blocklist means that spam can be rejected before the DATA stage, reducing the load on the server, and the bandwidth consumed by spam.

I'd rather just say "no CC/BCC lists above 30 people" and make it a part of the spec. A maximum bandwidth usage amplification of 30:1 means that if network usage *really is* that expensive, the spammer gets screwed an acceptable percentage of that amount (or ISP who is letting spammers send gigs and gigs of email).

That takes care of bandwidth concerns on the server side.

The question then is the cost of "human time" of skimming through it, which affects the *client*, not the mail server operator. I claim that client-side filtering is currently the best way (as opposed to server-side blocklists or filters) to handle this -- it lets people set their *own threshold* on what they want to see and use whatever filters they like best. I happen to be partial to SpamAssassin, but folks can use whatever is best for them.

Also, *advisory* server-side filtering may be a useful service for ISPs to provide, where emails are tagged with "POTENTIALLY-SPAM" or similar, instead of just dropped. Then, if the client desires, he can filter in whatever manner he so prefers.

Frankly, in the end, we're going to wind up with whitelisting anyway, though. Other approaches just leave things open to attack. My only concern is that the whitelisting return an appropriate "can't send" response, rather than something hacked up that just bounces the mail.

Re:They're annoying

[archeopterix]

The next step in anti-spam evolution will be spam-scanning software that automatically follows links back to webpages and looks for "spammy" content and tags the message as spam in the email system.

Dear dumbass:

That would let the spammer know your email address is active.

Not if done at the ISP level.

Re:They're annoying

[RT Alec]

While it is true that some DNSBLs block entire netblocks, those lists are used by the fewest people. There are a great many DNSBLs one can use to block mail, some are maintained better than others and most have different criteria for inclusion and removal. Use the ones that match your philosophical opinion of spam, don't use the ones that you feel are too extreme.

It's all about freedom of choice!

Re:They're annoying

[0x0d0a]

So don't use the extremist ones like SPEWS. There are plenty of other DNSBLs to choose from.

In a sane world, your response would be correct. Everyone could choose their own degree of filtering.

Unfortunately, that just isn't the case. I can't control the degree of filtering that happens that the compay where I work, as I'm not a member of IT. Furthermore, I cannot control the degree of filtering that happens to other people that I need to send mail to from *their* IT departments.

ISPs aren't so bad on this front. Business IT departments are *awful*. CEOs get pissy about spam and frequently don't deal directly with other companies via email (voice messages are more personal and don't get archived, plus they may have secretaries do contacts for them). IT feels pressure to block spam, so they promptly take a heavy-handed approach. Blam, false positives.

IMO, in a business environment, a 2% false positive rate is unacceptable. You frequently cannot afford to have emails not go through. However, that is also when emails are frequently filtered the most harshly.

Re:They're annoying

[kableh]

Anomy mailtools does this one better, stripping out malicious HTML like spam web bugs and such. I'm currently implementing it on my employer's mail servers: http://mailtools.anomy.net/.

Re:They're annoying

[muixA]

To me, your argument sounds like trolling.

SPAM on my 6 year old email address exceeded 200 messages a day, a few of which regularly made it past Spam-Ass. The moment I changed my MX to use blacklists (both Dynamic IP and known-open relay), SPAM throughput dropped by at least 40%. And as aothes above have pointed out, without tweaking, SPAM-Ass uses RBLs.

I would love for there to be a clean solution to this, but there presently isn't one. I'd rather see a few rejects a minute, than waste CPU and bandwidth tagging a message for the user...

As long as the coast of SPAM is born by the recipient, or recipents ISP, things will continue to get worse.

DJB had a suggestion here:
http://cr.yp.to/im2000.html

Re:They're annoying

[0x0d0a]

Hate to rain on your parade here

You aren't. No need to worry.

but SpamAssassin does use blocklists by default (as described in the FAQ). It is the existence of such blocklists that has forced certain major ISPs to stop writing "pink contracts" to known spammers and they are the only anti-spam measure that reduces the cost that ISPs have to bear in terms of mail-server storage and excess bandwidth that spam causes. Rest assured that the spam epidemic would be far worse without DNSBLs and the cost of Internet access far

Many crucial points:

1) SA uses blacklists, not blocklists. The behavior I find objectionable is the blocking of email based on IP. Providing notification to the user that the ISP thinks that email may be spam is not bad -- I can't see how it would be anything but good. SA does not (by default) *eat* email. It may mark it up.

2) I don't use said features of SA.

3) As I've posted elsewhere in the thread, there are better technical fixes (limiting amplification is a good, simple one) to attempting to keep network costs from being unacceptable. Conflating the problem of dealing with network costs on the server and the problem of avoiding wasted human time on the client is the major reason antispam folks have cause others so much pain.

4) Vendor support shouldn't be automatically dropping questionable email *anyway*. All email originating from dialup IPs is decidedly not spam. It'd be pretty awful if someone sends out a question and then just doesn't get a response.

Re:They're annoying

[mrex]

1) SA uses blacklists, not blocklists.

Uhhh...same thing.

The behavior I find objectionable is the blocking of email based on IP. Providing notification to the user that the ISP thinks that email may be spam is not bad -- I can't see how it would be anything but good. SA does not (by default) *eat* email. It may mark it up.

Of course, each score contributes to the mail being rejected. You'd really rather have all the mail actually blocked by blacklist fail silently instead of giving you a 550 when you try to send?

2) I don't use said features of SA.

Hey, good for you. Mind if I ask why?

3) As I've posted elsewhere in the thread, there are better technical fixes (limiting amplification is a good, simple one) to attempting to keep network costs from being unacceptable. Conflating the problem of dealing with network costs on the server and the problem of avoiding wasted human time on the client is the major reason antispam folks have cause others so much pain.

Say...what? I can't even parse that. Are you trying to say in a roundabout way that "antispammers" have wasted end-users time? Given the amount of complaining end users do about spam, I don't think that argument holds up. Although the tactics we've had to use have matured and become more effective as time went on, the root cause is and always was spammers.

4) Vendor support shouldn't be automatically dropping questionable email *anyway*. All email originating from dialup IPs is decidedly not spam. It'd be pretty awful if someone sends out a question and then just doesn't get a response.

Most e-mail originating from dial-up IPs is spam. I don't know where you're running your mailserver or for whom but your experience seems to exactly contradict mine.

Re:They're annoying

[Rasta Prefect]

But they aren't. They're run by people who think it is a good idea to blacklist entire datacentre netblocks because one guy was running a vulnerable formmail, and once blacklisted getting off the blacklist is often nearly impossible because they seem to want everything up to, and including, stone tablets carved by the hand of God as proof that the problem has been delt with.

Not all block lists are the same. The only one I can think of off hand that displays the above behavior is SPEWS. And they don't blacklist a block entire datacenter netblocks just because one guy was running a vulnerable form mail. For that they would block one IP. They expand to netblocks when emails to abuse@ about the problem go unheeded and the problem doesn't get fixed. So in short, if you want to stay off SPEWS get yourself an ISP/Hosting Provider that actually responds to abuse complaints.

