Slashdot Mirror
Australia's Largest ISP Redefines Spam
cpudney writes "According to this article in NEWS.com.au, Telstra BigPond, Australia's largest ISP will monitor its customers' e-mails and suspend the accounts of users suspected of sending spam, viruses or denial-of-service attacks. Under changes to its Acceptable Use Policy, BigPond will investigate cable and ADSL Internet customers sending more than 20 e-mails in a 10-minute period, and BigPond management "may suspend the (user's) account while the customer is contacted" if they are suspected of sending spam. Previously, BigPond's definition of spam was held to be 400 messages sent over a 15-minute period and now it's changed to 20 e-mails over 10 minutes. Internet Society of Australia president Tony Hill said BigPond's new definition of spam was very restrictive and he was concerned the limit had been set too low for legitimate e-mail users."
That's going to make life fun for my parents who use Bigpond, and type all their emails offline.
Log on, send 30 or so emails in 2 minutes, and log off.
Then wonder why they can't email again next week.
I hope they at least contact the user before shutting off service. I can think of many legitimate reasons to send 20 e-mails in 10 minutes. My adress book has many times that, and sending a CC to a fraction of my adress book would trip this.
"Sic Semper Tyrannosaurus Rex."
Never had to answer 20 emails? Great. Just hope you are online all the time and not coming back from a trip or something, where some emails may have acumulated in your outbox. 20 emails is VERY low - I am now going on a three day trip, and I can bet I will have 40-50 outgoing mails in my mailbox when I return, just waiting to hit our email server. So, with their definition I would be in trouble. WHOW.
Why is BigPond trying to identify a spammer from just 10 minutes of traffic. Or even just 15 minutes? I would think it would be much better to have a metric like 1000 emails in a single day. Or 10,000 emails over a week?
I can very easily go through 20 emails in 10 minutes just because I might be having one of those back-and-forth email conversations. I don't know if I could do 400 in a 15-minute period, unless I was running a mailing list (well, which I do, but that's why I use "personal" business ISPs).
This sort of metric just seems extremely silly. Is someone putting pressure on BigPond, or is one of their executives being an idiot?
Great..a slashdot style limit on time between posts.
Now Telstra's customers are just missing the lameness filter and the moderation. The occasional dupe happens in email allready.
Hm. There's a chance a lot of my work on Healthcare Informatics would be modded -1 Redundant and never reach my professor.
Irene KHAAAAAAN!
I couldn't tell from the article exactly how they were counting 20 emails (cc's or bcc's count? groups count?). But the fact that they monitor by email sending rate seems interesting. I think adding just one more step to that process could make it really useful.
1) Monitor all sources of emails in which large numbers are being sent over a short time period.
2) Allow a central repository for people to report which emails are considered spam. Once that amount reaches a certain threshold...
3) Connect the dots, you get a spammer.
--------
Bleah! Heh heh heh... BLEAH BLEAH!!! Ha ha ha ha...
...if not for Slashdot's 2-minute delay policy.
Sheesh, evil *and* a jerk. -- Jade
There's no reason for this. All an ISP needs to do is institute a policy whereby if someone is caught spamming, the cleanup charge is $20,000. They already have their credit card, all they need to do is charge it.
This is America, damnit. Speak Spanish!
Quote:
Under changes to its Acceptable Use Policy, BigPond will investigate cable and ADSL Internet customers sending more than 20 e-mails in a 10-minute period, and BigPond management "may suspend the (user's) account while the customer is contacted" if they are suspected of sending spam.
It doesn't say anywhere they they will suspend your account if you simply send 20 emails in 10 minutes. All it says is they may investigate users who do, and may suspend their account upon further investigation. I really don't see a huge deal with this, and there isn't any plausible reason to get angry with this policy if it is followed properly.
It's not like there's an automatic suspension for exceeding the limit. They're just advising that 20 in ten minutes is the level that now prompts them to look more closely at. If they aren't stupid about it, it shouldn't be a problem.
Admittedly, that's a big if, given that it's Telestra that we're talking about, but . . .
This is going to be a bit of a problem for people running things like majordomo and so on from
their home linux boxes.
