Russia, China World's Biggest Spammers

An anonymous reader writes "According to this ZDNet article, The Spamhaus Project has warned that organised cirminal gangs in Russia are supplying U.S.-based spammers with details of compromised PCs that can be manipulated to send junk mail. According to Spamhaus director Steve Linford, the Russian gangs aren't constrained by any anti-spam or cybercrime laws in their home country and have no respect for legislation implemented in other countries. Also, apparently 70 percent of spam is sent from China by American spam outfits who in turn have hosting arrangements with Chinese ISPs."

Comments

What is the best way to stop this?

[TJ_Phazerhacki]

Maybe not completely relevant to the specific subject, but what is the best way to stop this?

User end filters are a necessity these days, and even then, I still spend at least 15 min each day dealing with the spam. My personal box - No One else knows the address, it is for my own internal network purposes, is chock full of the stuff.

What do other slashdot'ers do? What can we hope to see in the near future?

Re:What is the best way to stop this?

[YrWrstNtmr]

Maybe not completely relevant to the specific subject, but what is the best way to stop this?

Due to the global nature of the internet, the only way is to wait until the governments of China and Russia change due to public, internal pressure. Note that this may take some time.

In the meantime, SpamBayes might help.

Re:What is the best way to stop this?

[chimpo13]

Going after the money would be more effective. Sure, we can't go into China and Russia, but we can make life HELL for USA spammers. If we make it unprofitable here and send more of them to jail, that'll stop most of the jerks. Even if it's just Scott Richter that goes to jail, that'll put a major dent in the action.

Re:What is the best way to stop this?

[halowolf]

While end user filters are a necessity, they should be the last line of defense, because by the time the SPAM has reached you, it has stolen the bandwidth, CPU cycles and disk space to get there.

I currently sit in the "email itself must change" camp to fix the problem of SPAM. Of course its an impractical camp to sit in at the moment, but things are moving along slowly.

I can't see that addressing the problem of SPAM on an international law basis is going to yield any results in the near and not so near future.

Just random opinions on my part...

Re:What is the best way to stop this?

[zangdesign]

The other method is to go after the advertisers who hire the spammers in the first place. Spammers are bottom-feeders, for sure, but if you cut off their customers, then you cut off their income.

Re:What is the best way to stop this?

[pe1chl]

The best way is to make sure this way of advertisement of your services is illegal in the USA, and actively go after those that still do it.

90% or more of all SPAM advertises a product or service in the USA. While it may be difficult to track the spammer, it should be simple for law enforcement agencies to track down the actual advertiser.
I cannot imagine one would not be able to find the guy who offers you a low-interest mortgage, for example. Make him go out of business. Then his competitors will no longer spam.
Same for the sale of unlicensed health products.

Re:What is the best way to stop this?

[lars_boegild_thomsen]

Aren't you missing one important fact here? That most of the spam are promoting american products? This is a big like fighting drugs by throwing the addicts to jail and hitting small time street pushers. The only way to deal with this is to his the ones that profit big time - which are the ones trying to sell their products using these questionable means.

Fact is if I look at my inbox - something like 95 % of all Spam promote questionable american products, 2-3 % is in russian so I don't even know what it promotes - and I have yet to see ONE spam mail that actually try to sell a Chinese product.

Re:What is the best way to stop this?

[PakProtector]

Lucky You.

I get spam all the time, though not in great quantity. Maybe 5 a day, tops. But here's the kicker: They're all Chinese and Japanese.[/p][p]I have no clue what the chinese ones say, but they're encoded in the chinese character set. From what I can make out of the ones in Japanese, along with having a friend who can bumble her way through the language, I've gotten about 40 Emails over the past year from a Japanese Home Loan Company.[/p][p]I don't own a home.[/p]

Re:What is the best way to stop this?

[Anonymous Coward]

I used to get quite a bit of spam in Chinese until I just set the filter to throw out everything tagged as being in Chinese. But they got my address through a contact in China, so it looks like spam for China's companies only goes in Chinese to people who they think speak the language.

Re:What is the best way to stop this?

[Anne Thwacks]

Target the people who are using this form of advertising>. A cruise missile through the bedroom window would work!

Or maybe the Mafia might be persuaded to act in the public interest. A horse's head in the bed can be very persuasive.

Alternatively, a visit from "men in black" to apply "cruel and inhuman torture" would be justified. There are "freelancers" who are quite skilled at this sort of thing available for relatively small sums of money and the government could fall back on "plausible deniability" as they normally do.

Re:What is the best way to stop this?

[dilvish_the_damned]

Even if you never publish your address, people you send to may do so inadvertantly by way of forwarding. Also, we have seen an agressive amount of username probing at our mail server, people cultivating valid email addresses dictionary style. If your email name prefix is common enough, then its not too suprising you get spam.

As a solution at my workplace, we deployed dspam at the mail server about 7 weeks ago. At first I was discouraged at the results so much that I thought I had made a worthless call. Gradually I saw improvment and now it is running at about %99.7 accuracy. I get something over 200 spam a day into my account. I now see about one spam in my in box every three or four days, the rest go into my spam folder. Our other users found the system to be far better than I did, faster learning even. One user reported near pefection in about a week, he gets 10 spam a day. Except for one user (but there is one in every croud), it has nearly fixed the spam problem at our orginization.
I expect this to be a more realistic and permanent solution far beyond what legislation will ever do to inhibit spam from using my time.
I mean, other than right now.

Re:What is the best way to stop this?

[Anonymous Coward]

"it should be simple for law enforcement agencies to track down the actual advertiser."

Peronally i would rather have my tax dollars going to put rapists murders and theives in jail rather then wasting time with spam advertisers. Get a good filter, use your own money and mind to do it....the government is not the solution to your little spam problems.

stendec@gmail.com

Re:What is the best way to stop this?

[killjoe]

Why can't the govt order the stuff on the spam and bust whoever cashed the check? After throwing a dozen people in jail I bet the spam would stop.

Re:What is the best way to stop this?

[sirdude]

a) We obviously need a reliable and mandatory handshaking system which verifies the senders domain and possibly email a/c before accepting a message.

b) because for some obscure reason politicians don't want to tread on the toes of the marketing industry, other systems should be put in place:

i)All marketing emails should contain Name and address of the company involved, the marketing company involved and any other intermediaries.

ii)The emails should all originate from a valid email address using either the marketing company's domain or the client's domain.

iii)Marketing companies must not be allowed to outsource any email campaigns outside their own country, i.e. all the emails must originate from the same country. Perhaps make it even more stringent and restrict email campaigns from targetting any country other than your own..

and so on..

Re:What is the best way to stop this?

[RT Alec]

1. ISPs (and any other business that gives a workstation a "real" IP address) need to block egress port 25. Comcast is going to be doing this soon, others should soon follow suit. This plugs the zombies.
2. IP addresses that continue to send spam will be blacklisted. With the zombies effectively out of the loop this will become easier (albeit never quite perfect).
3. SPF and other authentication schemes need to be adopted to prevent "spoofing" and so called "Joe jobs".
4. E-mail providers (including small companies) need to deploy mature e-mail systems for their users. In 1995 it was fine to accept e-mail from anyone on port 25, with no authentication and no encryption. In 2004, remote clients need to have an SSL connection available (both for sending mail and accessing inboxes), and must require authentication before accepting initial mail submission (SMTP+TLS+AUTH). Not only is this more secure, but it also addresses the issues always raised by blocking egress port 25 and deploying SPF.

Once these techniques and practices be come commonplace, it won't matter if spam originates from lawless areas of the world. Existing laws against fraud (and other illegal business practices) will cover the extreme efforts that will be necessary to continue spamming.

Appendix:
SMTP+TLS+AUTH is not that tough, no whining. All modern mail clients support it, on all platforms. There is a little bit of work to do on the server end, but that's what you pay your ISP (or IT department) for:

• postfix
• sendmail
• exchange
• qmail

Re:What is the best way to stop this?

[ObsessiveMathsFreak]

We need a new protocol for the sending and recieving of email. SMPT is far too trusting. It's innocence has been well and truely lost. How about a protocol where a user continuously posts "problems", programs to be run, in his email box. When anyone wants to send him a mail they have to download one of these programs, run it, and return the solution. Check if 2^12345 - 1 is prime maybe? Or just run any old compiled program, that takes "time" that is. Maybe 100000 CPU cycles. Spammers CPUs would quickly melt, but the rest of us would be fine. I think Bill gates came up with this idea already so I guess MS have alreqady got the patent.

Re:What is the best way to stop this?

[dfeist]

"ISPs (and any other business that gives a workstation a "real" IP address) need to block egress port 25. Comcast is going to be doing this soon, others should soon follow suit. This plugs the zombies."

I hate it when people like you try to split the internet in to parts, "clients" and "servers". The great thing is that everyone can be both client and server! Let's not change this!

Additionally, this measure achieves virtually nothing. Port numbers can be changed; and opening a connection to port 25 is still the normal way to send e-mail.

Re:What is the best way to stop this?

[1u3hr]

Most appear not to have read even the summary here, let alone the article. Let me draw your attention to: "organised cirminal gangs in Russia are supplying U.S.- based spammers with details of compromised PCs"> Aside from the atrocious spelling, note that the spam relays are "compromised PCs", probably mostly in the US. So geographical blocks aren't going to stop them. One part of the problem that could and should be fixed is to prevent the "compromises". I suppose these are email "click me and see a movie star's tits" trojans, or maybe more devious direct probes into Windows. In both cases there are simple solutions. Though we'd like to say "DON'T USE WINDOWS YOU MORONS", it will take a while for that to come to pass. But otherwise, a basic firewall and anti-virus, both available free, will prevent almost all these attacks, regardless of patching the OS, and thus reduce the number of zombies.

Re:What is the best way to stop this?

[Anonymous Coward]

Blocking port 25 is not the solution, it's an extremely bad action that infringes on my rights as broadband client to use mail directly to my server. This approach will only end up:

• Blocking my ability to use point to point mail with encryption
• Sending and receiving mail quickly and reliably by not using the providers mail servers
• Allowing me to install my own anti-spam policies by having mail come to my server first

Blocking port 25 is a very short sighted approach by the people that cry for this. Just because these people don't want to run their own legitimate mail server shouldn't mean that others are denied the right.

The point of having the right to control one's own privacy policy on mail seems to go right over the heads of people who cry port blocking as a solution.

Re:What is the best way to stop this?

[nkh]

I hate this kind of solution: What will I do if I want to read my mails on my old 486? Checking prime numbers? That's impossible.
And why wasting time? Just to annoy spammers? this would just be a temporary solution...

Re:What is the best way to stop this?

[TiggsPanther]

The best way is to make sure this way of advertisement of your services is illegal in the USA, and actively go after those that still do it.

This idea seems so obvious, and so potentially effective. So why won't the governments (or whoever else has the authority to do so) do this?

What I'm guessing contributes to it is two simple facts.

1. Companies pay taxes.
2. Knowing where to draw the line between what is Spam and what is legitimate advertising.

The first I'm guessing in itself is only a very small factor. But when a billion-selling company pays its taxes, then you want to be very sure they're not legit before pulling the plug or slapping them with hefty fines.

The main problem is the second. A great deal of mail is easily flagged as Spam. A great deal of mail (including some advertising) is definitely legit. The difficulty is that there is also mail all across the scale.
Too relaxed and you don't block enough Spam, people still complain, and there's enough leeway for the Spammers to adjust tactics to stay in the "grey areas".
Too restrictive and you run the risk of arresting/fining/whatever people who were sending mail that in that case was totally legit. And in the current knee-jerk sue-em mentality, that could be a bad move to make.

You could make it illegal to advertise certain product types over the internet, but again this could easily meet corporate resistance.

Now banning advertising would be cool. But that's only in my personal opinion, and highly unlikely to ever happen. Besides, even I understand that sometimes advertising revenue is important - even though I perosnally hate seeing adverts anywhere I go.

I guess that the Follow the Money idea is one that although would be the msot effective, is also the one with the biggest legal minefield.

Tiggs

Re:What is the best way to stop this?

[zeptic]

I'll bet you got a .COM mail-address? I get almost no SPAM on my .DK (Denmark) mail-addresses, and some of them are even listed on the 'net!!

Re:What is the best way to stop this?

[iserlohn]

Most likely your email appeared or was submitted to some Japanese or Chinese sites. Some crawlers like to crawl pages in their own languages, mind you. :)

Re:What is the best way to stop this?

[littleRedFriend]

I think spammers are stealing time (and therefore money) from the community and should be punished accordingly (jail time, large fines). It must have a measurable impact on the efficiency of the economy. There's enough people annoyed by spammers, so let's pass a law, hunt all spammers down and correct their criminal behavior.

Re:What is the best way to stop this?

[marsu_k]

Heh, your analogue about the war on drugs (which, in my opinion, is being fought just as you described, by harassing addicts and small time pushers) just awoke the conspiracy theorist in me.

<tin foil mode>
It's a known fact (among a certain crowd) that the CIA, contrary to common belief, is working right along with the Columbian cartels to get extra funding, ditto for Afghanistan (sans the cartels, and heroine instead of cocaine).

Now I've just come to realize it must be the same with spammers. So instead of trying to get to them, they just taxing them, ever so slightly. Plus I heard the male agents have much larger genitalia nowadays. Coincidence? I think not.
</tin foil mode>

Re:What is the best way to stop this?

[squiggleslash]

Blocking outbound port 25 also undermines SPF. SPF advocates argue that roaming will still be possible if ISPs allow non-local connections to their SMTP servers with one of the new SMTP authentication schemes used to verify that the connection is valid instead of simple IP addressing. However, if outgoing port 25 isn't accessable, contacting the SMTP server you're supposed to use to send email under the profile you want to use simply will not be possible.

Not that this means I necessarily think SPF is a great idea either, but...

Re:What is the best way to stop this?

[mog007]

I went to the mall a few days ago with a friend of mine, and he went into one of those health food stores. They sell unlicensed health products, and I almost laughed one of the salespeople out when she was trying to explain what this product did, but just managed to make herself sound like an idiot.

What's to stop someone from making a a boatload of spam and use it to shut down a company they don't like? I'm sure the vast majority of slashdot would start sending spam advertising a pre-order of Longhorn, and then the feds would go and blame Microsoft when they didn't do anything.

Re:What is the best way to stop this?

[Binary Judas]

It's interesting to read all these comments..
Everyone seem to be blaming the spammers, and not the victims.
If this was about viruses you would all be whining about how Microsoft or the script kiddies are not responsible, but the end users.
This is the same thing, the US companies are the script kiddies "writing" viruses and China/Russia are Microsoft supplying the script kiddies with ways to attack users.

What's the Big Fucking Difference?

Re:What is the best way to stop this?

[fdiskne1]

The other method is to go after the advertisers who hire the spammers in the first place. Spammers are bottom-feeders, for sure, but if you cut off their customers, then you cut off their income.

I'm doing this with one spammer's customer right now. Since they are a legitimate company in my town, I have collected evidence that the spammers they do business with are using dictionary attacks, web page harvesting, and zombies. I've explained to them that all this is illegal and if any of my 20 email domains receives another spam from their business, all the evidence is going to the FTC for prosecution via CAN-SPAM. The law is far from perfect, but at least legit companies can be punished for breaking it. They are listening and reconsidering unsolicited commercial bulk email as an advertising route.

I know, many people would say fsck it and just turn them in. I figure I'd be nice first. I've explained the consequences and I've convinced them I will follow through. If others out there live in the same city (not necessary, but it IS easier) as a legit business that is spamming, be professional and courteous, but make them wish they never spammed you.

Re:What is the best way to stop this?

[Steve B]

But when a billion-selling company pays its taxes, then you want to be very sure they're not legit before pulling the plug or slapping them with hefty fines.

Clear Channel presumably pays its taxes, but just got slapped with a hefty fine for the "offense" of offending the Religious Reich element of the GOP. Politicians do respond to pressure, if it's kept up long enough.

Re:What is the best way to stop this?

[Aggrazel]

The best way you can stop spam right now is to employ one of the many outsourced spam filtering services.

This way it eats someone else's CPU time, someone else maintains the filter, and someone else deals with all the crap.

Though these services are not usually very cheap. But the monthly fee is "in theory" gained back in increased productivity due to people not having to sift through hundreds of spam to get to the good things.

I work for one such service. (Shameless Plug, sorry ;) )In the last 24 hours of all the email to hit our system 83% of it was flagged as being either a virus or spam. 83% and we're obviously not catching 100% of them, no filter is bulletproof.