DNSBLs who just list specific IP's are ineffective. Why? Because pink contract providers just move their spammers around. SPEWS works on a form of social pressure - forcing the ISP's to actually deal with their spammers. Personally, I feel this is an acceptable tactic, and use SPEWS. If you don't like it, don't use it. If someone doesn't want to accept your email because it comes from a "spammy" netblock, thats their choice, not yours.

Re:They're annoying

[mjh]

Everyone in the world must jump through the painful, non-functioning hoops of whitelisting...

Just out of curiosity, what about whitelisting do you think is non-functional? I've been using a program that, among other things, is an automated whitelist management program. It's called TMDA and it works fantastically. There are other similar programs.

I'm just curious as to why you think whitelisting is non-functional.

Re:They're annoying

[Reziac]

Sooner or later, every arbitrary limit comes back and bites legit users. Your comment is akin to saying that no email ever needs to be more than 50 lines long, so anything longer should be dropped. Or that no one ever needs to send more than 3 attachments with a single message, so any message with 4 or more should be dropped. (Which is exactly what AOL does, making attachments to/from AOL users an Adventure. Ditto for email over 20k in length, tho that "feature" seems to have mostly gone away.)

Here, you're assuming that everyone who has an occasional need to BCC more than 30 people must also have enough need and savvy to run mailing list software, and that's just not so. Occasional personal announcements are probably the leading realworld use of large BCC sets. And a BCC set may change from one use to the next -- why have to admin a mailing list for something that changes every time you use it? Why make life difficult for ordinary users just because spammers abuse the system?

Besides, most of the spam I get IS sent by mailing list, not by BCC.

Your solution would be be like if since one guy pees in the pool, EVERYONE has to wear diapers.

Re:They're annoying

[Cramer]

As for item #4, you're right all email from dialup's is not spam. However, finding the few that aren't in the sea of spam is not easy, and in fact, not worth the effort. It's perfectly acceptable to tell dialup users to relay their email through their ISP's systems. It's not like email is being received on that dialup IP.

You're living in the land of theory (where everything works.) Dialup users are like trailer parks (no offense.) There are very few dialup users who patch their systems at all. In their minds, what's the point; they aren't connected all the time so how can anyone break in? (assuming they think about it, which they don't.) Plus, it takes freakin' forever to download the 30MB of M$ patches every week.

(FYI, UUNet wholesale dialup requires an SMTP filter in the RADIUS reply. If dialup spam weren't a problem, they certainly wouldn't require it.)

Re:They're annoying

[berzerke]

... like Bayesion filtering as well, though it needs to be smarter about the insertion of HTML comments in the middle of words (Viagra), punctuation (V'i'a'g'r'a), additional spacing (V i a g r a), etc. to get around the latest bag of tricks.

I'm seeing a different tactic to get around the bayesian filtering. I've noticed large sections of text, totally unrelated to the product being sold in the body of the spam message, i.e. parts of books (I recongnized Dracula in one), space shuttle reports, etc. The spammers are trying to flood the message with non-spam text in order to slip by the filtering. It's most certainly an arms race out there, and there's no end in sight.

That's why I feel the next step should be creating filters that automatically follow the links. Let's DDOS the web sites. This costs the spammer more money in bandwidth (it's not free; perhaps the monthly limit could be hit real quick and the website taken down for a month), and perhaps will prevent someone who would buy (which just encourages them) from being able to get to the site. Of course, this wouldn't stop joe jobs. :(

Spammers and the future of E-Mail

[jlemmerer]

First they spam us and now they do even infect us with viruses... when will it ever stop?
I don't really get it, while spam is increasingly annoying (altough i use a highly customized spam assassin filter i still get about 10 unwanted mails) writing viruses is plainly illegal. But what's the reason for DDoS'ing these sites? The only way to fight the spam is to use mail filters. if people want one they have to customize it themselves to make it actually work.

If the spam keeps increasing as fast as it has in the past few years, the future of mail will be dark... here is my vision: (behold!) you will have a "buddy" list of friendy or coworkers similar to instant messaging services such as ICQ and MSN Messenger and only mails from "thrustworthy" origin gets actually forwarded to you mailbox. not so cool, isn't it? but imho its the only way not to have to delete several dozens of spam a day. (and what annoys me most -> i sometimes accidentially delete mails from friends because they are hidden underneath masses of spam.)

yours
johannes

Re:Spammers and the future of E-Mail

[rusty0101]

The service the sites being DDoSed are offering is a list of well known IP address ranges, and domain names that are Well Known, because they have been found to either have customers who are known spammers, or have done nothing to prevent customers from being inadvertant spammers (open proxies and the like.)

If your spam assasin were configured to use one of the black hole lists that they provide, to either mark messages as potential spam, in addition to the filters you have customized, you may get a better recognition rate than just by using the filters you have customized.

No, this is not a perfect solution. Some ISP's attempting to help their customers by installing such spam filters are discovering that the black hole lists include ranges of their own addresses, and have had problems getting those addresses and domains unblocked. I am not criticising either the ISP, or the black hole list maintainers, just stating reported observations.

There are other flaws with this sollution, which generally means that you will have to continue to tweek your rules.

White lists are one option. Vetted addresses may be another. Restricting your in box to people who send their e-mail to you encrypted or signed with a public key is even another possible solution. The key doesn't have to be fully trusted to be useful, but it would be helpfull if your friends had already approved the key and your e-mail client would lift the rating out of the spam bucket if it was appropriate.

At the same time I have to review my "spam" bucket once or twice a week to make sure that one of my kids hasn't accidentally sent me a chain letter. Then I throw out the 60-80% of my inbound mail that has been dropped there. And yes that number does include the e-mail lists I am on that are not treated as spam.

-Rusty

Re:Spammers and the future of E-Mail

[SenseiLeNoir]

BLATANT Conspiracy theory, I know, but with the current situation (SCO, MS, etc) who knows.

- Current Virii spread most effectively via MS email products.

- Said products COULD have been "fixed" a long time ago.

- Features that SHOULD have been incorporated into Oulook (prevent external IMG in HTML email, selective Scripting disable, etc) are implemented by other vendors = profit for said vedors.

- MSN hotmail = spam magnet. Solution = MSN 8 = profit.

- more Virii & Spam = more attraction towards centralised email & buddy listing; Largest of which = MSN.

- moving towards a Microsoft "internet"??????

hmmmmmmmm

unfortunately untouchable

[grosa]

it goes without saying that this is pretty sleazy, but unless they are idiots, whoever wrote this is probably sitting somewhere overseas. so, unfortunately we can bitch all we want about it being illegal, because noone is going to do anything about it.

time to continue using spamassasin. it works pretty much 100% for me. it's not really the most ideal solution (the ideal solution being saving the bandwith used by spam by not allowing delivery), but it does same the man-time in trashing spam.