If things have been set up to use the ISP's mail servers as relays, which you might do to save on bandwidth, it's going to get sticky. (Or does one message with a trillion addresses count as one message?)
They're only going to investigate those people, not disable their accounts. If they look at it and see that they sent legitimate messages because they just pop on to send e-mail, they'll be find and their ISP will move on. At least this should make the net big enough to actively catch spammers eariler.
It's not stupid. It's advanced.
Oh this will be brilliant.
Picture this: Telstra Bigpond email systems die again (just give it another week) and you cannot send out your email. You have 20 messages in your outbox waiting to be sent. Finally their systems come back on-line (for now) and you send all the emails only to get flagged as a spammer and denied to email again.
You end up back where you started.
(\(\
(^.^)
(")")
*This is the cute bunny virus, please copy this into your sig so it can spread
One of my uni lecturers uses Bigpond as his ISP. He also has his uni email accounts redirected to his Bigpond address. He had problems a while ago when Bigpond went down. He normally accepts assignments via email, but everything sent to him got delayed a few days. Thankfully he accepted assignments which had been sent to him on time, otherwise a lot of people would have inconvenienced.
This lecturer also has other responsibilities (I won't go into detail here) which require him to him to send out newsletters to all of the students in our department, plus international committees and a large number of university staff. We are a small department, but still have ~100 students. Sending out a student newsletter would trip the new email limit. I don't know how he's going to get around this from home (obviously he can send it using our uni mail server when he's at work).
Just another example of Bigpond not being up to scratch these days. I personally use a competing ISP, and have never had a problem. I don't know how Bigpond is going to keep its customers with shit like this.
It's been reported that SpamCop is paying upwards to $30K / year for bandwidth as a direct cause of the continous DDOS attacks on it.
The spammers are doing everything they can to squeeze the anti-spammers out. They use frivolous lawsuits (aka Mark Felstein and his porn spamming backers) or DDOS attacks that either knock the anti-spam resources off completely or increase the costs so that no hobbyist can run them.
And while all this is going on, the law enforcement agencies are doing nothing to counter the clearly illegal acts of the spammers.
And ISPs are doing NOTHING to reduce the number of zombies on their networks. So the DDOS attacks continue.
Nice going.
It's only a matter of time when someone (Al Queda?) will use the zombie network for something that will truly be noticed.
Proletariat of the world, unite to kill spammers
400 in 15 minutes, yeah, that looks odd and should be checked into. 20 in 10...that's not too hard.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
When I'm sending e-mails to my disproportionately large extended family while drinking cans and cans of Red Bull.
___ In the words of Gen. Douglas McArthur: "I'll be right back."
I have an SMTP server running on my computer. I set it up a few years ago mainly to try to see how good a handle I had on how SMTP works, and I've continued to make use of it mainly so I can create my own Email aliases and help curb the amount of spam I get and keep track of its "real" origins... But setting it up was very little trouble for me. I grabbed a copy of sendmail, compiled it, spent a few hours figuring out how to configure it, registered an MX record with DHS International and that's it... It's running. DHS was a free service the first few years I was with them -- now they charge me $5 per year.
For a brief period my ISP was filtering access to the SMTP port on my residential address, which meant I couldn't receive messages using my SMTP server... But I was still using it to send them out with no trouble! But at some point I contacted them and told them that I only want to have it running for my own usage, just to help curb the amount of spam I get, that I won't be giving anyone else accounts on it and that I understand how relaying works and have correctly restricted it... And a week or two later my SMTP port became accessible again. (Hopefully they actually reviewed my usage logs and tried to relay something through me before they did this... I'd hate to think they weren't careful.)
Sooooo... If I had no trouble setting up my own SMTP server, isn't it reasonable to assume that any halfway intelligent spamming organization would do the same -- set up their own server, then use that server to send out their spam, and avoid giving their ISP the chance to easily monitor their messages' content?
So isn't this really a more or less completely pointless violation of almost always legitimate Email users' privacy?
Please God, let me find my blue hat with the red trim. (Frances Farmer)
This isn't about stopping spam, serious spammers don't use their own accounts, they relay off others.