Re:What is the best way to stop this?

[guet]

Maybe not completely relevant to the specific subject, but what is the best way to stop this?

Due to the global nature of the internet, the only way is to wait until the government of the United Sates changes due to public, internal pressure. Thus ensuring the people who are actually paying for and organising the spam in the USA are caught. Note that this may take some time.

Re:What is the best way to stop this?

[cluckshot]

Has anyone noted that you can still order all sorts of drugs to get high or low or addicted in general while the government targets grandma and grandpa for trying to get their meds at a lower price in Canada?

Re:What is the best way to stop this?

[ironfrost]

It's sad but true that a lot of the legitimate businesses that use spammers don't even realise that they're doing something wrong. When they're after business, the spammers don't tell them that they're using dictionary attacks and harvesting addresses from web pages. They'll pull the same "opt in" crap that they do to everyone else, and say that everyone on their mailing list of 5 million customers has agreed to receive advertising.

A lot of the people that hire "bulk e-mail advertisers" to market their business have no idea that they're spamming until people start to complain.

Re:What is the best way to stop this?

[Secrity]

In the US, it is currently not illegal to spam or to advertise using spam. The CAN-spam law ALLOWS spamming. There are certain things that are commonly used by spammers that are illegal, such as credit card fraud, using improper headers or not having a functioning opt-out process. And then there is the problem that users should NEVER opt-out of spam as spammers use it to confirm that an address is deliverable (and thus more valuable). I don't think that it is even illegal to harvest the email addresses of those people who opt out. The spammers sure got their money's worth with this law.

Re:What is the best way to stop this?

[msobkow]

Exactly -- there is a money trail from the "vendor" to the spam house to pay for the advertising. Why isn't the government chasing down the spam, faking purchases, and arresting the business owners for use of spam advertising once they've been tracked down?

I'm sure they'll claim it was an advertising agency doing so without their knowledge, so have them provide the information necessary to lock up the mythical agency owners instead/as well.

Stopping the spamemrs themselves cannot be done any more than the DEA will ever actually eliminate inner city crack problems by targetting street dealers instead of high-level shippers. You have to cut off a problem at it's source, and spam is mostly a symptom of slimy "business" owners who think the law doesn't apply to their business.

Then again, the federal government in the US has hardly done anything to discourage that attitude. What happened to the Microsoft penalties after conviction? How much jail time have energy industry executives done for their recent frauds? Or the accounting firms that enabled the "mismanagement"?

Anyone waiting for the Russian and Chinese governments to change to get rid of the spam needs to get over the fantasy. What advantage is there for Russia or China to enact laws blocking the sale of spam services or spamnets and incur the cost of enforcement when it's bringing money in to their countries?

That hope is as naive as expecting the south american countries "owned" by the cocaine lords to eliminate an industry (however distasteful) that brings hundreds of millions (if not billions) into countries with small to non-existant industrial economies.

Re:What is the best way to stop this?

[Tin Foil Hat]

Unfortunately, a lot of companies do not pay federal taxes. I mean a lot of companies. Yet they still get the support of the U.S. government.

What a lot of companies do pay is campaign contributions, which are even more important if you want special favors from your local congress critter. This situation will not change until we have true campaign finance reform. IMO, we should not allow businesses to contribute to any political campaign or organization at all. Last time I checked, businesses do not have a right to vote, so why should they be able to contribute to the political process at all? Government is supposed to be by the people, for the people, and of the people -- not corporations.

Re:What is the best way to stop this?

[Rick Zeman]

The best way is to make sure this way of advertisement of your services is illegal in the USA, and actively go after those that still do it.

90% or more of all SPAM advertises a product or service in the USA

A vast majority of my (several hundred a day to an account I've had since '93) spam is for Canadian pharmacies wanting to sell to me in the US. That's a very politically sensitive issue here now....You're not going to legislate that away on the basis that they use spammers.
A majority of the rest is now pirated (errr, excuse me: "OEM") software from Russia, all of which is already illegal. Can't do anything more about that, either.

For my personal domain, I have Postfix using Spamhaus' RBL-XBL blacklist. I've yet to see a false positive from them.

Re:What is the best way to stop this?

[IWantMoreSpamPlease]

Probably because most of that stuff offered would be a scam, and the scammers would probably have the smarts not to cash a check that says "US Gov't" on it.

Just a guess.

Re:What is the best way to stop this?

[maximilln]

ISPs (and any other business that gives a workstation a "real" IP address) need to block egress port 25. Comcast is going to be doing this soon, others should soon follow suit. This plugs the zombies

Get off your bandwagon. It's not going to work. Fancy language does not make it true. What do you mean by "egress"? Is that outgoing? You can't block a client machine from connecting to --dport 25 if the client machines are going to make legitimate port 25 connections to their smtp/pop3 server. Are you proposing that all --dport 25 connections originating from the client pool will only be allowed if they're connecting with the ISP mailserver? This won't stop the spammers. They'll simply forward their spam through webmail servers or through their Russian/Chinese ISPs. Do you mean incoming port 25 connections to the client pool? That won't stop anything. The spammers will move their zombie ports to something else and still use zombies to relay mail through ten or twelve hops before passing it out through a legit ISP. Legitimate mail servers still have to listen on port 25 and they don't care what the source port is. Are you advocating whitelists/blacklists? They suck and everyone knows it.

Get off the port 25 bandwagon!!! It will not stop spammers. The port 25 bandwagon is nothing but an ego-booster for ignorant IT managers and a foot-in-the-door for ISPs to begin regulating internet access by port. It will only lead to service plans being metered out by how many open ports are allowed.

What? Next I have to pay an extra fee to use IRC? Or an extra fee for various messenging clients? Or an extra fee for ftp? All in the name of stopping spammers? While the whole time, the spammers and P2P clogs don't care one whit for IANA port delegation and continue on as if nothing ever happened.

I like the idea of shutting down a connection that's spewing forth millions of e-mails/day. Default port 25 blocking, though? What about business connections? Are they going to have port 25 blocked? That hits the issue a bit more true, doesn't it? It's all about the money to the ISP. They don't really care about the spam. It's just about the business model. Some small business pouring out millions of spam e-mails on port 25 is fine. They pay their bill. The residential customers, however, we're got to ratchet them down and squeeze them for every penny they're worth.

Re:What is the best way to stop this?

[Marc Desrochers]

User end filters are about as good a solution to spam as kevlar vests are to the gun problem. It's not a solution at all, but a great business opportunity to make more money, buy selling people something to "solve" the problem.

Re:What is the best way to stop this?

[henrygb]

Check if 2^12345 - 1 is prime maybe?

It is not, and nor is 2^2117031812502203952770682472198515 - 1. Both are divisible by 31.

Re:What is the best way to stop this?

[squiggleslash]

SMTP+TLS+AUTH is not that tough, no whining.

You do realise that your plan to block egress SMTP completely undermines anyone who'd want to usefully use SMTP+TLS+AUTH?

WTF was this BS modded up? The proposals are a load of contradictory nonsense that ultimately undermine each other, and ultimately do little to actually relieve spam. We've tried the "Filter sources that may be legitimate but are statistically likely to be spam" method pretty much from day one. We've:

• Blocked email from ISPs that didn't do a good enough job throwing off spammers. Spam levels continued to increase and legitimate email dropped from innocents who happened to use those ISPs.
• Blocked email that contained keywords likely to be from spammers. Spam levels continued to increase and legitimate email dropped.
• Blocked email from hosts with problematic headers. Spam levels continued to increase and legitimate email dropped because problematic headers have nothing to do with spam.
• Prevented users from sending email directly by blocking outbound 25 or blocking incoming 25 from "dial-up" addresses (DUL). Spam levels have continued to rise, roaming is now much, much, more difficult and privacy has been undermined. Legitimate email has been dropped. Much frustration has been added to anyone trying to do anything non-simple.
• Prevented users from running their own email servers by blocking incoming port 25 to DSL addresses. Spam levels have continued to rise, privacy has been undermined, and people with sane, rational, spam blocking systems (such as giving each entity one does business with a unique address that can be turned off if it's abused) that actually work have been undermined and made more difficult for end users to implement.

Every spam measure encouraged by the filtering/blocking enthusiasts has ultimately not made a blind bit of difference. Spammers have gotten around them. There's no reason to think that the latest filtering/blocking system will do anything but continue in that tradition.

There are systems that work. Why are system administrators ignoring them, and indeed, choosing "anti-spam" systems that actually makes them hard for end users to implement?

Re:What is the best way to stop this?

[RT Alec]

Blocking egress port 25 traffic has nothing whatsoever to do with SPF. Mail providers need to have initial mail submission (different than mail transport) on a port other than 25 (465 or 587 are the most "standard" replacements, but I have also seen 2525 or even 26). If egress port 25 is blocked, but you can access your SMTP server via an alternate port (or even a VPN), then the roaming problem is a non-issue.

Re:What is the best way to stop this?

[RT Alec]

Please see point #4, as well as the appendix, to the parent of your post. That everyone can be both client and sever is not necessarily "great". Spam zombies are clients acting as servers, correct?

Re:What is the best way to stop this?

[Anonymous Coward]

The best way it to make it illegal for any company to send unsolicited emails or pay any other company to do it for them.

So if company X pays spammer to send bulk emails then company X is just as guilty as the spammer. So you charge them both with sending unsolicited emails and give a hefty fine (say $100 per email) to the company and some jail time for the spammer (so he can enjoy some ass loving).

Why just go after the guy doing his job - go after the guy that hired them to do the job. Should be pretty easy as that company is represent in the spam he is sending.

It is like murder. If you hire someone to kill someone you are just as guilty as the guy you hired to committed the murder.

So stop the cash flow before it even reaches the spammer... No one hireling spammers = no spam.

Re:What is the best way to stop this?

[RT Alec]

You do realise that your plan to block egress SMTP completely undermines anyone who'd want to usefully use SMTP+TLS+AUTH?

If e-mail providers allow initial mail submission on a port other than 25 (the "standard" is 465 or 587, but I have seen 2525 and even 26), then roaming users are accomodated.

Re:What is the best way to stop this?

[eaolson]

Due to the global nature of the internet, the only way is to wait until the governments of China and Russia change due to public, internal pressure.

When the people of China get together and say, "Hey, you know? We'd actually like to have a democratic government," the Chinese government runs tanks over them.

Spam is probably not at the top of their priority list.

Re:What is the best way to stop this?

[dfeist]

Why are "spam zombies" only clients? What's wrong with dial-up-hosts acting as servers, too?

IMHO, it is not the providers duty to prevent their users from trojans, because that is clearly impossible. You suggest that the providers should block the functions of some trojans, which does not solve the problem of the trojans. The users have to be aware of the problem, they have to ensure that their systems are secure.

I also have to admit that I haven't fully understood what the original poster meant:

Blocking outgoing connections to port 25: Would also block the current "accepted" way of sending e-mail through smarthosts. Very bad idea.

Blocking incoming connetions to port 25: Easily circumvented by setting the trojan to accept the mails on another port.

Re:What is the best way to stop this?

[squiggleslash]

Oh great, "it doesn't matter because we can get everyone to rewrite their software" plan. Or, I guess, end-users can always configure IPTABLES to redirect their internal port 25 to the destination SMTP server. I'm sure we'd all love to do that. Hey, tell you what, for easy backwards compatability, I'll just write me a little proxy that runs on port 25 of someone's own machine that allows you to use any email application that supports SMTP. Will handle the SMTP AUTH etc. I'm sure there are no problems whatsoever that'll introduce! (Where's the guy with that "Your anti-spam system sucks because *big long checklist*" form again?)

The other thing that annoys me is we have this wonderful attitude from the anti-spammers for virtually everything along the lines of "Why are you complaining? Only 1% of you will want to do this, and all you have to do to do that increadibly simple thing you were doing previously is (*insert 500 step plan here which usually includes replacing previously perfectly servicable software, negotiating with an ISP which, by default, is going to want to provide the same system to everyone and certainly doesn't want to make an exception for you, etc, etc*.)"

And we already know this isn't actually going to help. Indeed, if Russia and China are the biggest sources of spam at the moment, then doesn't it stand to reason that egress SMTP and/or SPF will make bugger all difference in the long run anyway? Who here seriously believes that either will actually be a serious deterent to spammers?

And if the plan is to continue the usual basket-of-filters approach, are we going to block all email from Russia and China? If so, how's that going to work? What happens when they switch to another country? What about the fact that Russia and China are two of the largest countries in the world and a lot of businesses are going to be very upset if they can't easily trade with them any more?

Why are we continuing to use these inane methods when we already know they don't work?

There are systems that work, why aren't we using them? And why do those proposing the filters upon filters upon filters not realise how difficult they're making it to create real solutions?

Re:What is the best way to stop this?

[mistered]

What are your "rights" as a broadband client? I don't recall reading in the broadband client bill of rights that ISPs must allow outgoing connections to port 25.

Since ISPs generally don't seem to want to block port 25, if you try to connect to my mailserver from an IP on a dialup black list, I'll reject your mail. Use your ISP's mailserver, get a hotmail account, I don't care. Greater than 98% of the email sent to me from dialup IPs is spam. I don't care if I inconvenience the less than 2% to knock out that much spam.

Re:What is the best way to stop this?

[mistered]

What about business connections? Are they going to have port 25 blocked? That hits the issue a bit more true, doesn't it?

No, and no. Why do you expect that your $30 cable/DSL connection should have the same benefits and capabilities as a (say) $100 business connection?

Re:What is the best way to stop this?

[Junior Samples]

The major backbone providers should simply disconnect China from the Internet and refuse connectivity until they clean up their act. This would place pressure on Chinese authorities to take care of the problem through whatever legislative means they have.

Sure, some businesses outside of China would be inconvenienced, but they can use the phone and fax like they used to before the Internet.

Disconnecting China will place an enormous amount of pressure on the country to clean up their act. Spam is everybody's problem. I'm sure that the majority of Chinese do not like it either, but then, they may not be affected by the problem. I've never seen any spam written in Chinese - but then I wouldn't recognize it if it were in front of me.

Re:What is the best way to stop this?

[WormholeFiend]

I currently sit in the "email itself must change" camp to fix the problem of SPAM. Of course its an impractical camp to sit in at the moment, but things are moving along slowly

Looking at how things work in today's society, I think it'll be a long while before email is changed, UNLESS somehow the system suddenly becomes totally unusable.

Then people stand up and notice.

Otherwise it's just an inconvenience for Joe Sixpack.

In the mean time, with my personal home-based non-commercial account, all my main email contacts are on a whitelist.

If anyone else's legitimate email ends up in my spam folder and I don't notice it, tough luck; write to your local politician about how spam annoys you. Or jump up and down in a temper tantrum. Or Whatever.

Re:What is the best way to stop this?

[QuantumRiff]

The best way to stop this, is on the ISP end. The article discusses how many comprimised PC's around the world are sending out the spam for many of these groups. Here at our office, (small community college with about 200 PC's) only the SMTP servers are allowed to send outgoing port 25 through the router, all others are dropped and logged (port 135 too). This makes us a nice net neighbor, and allows us to quickly identify a machine that has been comprimised with a virus. If more ISP's added these 2 lines to their router access lists, the amount of crap would drop a huge amount.

Re:What is the best way to stop this?

[black001]

Blocking port 25 IS a very big part of the solution (80% according to some recent figures).

There is no need to make the port unusable, they simply need to block it (and every other port that is not necessary for average Internet use) by default. Then users who actually know what they are doing can simply enable the ports they need.

It is incredibly irresponsible for an ISP to knowingly connect computer after computer to the NET knowing full well that it will be infected in a matter of days, or even hours. Every time another Grandma orders DSL for her new Best Buy computer we have a new spammer on the block. Grandma does not understand, nor does she care. Giving her an open line without any limits is INSANE.

Sorry but we need to transfer the responsibility to those who have the ability to deal with this, and that means the ISP must limit what they will provide to the uneducated consumer. Hopefully while allowing the educated consumer to take responsibility for choosing what doors to open.

Re:What is the best way to stop this?

[killjoe]

Mmmmm. You think an undercover operation is going to send checks that say US govt on them? If we can track money going to palestenian orphans you'd think we could track money going to spammers dontchathink?

Re:What is the best way to stop this?