Re:unfortunately untouchable

[JaredOfEuropa]

whoever wrote this is probably sitting somewhere overseas. so, unfortunately we can bitch all we want about it being illegal, because noone is going to do anything about it.

The reason no one is going to do anything about this is not the fact that these people are overseas, but the fact that local law enforcement is not doing anything.

These cyber-crimes should be addressed in the same way as any other (international crime). Your national law enforcement officers should track down the country of residence of the culprit and/or send out an international search warrant. Contrary to popular belief, 'overseas' isn't some backwards region whose citizens have barely discovered the abacus. In many countries, writing or distributing virii is a crime, as is executing DDOS attacks. Which is good, because it means law enforcement in those countries will generally assist in bringing these criminals to justice.

If you want to complain about nothing happening, complain to your local cybercops.

Re:unfortunately untouchable

[Mr Guy]

Besides, compared to the bleeding hearts in our justice system, "overseas" is often where you WANT to see them persecuted. Lets all just take a moment to pray they are in Singapore...

This may actually be good

[Kevinb]

These sites should turn their evidence over to the FBI. There's now good reason to go after the handful of individuals responsible for most spam.

Re:This may actually be good

[Eggplant62]

you really think the FBI (aka Fascist Bureau of Instigation) would lift a damn finger? They certainly didnt when osirusoft got taken all the way out. The FBI only cares about Thoughtcrime and crimes against major campaign donors. Anyone else simply doesnt matter. We're on our own here, and we're gonna have to fix this problem ourselves.

Y'all need to have a talk with Ron Guilmette, owner/operator of monkeys.com. Ron was running a very extensive network of proxy honeypots and using it to collate and publish data about various ISP's harboring proxy-abusing spammers. His data proved essential in identifying the outfits responsible for the virus-related abuse that we're seeing now. Ron also ran the proxies.monkeys.com blocklist, which was terribly good at filitering spam for me and many others.

Back at tail end of August, beginning of September, he was knocked off the net when monkeys.com came under dDoS attacks, most notably from machines known to be infected by viruses, all harboring open proxy software installed by the virus. He called the local police, who had to be coerced, he says, to come out and take a report. The FBI wasn't even interested enough to come out and take a look at his data. If you cannot prove a minimum of $5k worth of damages, you're shit out of luck.

Fighting the Spam

[Matrix2110]

I have found a useful friend with Mailwasher, For those of you that thought the war was lost, check out this beauty.

No direct links, Look it up for yourself.

Re:Fighting the Spam

[Pop69]

I've had a lot of luck spam killing with Popfile from http://popfile.sourceforge.net/ Works very well once the initial training is done and is handy for basic mail classification as well.

Here's the article

[l0wland]

Looks like the site is getting /.-ed. So in case it's down, here's the article:

Spammers Release Virus to Attack Spamhaus.org

A new virus released by spammers on Saturday 1st November is infecting computers worldwide, and this time the purpose of the virus is to attack www.Spamhaus.org. The W32.Mimail.D virus is the latest in a string of viruses, each one released by spammers for the purpose of creating a vast worldwide zombie network of spam-sending machines and building an attack network consisting of hundreds of thousands of virus-infected zombie machines with which the spammers then attack anti-spam organizations.

W32.Mimail.D is designed to infect computers worldwide causing them to each begin making overwhelming amounts of bogus requests to Spamhaus.org's web server, www.spamhaus.org, and also attacks the web servers of www.spamcop.net and www.spews.org.

Spamhaus began coming under massive distributed Denial of Service (dDoS) attacks in July 2003, soon after the release of the SoBig.E virus and the Fizzer virus (W32.HLLW.Fizzer). In June Spamhaus stated that spammers had now moved from simple spamming through open proxies to actually manufacturing and sending out viruses to create a network of spam proxies, infecting hundreds of thousands of mainly home-user machines on broadband (ADSL) lines.

Fizzer (W32.Fizzer-A) in particular is a very wide-spread worm which spreads by emailing itself to contacts in Microsoft Outlook and Windows address books. The purpose of Fizzer is to install a minature web server and a DoS attack tool, specifically for attacking anti-spam organizations. In August and September 4 anti-spam systems were forced into closure under overwhelming dDoS attacks that hit them for weeks at a time.

Spamhaus itself was subjected to the same intense dDoS attacks for 3 months but survived thanks to its large distributed network capable of absorbing the attacks. Still, expecting more attacks, and with still no intervention by Law Enforcement, in mid September we moved the Spamhaus web site behind an anti-dDoS device known as iSecure supplied by Melior CyberWarefare Defence (www.ddos.com) and can therefore now withstand the waves of dDoS attacks.

Spammers getting framed?

[Wrathie]

I dont think anyone can be that stupid... Uhh.... hmm. Nevermind.

Poor grandpa

[aardwolf204]

Recently my cable internet service was suspended. Upon calling tech support I was transfered to the fraud and abuse department, you can imagine the look on my face. The techie told me that my access had been suspended because a computer on my network was infected with the welchia worm. The techie was kind enough to even provide me with the MAC address of the offending machine. I was suprised because my mixed network of 10, linux and windows machines, is kept up to date with the latest security patches. After checking all 10 machines I found that none of them had the mac address supplied by the techie. Upon further investigation of my DHCP logs I found that my WiFi network, SSID free_as_in_beer had its first visitor. I left it open because I believe in free access and wanted to see if anyone interesting would enter the network. Unfortunatly the mysterious computer was not logged in so I could not send a net send message to it, and it seems that the person would connect infrequently. I asked my neighbors and couldnt find the individual so I was forced to employ WEP enchrption. Now I've got chalkings outside my apartment just incase someone with any bit of knowledge wants a free ride, but my point, yes I actually had one, thanks for reading was that I feel bad for grandpa and grandma with their 2000 model compaq connected directly to the cable modem for emailing the grandkids. I was fortunate enough to convince the ISP that my network had been secured and I was granted access again, they on the other hand have few options. Then again this is a good thing for repair guys that make house calls, but between gator (or whatever its called now) and all the other crap out there I think they're busy enough.

I only wish that I could keep my WiFi up without WEP for my neihgbors or anyone walking by without exposing myself to risk of internet connection termination.

Have any other slashdotters had similar experiences, or suggestions. Thanks.

Re:Poor grandpa

[gad_zuki!]

>I only wish that I could keep my WiFi up without WEP for my neihgbors or anyone walking by without exposing myself to risk of internet connection termination.

Print up some business cards with the WEP key. Hand them out to people you trust.

Control outbound port 25 connections via your firewall. Allow only port 80 from untrusted clients. etc. Its not *that* hard. There are linux distros set to do this using an old 286 if need be. If you want to give it away you will need a robust firewall. Think of it as a digital condom.

They are winning

[WindBourne]

based on the number of spams that are getting through. It has jumped up again (doubled) in the last 1-2 months.
The spamers are not desperate. They have simply figured out nice openings and are bulldozing a near infinity lane highway.

Remember when?