What it will sneak through under the cover of Spam hysteria is the following.
1) It will force budget business users onto more expensive corporate accounts.
2) It will stop people batching their email correspondence to miminise online time which in turn will reduce peak load on telstra and also bring in more money.
3) Less nasty but equally beneficient to Telstra it will allow them to stop worm riddled machines bogging down their email servers (Telstra are facing massive damages over the near collapse of their email infrastructure and associated business losses).
'There is a Light that never goes out.'
Come on guys, everyone knows what spam is. Its plain and simple. What this seems to be is a description of common behavior patterns of ppl who send spam. Thing is that this is going to have false hits. Filtering on content is really the only way to be sure (other thing nuking from orbit)
I can tell you that contacting users before shutting them off is a very bad idea. It's very frequent that a user will have wrong contact info on file when you go to contact them...any time you try to wait to contact them you're almost always just delaying for the sake of somebody who knows nothing about their computer except that how to use word...for the sake of what! Notification == waste of time, 16 years experience agrees with me.
The linux hacker
I opened a super-sized can of worms with a (NULL, Dumbass) of a question... damn brain cramp...
This IS spam in my opinion. My favorite one is some friends that e-mail me the same thing over and over. Basically it goes like this...they see it, they send it, they forget about it then they send it again and repeat. Honestly...how many times do I have ot see sea life form the seal of the United States?
Gorkman
But seriously folks!
This is what you get for being a sheep and supporting your local (ex)Monopoly. No surprises here, none whatsoever.
Pain for many normal users? Sure!
Likely to increase ISPs income? Sure!
Actually going to make a *real* difference to professional spammers? Not likely!
Not much more than the usual big company thinking It's not important to solve the problem. It is only important that we convince the public we're working hard to solve the problem. (eg Microsoft and Security)
Then again, perhaps it'll encourage a few % more people to seriously consider their Internet Access choices in Australia, and they'll be better off in the long run.
If it's not entirely obvious (read-my-sig), HELLstra is not my ISP.
Visit CryptoGnome in his home.
Agreed. But fighting the spammers won't prevent that. The only way to prevent that is to secure the majority of on-line PCs so they can't be zombified.
I don't care if it's 90,000 hectares. That lake was not my doing.
Sections in this document:
English Inflections First off, the OED gives nothing but viruses for the plural. Here's its abbreviated entry:
Other sources that support viruses include Birchfield (n Fowler :-) in Modern English Usage (3rd
Edition), and also the Cambridge Encyclopedia of the English Language .
Classical Inflections
While one would hope that the authoritative sources cited above would
suffice, some writers prefer to maintain the classical inflections on
some English words, particularly in technical writing. For example,
conflicting indexes/indices and minimums/minima are both
easily found, depending on the intended audience and use. In that case, what's
the classical plural of virus?
The simple answer is that there wasn't one. The longer answer follows.
Writers who, searching for a fancy plural to virus, incorrectly write *viri are doubtless blindly applying an overreaching -us => -i rule. This mis-inflects many words. For example, status and hiatus only change the length of the final vowel; genus goes to genera; corpus goes to corpora. Others are even worse if this rule is mis-applied, like syllabus, caucus, octopus, mandamus, and rebus.
Anyway, Latin already had a word viri, but it was the nominative plural not of virus (slime, poison, or venom), but of vir (man), which as it turns out is also a 2nd declension noun. I do not believe that writers of English who write viri are intentionally speaking of men. And although there actually is a viri form for virus, it's the genitive singular[1], not the nominative plural. And we certainly don't grab for genitive singulars for the plurals when we've started out with a nominative. Such hanky panky would certainly get you talked about, and probably your hand slapped as well.
This apparently invariant use of virus as a genitive singular may als
Is Telstra really excessively dumb? I would guess not, so let's suppose for a moment that they aren't.