[amerinese]

Agreed. Plus another angle (without absolving any already covered causal entities):

What about the computers that are being taken over, all of the world, many in the United States, almost entirely msft pcs?

Re:What is the best way to stop this?

[maximilln]

Because my $9.95 dialup connection did?

Since when is the difference between residential service and business service defined by which TCP ports we use? Spreading FUD about port 25 and outright lies about how it will reduce spam is leaning towards this sort of model.

Re:What is the best way to stop this?

[CroweinVA]

Full Disclosure: Original Poster is my Business Partner It is obvious, to me anyway, that much of the controversy surrounding the measures advocated here arises either from ignorance of the issues being discussed, or, worse yet, feigned ignorance by those who have an agenda....that agenda being the proliferation of their own SPAM, or, at best, a selfish indifference to the problem and an implicit assertion of "rights" which simply do not exist. I must admit that in order for me to grasp some of the technical implications here, I had to consult with my mail guru, but after much study it is apparent to me that the vast majority of posts in opposition to these measures demonstrate ignorance. So, in layman's terms, perhaps, what do these measures really mean? 1. Block egress port 25. I think this means that if I own an email server, I get to decide whether or not I will just blindly pass email along regardless of where it comes from and whether or not the sender is known to me. Desiring to take whatever small steps I can to reduce the amount of SPAM in the system, I would choose no, and, therefore, block egress port 25. Sure, if you own the server, it's your right to decide not to, but you can't deny that having an open relay contributes to the SPAM problem. It seems to me that the implicit asserted "right" that people are demanding here is the right for everyone to submit their email on any server they choose, without any responsibility for what they are sending. Why is it so controversial to expect that if you want to send email, you should have an account somewhere that authorizes you to use a specific server? 2. Blacklists. They help some, right? Not perfect, but ours help us to reject thousands of messages per day, and in about a year and a half of operation we have NEVER been made aware of a legitimate message that didn't get through. (Of course it's POSSIBLE...but...really). 3. SPF So there is a way that I can tell if an inbound message really comes from where it claims to come from. Sounds good to me. I roam all over the world, and am able to authenticate to my provider's server from a Cafe in Kiev or a Bungalow in Bali. It's really not that hard. If you can provide email, you can provide authentication. 4. This point was more of a summary of the three which preceeded it. So, in summary, the positions advocated here, in my view, amount to responsible mail management. MOst of the opposition seems to be in the "Wahhhh...I want a pony.." spirit. For those who argue that they are not effective because the spam problem hasn't improved, think about how narrowly these measures have been adopted. I can't wait until AOL, Hotmail, and the like institute SPF or similar measures. And, no, I will not blindly accept and pass along your unauthenticated, unknown, careless, lazy email.

Re:What is the best way to stop this?

[coopaq]

Fact is if I look at my inbox - something like 95 % of all Spam promote questionable american products, 2-3 % is in russian so I don't even know what it promotes -

In Soviet Russia, Spam promotes you!

...and I have yet to see ONE spam mail that actually try to sell a Chinese product.

So you're saying Walmart doesn't have your email address?

Re:What is the best way to stop this?

[iminplaya]

Sorry, but you're wrong. Demand is precisely why these things are profitable. Going after the producers will not aleviate the demand. It will only result in higher prices/profits, and will encourage more to take a chance with the authorities, and will also increase corruption amongst the authorities. As far as SPAM and other property crimes are concerned, a nice big fine and garnishment of income is a good solution that can bring in a net profit to the state, as opposed to feeding a prisoner his/her three squares and fixing their teeth for free at tax payer expense.

Re:What is the best way to stop this?

[iminplaya]

I've gotten about 40 Emails over the past year from a Japanese Home Loan Company.[/p][p]I don't own a home.[/p]

Would you like to buy one? Just send me $50 usd, and I'll send you my brochure on how to save money on home loans. We also offer great deals on car loans. and insurance. First 3,000 customers get a free "Will Kit".

Re:What is the best way to stop this?

[thelaw]

dude, turn them in now. only when the FTC knocks on their door will they actually start listening to you. why do you think whistle-blowers have to talk to the Feds in the first place? because their companies don't listen to them.

jon

Re:What is the best way to stop this?

[hearingaid]

The only way?

Okay, I don't actually use them myself, but black hole listings are pretty effective. (I don't use them because my network is small enough that user-based filters are all I really need.) You don't have to accept SMTP from everywhere if you don't want to.

Re:What is the best way to stop this?

[jnicholson]

Why does it have to be either/or? I want the government to do both!

My spam filter is quite effective, but I resent paying for the 70% of bandwidth wasted on this crap.

Re:What is the best way to stop this?

[j4k3]

Well we could all convince the respective governments, including our own to standardize computing practices. You know just like you do with your car? Registering it? And having it inspected for safety. Every year submit your computer to an internet worthyness test, and get a certificate issued to your computer. Kinda like getting an inspection sticker for your car. Then the government authority automatically monitors the computer, if they find it being virused up, or spewing mails as an open relay, they send you an E-Ticket for an internet violation.

On second thought, I think I'll let capatilisim take the drivers seat, your country doesn't give a rip about the flotsam it dumps on the internet, then I guess your GNP will be hurt by all the domains and netblocks country X blackholes, your companies bitch, and well you loose business.

But then what about contries like Nigeria where a large chunk of the GNP comes from shady e-mails and spam? Would throwing around economical muscle on them cause the spam to stop? Hrm no.

I guess, the best thing yet is to keep the filters going, get some anal ISPs, and keep pressing the delete button for now.

Re:What is the best way to stop this?

[mistered]

Actually, I do care about such inaccuracies. I basically fall into the same category, since I have a static IP from a residential DSL provider.

That's one reason to bounce email with a short reason instead of sending it to /dev/null. Then the sender can find out how to contact me, and how to have the list fixed. The responsible block lists will remove IPs that are incorrectly included. If the list won't make such corrections I won't use it.

Re:What is the best way to stop this?

[weijiao]

The US government has the power to stop this - it just lacks the political will.

The end benefit of spam goes to sales by US companies.

Draft laws to the effect that the company that gets the end benefit can be held responsible unless they can show that they had no knowledge.

For those that are worried about the civil liberties aspects of this, check out the laws related to pure food, employment of children etc etc, before you post.

Follow the money trail and then make it unprofitable for those that benefit. The spammer is just the scummy link in the chain - they are not providing morgages to anyone.

Re:What is the best way to stop this?

[gal0xy77]

Most of the spam I get doesn't have anything to do with money. It's usually a lot of nonsense words strung together.

Re:What is the best way to stop this?

[sql*kitten]

But when a billion-selling company pays its taxes, then you want to be very sure they're not legit before pulling the plug or slapping them with hefty fines.

But I've never been spammed by a reputable company. Sure Sony sends me more mail than perhaps I'd like, but it's all related to Sony products and services, and I did give them an email address when I registered some piece of equipment with them, and it's easy enough to drop it into a Sony folder.

Any company that sends mail containing text deliberately designed to evade a filter ("vuagra" is a typo, "v1agra" is deliberate) is by definition a spammer, and can be squashed without any negative consequences to anyone (who matters).

70% from US?

[westendgirl]

If 70% 70 percent of spam is sent from China by American spam outfits, wouldn't that make the US the biggest spammer?

Re:70% from US?

[NanoGator]

"If 70% 70 percent of spam is sent from China by American spam outfits, wouldn't that make the US the biggest spammer? "

Perhaps. But the solution is still in Russia and/or China.

Re:70% from US?

[WIAKywbfatw]

No, the solution isn't just in Russia and/or China, it's in the US too. Cut off the demand (by, say, making the use of unsolicited spam by businesses illegal) and you've solved the problem.

Saying that the solution to spam is only in Russia and/or China is like saying that the solution to the war on drugs (as stupid as that is) is only in Colombia, etc.

Re:70% from US?

[rf0]

May as well just block everything apart frmo 127.0.0.1, no wait I'm infected to ..

Rus

Re:70% from US?

[Anonymous Coward]

Exactly, this is a completely misleading title.

Not only that, what about the organised cirminal gangs in Russia

followed by: the Russian gangs aren't constrained by any anti-spam or cybercrime laws in their home country

So what makes them criminals exactly, if what they do is legal? Just because it's illegal in the US, you can't start calling people in other countries criminals. I mean, they are probably right, but just based on the information provided is plain crazy.

And then this and have no respect for legislation implemented in other countries

Why the fuck should they?! Like the US respects every freaking legislation in the world. I can tell you one thing, there's plenty of US legislation that I don't respect.

Spam does not come from Russia or China. It comes from the sleazebags in the US that pay these people to distribute it.

I don't know how often it must be said: follow the freaking money. It's US companies/people paying for it, and it's largely US people buying this shit, which keeps it profitable.

Re:70% from US?

[Tristandh]

If 70% 70 percent of spam is sent from China

Brought to you by the Department of Reduncancy department.

Re:70% from US?

[dustmite]

Yes, but /. seems to love spreading the prop^H^H^H^Hidea that it is China, in spite of facts. It doesn't matter where the implementation lies - you have to cut off spamming at it's source, otherwise the problem will not go away. Anything else is like respondonding to a murderer by going after the company that manufactured the gun.

Re:70% from US?

[Alioth]

I'm pretty sure that using an 0wn3d (i.e. hacked) proxy/zombie is already illegal in the United States. They need to start prosecuting under the existing laws before making yet more new laws.

Re:70% from US?

[gnu-generation-one]

"But the solution is still in Russia and/or China."

If the second worst spammer in the world can appear on a chat-show to talk about their activities, then the US isn't exactly a hostile environment for such people...

Re:70% from US?

[Detritus]

I get huge quantities of spam that are encoded in the Cyrillic character set, many with telephone numbers prefixed with the country code for Russia. Are you going to tell me that this is American spam, targeted at Americans, paid for by Americans?

Re:70% from US?

[Pharmboy]

They need to start prosecuting under the existing laws before making yet more new laws.

Amen! Part of the problem is the view of "spam crimes". Police are too busy arresting pot smokers (who we all know are sooooo dangerous). You just don't get headlines for busting spammers. It seems that the police still see spam as victimless, more of an inconvenience than a billion dollar crime. We don't have much of a choice on this one, local cops don't have the ability to deal with this, since it is interstate rather than intrastate crime. This is one of those few times when we need the feds to actually do something, such as shutting down, fining, and jailing those companies that use spam to get business.

Considering that the vast majority of email is spam, the vast majority of mail servers are purely to deal with it. We are about to move our mail server offsite simply because spam is eating all our bandwidth, and its cheaper to move the mail server to a rented rack where the bandwidth is much cheaper. This is a real cost as well.

I grepped through my logs yesterday, where we use Squirrelmail, Spamassassin and ClamAV. Over 97% of the activity is to deal with viruses and spam. Ninety Seven Percent. We have a semi-dedicated server for mail (does a few other minor tasks), and this is just for 15 mail accounts. In the real world, this would be major overkill, but unfortunately, its necessary. Even while the CPU usage is fairly low, the box is slow to ssh into simply from I/O overload, dealing with the volume of spam.

Re:70% from US?

[MoonBuggy]

How do you track which business authorised the spamming then? For example, what if Ford wanted to up it's web presence in order to sell more of it's new car aimed at geeks - it pays an advertising firm who take out banners for this car on Slashdot and setup a mailing list on the Ford website. The advertising firm outsources list management for all clients to India, the Indian outsourcing center then mails every address they have with Ford Geekmobile information rather than just sending it to the people on the Ford-optin list.

Who gets the fine there? If you say Ford since they're the ones who benefit, what's to stop them spamming adverts for other car companies and getting them fined? The ad agency didn't actually spam anybody, so they don't deserve any fine. The Indians aren't bound by US law so they don't have to pay.

Re:70% from US?

[WIAKywbfatw]

You punish people all the way along the trail. Of course you don't punish people for what you can't prove, you punish them for what you can prove - in that respect going after spammers is no different from going after drugs cartels or mafia organisations.

Where they affect US citizens and businesses, you also make US companies responsible for their the actions of their overseas subsidiaries. So, to use your example, Ford US can't outsource a bulk spamming job to Ford Elsewhere and skirt the law that way.

It's really quite simple: if you make spamming cost-ineffective by punishing the spammers more than they can make then the problem will go away.

Re:70% from US?

[radish]

You fine Ford. They scream at their ad agency, who promise not to use the Indian outsourcing center again. Indian guys go out of business. Problem solved.

Re:70% from US?

[radish]

No. The solution lies where the money/benefit lies - in the US. Whilst people still want to send spam, there will always be someone willing to provide the service. If not in China then in Europe, or India, or Australia or wherever.

Remember - where there is demand _someone_ will always supply.

Re:70% from US?

[Lars T.]

Let's say there are Americans who build WMD in Russia and sell them to the highest bidder. Where do you solve the problem, in Russia or in America?

Re:70% from US?

[Marxist Hacker 42]

And let's have some REAL teeth in the law, unlike the law against hiring illegal aliens or the law against lying to investors with bad accounting practices. Businesses that advertise for spam should be siezed by the government and their assets should be sold at public auction.

I personally favor the same punishment for all corporate wrongdoers; basically, capital punishment for capital crimes.

Re:70% from US?

[evilWurst]

You fine Ford. No, seriously. If you *don't* fine Ford, then they never have any personal stake in choosing better advertisers.

And Ford can't be joe-jobbed by some competitor... because Ford has to follow US law, which means they've got to keep their financial information for a certain length of time, which means it's right there in their own records that they hired Shady Advertizing Firm.

Ford can, of course, try to pass the damages on to S.A.F., or they can just eat the fine. The idea though is that fining Ford in this case would force change, because Ford stops paying spammers. And if S.A.F. is only a middleman, losing the business forces S.A.F. to stop using spammers too.

At the moment, there's zero accountability. There's no reason not to hire spammers. You can hire whoever you want and just look the other way, and you won't get in trouble, and chances are they're just a middleman and won't get in trouble either. For there to be change... get the instigator in trouble, and let the pain work its way through the system.

Re:70% from US?

[jlanthripp]

Anything else is like respondonding to a murderer by going after the company that manufactured the gun.

Um...actually...

Why does this remind me of illegal drugs?

[Infonaut]

It's the damned Columbians making all that cocaine! The friggin' Afghans are selling opium again!

Evil Russian spammers! Chinese spammers want to take down America!

And yet, in both cases there is plenty of demand from within the States. If it ain't rich kids experimenting, it's poor kids escaping with drugs from South America or Asia. If it's not a "bulk emailer" in California, it's a "clever marketer" in Florida sending millions of unsolicited email via servers in Russia or China.

Re:Why does this remind me of illegal drugs?

[Dachannien]

Who knows - spammers may also be sponsoring terrorism.

Re:Why does this remind me of illegal drugs?

[capoccia]

>And yet, in both cases there is plenty of demand from within the States.

In my case, only 1/4 of my spam was in English. I know a few hundred foreign words, but none in Russian or any Asian language. It seems pretty far-fetched that Americans could be creating demand for this type of spam.

Also interesting is that reporting spam did not decrease the quantity of foreign-language spam.

its great...

[drfrog]

to see them embrace captialism so readily

we should be proud!

Re:its great...

[ChiefPilot]

You mean this couldn't happen under Communism? Or Socialism? (I speak of economic systems, not political systems.)

If something can happen under multiple economic systems then it may be something besides the economic system...

Re:its great...

[drfrog]

unsure

fact is it is happening under the guise of capitalism so....

Well, technically

[dedazo]

The US is the largest spammer in the world. Russia and China would be the largest spam relays.

That title is wrong.

Re:Well, technically

[1u3hr]

The US is the largest spammer in the world. Russia and China would be the largest spam relays.

If Americans thought the same way about guns, they'd ban them. But they say "guns don't kill, people kill". Spam relays don't spam, people (most of them Americans) spam.

Re:Well, technically

[AtomicBomb]

The US is the largest spammer in the world.
Russia is the largest supplier for compromised PC.
China is the largest spam relays.

Now I see the new world order in the post cold war era! May SPAM be the saviour of the world :-)

Re:Well, technically

[atta1]

That has to be one of the most asinine comments I've ever read on /. You made two completely opposite points on completely unrelated topics. Whether it is guns or spam, the root problem is the people, not the process. I've read CowboyNeal poll options that made more sense.

Re:Well, technically

[Neophytus]

Well maybe you need to renew that NRA membership because it made perfect sense to me.

Re:Well, technically

[1u3hr]

That has to be one of the most asinine comments I've ever read on /.