[jcr]

Remember how every spammer that got interviewed would claim that he wasn't doing anything illegal?

Well, when these viruses get traced back to the spambags, it's going to be sweet to see those bastards doing time.

-jcr

evil spammers getting it slashdotted...

[auzy]

Well, the guy behind this article is obviously a spammer.. its a really smart idea to slashdot a site which is getting DDOS'ed... Well, I'm wondering what would have been more damage.. the worm or the slashdotting

Two part plan

[glassesmonkey]

Maybe it's a 1-2 punch type approach.
Step A - release virus to DDoS on blacklist maintainers ...(DNS/blacklist/etc has to be re-routed until virus passes)
Step B - while blacklists are down, send out massive spam campaign or more virus-type spam

Re:Desperate like a fox

[jmv]

Well, it doesn't prove they're desperate, but it shows that spamhaus and others hurts them (otherwise, why attack them).

Re:Could someone please make the argument...

[Analysis Paralysis]

Surely it would be more appropriate to force them to take an overdose of their own viagra? Sorry, v1agra.

I'm glad that the spammers did that...

[rediguana]

I'm being serious here...

Haven't the authorities shown a propensity for going after malicious software writers, particularly viruses and worms, whilst completely ignoring spam? By writing malicious software, haven't they just attracted a whole lot more attention from law enforcement than they would otherwise have got?

Good on them I say - I think we could do with more law enforcement attention on these sort of people!

Of course it doesn't deny the impacts on those being attacked, nor covers the international aspects of spam. But with more countries creating explicit laws to deal with hacking and misuse of computers, the more dodgy spammers might start getting what they deserve - a good ass-pounding in prison!

Re:I'm glad that the spammers did that...

[Steve B]

And sorry to say this, but it is IMPOSSIBLE to make "Spam" illegal because no two people can agree on what it is.

Nonsense. No two people agree about the precise boundary between marketing and fraud, and yet the latter is illegal. No two people agree about the maximum safe speed on a given stretch of road, and yet there are speed limits.

The law often boils down to picking some arbitrary boundary in the middle of the gray area and then treating it as the black-and-white frontier.

Re:Not really...

[nchip]

Oh, puhhlleeeze:

Read the virus analysis before making untrue claims:

The worm sends a large amount of data to remote servers (port 80 and ICMP). The worm verifies that a connection is active by contacting www.google.com. If successful, an attack is initiated on the following domains:

* spews.org
* spamhaus.org
* spamcop.net
* www.spews.org
* www.spamhaus.org
* www.spamcop.net

My evil plan for spam.

[gad_zuki!]

First get a corporate shield, an S-corp can be had for as little as $100 in most states. This will protect your personal assets from a lawsuit.

Get a bulk mailer and email harvester and sell "Placebon the Herbal Viagra." Get a credit card processing account (or maybe just paypal) from a bank.

Email a million people.

Get ~5,000 orders.

Charge $19.99

Send them a .40 bottle of vitamin C with a little sticker that says "Placebo you bought from a spammer, dumbass. Cure wait ails ya."

You profit. They get burned. Everyone wins. For the moral people, think of it as your personal war against scurvy.

Re:Intrusion detection software

[cpghost]

I'm actually asking if anyone knows of a free, OSS or not alternative.

snort is quite useful on *NIX machines. Quoth FreeBSD's security/snort ports description:

Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and much more. Snort has a real-time alerting capability, with alerts being sent to syslog, a separate "alert" file, or even to a Windows computer via Samba.

Packets are logged in their decoded form to directories which are generated based upon the IP address of the remote peer. This allows Snort to be used as a sort of "poor man's intrusion detection system" if you specify what traffic you want to record and what to let through.

For instance, I use it to record traffic of interest to the six computers in my office at work while I'm away on travel or gone for the weekend. It's also nice for debugging network code since it shows you most of the Important Stuff(TM) about your packets (as I see it anyway). The code is pretty easy to modify to provide more complete packet decoding, so feel free to make suggestions.

No good news here

[heironymouscoward]

Anyone who believes that this is the desperate act of a dying species is woefully wrong. Spammers used to be somewhat naive technologically, but the last year or two has seen a consolidation of spammers with virus writers and in essence the battlelines between the "good" and the "bad" users of the Internet have never been so well drawn as now.

A symptom of all evolving systems, natural or artificial, is that parasites will take advantage of easy opportunities. In nature, this battle has been a fundamental force for evolution and change. I don't see why it should be different in the Internet, which largely behaves like a natural system.

Here is an analysis of the subject by an expert on the matter (oh, it's ME?!). Bottom line: as long as the Internet is built on predictable defined structures (protocols and gateways), it will be heavily parasitized. What we see today is only a warmup. The solution is to find ways of evolving the structures of the Internet faster than the parasites can evolve.

This problem won't go away through wishful thinking - we need to understand what is actually going on. Heck, this discussion is moot: if my theory is correct, self-modifying defensive systems will happen exactly as the parasites have evolved: because this is what happens in natural systems.

I just trolled myself. Damn.

Re:No good news here

[Reziac]

[goes off, reads Expert Journal] ;)

Okay, since parasites also get parasites... how about a parasite that attaches itself to and debilitates spam?

Seriously, might that be doable/practical?? Obviously there are "vaccination" issues (you can't go invading every user's PC "for their own good") but how would one make such a parasite species-specific, so it would only feed off spammers?

No defense against idiots

[activewire]

this virus spreads itself by email a ZIP attachment which contains EXE that must be run, of course its Windows only.

I would love a way to identify IP address of all idiots who contract this virus, just to be sure my AOL/RoadRunner/Verizon netblock blacklists are complete.

Quick to judge

[Jesus IS the Devil]

People shouldn't just jump to the conclusion that the perpetrator of this is some commercial spammer. I visit some webmaster forums and many have commplained that some of these sites like SPEWS often go overboard in their blackholing, ending up block innocent bystanders who have a tough time getting out of these blocks.

I say it could have been the work of some pissed-off admins who were frustrated.

Re:Quick to judge

[Indy1]

if an admin did this, then he's a complete dumbass that fails to understand the purpose and reason behind spews and the other blacklists. If some spam friendly isp REFUSES to kick their spammers off, like att, c&w, exodus, qwest, cogent, internap, burst, etc etc etc, then they should expect to be heavily blacklisted. And if an admin (btw: i am a network admin myself) is DUMB enough to host with a known spam haus, then he or she shouldnt be surprised when their mail gets bounced with a flurry of 550's.

Its called doing your home work. Before you host that server, find out the history of your provider, dont go by the slick promises that they have an AUP. Find out if they really enforce it. Find out if they have any spamhaus listings (fyi: spamhaus.org is very conservative, and if you have a listing there, its a bad sign). Check on NANAE and ask if a given provider has a bad rep or not.