If they're not really really stupid, they might have thought: Gee, I wonder if there's any way to tell what's 3 standard deviations above the mean as far as peak mail sending rate is? Do we have, anywhere, a listing of all the emails that have been sent by our users? Preferably arranged in chronoligical order, with timestamps? If we had that, why all we'd have to do is a little grep and wc action, toss in some particularly ugly perl to aggregate the results, and we'd be able to figure out what normal is. From there, we'd be able to figure out what weird is. Once we know what weird is, we'll know which accounts we should take a closer look at.
I've gotta think they figured that out. After all, they have to have figured out how to count the mails per minute per user to be able to implement this (and their former rule), right?
Of course, it's possible they really are too dumb to look at their own server logs. Maybe they pulled this number out of some business weenie's ass during one of those catered lunch meetings in the big glass windowed room with the collossal oak table. If this is the case, then they'll get false positives by the cartload and they'll quickly be swamped in the acrid stench of their own foolishness.
I find the latter a little implausible. Telstra may be a big evil monopoly, but I don't think they're a big evil imbecilic monopoly.
Stop-Prism.org: Opt Out of Surveillance
What I want to know is, how do they decide if you're sending spam or not? Do they read your email? If so, that's pretty serious - I'd be interested to know what the user policy is with regards to that sort of thing. And if they just disconnect you while they check, that's bloody dramatic! I guess they can monitor you for continued heavy use, and then make a decision, but I can't see any middle ground between those two alternatives.
Either way, yet again glad I'm not with Telstra!
J.
Physicist, consultant, science communicator
If that happened here, I could only imagine the number of pseudo-mass-mailers that would have issues. You know, the people that send almost EVERYBODY WHOSE EMAIL ADDRESS THEY EVER HAD the greatest joke they read this morning, or funniest picture or....
Even I could get screwed over! After releasing a newsletter, which goes out upto 10 addresses (half in BCC), I get to hours old email, dashing through as much as I can, which tends to probably push the limit about once a month.
Besides, this problem could only be gotten around...oh, what, a dozen ways? Zombies, protocol switching, virii (have to write your own) and lets not forget remote accounts and any combinations you could come up with. Signal to noise is most certainly going to be difficult for Big Pond. As much as I dislike what they've done, I sincerily feel for their tech support.
"Yeah...it was the numbers that were irrational, not the murderous cult of vegetarians...." -- Hippasus of Metapontum
This is probably common with all huge Telco ISPs the world over but I think that Bigpond themselves could do more to prevent tides of Spam originating from their customers... I think these mega ISPs have a "CPE" attitude that's left over from their Telco division - i.e. If it's beyond the equipment we provide - it's "Customer Premises Equipment" and we therefore, don't care.
Bigpond could install heavy default firewalling (especially ports 80 and 25) to protect against people who install default operating systems with Christmas tree options or are infected with spamware so they readily become spam relays and force customers to use ISP provided gateway servers. Better yet, ask customers to knowingly switch off their ISP firewalling if they're providing a legitimate Internet service. (and therefore prove that they know what they're doing)
The end days of open-slather unfirewalled broadband accounts for "Mum and Dad" Internet users is long overdue.
The conspiracy theorists claim that because Bigpond charges customers per Mb for both incoming and outgoing traffic, they really don't care if their customers are open-proxy spam relays because they'll be hit with a bill for the traffic "they've" used at the end of it. That's probably extreme, it's more than likely that they just don't care or have the technical/human resources to do anything about it...
I object to this for several reasons:
Debunking the "59 Deceits"
It is simple... enable Spamassassin not just for incoming mail, but for outgoing mail too.
Then calculate the scores of each user. If a particular user is sending lots of email that Spamassassin is "scoring" highly, then it is likely that the user is spamming or at least sending out spammy emails, and would warrent a closer look.
This would increase the load on outgoing mail servers, but if they want to do this right, and do it much more automated than manually reviewing everyone that sends "X emails in X minutes", then this would be one good way.
Or even... hold user's emails that have a very high score in a "pending" queue, and have an admin go through the queue to make sure it isn't spam before actually sending it.
Of course, this depends on Spamassassin being able to correctly target spam versus ham (and recently spammers are getting better at getting around it) but each new version of Spamassassin gets better at this again, so as long as they keep upgrading, the above system would work pretty accurately, and would minimize intrusion into people's private emails.