I'm not worthy.

Whether it is guns or spam, the root problem is the people, not the process.

That was my point.

Re:Well, technically

[Buzz_Litebeer]

If I follow your analogy, then what they should do to spammers, is punish the people, the advertisers, that use spam...
I completely agree!

Sue the guys that are benefiting from the spam, then the spammers wont have any customers.

so lets see...

[ForestGrump]

Russia for mafia controlled zombies
China for high quality spam warez
Africa for business relations about that recently deceased relative.

GOT IT!
-Grump

Bullshit

[autopr0n]

Headline should read, US Spammers using services of Chinese ISPs, Russian mob. The Spam originates here, and ends up here. The vast majority of Spam is in English, and targeting an American audience.

Re:Bullshit

[RollingThunder]

More correctly, the vast majority of spam you recieve in the US is in English, and targeting an American audience.

At my last job, I adminned machines in Seoul. 95% or more of the spam was pure Korean, targeting Koreans.

The spammers know their audiences, and target accordingly. The other-language spam you get is errors.

Start Bombing

[rstidman]

President Bush just outlawed China forever. We start bombing in five minutes.

Re:Start Bombing

[sirdude]

Nothing the man does is going to surprise me anymore :P

I think it might help if politicians are shown bandwidth costs and statistics on the amount of bandwidth spam consumes in a day. They obviously either don't use email, or are hardened viagra/penile extension fans :/

Besides that, I've found that spam doesn't annoy me as much anymore [My blood pressure levels don't shoot up as much] - I've subconsciously accepted that it's now a fact of life and automatically delete any that escape my filters :S

Re:Start Bombing

[sirdude]

Oh well, atleast we have equal rights...so nobody will read your email either.

hehe - well put :)

I definitely don't understand what kinda clout these 'marketing' companies have in DC/wherever, that they are able to block any 'definitive' legislation against spam - something the majority of the populace will welcome with open arms.. Someone should make it a prime election issue :P

It's not as if it's the call-center industry where thousands of jobs are bound to be affected..

I don't get it. I don't believe Politicians were in mind when the term 'common-sense' was coined :S

Re:Start Bombing

[AtomicBomb]

Linford also told the conference that some 70 percent of spam is sent from China by American spam outfits who are hosting their servers with Chinese ISPs. In many cases the spammers have set up firewalls so that the ISPs can't actually see what's being hosted. "We keep battling with Chinese ISPs who don't understand what we are complaining about," said Linford

Here is an important point. No doubt there will be some Chinese ISPs decide to turn a blind eye on spammers' sites.... But, if everyone do that, the spammers do not need to firewall the ISP. Who knows what's actually happening over there?

Re:Start Bombing

[dustmite]

Well, I know it was a joke, but the Bush administration actually officially supports (totalitarian, communist) China over (the democracy) Taiwan. Communist China are becoming friends of the US, de facto making democratic Taiwan an enemy, I guess the US only supports democracies when it happens to align with their own interests.

Re:Start Bombing

[tealover]

The US is not alarmed by Chinese communism as it was by Russian Communism because China is not fixated on exporting its system to its neighbors. China seems to be preoccupied with internal issues at the moment. Whether that changes in the future, no one knows.

So yes, pragmatic relations between the US and China makes sense if one examines the issue beyond the surface level of a 1st year political science major. Politics is and should be nuanced because text books are not always good guides for real-time issues.

To suggest that Taiwan is now an enemy of the US is just useless hyperbole and distortion on your part.

Re:Start Bombing

[dustmite]

Well it was pretty much my point, and the response really just confirmed it. Why it is annoying is that the US claims to be some huge defender of democracies, abiding by democratic principles and so on. My point was precisely that pragmatic concerns rather easily simply override this claimed principle, so we all agree here. My point with Taiwan was forward-looking: the current president of Taiwan is pro-independence (or at least that is his image) and China continues with it's military/missile build-up over the strait, seemingly with every intent of invasion. So if we presume China does invade in the year 200X, and Taiwan (having a pro-independence president) attempts to fight back, the US, having aligned with China for practical reasons, will become the de facto enemy of Taiwan (which is why I said "de facto" too). So the irony lies in the US, while claiming to be the world's greates champions and defenders of democracy, aligning with the world's largest communist country (and STILL a major area of ongoing human rights violator in spite of relatively harmless foreign policy) against a modern democratic country. Of course it makes every sense from a practical perspective in the medium term, but it makes no sense in terms of claimed principles of the US, and this blatant hypocrisy is one of the reasons the US is not terribly popular in the world.

Steve Linford's corrections

[alanw]

in this posting to news.admin.net-abuse.email, Steve makes a couple of corrections to the article:

> Linford also told the conference that some 70 percent of spam is sent
> from China by American spam outfits who are hosting their servers with
> Chinese ISPs.

That should say: "70% of spam advertises URLs hosted in China" (not "is
sent from").

...

> Unless things change drastically, we predict that 80 percent of
> email will be spam by December this year, and it's very likely to go
> to 90 percent by this summer," Linford warned.

That should of course say "next summer".

Re:Steve Linford's corrections

[JCholewa]

> > > Unless things change drastically, we predict that 80 percent of
> > email will be spam by December this year, and it's very likely to go
> > to 90 percent by this summer," Linford warned.

> That should of course say "next summer".

No, it should say "last summer". I mean, right now, something like 99% of my email is spam. I have to use insanely aggressive server-side filtering (spamassassin, among other things) to get rid of 90% of it, and 90% of what gets through has to be bayesed out of existance. And some of what's left is spam, too.

--
-JC
http://www.jc-news.com/coding/freedom/

Surprise, surprise...

[ImpTech]

Seems like every day we have a story about such-and-such is the biggest cause of spam. In fact, I bet we've accounted for at least 400% of spam with all these stories combined.

If these trends continue, I'm afraid that one day soon I'll check slashdot and find out that 97% of all spam is coming from my IP.

Re:Surprise, surprise...

[serutan]

Yeah, I wonder what percent of the Russians and Chinese who generate 70% of spam are using the Windows zombie machines that distribute 80% of spam?

Re:Surprise, surprise...

[spacefrog]

If 97% of the 400% of spam comes from your IP, then you are only responsible for 24% of the total spam.

And, likewise, if there is only 400% spam quantity, and you are responsible for 24% of it, that is only 6% of the total spam.

Continue extrapolating, and you will quickly see that you are not responsible for any spam whatsoever.

Re:Surprise, surprise...

[sampowers]

I don't know about the rest of you, but I tend to get most of my spam via SMTP.

So why not quit using such an easily exploitable method of mail transport? Hell, the entire concept is older than me. We should be thinking about something like djb's Internet Mail 2000, in which the SENDER of the message is responsible for making the message available to recipients; only message notifications are delivered, which puts the cost of transmitting spam on the spammer, for once.

Email must evolve or it will die.

Re:Surprise, surprise...

[stoborrobots]

SMTP, huh, as opposed to what? CDMA/GSM? POTS? USPS?

Which would be different from the current problem how exactly?

Surely there is some stage when the message notification must be transmitted, as well as some metadata about the message which must accompany it... That metadata would tell you where to retrieve the message from, at the very least... So the spammers would simply send out millions of notifications...

Now, I don't know about you, but the majority of spam that I see is (relatively) short, letting me know that some website I have never heard off has a special offer, just for me! This is essentially a message notification...

I simply go to the website, and find out about the product (receive the message).

I'm not sure that there would be a huge cost to the spammers above what there currently is now... Even the required bandwidth to transmit all the messages is approximately the same...

I'd love to see it evolve, but I'm not sure what it can evolve into...

Re:Surprise, surprise...

[mav[LAG]]

Heh. That reminds me of the debugging axiom which states that every program has at least one bug. Therefore by induction you can reduce any program to a single line of code that doesn't work.

That old bone song..

[TidyKiller]

It's interesting how the Russian Mafia is helping American Marketers take advantage of Chinese Equipment. My question is: How involved are the actual Chinese people? Are they all victims of circumstance, or are they helping in some way?

Re:That old bone song..

[eeg3]

Quoting the article...
these Russian gangs aren't constrained by any anti-spam or cybercrime laws in their home country

So, I think it's more of the governments not having legislation governing spam than the citizens supporting it.

As for the Chinese ISPs hosting the spam, the article states that the spammers are setting up firewalls preventing the ISPs from seeing what is actually being hosted, therefore preventing them from stopping it.

Re:That old bone song..

[Rick Zeman]

It's interesting how the Russian Mafia is helping American Marketers take advantage of Chinese Equipment. My question is: How involved are the actual Chinese people? Are they all victims of circumstance, or are they helping in some way?

They profit.
This article is incorrect inasmuch as whenever you see a spam for "bulletproof hosting" it's for a Chinese server. The article kinda implies that their incompetent tools but if you go to and read the comments on the various ISPs you can see that they're really complicit.

Mod parent up

[Anonymous Coward]

Mod parent up: Classic Ronald Reagan quote spoof

Conflicting stories

[IAmMaxHarris]

"Also, apparently 70 percent of spam is sent from China by American spam outfits who in turn have hosting arrangements with Chinese ISPs."

Really? That contradicts this story posted just two days ago:

The Register is reporting a study by Sandvine.com that blames Microsoft Zombies for 80% of all spam.

So which is it, then?

Re:Conflicting stories

[aixou]

So which is it, then?

Who says it can't be both?

Re:Conflicting stories

[ComaVN]

73% of all statistics are made up.

Re:Conflicting stories

[mrchaotica]

It doesn't contradict at all - apparantly the Chinese are controlling the zombies

Re:Conflicting stories

[twistedcubic]

So which is it, then?

It's both. They use non-Euclidean statistics.

Give users the power to block countries...

[Dzimas]

A simple solution to offshore spam would be to give users the ability to filter the originating mail server by allowed countries. The vast majority of my messages come from Canada and the USA, followed by a small number from Europe and South America. If I could tell my mail server to reject all but mail from my "usual" countries, I could avoid the Chinese mail bombs and bizarro unicode virus messages. The biggest prob I can see with this is offshoring - I recently started to get mail from an offshored IT unit belonging to Shell in Malaysia. That one I would have probably blocked accidentally.

Re:Give users the power to block countries...

[Negatyfus]

Seriously, how are you gonna stop a country? They can forge the envelope and From: field, they can use proxies and open relays. You'll never be sure where the message was REALLY from.

Re:Give users the power to block countries...

[1u3hr]

f I could tell my mail server to reject all but mail from my "usual" countries, I could avoid the Chinese mail bombs

Thanks. It's people like you that block my mail (I live in Hong Kong) and make me have to use devious inconvenient methods just to send a normal message.

Re:Give users the power to block countries...

[AtomicBomb]

As many around here have pointed out, the bulk (80%) of the spam are sent by compromised cable/DSL machines. In other words, even if you can find the IP the email is originated from, it offers no solution to you.

The "70%" figure mentioned earlir on refers to the percentage of url embedded in the spam (e.g. the store for the V1a4Ga) that uses an IP from China... If you manage to instruct your spam filter to read inside the email main body, you may have a solution.

On the other hand, I don't think it will be a long lasting solution.... If spammers can send spam thru compromised machine, they should be able to web host their site thru a compromised machine...

Re:Give users the power to block countries...

[arivanov]

They already do. If you try to trace the websites in "cheap oem software offers" you will notice that they are in fact compromised machines on DSL and cable spread around the globe. The last sample I followed was in US, UK, France, China and portugal and a name server doing load balancing in the US. Registered by a russian company. This about says it all...

Re:Give users the power to block countries...

[Anonymous Coward]

Maybe you should get you government to change the law instead of bitching about it here.

Re:Give users the power to block countries...

[jcr]

Sucks to be you, dude. Perhaps you and the several million other legitimate internet users in HK should find the spammers and beat them to death.

-jcr

Re:Give users the power to block countries...

[tdemark]

Seriously, how are you gonna stop a country?

Simple.

In /etc/postfix/clientreject , add:

61 559 APNIC nets are a spam source. Go away.
202 559 APNIC nets are a spam source. Go away.
203 559 APNIC nets are a spam source. Go away.
210 559 APNIC nets are a spam source. Go away.
211 559 APNIC nets are a spam source. Go away.
218 559 APNIC nets are a spam source. Go away.
219 559 APNIC nets are a spam source. Go away.
220 559 APNIC nets are a spam source. Go away.

It's amazing how much spam this stops (approx. 50%)

OK, so it doesn't really block a "country".

- Tony

Re:Give users the power to block countries...

[gorbachev]

There's nothing wrong with blocking by country.

I have no ties in China, I will have no ties in China. There's no reason for me to get email from anyone in China. Why shouldn't I block email from China?

If I was running a big ISP serving customers in lower Manhattan, advertising in Chinatown, things might be a little different.

Proletariat of the world, unite to kill spammers

Re:Give users the power to block countries...

[Negatyfus]

What? Postfix doesn't seem to know about "clientreject" and it appears to be some sort of milter for sendmail that you are talking about.

Re:Give users the power to block countries...

[1u3hr]

I have no problem blocking email from infected countries. Perhaps you should get a more 'Americanized' email location/relay.

I have. But it's inconvenient.

Re:Give users the power to block countries...

[1u3hr]

Why shouldn't I block email from China?

You personally? No problem. But if you're admin for a company or an ISP, it's a pretty obnoxious policy to impose. Especially if you just silently drop messages rather than bouncing them, leaving me no way to know if I got through to my contact.

Re:Give users the power to block countries...

[1u3hr]

Perhaps you and the several million other legitimate internet users in HK should find the spammers and beat them to death.

The general wisdom is that, like the US, most of the spam appearing to come from local servers is from zombies. We have cheap broadband here, like Korea, and that brings its problems. It'd be nice if you guys could send a lynch mob to get these assholes and we'd all see less spam.

Re:Give users the power to block countries...

[Rydain]

I read an interesting thread on that particular spam scheme on NANAE a while back. All of the hacked machines serving the site submitted any input to a specific IP address owned by Comset, a Russian ISP. LARTs to said ISP seem to have been /dev/null'ed. Searching Google News for oem biz comset shows that they're still up to this tomfoolery.

Re:Give users the power to block countries...

[Arkaic]

Looking at the URL inside the messages is something that is already being implemented.......

http://www.surbl.org/

Re:Give users the power to block countries...

[mistered]

Dealing with spam is inconvenient, too. Get over it.

It sounds heartless, but spam is rapidly making email unusable. For example, I'm now getting so many false mailer-daemon reject messages (from trojans/spam with my domain in the From address) that I just delete them all. If 99.9% (say) of the mail I get from APNIC netblocks is spam, I don't care if I inconvenience the senders of the 0.1% a little bit.

Re:Give users the power to block countries...

[1u3hr]

Dealing with spam is inconvenient, too. Get over it.

Okay, so I'm collateral damage in your War on Spam. When someone punishes me for the actions of another I have nor control over, I do resent it. Nothing I can do about it, but I DO resent it.

If 99.9% (say) of the mail I get from APNIC netblocks is spam, I don't care if I inconvenience the senders of the 0.1% a little bit.

Perhaps you might care about the intended recipients of the legitimate email that you have deleted.

Re:Give users the power to block countries...

[moofdaddy]

Then it is your responsability to lobby your goverment to crack down on spam in your country.

Re:Give users the power to block countries...

[1u3hr]

Then it is your responsability to lobby your goverment to crack down on spam in your country

Most of the spam is from America and sent to Americans. Actually I get a lot of that too, though I couldn't buy the stuff advertised even if I wanted to (American mortgages, credit cards, cable decoders as well as the usual viagra etc). I assume you're American -- look at the Register of Known Spam Operations. 141 out of 180 are American. One is From Hong Kong. When you get the number of spammers down to the same, you come back and complain. Americans are the spammers. But you want the rest of the world to solve your problem, and/or suffer for it.

Re:Give users the power to block countries...

[IANAAC]

Most of the spam is from America and sent to Americans.

This is false in my case. I have an account that I've never published/given out with an italian ISP. It gets about 200 a week. From all over the place. I'll repeat that I've never given this email address to anyone.

Re:Give users the power to block countries...

[ncc74656]

Seriously, how are you gonna stop a country?

blackholes.us maintains lists of address blocks known to belong to certain countries. Add china.blackholes.us (for instance) to the list of RBLs your SMTP server checks and most mail from China will be cut off.

