Slashdot Mirror
Why Do Email Admins Make Viruses Worse?
gripdamage asks: "Why are email administrators still sending virus bounce messages, when everyone knows viruses forge the sender? This effectively doubles the amount of email traffic due to the virus (triples in the case that the recipient is also notified). As one of the links says 'any AV software or admins that have it mis-configured [so] that it is continuing to send out notices...to forged senders, deserve to be ridiculed.' I have received 4 times as many erroneous bounce notifications, because of MyDoom , than the actual virus, so the bounce messages are much more of a problem! This is a problem deserving publicity, so that email admins will be shamed into doing the right thing." The problem is that most bounces are automated responses, the simple thing would be to turn them off. Of course, the rational of the automated response is to hopefully notify the infected user of the problem -- what a catch-22! What kind of policy would you recommend when it comes to spam, e-mail and automated responders?
(fp!)
This sig no verb.
But this doesn't serve their purposes. Their goal, in the event of a virus outbreak, is to advertise. When people are getting viruses, they start looking for AV software, and that's the perfect advertising opportunity.
I always write back to the postmaster@domain to complain that their software is advertising, and I include a Cc: to the AV vendor, so they can see the negative publicity that results. It might help if everyone else did the same....
It's an advertisement, pure and simple. It's entirely to the software manufacturer's benefit to take the opportunity to advertise to third parties with you as the middleman.
And it works. I've had grey haired suits forward bounce messages to me to ask about the other products, asking whether we might want that instead of or in addition to the package I'd already put in place for them.
I don't administer any of these programs, but I imagine they all do have the ability not to send these messages, but someone's got to change the settings.
Are we certain that they are bounces and not just viruses pretending to be bounces? The pattern of the messages I've received suggest to me that the viruses are trying to conceal themselves (poorly) as bounce messages.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
That's great. I recieved thousands* of emails telling me that I was infected with the last MS virus. I run Linux. I don't particularly care about the bandwidth, I *do* care about the fact that my inbox was rendered useless for quite a while with all the anti-virus spam.
* (When I say thousands, the actual figure was twenty thousand over three months).
As I've seen it, there's multiple camps for what to do with email bourne viruses. Those that say strip the attachment, and those that say can the whole thing. I have always belonged to the "can it" group, and Mydoom is a good example. Before our virus scanner started catching them, I got at least 5 emails about how a hacker must have broken into the email system, because they got this message returned to them that they didn't send, etc. If the mail had a virus in it, just can the message.
Next, is what to do after you've tossed the mail: to notify or not to notify. Well, I'm the type that believes that *someone* should get a notification if an email is tossed (ie, mail should never disappear without some sort of DSN going somewhere). So in the case of non-mass-mailing viruses, I send a notice back to the sender telling them their mail was canned, and why.
So my question to other mail admins (which I recently posed to the amavis-new list), is why not rely on the virus scanner's naming schemes? I use f-prot here, and all viruses that fake sender email addresses end with "@mm" (for Mass-Mailer). So I told amavis to not notify the sender if the virus name contains "@mm", but to notify the sender if it does not.
Result? I've blocked over 8000 copies of Mydoom in the last 24 hours, and not sent a single mail to the "sender"s, but when one of the professors sent a mail out with a Word document attached that had a macro virus in it, he got a mail back saying the message was stopped and why.
Simple, elegant... but why don't others do similar setups?
Three dits, four dits, two dits, dah!
Radio, radio, rah rah rah!
And it doesn't even solve the problem of bouncing a virus infected email back to the person who is listed in the "from" address. Because with most new viruses, that person isn't the infected one most of the time.
I think that's what the submitter is complaining about. Anti-virus solutions sending bounce messages for virus infected emails to the people in the "from".
There are only 10 kinds of people in this world... those who understand binary and those who don't
And you are the reason that RBL's cause so much collateral damage.
It's great that you are taking this political stand and sticking it to the virus scanner companies. I'm sure all the email admins out there make the logical jump that their virus scanner messages are causing their IP addresses to show up in RBL's. They'll all disable their virus bounce messages for you.
Actually, now that I think about it, it's more likely that people will assume RBL's are useless and don't work. They'll probably complain to their peers and convince them that RBL's are unreliable.
Way to go, jerk.
-- DrZaius - Minister of Sciences and Protector of the Faith
> For now, I'd settle for enforcing strict compliance with RFCs
Indeed. I'd pay money to get my ISP to block messages that don't have a
valid Subject: header.
> helo must be a FQDN that can be forward and reverse dns matched with the
> connecting IP would be an excellent start
I've considered merely rejecting mail from sending servers whose IP address
has no PTR record whatsoever. The only problem with this is that it blocks
approximately 110% of the continent of Asia from sending you mail. (Then
again, I'm of two minds about whether that would be bad...)
Cut that out, or I will ship you to Norilsk in a box.