**FREE** Track and view your phone's via CellID and/or WIFI and/or GPS
The time scale is definately not too small. If the ISP wants to stop a spammer, he should do that as soon as possible (after 10 minutes or even earlier), not a day later, when 10.000.000 e-mails have already left the pc. Once upon a time one of my servers was an open relay and got abused for a spam-run - I assure you: in 10 minutes the server will spout out several thousands of e-mails! Kudos to Big-Pond!
There was an article, featured on Slashdot, quite some time ago, which could be applied here. The thought was that if an identified spammer tries to send to your SMTP server, the service would be slowed down.
To protect both the ISP and the innocent, they could implement a feature where after 20 mails in 10 minutes, mails would only be processed at the speed of, say, one mail per 30 seconds, and maybe slowing progressively after each 100 mails. When the mail pipe has been silent for a given amout of time, say ten minutes, the "mail slower" would be reset.
This wouldn't make much difference for the legit home user but for the spammer (and for a business connection) it would be a tar pit to avoid.
This could probably be implemented just by installing a crappier mail server ;)
~llauren
I am a bigpond user. and i know that for many users this is a godsend! you see bigpond has very restrivtive and long contracts which cost a lot to buy out of. this gives us the chance to get out of our contract without paying the fee. also... bigpond has the worst spam of any network in the world...simply because they have incompetent staff. this won't stop it.
no this doesn't help at all. the spammer can use the work around like you say, so it can only hurt innocent people.
it shouldn't be about stupid arbitrary restrictions or conditions for all users, just about identification and elimination of offenders with no collateral damage.
Ignore the frequency of email. If you are going to go digging into the details of your subscriber's emails, perform a one way hash on all of the recipient addresses and simply count the number of unique recipients in the last month (storing only the hash ensures privacy). More than 1000 - spammer. No spammer could make much money spamming less than 1000 people.
Granted, this is going to add some processing and storage overhead, but it could be done offline, and the statistics gathered used to suspend accounts once a day.
-josh
ISPs do need to more closely monitor mail that is sent from their subscribers computers--not the content but the destination and headers. Similarly, ISPs need to filter incoming mail as described below. I am glad to see an ISP like BigPond taking some step though I think they could more narrowly tailor their efforts.
Right now three domains owned by members of my family have been chosen by spammers as the forged source domain for their spams, which are primarily sent to AOL, MSN, Yahoo. Working with AOL's postmaster team (which took a long time to find), we have determined these messages originate all over the world from a number of machines on many dozen ISPs and universities--directly from clients on those networks, not mail servers. AOL says there isnt a thing they can do about it (apparently even thousands of spam messages aren't a lot for them and no filtration process exists to, say, block any email which purports to originate from a domain but doesn't originate from the ip address of that domains email server) and I should contact each network directly (a daunting task since no one reads postmaster emails anymore).
Meanwhile, AOL's, MSN, Yahoo, etc. postmaster account sends hundreds of rejected messages to our domains daily.
The spammers' chosen method seem to be to create a relay on these public access networks. Chose a random source domain (which remains relatively constant) and then apply a number of random email account names to create a forged source. Then send to every possible subscriber at a major ISP in small but continuous batches.
Short of requiring authenticated emails, it would still seem relatively easy to detect this spam both leaving and coming in to an ISP:
-- mail is being sent directly from a client and not relayed either through the ISPs mail server or another relay which matches the reply to domain.
-- mail from the same machine continually iterates reply-to names
-- if 100s of messages are being rejected, then logically 1000s must be successfully sent--which means these machines should be more than a blip on ISPs server logs.
-- while messages come in waves, they continue throughout the day (and mail sent by humans is sent in small batches usually during waking hours)
What I would really like is a registry, perhaps tied to my domain registrar, wherein I can register the mail server(s) of my domain(s) and other ISPs can do a lookup for incoming mail and block email which isn't relayed through that mail server/IP address. This simple method would stop all my spam--at least until spammers find a new method.
They redefined "Spam"? That's nothing. Those guys already redefined "Unlimited Broadband".
Karma: It's all a bunch of tree-huggin' hippy crap!