Finally, spews doesnt go overboard. Spews is designed to put a LOT of pressue on isp's that dont kick their spammers. And it does work. If you get caught in spews and your not a spammer, dont bitch to Spews. Spews wont care, and the thousands of mail admins who use it, like me, wont care either. Bitch to your spammy isp to clean up, and if they refuse, cancel the contract and move to a better neighborhood.

Re:Quick to judge

[melonman]

I don't like spam, but I have to admit that the thought of someone seriously inconveniencing SPEWS doesn't upset me too much.

Our server ended up on their blacklist despite never having sent a spam, because someone else in the 16-bit IP range had. 16 bits, that's up to 65K machines with maybe half a million users...

Our machine is in a server park. Of course spammers operate from such places. The SPEWS argument that you block thousands of innocent users to get at one guilty one is just plain immoral, and, at least in my case, has the effect of making me opposed to any centralised anti-spam measures, whereas previously I would have been favourable.

If it ever happens again, I'll buy myself a clean SMTP server, or find another solution, but the one thing I'm never going to do is contact my ISP (who, incidentally, enforces a strict anti-spam policy), because I object on principle to being dictated to by people who treat my company's reputation as 'collateral damage' as part of their quixotic campaign.

As for the 'change ISP every three weeks' advice, that just isn't a viable option when you have a few dozen domains, many of them interacting with third party mail filtering, Exchange servers etc.

If SPEWS dropped that one policy of punishing the innocent in an attempt to get at the guilty, it would have my support. Until then, I expect SPEWS to continue to alienate the people who should be on the anti-spam campaign's side.

Re:Quick to judge

[Indy1]

more then likely, your hosting service refused to act on spam complaints, and spews kept escalating the listing untill the whole /16 got nuked (would you indulge my curiousity and tell me what /16 your on? I'm willing to bet its a major spam haus). Spews wasnt trying to get that one spammer only, its trying to beat some sense into your hosting service by bitch slapping them. You are collatoral damage.

Changing isps every 3 weeks isnt viable, but when you pick isps in the first place, do you homework.
Pick a good one once, and your very unlikely to ever have to worry about Spews. The reason why Spews is a problem for you is because a LOT of mail admins including me use it. Spews itself IS NOT your problem, its your isp thats the problem for refusing to deal with spammers on their network. We collectively have decided that when a major isp refuses to deal with their spam problem, that we'll refuse to deal with them. And your caught in the middle.

Hypothetically, if Spews ever died, you'd have far worse problems. Why? For example, I HEAVILY firewall off large isps that have major spam problems, you should see my ruleset for blocking. Not counting the geographic bans, its at 944 entries, and each entry drops a /24 at a minimun, with most entries taking out a /16 to /20. And I know i am not the only one doing this.

Now imagine your isp starts harboring a spam gang (ala Verio or C&W) and blatantly lies and refuses to get rid of the spammers despite all complaints. This quickly gets noticed in NANAE, and mail admins will start dropping that entire hosting service into their deny lists and firewalls. Good luck EVER getting out of 1000's of firewalls and deny lists. At least you can get off Spews if your isp cleans up.

Re:Quick to judge

[AKnightCowboy]

For example, I HEAVILY firewall off large isps that have major spam problems, you should see my ruleset for blocking. Not counting the geographic bans, its at 944 entries, and each entry drops a /24 at a minimun, with most entries taking out a /16 to /20. And I know i am not the only one doing this.

Unless you're running the firewall for AOL, Earthlink, MSN, or Yahoo I really doubt Verio or C&W gives a shit if you just fell off the face of the earth completely, much less blocked a couple of their networks. If you did work for such a large company you wouldn't be blacklisting like that for long as you'd lose your job.

Re:Quick to judge

[lars-o-matic]

I can understand the frustration that would lead an admin to attack SPEWS. I don't think it's right to have done so, but your position is simplistic.

"It's called doing your homework" eh? In my (limited) experience, SPEWS sometimes lists inappropriately wide IP ranges. If my hosting ISP's upstream provider is in the same block as another who provides bandwidth to someone who hosts someone who spams, my ISP doesn't have a business case for complaint against those hosting the spammer. We and our provider are not their customers. The big bandwidth provider may also be far removed from us -- it will take a while for our complaint to go up the chain, and a direct complaint from a non-customer may bear little weight.

The result? We have to wait for someone else to get our service restored for us.

In a case like this, I say SPEWS must also do its homework and block only an appropriate range of addresses. Where does one draw the line? In my (again, limited) experience, perhaps closer to the home of the wrong-doers than SPEWS may have done.

DOS-ing SPEWS might be someone's idea of a correct way to take issue with a high-handed policy, since as you point out "dont bitch to Spews. Spews wont care" and that may be how they feel SPEWS has treated them -- denied them service, without recourse.

I say again, I don't think it's right, I just think it's understandable and that an admin need not be a complete dumbass who misses the point, but could be someone who has a big problem with the implementation.

Outlook mail is to blame

[Phoinix]

The spammers spread the new viruses by email. People who use outlook are the ones at risk.

I think that software companies that produce such defective software (MS in this case) share the blame and should be included in ay legal action against these spammers!

But they CAN do these viruses ...

[MAFIAA]

What beggars belief more is that a corp with the near-infinite resources of Microsoft still gives people a near-perfect vector for virus distribution. I'm sure if any one of us had 40Bn cash and 8 years (is that how old LookOut Express is now?) we could either code or hire programmers to code an email client that wasnt broken.

Of course.. if they ever mended LookOut the AV guys would go out of business overnight but that's a whole new consipracy theory involving large cash backhanders and deliberately broken coding there... :o)

Re:But they CAN do these viruses ...

[leerpm]

Of course.. if they ever mended LookOut the AV guys would go out of business overnight but that's a whole new consipracy theory involving large cash backhanders and deliberately broken coding there... :o)

The newest versions of Outlook have been fixed. They no longer auto-run scripts, etc. But it is pretty hard to protect against stupid users who will open .exe's from just about anyone. Though I have heard Outlook can now be configured to just plain reject emails with any sort of script/executable attachments.

Reject before accept (was Re:They're annoying)

[Joel Rowbottom]

Seriously, if you want to reject stuff at SMTP time rather than accepting it then processing it, try using sa-exim (a freshmeat search will turn it up) - it fits into exim and rejects as soon as it's worked out it's spam - mid-DATA if need be.

Re:Reject before accept (was Re:They're annoying)

[dodobh]

You either interrupt transmission before the data phase, or after the data phase has been terminated by . (RFC 2821 mandates that data cannot be interrupted).
Interruption during the data phase will be considered as a network problem and the mail will be resent, for upto five days. Lots of bandwidth wasted.
Stopping before the data implies that only the helo/ehlo, mail from: and rcpt to: have been sent. Stopping after data but before the quit just implies that your server will not deal with the bounce. It does nothing to save your inbound bandwidth.

An eye for an eye, a minute for a minute

[matfa]

An eye for an eye, a minute for a minute;

Well, say spammers send their messages to 2 million recipients, and each spend, on average, 10 seconds reading and deleting said spam. That comes out at 231 days of _completely wasted_ life. Life that can never be given back to whoever lost it.

