Why Blacklisting Spammers Is A Bad Idea

Roland Piquepaille writes "For the last two months, an eternity in Internet time, I was unable to reach -- and to contribute to -- Smart Mobs, the collective blogging effort around the next social revolution initiated by Howard Rheingold. Why that? Because an unknown customer of Verio decided it was a spamming site and asked the company to blacklist the site. Verio complied -- probably without even checking it -- and my problems started. It took me dozens of e-mails and phone calls and two visits to the headquarters of my french ISP, Noos, to fix the situation. More about this horror story is available here."

Comments

ORBS

[olman]

And other RBLs require usually multiple reports from multiple sources. And you have fairly straightforward way of getting de-listed, too.

What's with the current boo-hoo over blacklists? Do we have some kind of spammer astroturf going here?

Re:ORBS

[PurpleFloyd]

The current "boo-hoo" over blacklists can be mostly summed up by one word: SPEWS.

They operate on the "nuclear bomb" method: list spammers, plus anyone using a "spam-friendly" mailserver (a definition that can be stretched to cover almost anyone) or anyone who is simply "suspicious." Oh, and you might also be listed if your new IP block was once used by a spammer. Don't worry, though. You can just wait a few weeks and lose massive amounts of buisiness because many customers can't recieve email from you and have no idea why - they just think you aren't responding. Or you can go onto NANAE and post a delist request, which will get you nothing but "Whiner! Eat your SPEWS, it's good for you!"

To be sure, a large portion of the problem comes from ISPs implementing SPEWS incorrectly - silently dropping all IPs listed, not just tagging level 2 and dropping only level 1 (confirmed spammers), and the spammers have created this problem themselves. However, SPEWS' "list 'em all, let God sort 'em out" approach is irresponsible, particularly when they know that ISPs are applying the filtering with a wide brush.

Re:ORBS

[Eggplant62]

[SPEWS] operate[s] on the "nuclear bomb" method: list spammers, plus anyone using a "spam-friendly" mailserver (a definition that can be stretched to cover almost anyone) or anyone who is simply suspicious." Oh, and you might also be listed if your new IP block was once used by a spammer. Don't worry, though. You can just wait a few weeks and lose massive amounts of buisiness because many customers can't recieve email from you and have no idea why - they just think you aren't responding. Or you can go onto NANAE and post a delist request, which will get you nothing but "Whiner! Eat your SPEWS, it's good for you!"

Incorrect characterization of SPEWS methods. From my own personal observations, a SPEWS listing starts out with the spammer's IP addresses based on spam received at multiple spamtrap accounts. Complaints are filed by the people who run the SPEWS list and, of course, they do not identify themselves as SPEWS operators in those complaints. Some time elapses (I'm not SPEWS, how should I know how much time exactly?). Either the spammer is removed (Yay! The listing drops off the list) or the complaints go ignored and more spam is received at the spamtrap accounts. The listing gets widened to the /24 in which the spammer space is included (this may happen immediately in the case of a spammer identified by Steve Linford's ROKSO (Registry of Known Spam Organizations) at spamhaus.org (may be difficult to reach due to the Slashdot effect or DDoS by virus)).

Lather, rinse, repeat the above until someone at the responsible ISP who received the original complaints wakes the fuck up and notices the situation, usually after their own customers are screaming at them, asking them to fix the problem that got them blocklisted. Then again, this is all laid out in the SPEWS faq in fairly clear, easy to understand language.

If ISP's are dropping mail from both level1 and level2 listings, they've made their own bed and are now laying in it. Only an idiot would block on level2 listings as they are meant as an historical indicator of problems with an ISP and do age off after an indeterminate period of time, again outside my control or knowledge.

SPEWS is the only thing thus far in the war against spam that actually has an effect at the ISP level to get some of these outfits to wake the fuck up and see what's happening in their own abuse@ mail accounts. ISP's think they can continue to shine on the spam problem, thinking they have no responsibility for their customers' actions. We, the users of SPEWS blocklist, say otherwise.

If I decide I don't want mail from a corner of the Internet that has sent me nothing but spam, that's my right. If I decide to rely upon the opinion of another Internet service who tracks this kind of information for themselves and elects to share it with the public, that's my right also. SPEWS works for me and mine.

Just

[SargeZT]

Break into the lobby of the ISP, guns in hand, and force them to remove the site from the blacklist. It's what I do when I'm pissed.

Why Blacklisting Spammers Is A Bad Idea

[wo1verin3]

This article should have been called...

"Why it's important to have good policies and procedures in place when blacklisting spammers"

Re:Why Blacklisting Spammers Is A Bad Idea

[sweetooth]

No kidding. The primary problem is the ISPs and thier upstream.

