Why Do Email Admins Make Viruses Worse?

gripdamage asks: "Why are email administrators still sending virus bounce messages, when everyone knows viruses forge the sender? This effectively doubles the amount of email traffic due to the virus (triples in the case that the recipient is also notified). As one of the links says 'any AV software or admins that have it mis-configured [so] that it is continuing to send out notices...to forged senders, deserve to be ridiculed.' I have received 4 times as many erroneous bounce notifications, because of MyDoom , than the actual virus, so the bounce messages are much more of a problem! This is a problem deserving publicity, so that email admins will be shamed into doing the right thing." The problem is that most bounces are automated responses, the simple thing would be to turn them off. Of course, the rational of the automated response is to hopefully notify the infected user of the problem -- what a catch-22! What kind of policy would you recommend when it comes to spam, e-mail and automated responders?

Comments

Bounce the headers

[aridhol]

Bounce the headers of the message, and possibly some text. Do not bounce any attachments. If the "sender" is real, they will know their own message by that; if it is fake, bandwidth is not overused.

Re:Bounce the headers

[menscher]

Bounce the headers of the message, and possibly some text. Do not bounce any attachments.

I'd actually prefer if you bounced the entire attachment. In the case of virus outbreaks, it's a lot easier to filter out the unwanted bounces based on an attachment, than having to read all the headers and wonder if I (or a user) sent an email to someone with a subject line of "Hi".

Yes, it wastes bandwidth. But it saves human time. If you're that concerned about bandwidth, don't bounce known-spoofed-From:-header virus email at all.

Re:Bounce the headers

[David Byers]

I've yet to see a single useful bounce generated by an AV scanner, because they insist on sending the bounce to the forged sender.

People using AV scanners need to hook them up to their SMTP servers so the SMTP server can reject the message as it is being sent. That way innocent people won't see a deluge of misdirected bounce messages.

Not exactly

[sahrss]

I have received 4 times as many erroneous bounce notifications, because of MyDoom , than the actual virus, so the bounce messages are much more of a problem!

I agree that the bounces are damaging, but they usually don't multiply the damage; assuming one bounce per virus email, that is only 1x as harmful as the virus itself.

Most AV will not bounce the emails (these are the ones you don't see of course), reducing the ratio of (bounced emails) / (total emails) to below 1.

The simplest rule I would enforce.

[Anonymous Coward]

If you are the admin of a mailserver, NEVER BOUNCE OR REPLY BASED ON ANYTHING EXCEPT THE INFORMATION IN THE ENVELOPE HEADER.

I am fucking tired of seeing mail bounced to my server and email address, just because my email address (or domain) was in the From: portion of the message. They should be smart enough to take a look at the envelope portion of the header and see there is a difference.

Also, stop notifying senders that "you may have a virus". At all. If you want to do this for your own users, that's fine - but stop sending this shit to people outside of your domain!

And third... GAH... Where to begin. I give up.

It's a subtle form of spam..

[zcat_NZ]

and should be recognised as such.

AV vendors know damn well that 99% of viruses spoof addresses. More than anyone else, since studying viruses and figuring out what they do is their JOB!!

The only possible excuse for this behaviour is that they get FREE ADVERTISING out of it. It's spam advertising AV software and/or mail filters, plain and simple. It should be treated the same way as any other spam.

Problem is

[jptechnical]

Many admins think that they are lord of the castle, if you suggest a change to the email system, like cancelling the bounce, the first answer is NO like you are stepping in their territory.

I used to work for a place where the admin also got so paranoid with spam that he blocked entire domains like yahoo and hotmail even though there were at least a dozen legitimate customers that used those email services as their primary business email.

It isnt until there is a backlash or fear of losing their castle that some will make a change.

Sometimes you just have to be the loudest voice in complaining and go over their head and reason with their boss. Explain that a flood of redundant emails is bad practice and that in many peoples eyes a bounce message saying "virus found!" with your companies domain makes people think that YOU have the virus. Sounds strange but it happens. You bounce a message and you get a call saying "You guys have a virus... we just got an email about it" coming from the internal staff, then spend the next 15 minutes explaining that they are protected and that the bounce was only informational and still they dont always get it.

Virus protection is best operated SILENTLY! You as an admin can sweat the details but the clients should just "Know they are protected" and not be bothered with details. It's just good management.

What's the to do with spam and viruses at the ISP?

[vojtech]

The answer is quite simple:

• mark
• defang
• deliver (if recipient exists)

And don't ever send a bounce.

Send bounces only for mails not detected as either virus spam.

That would make everybody happy.

Re:bounces are good

[DarkFencer]

ABSOLUTELY NOT!

I run a mail server with 13000 users! Getting every bounce of these things to postmaster no matter who sent it would make me route postmaster to /dev/null

Re:What's the to do with spam and viruses at the I

[R_Harrold]

Problem here is that if you mark, defang and deliver some people will get hundreds of e-mails in their inbox which consist entirely of the attachment removed due to virus infection message. They inevitably come back to the mail administrator and report it as a problem: 'all of my e-mail is getting the attachments removed'. Far better just to log the event and place the infected e-mail into the bit bucket, never to bother anyone again. This approach doesn't cause lots of 'shells' being sent to the recipient and does not toss lots of NDR messages to the alegged sender (who probably did not originate it anyways given the methodology being used by the newer mass-mailer worms). Robert H

Re:"Simple" solution?

[jhunsake]

Simple, elegant... but why don't others do similar setups?

Laziness.