(Note that I said "most," not "all"...a fair bit of the spam that still gets through is from IP addresses that I've traced back to China that aren't listed at blackholes.us. I'm beginning to wonder if I should set up a private RBL to which I can add the netblocks in China, Brazil (another big spam source that's not mentioned in the article), etc. that still get through.)

Re:Give users the power to block countries...

[Negatyfus]

Yeah, I know Postfix-- I'm running it at the office. Just didn't know about this option and your list. I'll check it out.

Currently I run it with MailScanner and SpamAssassin (with Beyes filtering and several RBL's). I still wasn't really able to stop all spam.

So thanks for the info...

Re:Give users the power to block countries...

[hearingaid]

About 90% of my spam originates in Hong Kong.

Want to send North Americans email? Get your government to outlaw spamming. Hint: Mention that spam is often used to promote Western political ideas and consumer products. That should get it done.

Re:Give users the power to block countries...

[mistered]

Most of the spam is from America and sent to Americans.

Yes, that may be true, but although the spam may originate in the US and end up in the US (or Canada, in my case) it's often relayed through places like Korea, where complaints to ISPs have little effect.

My complaint is not with the goverments of Hong Kong, Korea, etc., or the spammers that may operate there (since I get very little, if any spam from them). It's with the ISPs that refuse to do anything about spam being relayed through their network.

Re:Give users the power to block countries...

[mistered]

Nothing I can do about it, but I DO resent it.

Fair enough, but there is something you can do about it: convince your ISP to do something when they receive complaints about spam relaying. I have no desire to block a region or a country, only to avoid netblocks that are large sources of spam.

Perhaps you might care about the intended recipients of the legitimate email that you have deleted.

Actually, not really. Email (for me) is teetering on the edge of becoming completely useless. I'm willing to put up with a few false positives from automated techniques. In the absense of spam mitigation, I'd end up losing more mail just from my inability to deal with the sheer volume of messages.

That said, I certainly would never want to accept email, then decide it's spam and blackhole it. If you try to email me from one of the listed netblocks, you'll get a bounce explaining why and indicating how you can get the message through.

So then, the legitimate email I won't see comes from an address on a block list, and either has an invalid return address or the original sender filters my bounce message. I can live with that.

Re:Give users the power to block countries...

[shlomo]

Does anyone know how to tell if an ip is dsl/cable besides a nslookup?

is there any mapped ip which belong to cable companies whcih are known??

Re:Give users the power to block countries...

[1u3hr]

>Nothing I can do about it, but I DO resent it.
Fair enough, but there is something you can do about it: convince your ISP to do something

How would I go about convincing my ISP (the Sony corporation) to do anything? I can't get beyond the first level of customer support when I have a problem. The only other choice of broadband I have is PCCW; which has a much bigger spam problem, probably due to it being broke and understaffed.

>Perhaps you might care about the intended recipients of the legitimate email that you have deleted.
Actually, not really

It's not clear to me whether you're talking about your personal email or for a company or ISP. If the former, block away, pull the plug. If the latter, it's a very cavalier attitude to take with someone else's communications.

Re:Give users the power to block countries...

[mistered]

It's not clear to me whether you're talking about your personal email or for a company or ISP.

Sorry, I should have made that clear. Everything I've discussed is for my own email. I run my own mailserver just so I can have this level of control over my incoming email. I agree that it would not be appropriate to unilaterally impose this sorts of measures on others.

Re:Give users the power to block countries...

[JuggleGeek]

How would I go about convincing my ISP (the Sony corporation) to do anything?

I've received spam from Sony, so I suspect that convincing them to do anything to stop spam is going to be difficult. I had just bought a Sony TV when they sent me the spam - I'll never buy from Sony again.

Re:Hmm

[Anonymous Coward]

Dear Sir,

It is common known that Russia and China are the source for White and Chinese mail-order brides. However their population has not the African type to satisfy your cravings. Therefore I and my colleagues who have the contact you for V aig r a already have prepared a business venture in which you can test your new supply. For only a small investment we will connect you to the premium provider of African mail-order operating out of our Locations in Congo, Liberia, and Somalia. Please reply post haste with your reply.

Sincerely yours,
DOCTOR M. BOKUZUWANDI

maybe a FTA would help!!!

[erucsbo]

If having a free trade agreement is a good way of getting US legal muscle in to local laws, we should encourage FTAs between the US and Russia, China and all the other spammers.
Maybe we could then enforce the evil bit (RFC3514) world-wide!

Re:maybe a FTA would help!!!

[LPetrazickis]

Hmm. Free Trade Agreements tend to encourage unethical business practices. If anything, an FTA between China and US will force US to harmonize its anti-spam legislation with that of China by junking it.;)

Wasn't it Windows PCs...?

[osobear]

There was just an article on how it was infected windows PCs.... and I remember everyone assuming that it was PCs here, so are we talking about Windows in China, now? How do you plan on education in that case?

Outsourcing SPAM

[Anonymous Coward]

If 70% 70 percent of spam is sent from China by American spam outfits, wouldn't that make the US the biggest spammer?

That's exactly what it is, only we in the U.S. like to outsource everything we possibly can--tech support, call centers, software development--and that now includes everyone's favorite e-mail marketing substance, SPAM.

Outsource! It's the trendy thing to do!

More importantly

[lancomandr]

Lots of that spamming is for harvesting information. Russia and China are some of the biggest culprits in the theft of credit card numbers, eBay, Paypal, Amazon etc. Web hosting located in Russia or more often China for hosting scampages is available to anyone l33t enough to find the people selling it (not very l33t.) No logs, except of course the information you want to reap. Spam away and let the filled out forms roll in!

Re:Solution?

[theguywhosaid]

or 1. people could just stop being assholes.
or 2. people could just stop reading it and buying the junk.

i would rather my first solution happens, because as a side effect there wouldnt be any more assholes. number two wont happen, because sometimes you just want to see if it really will make your junk bigger. your idea is GREAT, but... i dont really know what the new paradigm would be.

X% of Spam is caused by This

[SJrX]

You know in the past month I have seen that 80% of Spam is caused by infected PC's in Windows. That 80% of Spam comes from China. That 70% come from Russia and China. That the US accounts for 60% of Spam. That Eastern Europe Accounts for 60% of Spam. So from this I know that there is 80+80+70+60+60= 350% Spam. This also tells me that Russia accounts for Negative 10% of Spam. Don't believe me, take this The Reg Story, http://www.theregister.co.uk/2004/06/04/trojan_spa m_study/, This one, http://www.theregister.co.uk/2004/05/25/spam_delug e/ and thats just El Reg. The only conclusive thing I have been able to determine is that these stories are worse than spam, not only are they useless, but we actually read these stories.

Re:X% of Spam is caused by This

[bro1]

Those 350% might explain why I get so much spam... I am sure I have been receiving only about 100% of spam about a year ago

Spam Slashdot?

[Anonymous Coward]

Does anyone else see the garbage troll posts that make absolutely no sense? Reminds me of spam.

Someone should make (using genetic algorithms) a posting bot that tries to make insightful first posts. Its fitness can be determined by the readability and moderation score.

another...

[abscondment]

another possible explanation of this is illegal copies of Windows.

I was recently talking with a friend from hong kong; he mentioned that virtually no one buys legitimate copies of software because it's more expensive and less readily available.

he also said that users and companies using pirated software don't update it for fear of legal action--hence the huge number of zombies.

Re:another...

[1u3hr]

I was recently talking with a friend from hong kong; he mentioned that virtually no one buys legitimate copies of software because it's more expensive and less readily available...users and companies using pirated software don't update it for fear of legal action--hence the huge number of zombies.

Not true any more (maybe 10 years ago). Now if you buy a PC in HK it almost invariably comes with a Windows OEM install. As for "less readily available" -- that's bullshit. Ther are lots more legal software places than bootleg now, the govt has shut most of the bootleg shops down (though they're easy to find if you want to), they're small stalls in temporary locations for the most part.

A lot of applications are pirated though, but the OSs are mostly legal. People don't update for the same reason Americans don't; they don't understand the need or care as long as it's still working.

Sorry but

[lancomandr]

In Soviet Russia, everyone and their grandmother is a spammer.

New laws

[Claire-plus-plus]

The USA is quite obviously the source of the spam. It is up to the USA to legislate in some way to stop the flood of spam that is hurting people all over the world. The real question is: how do you stop the spam when it is being sent from countries like China where the USA has no power to arrest spammers?

Well I think I have a possible solution and it can be illustrated by a case study. In Australia we had an international Paedophilia problem, Paedophiles were travelling to countries like Thailand where sex with children was not illegal and thus were not getting arrested. The solution that was eventually found was new laws whereby anyone who broke Australia's anti-paedophile laws could be arrested no matter where the offence was enacted. Offenders were met at the airport by police and arrested for crimes in other countries and the problem of "paedophile sex tourism" was solved.

My Solution to spam is similar. The USA needs to pass laws allowing them to track down the companies and individuals that are using the Chinese spam services and arrest them. Make the law such that sending spam is illegal no matter which country it is sent from. The spammers might get so scared they will stop Spamming

Re:New laws

[Claire-plus-plus]

why moderate the above comment down? Makes no sense

Re:New laws

[humankind]

why moderate the above comment down? Makes no sense

With all due respect, it would make sense to you if you had sense.

We have a ton of spam laws already. Passing more laws doesn't change a damn thing. Almost all spammers are already breaking numerous laws, criminal felonies involving computer tampering are just the start. In fact, the USA Patriot act could even be employed to consider the activities of most spammers to be terrorism and thus subject spammers to capital punishment. What more do you need? The problem isn't more laws. The problem is.... say it with me.....

E N F O R C E M E N T

Our law enforcement branches are more interested in going after people downloading Metallica or Martha Stewart's stock dealings than they are enforcing the plethora of violations done by spammers. Passing more laws has not proved effective.

Re:New laws

[Claire-plus-plus]

Enforcement isn't happening, receiving end software doesn't work, the solution is not going to be simple. I was just stating an idea that probably hasn't been tried.

If enforcement is truly not being performed it states a lot about the USA. Spam is costing business millions and if that isn't the incentive the US government needs to make examples of some spammers I don't think enforcement is ever going to happen as there will never be a more compelling reason than the loss of income to business.

Re:New laws

[Claire-plus-plus]

on incidentally I was stating that moderating something as "Overrated" when it hadn't been moderated up as an act that made no sense. If you don't think I had somethign intelligent to say, I don't care really but moderating something down from 1 to 0 unless it is flamebait or a troll is silly.

Re:New laws

[1u3hr]

Paedophiles were travelling to countries like Thailand where sex with children was not illegal

It most certainly is illegal in Thailand. You will be severely punished if you can't afford a hefty bribe to the police and judge.

Connecting the dots for whomever missed it

[Infonaut]

in both cases there is plenty of demand from within the States. If it ain't rich kids experimenting, it's poor kids escaping with drugs from South America or Asia. If it's not a "bulk emailer" in California, it's a "clever marketer" in Florida sending millions of unsolicited email via servers in Russia or China.

I'll connect the dots:

Demand for spamming services is akin to demand for illegal drugs, in that demand from the United States fuels supply from other countries.

The Russian mafia

[drgonzo59]

That is the other (electronic) Russian Mafia. Unlike the dumb Italian teamstears who beat people with baseball bats, some of these guys are very skilled and intelligent. The counterparts of many American geeks in Russia couldn't find a well paying job, have plenty of time, and nowadays on the Internet, they have access to all the technical information they need on any subject. They will use the best asset they have, their brain, to make money or build recognition for themselves. And the way the laws are shady there they think they can get away with anything as long as its online. If spam will make a couple of hundred rubles - they'll get into spam, if they can extort money from banks by compromising their webservers, they will do that. How do I know all this? I grew up in those part and still visit friends and family once in a while...

Re:The Russian mafia

[chimpo13]

Unlike the dumb Italian teamstears who beat people with baseball bats

Hey, You're leaving the mobsters from the USA out of that.

Sin-cerely,

Jimmy Hoffa

Re:The Russian mafia

[narkotix]

rule no 1 - intimidate your enemy...remember times have changed from the "italian" time...everything is internet based nowadays so you cant accuse the italians being dumb. They exploited the US govt right up to the top which is a pretty good achievement!

Re:The Russian mafia

[21mhz]

The counterparts of many American geeks in Russia couldn't find a well paying job
Yeah, cry me a river. At least in major sities, this is not the case. The definition of "well paying" may vary, but we're talking about Russian standards here. It's more like the employers can't find adequate geeks to man the jobs.
In small shitholes, it can be tougher (what country has it the other way?). But nothing really prevents people from moving anymore.
The bottom line is: these people have deliberately chosen to be scumbags.

Re:The Russian mafia

[mtve]

that's true.

Re:The Russian mafia

[Stiletto]

Somehow I don't think you can sustain yourself through unemployment by eating all that self-rightiousness, no matter how much ketchup you dump on it.

Be happy you are one of the 5% who were fortunate enough to be born into privilege.

Re:The Russian mafia

[drgonzo59]

I will have to disagree with you. It is not always true that in even in the major cities you can find computer related jobs. Sure you can clean the street or even work as a waiter, but I was talking about computer jobs, anything hardware or software. There are some very good software firms in Russia and ex-Soviet republics but computers are still not as pervasive as they are in US or Western Europe. That is another reason why so many of them leave and I am one of them. And as far as nothing preventing people from moving, you forgot, we are talking about Eastern Europe here, you can't just pack your bags and move to America or Europe, you gotta go through a lot to get a visa and be allowed to come in those other countries.

Re:The Russian mafia

[21mhz]

By moving I meant relocating to Moscow, St.Petersburg, Novosibirsk, or other big city that has the software industry going. This is not entirely impossible. Leaving the country is still an option too, as you mention. Anyway, there is always a choice.

Re:Solution?

[Claire-plus-plus]

that;s the problem with new paradigms, it is very difficult to see into them from within the old paradigm.

Spamassassin 3.0 and URIBL_SBL

[alanw]

The soon-to-be-released Spamassassin 3.0 will have the URIBL_SBL test. This will test the IP address of domains referenced in the body of the spam against lists of known spammer hosts. This will reliably trap all of the 70% of spam that advertises web sites hosted in China.

http://www.spamhaus.org/sbl/howtouse.html
http://www.spamassassin.org/full/3.0.x/dist/rules/ 25_uribl.cf

Re:Spamassassin 3.0 and URIBL_SBL

[Zocalo]

The soon-to-be-released Spamassassin 3.0 will have the URIBL_SBL test.

It's due out around the end June, assuming no major glitches in the code, etc. I've been testing the URIBL_SBL rules with the current version, and after a little messing around to get it working have found that it works very well indeed. It's definitely worth looking at the upgrade if you are currently running a vanilla version of SpamAssassin. IIRC, version 3.0 will also be adding support for Spamhaus' XBL list, which lists the hosts that the article is about; those that have been demonstrably compromised by a worm or trojan.

Surely this contradicts a previous article?

[Atrax]

"apparently 70 percent of spam is sent from China by American spam outfits who in turn have hosting arrangements with Chinese ISPs."

Infected Windows PCs Now Source Of 80% Of Spam

OK, which is the more reliable figure?

Re:Surely this contradicts a previous article?

[transops.net]

Most likely both are true. American marketing firms have hosting arrangements with spammers operating servers in China and Russia. Additionally, these same American marketing firms most likely buy "bulk email services" from Russian and Chinese spammers operating networks of compromised PCs.

In fact, if I had my guess, I'd say it's quite likely that the bulk of infected Windows PCs are in China and Russia, since both nations have a track record of using illegitimate software that can't be updated. Again, in that case, it's still American marketing firms buying cycles and bandwidth from spammer outfits using compromised PCs to do their work.

Re:Surely this contradicts a previous article?

[gorbachev]

"Additionally, these same American marketing firms most likely buy "bulk email services" from Russian and Chinese spammers operating networks of compromised PCs."

Steve Linford was misquoted in the article. 70% of the spamvertised websites are hosted in China, so the 80% zombie spam source quote is accurate.

However, what was said above is not quite true.

There aren't that many spammers in Russia and China. They mainly offer spam support services.

Russians specialize in writing viruses that create zombie networks. They then sell access to the zombie network to American spammers. Russians USED to also host the spamvertised websites, but for some reason that's not happening as frequently any more as it was 2 - 4 years ago. Probably because the Chinese have better pricing and/or infrastructure.

The zombies are controlled by American spammers, using open proxies and other zombies to hide their trail.