Re:Why Blacklisting Spammers Is A Bad Idea

[rgmoore]

Yeah, because blacklisting has been so effective thus far, we just need to do more of it. Yeah, right. Blacklisting is basically playing a game of whack-a-mole; it makes things a bit less convenient for spammers, but doesn't seem to be doing them serious harm. OTOH, crippling the email of innocent bystanders who happen to share IP blocks with spammers seems a rather steep price to pay for something that does very little to stop spam.

Spam is a tough problem, and it's going to take more than just vigilante action to deal with it. What's needed is a two pronged approach. One prong is legal and is being followed fairly well; pass laws that make spamming illegal. The other prong, which is still under development, is to make technical changes to email so that spammers can't hide their addresses. Neither one will succeed alone- laws can't help as long as spammers can hide, and making spammers stand still won't help if there's no legal recourse against them- but the combination of the two should help a lot.

Re:Why Blacklisting Spammers Is A Bad Idea

[BrokenHalo]

Spam is a tough problem, and it's going to take more than just vigilante action to deal with it. What's needed is a two pronged approach.

So I should find a spammer and spear him with a pitchfork?

Just to clarify

[Nachtwind]

"blacklisting" in this article refers to completely block an ip address. This is not a "bad idea", but complete nonsense. First time I've heard of something like that. This is not to be mistaken for using an open relay blacklist or similar, which only blocks mail from a certain address. I bet those "network administrators" clicked on some fancy "block site" button, not knowing what they were doing...

Re:Run your own mail server on your own domain

[bhtooefr]

RTFA. Verio was doing blacklisting on ALL PROTOCOLS for this ISP. The guy could not even GET TO THE SITE.

Non sequitur

[ScottSpeaks!]

The fact that a strategy (such as blacklisting) can be mismanaged and that it is not invulnerable to abuse does not necessarily make it a "Bad Idea". It just means it needs to be managed more carefully, and better secured from abuse.

Improperly done blacklist

[DaEMoN128]

Why is the blacklist being done on a domain level. Spam is usually email....so block the email address. That is simple enough to do with intrusion detection systems, some application level firewalls, and if your really bored....an access list on a router. Whoever decided to block ftp or http to stop spam was not all there. They should have stopped smtp traffic from there instead and been done with it.

Black listing of spammers is a good idea, we just have to make sure we are only blocking them and not innocent bystandards.

Re:Improperly done blacklist

[PReDiToR]

I'm still pissed that AOL won't let me send email to any of their customers, just because I run my own SMTP server.

That sucks ass royally.

Re:Improperly done blacklist

[spicedhamhawg]

Speaking as someone who fights spam for a living, effective blocking requires a combination of techniques. You need to filter on sender (both envelope and From:), sender domain, sender IP, and content filters.

Your statement that whoever decided to block ftp or http was not all there completely misses the point, I think. If a site is known to spamvertise, blocking *all* traffic to/from that site is actually a pretty good idea. Why? Consider why spammers send spam: to generate traffic to a web site, an email address, a phone number, some way to contact that. Since they know any email address they use to spam probably won't last as long as fart in a room full of air purifiers, the contact link is usually URL, whether by domain name or IP address. If they spam and you put in a filter for that spam, they may never get that spam through again, but they may still get some buyers from among your (stupider) customers. However, if your policy is to block all traffic to/from that IP address, they get zero traffic and zero business from your netblock and you really hit them in the wallet.

Verio's idea is good, but someone dropped the ball on implemenation in this case by not checking the facts before blocking.

What I'd like to know, though, is why the author of the article uses an ISP as bad as Noos. They sound so bad they make even wanadoo.fr (gee, speaking of spam!) sound good in comparison. Someone at Verio apparently made a mistake, but if so many people at Noos weren't so incompetent (did the PHB character come from their, I wonder?) the situation probably could have been resolved in a day or two.

Re:Improperly done blacklist

[bigberk]

If so, why don't you use your ISP's server as smarthost and relay through them?

Why don't I use my ISP's mail server? Because:

1. My ISP's mail server sometimes takes as much as 3 hours to deliver a single email
2. Mail sometimes gets lost entirely, and without access to logs I have no clue what happened
3. I have a host with TCP/IP abilities just like everyone else. Just because I'm not paying thousands of dollars doesn't mean I can't establish a port 25 connection to another host. I resent the drive by industry to segregate connectivity based on service class (consumer/business). TCP/IP knows no such labels.

Horror story my arse

[pauldy]

Use some common sense editors when presented with a story that seems unusually slanted please take it at face value. This is why corporations such as verio need to be made aware of their policies not working not that black lists do not. Blacklists are the only thing that works against spammers and they know it. So how do they fight back by using the blacklists against regular sites to try and disrupt users service so that people might think twice about using them.

Instead this article should be title "Why Blacklist Do Work" and what spammers are doing to try and disrupt them.

That's what I'd call costumer care...