Even worse, since that's time spent awake, it's more like a year of real time. Say the spammer sends 100 such spams, he would then have _wasted_ an entire lifetime. We can thus, by the "An eye for an eye, a minute for a minute" rule, confiscate the rest of his life!

There's the argument you requested!

cheers,
m

Actually, This Could Be Good

[TheWanderingHermit]

If spammers are really behind these virii, and we're able to verify it, then it is probably that even the blind and computer-ignorant gov. offices, like FBI, or whoever, will eventually get the same info others have.

Whereas before their only offense was spam (which is gradually being outlawed), now they have done something for which people have been indicted and sent to jail for.

Spammers are evil -- we all know that -- and this just means the gov. (if they're awake) will finally have a tool to put the worst of them in jail once they can prove who's spacking and creating anti-anti-spam virii.

Re:Actually, This Could Be Good

[mabu]

If spammers are really behind these virii, and we're able to verify it, then it is probably that even the blind and computer-ignorant gov. offices, like FBI, or whoever, will eventually get the same info others have.

You would think so wouldn't you?

The problem is spammers have been breaking federal laws since the beginning of the Internet. Hijacking a mail relay has never been legal -- it's a felony. Ever heard of anyone getting jail time for a flood ping even though it is illegal?

It's interesting. You can DDOS an entire network into the stone age, interrupting commerce and costing tons of money and lost productivity, but if you put up a web site selling a tobacco pipe, you'll get 10 years in jail. Ask Tommy Chong.

Bayesian filtering

[dido]

I've been using SpamAssassin's Bayesian filtering features to get rid of my spam for good. I've turned off SpamAssassin's use of any of the antispam sites like spamhaus, spews, and spamcop, mainly because some of them have been foolish enough to sweep such a wide net that turning on use of these sites causes SpamAssassin to filter legitimate mail that comes from my own domain! (that's what I get for living in a country whose ccTLD is run by a brain-damaged registrar...) I've been running almost totally on Bayesian filters after having trained them carefully for a month, and have thus far had zero false positives and false negatives. I mainly keep the spam around to further strengthen the training of my filters and for occasional entertainment value. Those Nigerian scams can be really funny sometimes, you know. :)

These blacklists could go away tomorrow and my Bayesian filters will only keep getting better and better at weeding out the spam. In my experience, these antispam sites are actually more part of the problem than the solution, because they filter more mail than they should.

Re:Bayesian filtering

[Indy1]

and the spammers will continue to waste your network bandwidth and resources. Content based filtering is
a inperfect solution at best, and one that does NOTHING to discourage the spammers. Only heavy blocking of spam friendly countries and isps seems to do much to discourage more spam.

Re:Bayesian filtering

[mkettler]

I agree entirely that content-filtering is an interim solution at best.. and quite frankly, so is IP blocking.

As a contributor to SpamAssassin and study of spam, no form of filter tactics are discouraging to spammers. All they seem to do is become more determined to find clever ways of avoiding you.

IP address blocking, bayes, content searches, none of this does much but force spammers to keep changing their tactics.

Take a look at the HTML source for some of your spam.. notice that a lot of them are hiding "high dollar" words in HTML comments, or white-on-off-white text.. These are deliberate attempts to poison bayes type methods.

IP blocking is a bit more difficult for spammers to evade, but quite frankly the only truly effective way to avoid them entirely is to block 0.0.0.0/0 (that's all IP addresses for those not familiar with CIDR). Selective IP blocking just forces spammers to try more aggressively to find new hosts to abuse. They are sending trojan horses to ordinary home users to abuse their machines, they are attacking educational networks, corporate networks, and pretty much anywhere they can get anything installed.

Even a rewrite of SMTP for security won't help much against the current tactics of the more sophisticated spammers.. They're already targeting legitimate windows users with trojan horses. Once a spammer has control of your machine, he can send spam with all the same credentials you have. Unless you've got some kind of authentication that you need to re-enter every time you send mail, they can send mail as some dumb joe who ran their trojan no matter how secure SMTP becomes. Even if every mailserver in the world was 100% secure against relaying, address forgery was impossible, and servers required authentication for delivery of mail, these tactics which are already in use would still allow them to send spam.

And let's face it, the prevalence of mail viruses shows just how easy it is to convince your average end user to run a trojan.

The best we can hope for is to make spamming inconvenient.

Re:Could someone please make the argument...

[DNS-and-BIND]

It just wouldn't be slashdot without a kneejerk liberal taking everything seriously and issuing a sober, politically correct refutal to someone's offhand comment.

Re:Not really...

[Illbay]

I, for one, am sick of admins--wherever they might be--with overly lenient spam-hosting accomodations.

So there.

If the Virus doent kill them...

[Pope Raymond Lama]

Slashdot will.

There are few things I can think of more Homer-Simpson-ish than post a slashdot link to certains sites to tell the world they are being DoSed.

FWIW, Spamassassin can do Baysian

[0x0d0a]

Spamassassin has Baysian filtering, in addition to the extensive ruleset it uses.

It can also optionally "autolearn", where decisions about what is spam based on existing knowledge can be used to provide automatic learning input for the Baysian system for future emails.

Re:I don't see what the problem with spam is

[McDutchie]

If it is useless, I delete it (it takes all of 2 seconds). Whats the problem?

Two hundred thirty-five gazillion times two seconds is the problem.

I highly doubt a consparicy

[Sycraft-fu]

It's just general lack of competence and understanding with law enforcement. The whole Internet thing is new to them (it's fairly new in general for that matter) and it requires very different tactics, skills and resources than normal investigations. Thereofre it is taking time for the law enforcement agencies to change and grow.

Also it isn't really clear what is and is not important on the Internet, crime wise or even what should be a crime. I mean some things are pretty clear, like pedophiles luring little kids in for sex, or defrauding someone. These are normal crimes in a new medium. But some things like SPAM aren't nearly so clear. I mean to the lay person, it seems just like junk mail. WEll junk mail is a little annoying, but no big deal. They don't know that SPAM is different (it costs the recipient) and that the spammers aren't legit bussinesses like jumk mailers usually are, they are often scammers and criminals willing to go to any lengths.

Unfortunately, I think we have 10-20 more years before we start to see really efficient policing of the Internet. Laws and law enforcement agencies need to be changed and they need time to learn how to efficiently handle electronic crime.

Re:I highly doubt a consparicy

[swb]

Unfortunately, I think we have 10-20 more years before we start to see really efficient policing of the Internet. Laws and law enforcement agencies need to be changed and they need time to learn how to efficiently handle electronic crime

What I think we'll end up with is one of two things:

(1) The internet largely hobbled by draconian rules, regulations and laws and left unusable except for EDI among large corporations. Think of "national security", "public morality" and "piracy" as the reasons here.

(2) The "internet" still exists, but most people connect through "super ISPs" that filter, process and protect their users. Unlike AOL, they actually will be responsible for protecting PCs connected to their networks.