Chinese specialize in bulletproof hosting, i.e. hosting spamvertised websites with service contracts that state the sites will not be terminated due to spam complaints.

"In fact, if I had my guess, I'd say it's quite likely that the bulk of infected Windows PCs are in China and Russia."

Clearly you have never had an account on any of the US broadband providers. ALL of them are FULL of zombies. It's completely insane. You plug your computer on their network and within a second your firewall lights go completely nuts. If you're stupid enough to run your computer without a firewall and without all the latest security fixes, you will be a zombie within the first minute as well.

Proletariat of the world, unite to kill spammers.

Re:Surely this contradicts a previous article?

[transops.net]

Steve Linford was misquoted in the article. 70% of the spamvertised websites are hosted in China, so the 80% zombie spam source quote is accurate.

So noted. Thanks for the heads up; I figured someone must have misquoted something on this due to the math problems the poster's message seemed to imply (but wait... nobody ever misquotes anything on Slashdot, right ;) ).

However, what was said above is not quite true.

There aren't that many spammers in Russia and China. They mainly offer spam support services.

Funny thing about that... I was actually approached by a Russian outsourcing firm here in Atlanta about using their programming talent on our smaller customer projects. The negotiations were going great until I asked them about their privacy policies and enforcement technologies (specifically with an eye to preventing web apps from being used as spam engines). I guess they misunderstood that part of my question, because the dude excitedly began to tell me all about their "delivery assurance" software that he guaranteed would *defeat* SPAM filters on mail servers. I wasn't terribly polite in my characterization of his firm for a couple of minutes, and he lost our business along with that of two other local software firms sitting in on that day's meeting.

Russians specialize in writing viruses that create zombie networks. They then sell access to the zombie network to American spammers. Russians USED to also host the spamvertised websites, but for some reason that's not happening as frequently any more as it was 2 - 4 years ago. Probably because the Chinese have better pricing and/or infrastructure.

Now that I really think about it, this makes perfect sense. I'll run a few scripts on Postfix logs in our archives for my own entertainment, but I do believe you're right on target with this one. The Chinese may have their problems, but they have become a major player in "legally sensitive" technologies, at a startling pace in some areas over the last year alone. This one seems like a particularly thorny issue, because people seem to forget that we can't really legislate or innovate practical solutions to many human-based tech problems in our own countries, let alone convince a nation like China to honor our system of laws and procedures. Always a fun thing to think about.

The zombies are controlled by American spammers, using open proxies and other zombies to hide their trail.

This makes good sense when we consider the prosecution process mandated required by the U.S. legal system for many criminal (such as fraud or theft) and civil (contract violation, culpability for financial loss, etc) proceedings. As long as U.S. marketing companies can claim plausible deniability concerning the nature of their relationship with a contracted "bulk mail firm", it's tough to convict the marketers or their management of any legal wrongdoing. I'm strongly against most new laws given my personal polical ideaology, but perhaps this is a case where marketers should be required to do at least minimal due diligence into examining the technical resources of contracted sender agencies prior to hiring them. Something like proving that the contracted firm can actually operate their "superior server cluster" in a realistic mail campaign to a separate (and suitably large enough to reflect a real campaign) test set of recipients. If the company can show off their network while the marketing firm's execs actually stand there and watch them execute a test campaign, we're at least removing the problem of zombie networks doing the sending. This, of course, assumes the marketing firm has the presence of mind to at least briefly employ a neutral tech outfit to make sure the bulk mail guys aren't bullshitting them during the demo. I think I may smell a business unit prospect here... this deserves more thought.

Chinese specialize in bulletproof hosting, i.e. hosting spamvertised websites with service contracts that state the sit

Creating Axes

[DeICQLady]

Destroy enemies, only 15 years later enlist their help to for the *spammers* axis of evil! If that isn't a miracle of capitalism I dunno what is. Too bad Iraq and Afgahnistan have to wait that long for their slice of the pie -_-

I asked this around and didn't get an answer

[Kickstart70]

I -never- expect to get ligitimate mail from Russia (though I have a friend in China). I run my own Postfix mailserver and SpamAssassin. Does anyone know how I can completely block out Russian IP addresses from sending mail to me?

Thanks! (and yes, I know that it won't solve all my spam problems)

Re:I asked this around and didn't get an answer

[hacker]

russia.blackholes.us, of course:

# DNS based IP address spam list russia.blackholes.us
R$* $: $&{client_addr}
R$-.$-.$-.$- $: <?> $(dnsbl $4.$3.$2.$1.russia.blackholes.us. $: OK $)
R<?>OK $: OKSOFAR
R<?>$+<TMP> $: TMPOK
R<?>$+ $#error $@ 5.7.1 $: Mail from $&{client_addr} rejected by russia.blackholes.us

Re:I asked this around and didn't get an answer

[ezh]

it won't solve your problem at all. the article says russia supplies the addresses of 'zombie' pc's, which are all over the world. it's not like russia sends spam in these proportions.

Re:Solution?

[Nogami_Saeko]

Or, rather than throwing the baby out with the bathwater, install POPFile (http://popfile.sourceforge.net/). Problem gone.

My current stats (Since May of last year):

Messages classified: 8,398
Classification errors: 66
Accuracy: 99.21%

Most of the classification errors were in the first couple weeks of training it.

It's nearly bulletproof now. Maybe one message a month gets past it. Works on all platforms and the Windows client has become much easier to use than older version (nice installer and all).

Highly recommended!

N.

It can't be both

[IAmMaxHarris]

From comment #9384574:

Headline should read, US Spammers using services of Chinese ISPs, Russian mob. The Spam originates here, and ends up here. The vast majority of Spam is in English, and targeting an American audience.

and from comment #9384576:

> Linford also told the conference that some 70 percent of spam is sent
> from China by American spam outfits who are hosting their servers with
> Chinese ISPs.

That should say: "70% of spam advertises URLs hosted in China" (not "is sent from").

...

> Unless things change drastically, we predict that 80 percent of
> email will be spam by December this year, and it's very likely to go
> to 90 percent by this summer," Linford warned.

That should of course say "next summer".

Re:Solution?

[Anonymous Coward]

Problem gone? Not by a longshot.

You only got 8,398 messages in one year?

I more than that in ONE WEEK. Each day, I average 1,650 email messages; with about ten of those being legitimate. With your recommended software, even with its "amazing" accuracy, I'd still be getting more spam passed through than legitimate messages.

(This is an old email address, used for well over fifteen years. It has been out in the public forever--used on things like domain registrations and Usenet--well before email addresses needed to be guarded, because spam simply didn't exist back then).

No, classification and filtering is not a reasaonble solution. You got 66 classification errors; how am I supposed to look through over 1,500 messages a day to pick out the one or two that actually were legitimate but got filtered as spam? It's insane, and I'm not going to do it.

We need a BETTER solution than filtering--because if this trend continues, within a couple of years EVERYONE is going to getting thousands of emails a day.

NEXT!

[humankind]

The USA is quite obviously the source of the spam. It is up to the USA to legislate in some way to stop the flood of spam that is hurting people all over the world. The real question is: how do you stop the spam when it is being sent from countries like China where the USA has no power to arrest spammers?

Hey, what a brilliant idea. We currently have only a hundred or more anti-spam laws across the world, most in the US. Let's pass a few more. I am certain that when we pass the 500 anti-spam law mark, spammers will suddenly start to cower in their boots and realize that 500 anti-spam laws that aren't being enforced or have no legal/civil/criminal teeth are a formidible obstacle to overcome!

Re:NEXT!

[Claire-plus-plus]

do any of the current anti-spam laws allow prosecution even when the spam is sent from another country? Because that is what I think is needed. I assume that it is currently sent from china because you can get arrested for sending if from the USA, make sending spam from anywhere an arrestable offence.

Re:NEXT!

[humankind]

do any of the current anti-spam laws allow prosecution even when the spam is sent from another country? Because that is what I think is needed. I assume that it is currently sent from china because you can get arrested for sending if from the USA, make sending spam from anywhere an arrestable offence.

The source of the spam is ultimately in the United States. Using a foreign network to route spam serves to make the spammers harder to track and catch, but not impossible. The truth is, most of the largest spammers are easily trackable and can likely be proven guilty of numerous laws, whether they use foreign servers or not. The problem is it's a very low priority for law enforcement authorities unless, for example, the spammers mailbomb The GAP or Macdonald's company headquarters... then there'd be hell to pay.

Another problem is District Attorneys in most states in the United States have no interest in prosecuting spammers. Either they are ignorant or apathetic, but numerous spammer criminal cases have been presented to authorities for prosecution only to have them turned down.

Re:NEXT!

[aXis100]

Surely the easier solution is to charge the companies who are advertising their products via spam, not the elusive spammers themselves. Two good reasons are:

1) The spam obviously has to have a link back to the vendor in order to make sales.
2) If there is no demand for it, spam will stop.

Re:NEXT!

[grahamm]

Are US District Attorneys not elected officials? If they are, could spam not be made a campaign issue (by the voters) when the official comes up for (re-)election?

Re:NEXT!

[Smallpond]

Except that there are no legitimate companies spamming. A while back, Norton had to post a disclaimer on their website. All of that cheap NAV stuff being offerred was illegal copies, not really from Norton. Most of the other offers that use real company names are scams. For example, the discount Windows offers.

Re:NEXT!

[dustmote]

I don't know, and I think that is rather indicative of the problem in the first place, but I'm fairly sure that they're appointed.

Re:NEXT!

[Lost Engineer]

You seem to think the DA cares about you... The only way a DA would give 2 shits about anyone in his electorate is if they started snipering folks from the back of an old car. Then again maybe im too pessimistic. Elected government occasionally works on the local level.

Re:NEXT!

[mdfst13]

Federal district attorneys are appointed by the President. State, county, and municipality district attorneys may or may not be elected (for example, in Pennsylvania, the state Attorney General is an elected position).

Re:NEXT!

[sootman]

Don't laugh--passing tons and tons of laws has stopped gun violence and drug use, right? Oh, wait...

Re:NEXT!

[humankind]

This is perhaps the most significant issue in the anti-spam battle.

People need to petition their local DAs to start prosecuting these cases.

I know, from personal experience of taking a case to the DA, where I identified a guy who compromised my system to send out spam, and in cooperation with the Feds, we presented a case to the DA to prosecute and it was turned down. I even had the guy's mobile phone number and home address and evidence of him hacking AOL accounts to host landing pages for the spam. That makes computer tampering, fraud and several other felonies, and the DA rejected the case for prosecution.

I spoke with Julian at Spamcop when I was pursuing this case. He told me the chances of me getting enforcement to pursue the case was slim at best. He was right. This is unfortunate.

Oh no!

[YeeHaW_Jelte]

"According to Spamhaus director Steve Linford, the Russian gangs aren't constrained by any anti-spam or cybercrime laws in their home country and have no respect for legislation implemented in other countries."

Criminals with no respect for the law! This world is surely going to the dogs!

Spam

[Sinful_Shirts]

I have gotten quite a bit of spam that is actually written in Chinese. I don't think I have gotten any spam in Russian. I actually got a piece of junk mail that I thought was funny once. The subject was "Hard times ahead!" and I thought it would be about saving money, but it was for viagra or something.

Re:Spam

[Guy Harris]

I don't think I have gotten any spam in Russian.

I have, although it's more obvious when reading it with Mail.app on my Mac at work than with Mutt on my machine at home - it shows up in the Cyrillic alphabet in Mail.app but not in Mutt in my boring old ISO 8859-1 xterm.

Messages in various Chinese/Japanese/Korean encodings look, when viewed by software assuming ISO 8859-1 encoding, like a different form of noise than messages in Cyrillic script, so you might be able to reconize Russian spam that way as well.

I actually got a piece of junk mail that I thought was funny once. The subject was "Hard times ahead!" and I thought it would be about saving money, but it was for viagra or something.

One of the funniest spams I saw was one posted to alt.sex.nfs (which I was reading at the time as I was working on NFS at Network Appliance) - it had the subject "Men needed for lesbian lust", which is somewhat of a Special Extra Bonus Unclear On The Concept subject line....

Re:Spam

[liquidsin]

Best spam subject I've had yet (and I've gotten it about three times in the last two weeks) was "Haha, U Have A Real Small Penis". Of course I wasn't amused at first, as I thought maybe it was from my ex. Fucking herbal viagra bullshit :/

"water-among-earth's-wettest-substances dept"

[KNicolson]

I thought water wasn't actually very wet, due to a lot of surface tension, or something?

I hope there's no -1 Pedantic moderation category...

My new spam fighting techniques.

[ffsnjb]

I implemented some new spam fighting techniques last night. The most effective one from logs since implementation was making HELO checks mandatory in Postfix. If the sending client doesn't submit an EHLO response, Postfix rejects the client. Since this happens before message transmission, it seems that not nearly as much bandwidth is being used (haven't verified that yet.) I'm surprised this isn't on by default in Postfix, but it sure is funny to see all these hosts rejected. None of them even resolve, there's no way that it's legitimate mail. If it is, too damn bad.

Re:My new spam fighting techniques.

[TiggsPanther]

OK, for those of us who aren't quite as up-to-speed on how SMTP works (OK, maybe just me then), how does this work?
I don't really understand the HELO/EHLO checks, so haev no idea what they're checking for. What is it that, in this case, they look for that Spam messages don't respond with?

Tiggs

Re:My new spam fighting techniques.

[stoborrobots]

it's somewhat trivial to forge the EHLO line... What checks is it actually doing?

Re:My new spam fighting techniques.

[Zocalo]

I'm not too sure what the original poster is doing from the description, but I reject some connections based on HELO/EHLO too, so I can tell you how what I do works. But firstly, since you say that you don't know the details of SMTP, let's clarify what HELO/EHLO do:

When host connects to an SMTP server in order to send it an email, it will receive a banner back which may include the string "ESMTP". If it does then the remote SMTP server supports an enhanced version of SMTP with additional features, "ESMTP". If the host also understands ESMTP, then it should respond with an "EHLO" command. If the host does not understand ESMTP, or the string is not present in the banner, then the host will respond with the "HELO" command defined in the original SMTP RFC to use the simpler set of SMTP commands.

In either case, "HELO" or "EHLO", the host should also tell the server its host name, viz:

EHLO host.company.com

Ideally, "host.company.com" will also have a valid reverse DNS record which will match the IP connecting to the SMTP server. However, the SMTP RFCs do not actually *require* that this is the case, nor for that matter that the hostname is provided at all. Frequently the hostname will be given, but will not be a valid fully qualified domain name on the Internet. So, depending on how draconian you want to be, there are a number of options for rejecting the connection before any data is sent:

• No hostname after HELO/EHLO
• Hostname given is just a host, not an FQDN
• Host domain name given does not appear to exist in DNS
• FQDN given does not have RDNS record
• FQDN given has RDNS record, but it does not match the IP connected

Using any or all of those will certainly reduce your spam intake, but may also cause legitimate email to be rejected, as usual YMMV as to how much. One thing to watch for if considering this though is that a *lot* of legitimate Windows boxes, including some operated by ISPs, seem to have been configured so that they provide their NetBIOS name when they HELO/EHLO, all but the first check listed above would refuse the conection from such a server.

Re:My new spam fighting techniques.

[TiggsPanther]

Firstly, thanks for the info. Helps a lot. Also gives me a few ideas. (Though probably not anything that hasn't already been considered before)

Maybe the next round of SMTP RFCs should require at require at least something to be given in the HELO/EHLO command. Depending on how strict the RFC requirements were you could then easily block on the criteria you supplied above.
Certainly if you reject at the level of RFC requirements then any corporation or individual complaining that their legitimate mail got rejected can then be told that their server breaks the published standards. (Yes, I know that RFCs are more suggestions than had requirements, but they are the closest we have to de facto standards for the various protocols)

Also if it was part of the RFC, then there would be more pressure for software-houses and ISPs to have the Windows-based servers set up to respond properly.

What would help (and would be nice) was if ISPs would allows RDNS records for those that request them for no extra charge. So then you could easily reject on the fourth (or fifth) item in the list. Especially if it was opt-in only, then anyone sending directly from their machine legitimate would have a valid RDNS entry.
People sending directly from machines without RDNS entries are more likely to be either compromised boxes or people trying not to get caught. And if it was free to get your IP address an RDNS entry from your ISP then it would reduce the legitimate reasons for people not wanting to get one.