[rune.w]

Quoting from the article:

1. Technical support people don't have access to Internet;
2. They are not allowed to phone to customers;
3. And they are not allowed to send them emails.

Maybe it is a good time to change ISP?

Am I understanding this correctly?

[orthogonal]

From the article: My ISP has a partnership with Verio to handle its traffic in the U.S. When Verio blacklisted Smart Mobs, any request from Noos went unanswered -- sorry, there was the (in)famous 404 error.

I want to be sure I understand this correctly. Verio wasn't (only) discarding mail from Smart Mobs, because they thought it was spamming site, they were refusing to pass through http (or other) connections to it?

Discarding mail is one thing, but blocking an IP address is quite another. What's the justification for this? To prevent the (supossed) spammer from profitting from the spam, by preventing anyone from connecting to it to (presumably) buy the product touted in the spam?

Discarding mail from a spammer can be justified, by, among other things, the argument that spam mass-mailings strain system resources. But connecting to sites happens all the time -- an ISP should should be set up to handle that traffic, and can traffic to sites touted in spam really increase the volume that much?

To me, this seems like a dubious policy on Verio's part -- even without the problem of mis-identifying sites as in the case of Smart Mobs.

Hypocrisy

[sirket]

First of all, the idea of Verio blocking spammers is laughable. They have always been a haven for spammers and everyone here probably already knows that.

The real issue, however, seems to be this guys ISP. I mean honestly, what the hell is wrong with them? If I had called Speakeasy with this sort of problem, it would have been taken care of that day.

-sirket

My own slashdot horror story...

[Sun Tzu]

I have an earthlink.net account and a couple of weeks ago I was issued an IP address in the dreaded slashdot BANNED! file. Pity poor me, getting the big orange screen telling me about the terms of use and how, as a BANNED! IP addy, I was unable to even read them. Fortunately, the evil orange BANNED! page quoted me a few of the offenses that might have gotten 'my' IP banned. I must have spammed the input queue or posted a PWP (page widening post) or somesuch.

Of course, it wasn't me. It was some other Earthlink customer who, sometime in the past, was issued that same dynamic IP address and committed the unpardonable offense. That customer has moved on to a new IP, but /. never forgets.

It was hell. I spent *hours* unable to access /. -- can you imagine the suffering that such a fate would cause *you*??!

Eventually, I was issued a new IP address from earthlink and was back online as the ageless Sun Tzu once more. But I still live in fear that someday, perhaps when I least expect it, the evil orange BANNED! page will return to haunt me. This is the personal hell that I inhabit and it is here that I shall remain, until I get a clean static IP address of my very own. I live for that day.
--
Send us your Linux System Administration articles

Re:My own slashdot horror story...

[pyrrhonist]

And you couldn't manually request a new DHCP address because... ?

He probably could, but unfortunately he'll probably get the same IP address. From the RFC:

If an address is available, the new address SHOULD be chosen as follows:

• The client's current address as recorded in the client's current binding, ELSE
• The client's previous address as recorded in the client's (now expired or released) binding, if that address is in the server's pool of available addresses and not already allocated, ELSE
• The address requested in the 'Requested IP Address' option, if that address is valid and not already allocated, ELSE
• A new address allocated from the server's pool of available addresses; the address is selected based on the subnet from which the message was received (if 'giaddr' is 0) or on the address of the relay agent that forwarded the message ('giaddr' when not 0).

Bummer, dood.

Answering the question.

[_Sprocket_]

So the question presented by this article would be "WHY is blacklisting spammers a bad idea?" Unfortunately, it doesn't answer the question.

The blurb mentioned by the article submitter is the entire coverage of any such activity. The rest of the piece then goes on to complain about the user's ISP. Those who haven't RTFA'd can feel comfortable in skipping this one.

I'm sure this submission will provide nice fodder for expressing annoyance over spamming and horror stories of "collateral damage". But then - we've had plenty of those before. It would have been nice if an article had provided some framework around this kind of conversation.

This article doesn't.

Wrong. Not perfect != "bad."

[the_dreadnought]

The good it does is far outweighed by the bad. Just like everything else in life, mistakes will be made. You can have a problem with the process to correct mistakes, but advocating RDNS blacklisting should go away doesn't make sense.

Verio = SBF (Spammer's Best Friend)

[NoSuchGuy]

To get kicked from Verio, you have to burn down a network center or something like this. About 500 mails from users to abuse@verio.net for one spamvertized website netmails.com and no action taken ==> They do nothing against spam. They tolerate spam.

Check for yourself: Verio's Listing .

I use blackholes.us to block (port 25) entire countries (cn, kr, tw) and ISPs (Verio, interbusiness.it...) that do not qualify (in my standards) for connecting to my mailserver.

NSG

Better title

[commodoresloat]

"Why Blacklisting Spammers is a Bad Idea: It Takes Up Valuable Time that Could Be Spent Tracking Them Down and Killing Them"