Re:Could someone please make the argument...

[philbert26]

\begin{tongueInCheek}
The death penalty, according to the liberals, is no deterrent because if you are crazy enough to kill, you won't be deterred by the threat of execution. Fair enough, but that's not going to be the case with spam. A few spammer executions would tilt the risk-benefit calculation hugely against spamming, thus eliminating the problem and saving millions of dollars (which will help the economy and therefore improve standards of living and therefore improve life expectancy -- thus saving lives).

Next up, the death penalty for people who stuff bubble gum in coin slots so I can't buy my bus tickets... \end{tongueInCheek}

Re:Legislation and TLD's

[vidarh]

The flaw with this is exactly that it allows easy filtering. Spammers want to reach you regardless of whether you are filtering or not, so would likely not care about *.spm.

And for porn sites: If they are all on *.xxx they will be filtered, but much of that filtering would happen by people apart from their clients themselves. Yes, it would remove children (which I'm sure the porn sites would be very happy about - if you're in a business that require credit card signups and where your primary cost is bandwidth, would you like to have an underage person with no credit card but all the time in the world to download your preview content over and over again and wasting your bandwidth accessing your site?), but it would also remove people surfing from work (you'd be surprised - I've run several networks where all traffic went through a Squid proxy, and the traffic stats were "interesting" considering it came from people working in glass cubicles), from any country that decides to stop the "immoral" porn sites, from any municipality or state with powers to order ISP's to filter, and a wide variety of other situations.

The porn industry would likely hate *.xxx for those reasons: It makes it easy to censor them.

And we should be vary of any attempt to force controversial content to be labelled for exactly that reason.

Another problem is who sets the standards. In some countries kissing publicly is considered obscene. Some countries consider bare womens limbs obscene. Some countries are pretty liberal about underage nudity as long as it's not in a sexual setting (some places parents taking pictures of their children playing naked on the beach would be ok on a page with their holiday pics, but would be considered child porn if they were put on a porn site, for instance)

This is why the .kids proposal was altered to .kids.us - it restricts the above problem to standards within a single country. But in the .kids.us case it's about positive labelling: Label what you explicitly want to allow rather than that which some people will want to restrict, so the problem was smaller to start with.

A .spm would have some of the same problems. As long as the criteria would be made purely based on delivery method and volume I wouldn't be too concerned, but again the question would be in what cases mass distribution could be made outside of .spm, and how to verify that it taken place.

Also, a .spm would need more than just that - a major problem of spam is the cost of handling it for ISPs. Making it harder to reach users, but giving spammers a specifically legal way of delivery, would likely exacerbate that by forcing spammers to massively increase their volume to make up for reduced reach.

Re:I don't see what the problem with spam is

[Anonymous Coward]

Your *kid* having to push delete on something with pictures of stuff in orifices where it doesn't fit is also what the problem is...

Whitelists and Degrees of Separation

[Presence1]

Consider the consequences of univeral use of whitelists.

Spam initally becomes almost completely ineffective (good), and it becomes difficult to contact people initially without an introduction.

So, how do we solve the problem of contacting someone who does not have my address on their whitelist, e.g., a researcher who just published something of interest?

We'd need to start a way of traversing overlapping "buddy networks". This may spawn something like the 'Six Degrees of Separation' experiment/game, as in "I need to get this message to Mr. X, could you please forward it to someone who might be closer to him?".

This could have ineresting social consequences. Increasing bonds by increasing communications and traded favors? Increasing annoyance among friends? I don't think spam could penetrate such a filter, since it would have to convince multiple people that it is a genuine message.

Thoughts?

Re:Mimail-E also DDoS'ing financial sites

[gorbachev]

It's not attacking several financial sites, just Fethard Finance.

The .biz TLD has been regularly used by spammers, who use the zombie networks to host their websites and even DNS servers. I bet fethard.biz is ran by someone, who is sick and tired of getting the .biz domain thorouhgly plonked by blocklists and complained either directly to the criminal spammers or the admins of the .biz TLD and the spammers got a word of that.

Proletariat of the world, unite to kill spammers.
The more painfully and slowly, the better.

Spam Prevention

[cagle_.25]

This is slightly offtopic, but I've been turning over an anti-spam scheme in my mind for a while. What if ...

you are required to pay a small escrow fee as part of your ISP service fee, AND

if someone receives and e-mail from you and deems it as spam, then he clicks the appropriate button, AND

your escrow fee is charged *once per e-mail* and his is increased by the same amount.

The balance of the escrow fee would be refundable at any time, but accounts with a balance of 0 would be unable to send e-mails.

As I think through this, I can see several virtues:
1. The senders of spam would have to pay per offensive e-mail and would thus have strong incentive to stop.
2. Senders of legit e-mail would continue to have free or mostly free e-mail.
3. Those affected by spam would have immediate recourse and receive compensation for their time.
4. The spirit of the plan seems right: if you are going to waste my time with your spam, then you pay me for it. But if you are a friend, you get my time for free.

Does anyone see drawbacks to this plan? Perhaps increase in net traffic per e-mail sent, but that would presumably be offset by a substantial decrease in spam.

Re:Spam Prevention

[Zed2K]

"Does anyone see drawbacks to this plan?"

Basically its the same theory as warning someone in AOL-IM. Their warn level gets high enough they can't send messages until it drops some. The problem is people get into "warning wars". How high can I make a friends warn level to piss him off.

For spam who is going to be the judge to determine if its spam or not? I consider all the stupid jokes I get from people spam so I should hit them and make them pay for it. What if I piss someone off so they decide to report every email that I've sent as spam in retaliation. Even friends like to piss other friends off from time to time.

SPEWS is *slow* to judge

[frankie]

despite never having sent a spam, because someone else in the 16-bit IP range had.
[...]
my ISP (who, incidentally, enforces a strict anti-spam policy)

These two statements are mutually contradictory. But first, a reminder that SPEWS is not Not NOT representative of mainstream anti-spam blocklist providers. Both SpamCop and SpamHaus use narrow targeted blocklists. Furthermore, the real responsibility for your blocked email lies with the recipient postmaster who chose to use the SPEWS list. Their server, their rules. You could call them and ask to be whitelisted.

According to best evidence, SPEWS always starts with an abuse complaint email and a /32 blocklisting. If further spam arrives at their address(es?) the listing expands to /28, /24, etc, until either the spammers are removed or the entire ISP is listed. In order to reach /16, your ISP must have ignored SPEWS and retained its spammers for a long Long LONG time.

Whitelisting may be the only sollution

[Erik Hensema]

But not whitelisting as we know it.

Think about it: most spam comes from cable and adsl connected machines. dynablock.easynet.nl is trying to block each and every dynamic IP on earth, effectively making it a whitelist of static and therefore blockable IP's.

One could even take this one step further: blacklist the entire internet and whitelist known mailservers. Getting out of that should be easy, but no so easy that a spammer could do it automatically. And when you're spamming from a whitelisted IP, the IP is blacklisted again for, say, 1 week. Then it can be whitelisted again, but when you're spamming again, then it's blacklisted for a month.