It wouldn't catch everything, but it'd at least make it harder to send anything unofficially. And provide a way of directly identifying any server that sent you stuff you didn't want.

Tiggs

Re:My new spam fighting techniques.

[maximilln]

How do you handle mailservers on a LAN inside a firewall? I certainly wouldn't want my mailserver outside the firewall. Even if the host uses a perfectly valid TLD (company.com), the mailserver may identify itself as (ps1-hf56.company.com) which is only known to the DNS servers on the LAN inside the firewall. Incoming mail (SMTP connection) is handled at the firewall and redirected to a group of mailservers.

Not that it's a bad idea but it's not very friendly to companies which NAT their mailservers through a firewall.

Re:My new spam fighting techniques.

[Zocalo]

All major MTAs, if not all MTAs period, allow the identifier given on HELO/EHLO command to be independent of the hostname (and NetBIOS name if applicable). It's just a string afterall. If you are NATing through a firewall, then your SMTP connections will appear to be coming from the firewall's IP. So, provided that you set the MTA to identify itself with whatever the RDNS entry of the firewall is, then even the most draconian of RFC compliance Nazi's will have no cause for complaint.

Inbound is a different kettle of fish. If you are NATing the IP before it hits your MTA then you are heavily restricted in what you can do with the HELO/EHLO. If external DNS resolution is available to the MTA, then you can still use FQDN checks and reject on hostname (assuming they are not proxied by the firewall too). What you can't do is see if the IP matches the FQDN, because the connecting IP will be the firewall's internal IP and obviously won't match.

Whether it's a "bad idea" or not is down to your personal circumstances - it's certainly not going to magically fix your entire spam problem, and in some cases will probably cause far more problems with legit email. However, provided that you are not over zealous with the filtering, then it's only unfriendly to people who spam and people who could probably do with a little more education on configuring their MTA. I guess it depends on which group you feel the strongest about, but you could always compromise and provide a helpful message about *why* the connection was refused.

Re:My new spam fighting techniques.

[maximilln]

All major MTAs, if not all MTAs period, allow the identifier given on HELO/EHLO command to be independent of the hostname
That solves that problem. The only thing left to check is if the IP of the client is within the IP range alloted to the HELO/EHLO identifier. What about mobile users not sending mail using an outgoing SMTP host? Hopefully their client will return an EHLO/HELO identifier which correlates with whatever road ISP they're using.

then it's only unfriendly to people who spam and people who could probably do with a little more education on configuring their MTA
In my opinion this is a good thing in both cases.

Re:My new spam fighting techniques.

[ffsnjb]

Postfix's smtpd_helo_required, when set to yes (default is no) rejects any connection that doesn't provide a HELO/EHLO response when connecting. A properly config'd machine will provide the response.

Re:My new spam fighting techniques.

[stoborrobots]

And so will just about any other SMTP-aware client... It's in the spec, after all... Are there really any viruses out there that attempt to send mail without attempting a HELO? FWIW, I didn't know that you could choose to NOT require HELOs - what purpose would it serve?

Re:My new spam fighting techniques.

[ffsnjb]

A quick parsing of my maillog from the pat 48 shows 1,248 reject attempts, all from domains that don't reverse to a hostname and are in net-blocks assigned to China. I was getting about 3,000 messages a day, about the ratio that was being sent to /dev/null by spamassassin. Requiring the HELO has drastically cut the load on the machine due to procmail and SA not being passed garbage. I'm sure this is only a stopgap until some spammers start implementing HELO replies, as they get around every filter type eventually. But for now, it's working.

Wrong headline

[1u3hr]

The headline is "Russia, China World's Biggest Spammers". The text says "organised cirminal gangs in Russia are supplying U.S.- based spammers with details...". The SPAMMERS ARE AMERICAN. The spam is mostly from Americans, to Americans. The solution is in America. Don't fuck up the whole world's Internet because you can't work out how to stop the 100 guys in Boca Raton who send most of the spam.

PS "cirminal": Jesus, Timothy, you're actually paid to edit this?

a growing percentage is not english

[bani]

a growing percentage is korean, chinese, spanish or russian. do you really think they're targeting americans?

eh?

[bani]

how would the whole world's internet be fucked up because east european virus authors get arrested?

they are after all, writing viruses on contract to american spammers. if these criminals get arrested, how exactly is that a negative impact on the rest of the internet?

Re:eh?

[1u3hr]

how would the whole world's internet be fucked up because east european virus authors get arrested?

I was referring to the common remedy advocated of banning China/Korea/Russia, etc.

Re:eh?

[Sycraft-fu]

Well, if they don't show some common 'net deceancy, it may be the only answer. This applies to ANY ISP, regardless of national location. Take some time to do research on the fight against uu.net, a large (some would say the largest) US ISP. The long and the short of it is uu.net was quite a spammer/hacker haven and refused to do much about it. This generated a lot of backlash from groups like NANOG, and got them threteaned with large scale bans like the UDP (Usenet Death Penalty, would remove them from Usenet effectively).

Well, the same goes for ISPs in China and Russia. If they aren't willing to police their networks, they may find themselves winding up in ban lists. I mean it's not hard, and it really IS your job. If one of our computers starts up with shit it shouldn't be doing, and we don't happen to notice, we usually get an e-mail from another university or ISP. As soon as we do, the computer is off the net. Cox did the same thing. My roomate got blaster on his computer, and they shut our connection down. That's how I found out he had it, and that he wasn't patching.

So it's not a national thing, it's a responsivness thing. ISPs need to do basic things to police their own networks or at the very least, respond to complaints. Doesn't matter what country they are in.

Re:eh?

[1u3hr]

Well, if they don't show some common 'net deceancy, it may be the only answer. This applies to ANY ISP

But people are banning entire countries, not ISPs. That leaves those who live there no reason to choose a "good" ISP over a spam haven; all are discriminated against. If you're going to be punished for living in the same country as spammers you might a well get the benefit from using a service subsidised by them.

Re:eh?

[bani]

banning entire countries has become a last resort. some countries have a rather cavalier attitude toward abuse, like china. the chinese state operated national networks had an official autoresponder which responded to _all_ abuse complaints with the lie:

"In your SPAM eMail,I can't find the IP or the IP is not by my control.Please give me the correct IP.Thank you."

it's no wonder china is one of the most regularly firewalled networks. besides them being a spam haven, their _official policy_ regarding abuse is to do nothing at all, and lie about it!

so really, in china there really aren't any "good networks". they are _all_ bad.

as for banning korea etc. well, i have absolutely zero reason to receive email from anyone in korea nor do i read korean. so into the bin goes *.kr. how exactly does that hurt any koreans?

answer: it doesn't.

Re:eh?

[1u3hr]

as for banning korea etc. well, i have absolutely zero reason to receive email from anyone in korea nor do i read korean. so into the bin goes *.kr. how exactly does that hurt any koreans?

If you're filtering your personal email, use an Ouija board, whatever you like, it's your privilege. If you're adminning for a company or an ISP, it's excessive.

High Volume E-mail Deployers

[CHaN_316]

Did anyone see that awesome interview with Scott Richter (spammer overlord) on the Daily Show? It was so hilarious. He calls himself a high volume e-mail deployers that send useful services to people.

The best is when they posted Scott's e-mail address on national TV, which is: scottrichter442@yahoo.com

This site here has the video available of that Daily Show clip. Please try not to slashdot the site, maybe someone setup a mirror or something.

Re:High Volume E-mail Deployers

[Inda]

This link works and seems faster.

http://freecache.org/http://www.badmonkey.ca/files /show.wmv

Re:High Volume E-mail Deployers

[YrWrstNtmr]

I saw that too. What a turkey.

"Is it ok if we show your email address on screen?"
"I'd rather you didn't." (as scottrichter442@yahoo.com flashes several times...:)

A couple of weeks ago, the Aunty Spam blog did an interview with Scottie. Very evasive answers. I had a little back and forth dialog with him in there. (scroll about 1/2way down)
Very enlightening as to his mindset.

Re:High Volume E-mail Deployers

[CHaN_316]

I think for posting slashdot comments, we should be allowed to use tags for any spammer's e-mail address.

spam stats

[humankind]

Some analysis of my rejected mail logs over the last 24 hours revealed this:

Total rejected spam: 16235 (and 8178 accepted messages)
Confirmed Chinese spams: 1229
Confirmed Korean spam: 1414
Confirmed Canadian spam: 264
Confirmed Polish spam: 342
Confirmed US/comcast spam: 1363
Confirmed French spam: 181
Confirmed Southwest Bell spam: 382
Confirmed Italian spam: 114
Confirmed Spanish spam: 167 (TDE must have finally gotten their act together)
Confirmed German spam: 967
Confirmed Netherlands spam: 452
Confirmed Brazillian spam: 864

This is by no means a scientific analysis - it's based on hard-coded IP-based blacklists that are caught before standard blacklists are checked.

Spamcop RBL rejects: 5460
Spamhaus RBL rejects: 1509
Njabl RBL rejects: 1807
Homebrew RBL rejects: 6382

The big three spam sources have traditionally been Korea, China and Brazil. Comcast has been the big US spammer. France (wanadoo) has also been a major contributor though it doesn't seem to be reflected in this days' logs.

Re:spam stats

[phoxxy]

I have to agree. I notice most of the spam that hits my server is from Korea, China, Brazil (and to some extent Russia as well) as far as "originating" from foreign addresses. Comcast is was such a pain that I have complete blocked any email that originated from a comcast address. I have advised my users that if they want to get an email from someone they know who is a comcast user that they have them send email from another account.

It is amazaing what the catch all account and spam folders that fill up with the trash that comes in.

Part of the fire that fuels the spam problem is most users ability to understand that they add to the problem. For instance, my mother-in-law has an account on my server. Once a week I have to clean approximately 20MB of spam out of her spam folder on the server. She has this nasty habit of signing up for anythng and everything she sees online. No matter how many times I explain that "offers" she sees in a pop up ad aren't really offers at all and that everyone under the sun doesn't need her email address, she still sumbits away. She is also notoriously bad about going to sites that advertise "Email this link" or "Email this page" to a friend. Every time she does this, I can count on at least a surge in spam every time she does this by about 10 to 15 emails a day.

There needs to be a level of eduction out there for the end user to understand how they contribute to this problem. System administrators can only do so much. Anti-spam measures may be in place, but when the demand for producing such spam is high because of irresponsible use and lack of understanding of how the internet functions in how spam mail is produced, the job is always going to be difficult to keep on top of.

As a sysadmin who is tired of the user complaining about system administrators, etc aren't doing enough to block or combat spam, I say there needs to be a little bit of action and change on how a user approaches and uses the internet. I think it's everyone's responsibility.

Re:spam stats

[AShocka]

My main email address has been in use 10 years, I post everywhere with it. It gets filtered at Spamcop. I only spend a few minutes each day, often only 30 secounds, checking the emails that need confirmation, then send them through to my ISP. Everything else is blocked. I don't have problems with legit people contacting me. I get very few emails that actually end up in my mail box that are spam. I'm happy to pay an annual fee for this service. Thanks Spamcop:-)

Re:spam stats

[humankind]

I am totally with you on this.

I have found after more than ten years of administering Internet mail systems, nothing works as well as a finely-tuned IP-based blacklist.

I've also noticed that the ISPs are becoming much more focused on isolating DUL/Broadband (that shouldn't be running SMTP services) IP space, so large scale IP blocking is becoming even more effective. Ironically, they've probably isolated the non-SMTP-authorized IP space so they can do their own anti-spam control, but the added benefit is those of us who have been fine-tuning IP blacklists have ended up with very good blacklist data as well.

Yes, the occasional Linux user running SMTP from his cablemodem will get caught, but like others, rejected e-mail from my system is accompanied with a URL they can go to in order to be whitelisted, so it all works out.

All ISPs should be adopting this strategy. It's nothing short of amazing how effective IP blacklisting has now become. 95% of all spam is now being filtered by my system. No content-based filter system comes close.

doh, forgot Russia

[humankind]

Confirmed Russian spam: 1421

No.

[bani]

2) is not a solution. never will be, either.

spam is so unbelievably cheap to send, that if even ONE PERSON ON THE WHOLE FUCKING PLANET buys a spamvertised product, it's still a net profit for spammers. 1 million emails? 100 million? 4 billion? it's all the same to spammers.

they won't stop spamming until the people buying via spam is a big fat ZERO. the less that people read and buy from spam, the more spam they will send in order to maintain status quo.

Re:Solution?

[Daedius]

someone has been watching starship troopers too much.

And don't forget...

[Tuxedo Jack]

CoolWebSearch is based in Russia. They're the group of people who pay their affiliates to hijack people's PCs and change their search settings and install trojans?

Yeah, thought so.

There is a fundamental problem with email

[Daedius]

People want an open public form of communication, but are unwilling to accept email from people they don't want to hear. I think its interesting that people expect others (i.e. government) to go after these individuals in the hopes that it will put an end to all unwanted email (especially when the individuals are in other countries). If you sat down in the middle of times square, do you think its fair to expect people to stop yelling, the cars to stop honking, cellphones to stop beeping, or the people to stop shuffling past you? The truth is, you will always get unwanted email if you aren't going to actively manage what email gets to you. Do you ever get SPAM from IM? No. The reason why is because you have actually personally networked who you want to talk to and eliminated all others. I believe the future of email communication will be based around a networked process of individual/group permissions. Till that day, people are going to be lazy, unhappy, and wishing for something impossible -- that SPAM will end if they do nothing.

Re:There is a fundamental problem with email

[radja]

it's not about individuals we dont want to hear. it's about artificial entities we dont want to hear. people merely want what they also have in the offline world: commercial messages should be regulated. ads on tv are regulated. ads in newspapers are regulated. bulk snailmail is regulated.

be aware that commercial messages by companies do not fall under freedom of speech (or at least not in my country. freedom of speech is only for people.)

Re:There is a fundamental problem with email

[Idarubicin]

People want an open public form of communication, but are unwilling to accept email from people they don't want to hear. I think its interesting that people expect others (i.e. government) to go after these individuals in the hopes that it will put an end to all unwanted email (especially when the individuals are in other countries).

People want an open public form of communcation, but are unwilling to accept telephone calls from people that they don't want to hear. I think it's interesting that people expect others (i.e. government) to go after these individuals in the hope that it will put an end to all unwated telephone calls...

Regulating such calls would be untenable. Legislating an end to telemarketing calls entirely--that would be totally unreasonable. Right.

There are also laws regarding junk faxes and restrictions on junk snail mail. Having the government regulate advertising in telecommunications is not exactly a new concept. It it unreasonable that people expect them to step in for email as well?

Re:There is a fundamental problem with email

[bluGill]

I don't mind communication from people I've never met before. I welcome it, so long as the person sending the mail has good reason to believe I'm the right person to contact. I'll help your trace my branch of the family tree for instance, if you need it. I don't even mind getting sales announcements from local stores.

However after filters I still get 30 emails a day, that I can't read at all (I don't know hat language uses that character set but I don't read it), is fraudulent, is illegal, or is offensive. (Not just porn, I've also got some that advocating KKK type positions though porn is the most common)

In essence, the unwanted communication is taking up a large part of my inbox.

Re:Solution?

[Nogami_Saeko]

To the Anonymous Poster:

I suppose I should clarify a bit because you don't seem to understand how the system works...

The classification errors are on the side of a spam getting through, not real messages being tagged as spam.

So out of the "1650" email messages per day that you get, it "might" misclassify 12 or 13 spam messages as real messages based on my accuracy rating. With that volume of email however, the corpus will build that much faster and become even more accurate.

Spam filters aren't the best long-term solution to solve the problem, but they're a damn fine short-term solution until something better is worked out. Spam has ceased to be a problem for me thanks to POPFile.

You may be abnormal in your email volume and perhaps that sort of filtering may not be quite as effective for your peculiar circumstances, however you are the exception to the rule.

N.

Reply to your business proposal.

[Dimensio]

Dear Dr. Bokuzuwandi,

Your prosal intrigues me, as I am always seeking to expand my business to new countries whenever possible. You must understand, however, that I cannot simply blindly enter into deals with people who I have never met. As such, I will require a sign of TRUST from you, in the form of photograph identification. Please understand that I will not be able to accept normal government ID cards or an international passport for this endeavour, as such things are easily forged. Instead,I shall give to you a password phrase, and you must have a photograph of yourself holding up a large and clear sign that displays this password phrase. Scan this photograph in and email it to me as an attachment. When I have received it, I will be 100% ready to trust you with your business proposal.

