Spanish Internet Provider's SMTP traffic Blocked

Andrew D Kirch writes "After being barraged by spam and 419 scams from Rima-TDE and telefonica.es [translated], the AHBL has announced that all of Spain's national ISP's e-mail will be blocked by their blacklisting service. One has to ask though, is blocking an entire country like this the future of spamfighting, or has something gone horribly wrong?"

Comments

Inevitable, and other countries are next.

[joeszilagyi]

The message is clear: police your people's usage and abuse of the Internet, or prepare to enjoy your new Intranet.

A few other countries that can use this are found here.

Re:Inevitable, and other countries are next.

[kinzillah]

"Blackholes.us does not list spammers, spam supporters or vulnerable hosts at the present time. These lists are meant to contain all known networks assigned or allocated to the respective provider or organizations within the respective country. Lists are created for research purposes, primarily, and are made public for any use others see fit."

It seems the purpose of the site is to list the IP ranges associated with various bodies in the event you should wish to block their traffic.

Re:Inevitable, and other countries are next.

[aqua]

Chinanet's attitude is utterly hostile. To the extent that one can communicate with them at all (only slightly worse than trying to communicate with any large american ISP, to be fair), they not only don't care, they will defend the spammer ("is not spam") or lie about its origins ("IP in report is wrong.") [quotes here from n.a.n-a.e] Giving them the benefit of the doubt (i.e. that they're not pernicious malevolent cretins and merely have a very different view of right and wrong in this matter), it's still impossible to deal with them on an individual basis. Maybe a government could. Or MSN, or AOL. But until that happens, all of Chinanet's known IP address blocks have a nice shiny DROP rule in my mailservers' firewalls, and any URL to a host in those blocks earns several points for spamassassin to work on.

Unfortunately for this sort of problem, there isn't an email equivalent to a Usenet Death Penalty (UDP). UDPs threatened or applied against major ISPs often tend to produce some meaningful action. Partly it works (to the extent that it does) because Usenet has a replication fabric controllable by a relatively small number of people, whereas email has no such system.

Maybe someone will stage a worm attack in the opposite direction from the usual -- writing a worm to scan the top spam sources lists and spamvertized website lists and DDoS them. It would do little for the problem directly, but it would increase the cost of doing business substantially for Chinanet and their kind. (okay, vigilante justice is usually very bad. But it's a fun fantasy.)

Re:National ISP

[LibrePensador]

Telefonica is the biggest ISP in Spain. There are others, but Telefonica's servers route a huge portion of Spain's emails, so this is significant.

One problem with blocking entire countries

[dtfinch]

The United States produces more spam than any other country.

This doesn't happen overnight.

[dinodrac]

Rima-tde's long time treatment of abuse complaints has lead to them being labeled by many in the community as a rogue provider.

This has continued for quite some time, as evidenced by archived usenet posts (http://groups.google.com/groups?q=rima-tde&ie=UTF -8&oe=UTF-8&hl=en&btnG=Google+Search)

Getting up there along with the likes of HINET and Chinese state-run providers takes some serious work, and in goes to show Telefonica De Espana's commitment to its spammers!

Congratulations to them on this well deserved moment of (in)fame.

Re:perhaps?

[Ded Mike]

TDE is blacklisted.

They are as government independent as the BBC or DeutscheTelekom or the BundesPoste. If they were independent and a commercial enterprise, perhaps they would take the actions of those trying to preserve the Internet for the rest of us from the spammers, script-kiddiez and terrorists as seriously as they should.

Re:Is there such a thing as a reputable blacklist?

[gujo-odori]

Yeah, that happens pretty regularly where I work, too. We provide inbound and outbound mail service for corporate clients, but do not allow spamming. Nevertheless, it seems like all it takes is one dimbulb somewhere to decide (usually erroneously) that something is spam, and one of our hosts will wind up on the spamcop list. They've really gone around the bend.

There is one blacklist I trust day in and day out, though: ORDB. That's because ORDB will only list confirmed open relays. This is a conservative approach but it means that if a host is listed, there is no question of whether or not it belongs there. Also, there is an automated retest-and-removal system. I can't use ones like SPEWS because even though I mostly sympathize (although I think they are *way* too quick on the trigger), in my business that would block far too much legit mail and we just can't do that.

Re:Internet passports

[maxpublic]

We have real life IDs that are difficult to forge and even if you can forge them, you'd get hit by hefty penalties for doing it.

This is a silly argument. Criminals will forge i.d.'s regardless of the law *because - duh! - they're criminals. It's what they do*.