The hard part of such a whitelist is: where do you start? I think it would be sensible to start out by simply tagging mail originating from blacklisted IP's. Early adopters can then whitelist each and every IP they expect mail from. After a while a sufficiently small amount of mail will be tagged by the blacklist, so it can be used to start blocking with it.

If we only could convince each and every postmater on earth to use such a system, it could be very, very useful.

Meanwhile, please use Dynablocker. It can really help making h4x0red boxes useless as a spam source.

Why it won't happen

[swb]

• The government is too busy busting bong makers and other "terrorists" destabilizing the American Way of Life.
• Big business has done a great job of undermining all aspects of government regulation of business activity -- it took outright criminal theft at Tyco, Worldcom and Enron before the government cared. Microsoft is allowed to run an illegal monopoly with no penality. Fraud, churn and deception at almost every investment bank and mutual fund. The examples go on, but the basic idea is that the government is unwilling to go after massive corporate fraud unless there's a PR risk to the President.
• More insidious I think is the level of "responsible" corporate complicity in spam. There was a great article in Sunday's Minneapolis Star Tribune about the level of involvement by businesses one would assume have too much at stake to get involved in spam; they don't spam directly, but they're more than willing to deal in email info, which ultimately leads them to deal with spammers. Equifax, Experion and so on are willing participants in linking email with credit information and other personal data. Anyway, these people are "Platinum Club" members of the Republican political machine. Exposing them to news articles about spam and black-hat activities, even with a degree or two of seperation, is a major political problem for the Republicans. Republicans also depend heavily on the "car dealer" economic-level entrepenuer, the local bigshots who bankroll house seats. This socioeconomic group more than likely has a lot of involvement in the direct marketing game, and they can't be pissed off, either.
• There's also some "legitimate" ideological rationalization. The Republicans are staunch allies of anything associated with corporate free speech. Any limitation on what or how a corporation can send its message runs into a whole gauntlent of Republican ideaologues who insist on the corporation's "right" to free speech in all realms, including the commercial.

The basic problem is that the DOJ is a political institution. It's not a neutral enforcement institution seeking to punish lawbreakers. Who and how it decides to punish people are political decisions, deeply influenced by the political needs and goals of the administration. Spam and spammers have too many growing ties to people important to the Republican administration and its pro-corporate, pro-business financial backers. A real crackdown on spam would have shockwaves that would hurt them financially and politically, and with the election only a 366 days away, you can bet that pissing these guys off is something they don't want.

Press Release

[rfrenzob]

Since the site is currently being slashdotted, here is a copy of the press release:

A new virus released by spammers on Saturday 1st November is infecting computers worldwide, and this time the purpose of the virus is to attack www.Spamhaus.org. The W32.Mimail.D virus is the latest in a string of viruses, each one released by spammers for the purpose of creating a vast worldwide network of spam-sending machines and building an attack network consisting of hundreds of thousands of virus-infected zombie machines with which the spammers then attack anti-spam organizations.

W32.Mimail.D is designed to infect computers worldwide causing them to each begin making overwhelming amounts of bogus requests to Spamhaus.org's web server, www.spamhaus.org, and also attacks the web servers of www.spamcop.net and www.spews.org.

Spamhaus began coming under massive distributed Denial of Service (dDoS) attacks in July 2003, soon after the release of the SoBig.E virus and the Fizzer virus (W32.HLLW.Fizzer). In June Spamhaus stated that spammers had now moved from simple spamming through open proxies to actually manufacturing and sending out viruses to create a network of spam proxies, infecting hundreds of thousands of mainly home-user machines on broadband (ADSL) lines.

Fizzer (W32.Fizzer-A) in particular is a very wide-spread worm which spreads by emailing itself to contacts in Microsoft Outlook and Windows address books. The purpose of Fizzer is to install a minature web server on which spammers then host typically "pills & porn" sites, an IRC backdoor, and a DoS attack tool specifically for attacking anti-spam organizations. In August and September 4 anti-spam systems were forced into closure under overwhelming dDoS attacks that hit them for weeks at a time.

Spamhaus itself was subjected to the same intense dDoS attacks for 3 months but survived thanks to its large distributed network capable of absorbing the attacks. Still, expecting more attacks, in mid September we moved the Spamhaus web site behind an anti-dDoS device known as iSecure supplied by Melior CyberWarefare Defence (www.ddos.com) and can therefore now withstand the waves of dDoS attacks.

From: http://www.spamhaus.org/news.lasso?article=13

Re:and SBC DSL services...

[Abcd1234]

My parents have an SBC DSL account and now I can't send them email from my server (admittedly hosted on a roadrunner cable modem) because they're blocking everything from 'dialups'.

Then relay your mail through your ISPs SMTP server and move on with life. Suddenly, everything works, and you still have control over your own mail server. This also offloads SMTP re-sends, etc, onto the ISP mail server, rather than your own, which is rather nice.

SPAM good for (Inter)National (Cyber)Security

[Moblaster]

Spammers spend a tremendous amount of time and energy cracking systems, setting up zombies, getting around barriers of all sorts. The reason why is because they have a financial incentive to do so.

If security through obscurity is an intellectually bankrupt concept, then the spam industry innovates security knowledge like no other.

The fact is that spammers not only save work for the script kiddies, they help the NSA, CIA, FBI, KGB... as well as IBM, MSFT, SYMC...

Think of them as parasites that feed off our collective ignorance, and you'll see what a useful cleansing function they serve in the greater ecosystem.

Bluebottle was DDosed off the net..

[msimm]

They where a great free email service ('whitelist') similar to the TMDA system.

I see quite a few posts suggesting that spammers are getting desperate, but brazen seems more appropriate. They are shutting down some of our most effective anti-spam tools and there seems nothing we can do about it. To me that looks more like their winning.

Here's how more laws and regulation will stop spam

[mabu]

1. Print out all the new laws and proposed regulations; bind them into a big, thick book.

2. Get some competent network admins (who are obviously nowhere near any government cyber-crime unit) and can easily track down the source of the spam and worms.

3. Go to the perpetrators home or residence.

4. Beat the perpetrator over the head with the book of laws.

The more laws we pass, the heavier the book becomes and the more brain damage it will do. Considering the trend our leaders have in thinking more laws will stop this when the existing laws aren't being enforced, the only reasonable solution is to use the actual laws themselves as some form of blunt instrument.

Re:How spammers will get around C-R

[mjh]

Well, if you use TMDA, you can configure it to avoid what you're talking about. With TMDA, it can detect whether or not an email was sent in response to an actual email that you sent. If so configured, then any challenges that you get from someone will only be delivered to your mailbox if you actually sent the original email. If a spammer, right now, sends an unsolicited challenge to my mailbox, I'll never see it.

So, exactly the contrary to what you're saying. The wider spread the use of C/R like TMDA, the less effective that your suggestion will be.