And if you think it's difficult to forge a driver's license or a passport, from *any* country, you've been swallowing too much government bullshit. For $500-$1000 you can get a completely new, legal identity that'll check out if the government investigates it, because it was purchased directly from the folks who control the system that issues i.d.'s in the first place. I could, in 48 hours, get a perfectly valid (and new) SSN, drivers license, and birth record entry which will hold up under government scrutiny *because the folks who control the system will sell them to me, and they aren't forged*. I can get decent forgeries for just a few hundred bucks, if I don't need to pass a serious security check.

Internet i.d.'s will be no different, and no harder to forge. Or to buy, from the right people.

Max

Re:about time

[trelanexiph]

Telefonica.es is the ISP, as RIMA-TDE (another hat it wears) it has been responsible for the continuing incredible 419 spams out of Spain, though they're a BIG ISP, and they are, this does not excuse them from policing their network and ensuring that such things are kept to a minimum, and terminations occur when appropriate. The issue here was they refused to identify corrective actions, refused to terminate abusive customers, and refused to return contact after they initiated contact.

Re:Bah, typical slashfoo

[bruns]

The AHBL is the redesign of the older blackholes.2mbit.com DNSbl from years ago. We've just changed its main focus on abuse in general - which includes e-mail, DoS attacks, etc.

We are apparently in wide enough use that we deal with TDE customers on a daily basis that are complaining that they are blocked.

Its not our primary focus to be the biggest.

Our primary focus is to protect our systems, and the systems we manage, from spam and abuse. We make our data available to anyone and everyone, because we know that our data will improve on the feedback of our users.

So far, we have had zero complaints from our users as to our blocking methods, even if they are extreme at times.

AHBL policies

[bruns]

The AHBL is very open to working with providers to solve their problems. On a daily basis, I can be working with several ISPs to figure out how to better tune our listings, or help them track down a spamming customer.

We only resort to this wide range listings when we're run out of options. In the case of TDE, we just do not have any more patience.

We gave them time. We sent them abuse reports. We even asked them to provide us with accurate information on their netblocks so we can tune our listings down to only their dynamic customers.

However, they ignored our requests.

The AHBL has very strict policies on what we will and will not do.

We are taking a strong stance on 419 and phishers right now - just take a look at our ongoing fight with megamailservers.com - we caught them in a lie with their phishing customers, and we are holding them responsible.

If we are having an effect or not, it doesn't really matter to me. All I do know is that we are taking a stance and asking others to support us.

The hope being that with enough people working with us, we will be able to force providers to do something about their problems.

Feel free to flame me all you want.

Re:you mean BIG?

[Anonymous Coward]

A 419 e-mail refers to a particular kind of Nigerian fraud e-mail, not the number of e-mails sent.

Re:Geeks

[harlows_monkeys]

What a bunch of arrogant fucksticks...How about sending the Telco's CEO a registered letter, pointing out what will happen within a month if things don't change?

I think it is interesting that you call them arrogant fucksticks, when you have no clue at all how this stuff works. Hint: a block only becomes this big when the ISP has repeatedly ignored abuse reports over a long period of time. The only way to get their attention is to block them.

And, in fact, now that they have been blocked, they suddenly have shown an interest in dealing with their spam, and have contacted AHBL.

Note also that AHBL asked for details on address ranges, so they could tune the fine-tune the blocks to just catch the dynamic addresses (the ISP claims that most of the problems are from users at Internet cafes), and was ignored. Note also that the ISP could solve this problem with a simple block on outgoing port 25 from their Internet cafe customers.

Korea was First, China Second

[billstewart]

Korea was the first country to get massively blacklisted. It's probably the most wired country in the world, with a large number of cookie-cutter badly-administered machines (mainly in the school districts) that had open relays on them, language barriers that meant that if you did send mail to the bad administrators, they couldn't read them and you couldn't read their replies, and it has a relatively small set of industries that do Internet-related business with US locations - if you don't make chips or consumer electronics, and don't have friends over there, you're highly likely not to get many false positives by simply blocking the whole country and its huge spammer load. And if you _do_ have friends over there, you can still block any email that's not in Korean character sets :-)

China's another popular place to block, not because of badly administered machines, but because of policies of tolerance of spammers and scammers and lack of useful response to abuse complaints. I haven't gotten much spam in Chinese in a while, but I still get lots with either the email origin or the web site located in China. And China's Internet access is controlled by the government telecom monopoly, who obviously don't mind spammers if they pay their bills.

So blocking a whole country isn't a new thing. But this isn't a whole country, it's just one of the major providers there. Spain doesn't censor their users' internet service - if you're blocking their mail, they can get themselves a Hotmail or Yahoo account to reach you.

Re:As a Spaniard...

[Anonymous Coward]

As Spaniard...

It's true that the announcement does'nt say that they'll block the whole country, but telefonica rents his lines to other companies, so they will be blocking a lot of people, a lot more than the 50%.

Its incorrect that telefonica is the gov's isp, it was few years ago, but the previus government privatized it so the new government (we have elections a month ago) doesn't have any control over the company.
The process of privatizacion was very obscure, a lot of directives getting a large amount of money, the new president that was designed was a friend from school of the old government president, etc etc.

We've got only a pair of alternatives and isn't as easy as it seems to change provider, for example you can't change company in the first year whithout paying a large amount of money.

We're paying what the previous government do, they do their worst in exterior relationships, they had a very bad plan about new technologies, education, etc. For example Spain got the worst number of internet connections, internet services and the most expensive connections of Europe.

Telefonica got the worst client hot line you can imagine and they don't pay any attention to what the users says, but you've got no alternatives in the most of the cases.

So as a Spaniard and as a Telefonica user i thought that it isn't fair to ban the whole company ips but it's fair to make telefonica pay a large amount of money or punish it other way.

PD: sorry for my english

Unfortunately, large blocklistings are necessary.

[DocSnyder]

rima-tde.net is a major European spam source. So is wanadoo.fr whose official email relays (193.252.22.21-30) are sending me about 50 spam emails per day. Almost everyone in Europe is blocking their entire netblocks, but that can't be a solution as not everyone is able to block them.

So I unblocked their relays a week ago to see the input IPs and LART each spam originating from worm-infected Wanaspew customer PCs. Surprisingly, the whole mess hasn't been coming from thousands of wormed Weendoze boxes, but merely from *four* (later six) different input IPs. A responsible ISP wouldn't have any problem in preventing a handful of customers from emitting spam.

Wanapoo did nothing. In spite of 44 (!) complaints to Spamadoo and some further communication with the French ISP association AFA France, the same customer IPs I've been LARTing up to 10 times since Sunday last week were still spamming on Friday.

So there are only two solutions left - either eat your spam or dig a deep hole, put Wanadoo's netblocks including their email relays in and let them rot there. Writing spam complaints to Wanadoo is futile.

Blacklisting at this level can help

[DeanFox]

So many posts complaining that this won't solve the problem...

Blacklisting the entire ISP does not solve the problem in a technical sense. It's designed to achieve one thing. It gets the attention of top management who can fix the problem.

As in human nature, the problem isn't important until it affects you. This is especially true in large organizations, and becomes more and more true the further up in management one gets. It's a given in political jobs at any level.

Polite emails are not an affect; I doubt top management even knew about them. The decision makers at TDE haven't cared because they haven't had to care.

If AHBL is large enough to have an effect, now the top management has something to care about. Since their positions at the top are governed by politics, this notoriety is exactly what's needed to get their attention.

Blacklisting like this solves the problem by affecting the top management in a way that motivates them to act. Now policies will be enacted, procedures will be followed, closing down forwarding on port 25 will happen, so on and so forth... And those changes do help fix the SPAM problem.

This is news? Slashdot already blacklists TDE

[JackAsh]

Hi all,

My family actually lives in Spain, and uses Telefonica as their ISP. During my last visit, I discovered a wonderful surprise: Slashdot already blacklists the entire Telefonica data block. Whenever you select a link to read a story's comments, etc., it comes up with some message about not allowing that operation due to abuse from the netblock. It was pretty cool, really.

In any event, Telefonica is a big, monolithic telephone operator. They used to be the official, national telephone monopoly company before the market was opened up to other operators. Telefonica is still huge, nonetheless. They have voice, data, and cell phones in Spain; I think they also own a good chuck of media there. They run a pretty sizeable percentage of the telco business in South America (possibly the largest telco in the region). They bought our Terra back in the 90's, which bought out the Lycos networks for those that actually care.

Telefonica could probably have worse service, but they would need to train their personnel for it. As with most old monopolies there's this pervasive company culture that they are the center of the universe and if you don't like it you can go jump off a cliff or something. So I'd suggest not holding your breath for this situtation to be resolved. Although, as with every bureaucracy, every once in a while messages accidentally make it to the desk of the one guy who has a clue... :)

-Jack Ash