I do apologize, but until I receive this form of identification from you, I will not be able to provide you with any further information about myself.

The password phrase is "I LOVE ARSE FORKING"

Yours Very Truly,
Pastor Phil McCracken

(Hey, it worked before!)

Now if only I could find a way to similarly humiliate the spammers who advertise pirated software or penis pills...

China ? But I thought...

[Professeur Shadoko]

that the internet was VERY controlled in China.
How can this happen then ?
Does it mean that this activity is accepted by their authorities ?

Re:China ? But I thought...

[DrDebug]

Although China is (slowly) moving to a capitalist mode of economy (they haven't abolished it in Hong Kong yet, have they?) they still fear the idea of independent thought. E-mail is a way for people to express different and radical thoughts. Since spam clogs up the e-mail channel, perhaps the government-run ISPs encourage spam as a way to discourage people from reading e-mail. Just a thought....

Second thought, while I'm at it -- perhaps China allows ISPs to encourage Spam as a snub to the USA and the free world in general. What a better way to show disrespect of our law than to openly ignore it and encourage Spammers.

Third thought!! -- Their ISP administrators are just as lazy and careless as ours. Yeah, that's the ticket!

"click here" domains

[KalvinB]

I filter based on those.

Current List of Domains

At the time of this posting it's at 2209 domains. In a day or so it should go up several dozen when I do an update.

It's the only thing in a spam that can't be obfuscated or it simply won't work. At best they can do one to one character codes. Occasionally a spammer will try to be clever and request the user copy and paste the link into their browser. I tend to catch those when I examine what got through but the pay off from those is probably so low that the spammer goes back to links. It's hard enough to get someone to click.

The other advantages of blocking based on click-me domains is that the header is irrelavent (it doesn't matter where it came from) and that it's the only thing that costs the spammer real money. And it's the only thing guarenteed not to be in a legitimate e-mail ever.

I've gotten several occuraces of dictionary words inbetween the same obvious spam domain entry. It's quite simple to see which are the filler to fool fully automated anti-spam systems and which are the real links.

The long and shot of it is that if you can use it, so can spammers. Charging thousands for a .mail domain is just dense and turns e-mail into a commodity controlled by big business instead of what is basically seen as something for everyone.

You have to deal with spam within the rules that spammers set. You can't invent rules and then pretend spammers are going to follow them. After an update it takes a few days for the spam to pick up again. If major players would stop worrying about where spam was coming from and start dealing with where it's pointing to, this problem would be a lot more managable.

I've started sending my hotmail spam off to my mail server to help build the filter. It'd be nice if other people were building reliable lists so that I could premptively filter more domains. Nobody really takes it seriously though. They'd rather blacklist countries since it's "easy."

Ben

Re:"click here" domains

[CleverFox]

This is being done already on a large scale:

http://www.surbl.org/

Obligatory

[Hew]

1. In Soviet Russia
2. ...
3. Profit!

A war on spam

[n0dez]

What is the best way to stop this?
Trying to rally skeptics on both sides of the Atlantic, President Bush said Saturday that the war on spam is the "challenge of our time" and insisted that bitter disputes among U.S. allies over the war on spammers were dissolving.

Oh get off it

[Sycraft-fu]

This is simply presenting more of the story. SPAM is an international enterprise. Most of the instigators are here in the US, as are most of the compramised computers. However it sounds like from this and other articles is that much of the hacking work is being done by criminal syndicates (huge shock there) and that most of the websites the spammers are setting up are in China.

This does NOT mean that the domestic spammers are being ignored. One has already been convicted, Microsoft and Time Warner are suing a bunch more, and the justice department says it is prepping 50 criminal cases under teh new SPAM law. This was all announced on /., if you bothered to read it.

Quit with the anti-American bullshit. Yep, the problem is here. We know, we finally have a law for it, though not as strong as we'd like, and the wheels are in motion. Doesn't mean that the US is solely responsible. I do not at all think it is unreasonable that Chinese hosts should show the same standards demanded of US hosts in not hosting SPAM sites.

Re:US biggest Spammer!!!!!!!!

[palutz]

"70 percent of spam is sent from China by American spam outfits" The same scheme over and over again! Stick your homophobia somewhere and keep to the facts.

-- Its those damn gay russians spammers again. Luckily your average persons xenophobia takes care of the straight spammers as well.

When will they learn?

[ThatsNotFunny]

The Spamhaus Project has warned that organised cirminal gangs in Russia

When will they learn... Cirm doesn't pay...

Re:When will they learn?

[jnicholson]

That's spelled 'cirme'. Honestly, the younger generation these days...

Wait, what?

[Twon]

Wasn't there an article here a few days ago that said 90% of spam was getting send through compromised zombies? Are most of them colocated in China?

Re:Wait, what?

[adzoox]

Ha - I thought the same thing when I read the article. Tomorrow there will be an article about 90% of SPAM comes from get rich quick from your one bedroom apartment MLM schemes. (Which is where I think a significant portion comes from)

My theory is that that it is essentially an assault on the home user by marketting companies who (starting in 2000) scrambled due to mail costs going up and junk mail being investigated criminally more often. The National Do Not Call List also had a huge impact.

Now, telemarketers and the like (scum) have turned to hiring "at home" spammers. I know someone (read not liked) that worked for Opt In Real Big - he gave them 200,000 email addresses a month and made $1500 a month spamming his OWN customers from his OWN web site sales.

Realistically I would say all major sources of SPAM are 20%:

Viral SPAM
China
Direct marketting
Hacking/Phishing/Piracy
Everything else

ok..

[TheHawke]

Since it seems that foreign ISP's are in league with organized crime, then i'd say that this is a threat to national security. Therefore, I recommend that all TLD providers remove all references of the suspect ISPs from their databases, including blocklisting their POPs and SMTPs.

It'll be a double-edged sword, I know, but in this matter, it'l hurt them more than the rest of the world. Boycott and Blacklist all *.ru and *.cn servers until this matter has been settled.

Re:ok..

[cpghost]

If you want effective control, DNS blacklisting is not enough. If OTOH the NANOG operators configured their routers to block all IP-based traffic from these countries, legislation over there would change in a blink of an eye!

Shitty Russian mob

[Anonymous Coward]

Dmitri: So Vladimir, whatever area do you specialize in these days?
Vladimir: Smuggling, my friend. Vodka, narcotics, humans... If it can be smuggled, chances are I smuggled it some time...
Dmitri: Sounds good, how about you, Ivan?
Ivan: Weapons trade, of course. Got a few good high-up friends in the Red Army that are willing to relinquish some surplus material to me at a good price, which I sell in Africa and the Middle East.
Dmitri: Good to hear you two are making a nice profit.
Vladimir: How about yourself?
Dmitri: I rent out hundreds of cracked computers to US based companies.
Ivan: ...
Vladimir: Dmitri, you suck.

Re:Shitty Russian mob

[irokie]

in soviet russia, spam gets you!

how come no one made this joke yet?

Profiling

[actu]

A quick profiling of the underground eco-system (who tries to hide behind DDoS attacks and SPAM):
PPT
PDF

I guess I'm alone...

[Toadpipe]

...in the fact that I don't get spam, I don't use filters and I don't give out my email address. Oddly enough I don't get spam, that's right, none.

I find people's fixation on digital junk mail disturbing. What about laws to stop real junk mail? You know, that stuff that fills your "real" mailbox? That's a far larger problem. After all, you can just delete spam, how do you delete 17lbs of paper?

Re:I guess I'm alone...

[SoTuA]

how do you delete 17lbs of paper?

You recycle it, of course.

BTW, you can't get fraudulent snail mail. Ok, you can, but there's a law against it. And the people who sent the 17lbs of paper paid to send it. When you get spam, you paid for the bandwidth to download it.

Re:I guess I'm alone...

[Steve B]

What about laws to stop real junk mail? You know, that stuff that fills your "real" mailbox? That's a far larger problem.

No, it isn't.

Paper mail advertisements do not, and will not in the future, threaten to make the postal system useless for personal communication. E-mail spam does threaten to destroy the usefulness of e-mail. The fundamental difference is that the former is a legitimate purchase of a service (the advertiser pays the postage) and the latter is a theft of service (the spammer uses trivial amounts of his own bandwidth to inject spam into the system, after which it is circulated using other people's resources).

I'll give you the benefit of the doubt and assume that your comments reflect ignorance and failure to think through the issue, rather than being a spammer-apologist troll. (Because this exact argument is so often offered by known spammers and trolls, you will no doubt be accused of being one of them.)

Re:I guess I'm alone...

[Toadpipe]

You mean to tell me that all this time people defining "spam" as "unsolicited email" (in other words, unwanted) were wrong? Wow. Shocked. As for your recycling comment, in my area they charge us by the pound to recycle, the average monthly bill is around $80. We'll add the glossy non-recycle paper that most of it is comprised of to the trash bill since the recycling boys refuse to take it, $50 a month. Now, compared to the zero spam I recieve via my $11 per month dsl, which one do you think you'd be more concerned over? Which one do I care more about "paying for"?

Re:I guess I'm alone...

[Toadpipe]

No, I have thought through the issue, and as my original post stated since I don't ever recieve spam, I don't even begin to concider it a problem. I've had the same email for 5 years, still useful, not threatened. So no, I don't care if you think me a troll, so long as you realize I don't concider your whining to indicate a problem. Because that's all I see, people whining. I see no spam in my inbox.

Re:I guess I'm alone...

[jnicholson]

Then yes, you are alone. The rest of us see a problem, and feel free to complain about it. That's why we're in the thread.

The fact that you don't suffer from a problem doesn't make those who do whiners.

Re:I guess I'm alone...

[jnicholson]

Can't you mark it RTS and dump it in a mailbox? Or complain to the people who sent it (who are readily identifiable)? Or put a 'no fliers' sign on your mailbox?

Re:I guess I'm alone...

[SoTuA]

You mean to tell me that all this time people defining "spam" as "unsolicited email" were wrong?

Please tell me where I said that spam was not unwanted email.

As for your recycling woes, :(. Doesn't happen that way around these parts, but the other way around. (256/128kbps DSL is about, say, US$38/month, but people will take recycling paper out of your garbage!)

Obligatory

[Man of E]

In Soviet Russia, the spammer IS YOU!

Re:Conflicting stories - No, try RTFA!

[Mostly PO'd]

From the second sentence of the article:

"Steve Linford, director of The Spamhaus Project, warned on Tuesday that these gangs are supplying US-based spammers with details of compromised PCs that can be used to send out their unsolicited commercial messages, and creating viruses that will create more of these open proxies. "

In other words, this is the source of most of the zombie PCs referenced by the other slashdot article here.

A simple Question...

[Lord_Pain]

Why are we not punishing the fools who hire these spamming bastages to promote their business?

After all if the source of the spammers income dwindles then they wither. Perhaps I'm being overly simplistic.

Korea

[Anonymous Coward]

I don't know about the rest of you, but I have noticed most of my spam (over 50%) is coming from Korea.

I've actually taken to the process of filtering entire Korean IP ranges. While time consuming, within a week I have cut my spam in half. I'm also no longer getting unreadable asian charsets.

Anybody know where someone might obtain a list of IP ranges as assigned by country?

I could give a flying fork about asisn users. I have no need to recieve email from that part of the world anyway, so for me, the best solution is to just block off that part of the world.

No skin off my back.

Gene Therapy

[Seanasy]

Has anyone tried, even proof on concept, to create a virus or worm that innoculates zombies?

growing != most

[autopr0n]

The article said 70% was from america. You understand the diffrence between "growing" and "big" don't you?

RICO the spammers, spam businesses & suppliers

[swb]

It's becoming clear that spam isn't just low-rent MLMers using disposable AOL accounts to sell their crap, spam is about organized crime and the tool we need to use against it are the RICO laws designed to fight organized crime.

First of all, start with the assumption that most spamvertized businesses are either outright frauds or otherwise participating in something illegal (ie, controlled substances without a legitimate prescription). I don't think that most people would challenge this hypothesis.

Since the primary economic activity and the secondary activity (spamming) is illegal, we can then presume that the entire enterprise represents racketeering, and anyone knowingly participating in it is also guilty of racketeering. It's viral, like the GPL. ;-)

My guess is that the spamvertised businesses and the spammers have ties with legitimate businesses (banks or ISPs), some of whom are aware of their activity and go along with it either for personal or corporate profit.

If a big enough operation could be captured under a single RICO net, get sucessfully prosecuted and do hard time it could have excellent benefits in controlling spam. The negative PR that would affect otherwise legitimate businesses (banks, ISPs) might make them far more careful who they do business with, rejecting existing spammers and spamvertised businesses, and I have a hard time believing that spamming and running a spamvertised business is something you can do without ties to the real world. Spammers and spamvertised businesses may just decide that facing federal prosecution and working much harder for resources isn't worth the risk, especially if it means criminal penalties ending in a trip to a PMITA prison.

..and speaking of headlines

[kent_eh]

The text says "organised cirminal gangs in Russia are supplying U.S.- based spammers with details..."

I know I'm repeating myself, but, we have to make sure that headline appears in the "mainstream" media, not just in places that only us geeks look.

Joe 6 pack needs to be routinely reminded that "spammers=criminals", and "buying from spammers=giving money to the Russian Maffia".

I think those of us who are familliar with the problem, need to take the initiative to contact our local media and help them understand what's going on. Lay it out for them: virusses -> zombie PCs -> mail relays -> spam -> criminal gangs.
And then repeat to make sure they get it: "Aunt matilda's computer is being used to make Big Money for the russian maffia.", and "buying from spammers finances the creation of more virusses".

The fewer people who buy from spammers, the less spammers can afford to stay in business. Shout it from the rooftops.

Spellcheck

[PhraudulentOne]

An anonymous reader writes "According to this ZDNet article, The Spamhaus Project has warned that organised cirminal gangs in Russia are supplying U.S.-based spammers with details of compromised PCs that can be manipulated to send junk mail. According to Spamhaus director Steve Linford, the Russian gangs aren't constrained by any anti-spam or cybercrime laws in their home country and have no respect for legislation implemented in other countries. Also, apparently 70 percent of spam is sent from China by American spam outfits who in turn have hosting arrangements with Chinese ISPs."

Its Criminal, not Cirminal

I completely disagree

[Ummagumma]

I just installed an anti-spam appliance yesterday. So far, over 80% of the Spam that is blocked has come from DSL and Cable lines, presumably from compromised machines.

MOD PARENT UP

[Lost Engineer]

Another way of saying this is we should not let politicians accept corporate campaign donations. I mean isn't a senator taking money from the corps. he's supposed to be regulating just the same as a judge taking money from a defendant? What possible further good could come from allowing this practice except the further dumbing down of the American people through incessant political advertising? Alternately we could just teach people to vote with their brains instead of based on what they heard on CNN. Right... like that'll ever happen.

I can't believe it!

[justkarl]

An article about real russians and nobody takes a cheap "Soviet Russia" joke? This is history in the making!

Why I Am Not Surprised

[$criptah]

As somebody who lived on the territory of the former USSR, I am not surprised that the majority of spam arrives from Russia and that kiddie pr0n sex rings are linked to companies in Belarus. Why does that happen? Well, compared to the United States those countries have virtually zero law enforcement and high levels of corruption.

Even with Vladimir Putin, Russia still lags behind in terms of law enforcement when it comes to protecting human rights, technology, women, children, etc. When I traveled across the republicts of the former USSR I was surprised by the amount of counter-theft goods that one could get through local flea markets. You can get CDs full of the latest software, like 3D Studio Max, for $2-3USD. If you get a several CDs, you get a discount. When you pop one of those puppies in your drive and read the instructions, they'll say "Please run a program called crack.exe in order to activate the product." Activation my ass. The same applies to DVDs, and brand-name products.

According to my friend who travelled to China, that country is pretty much in the same spot. Yes, they are good at banning people from accessing forbidden sites. Yet at the same time you can to to a street market and purchase a fake "NorthFace" jacket for $20USD or less; In the states you'd pay up to ten times as much. Then there are corrupt politicians and cops who can close their eyes provided that you pay them a certain amount of money. With that in mind, it is not a surprise that China and Russia lead in spam.

There is a lack of sync between technology and the laws that govern it in the countries that are not, well, *that developed* yet.

Good Corrections. Wearden needs to think more.

[twitter]

I'm glad Linford stepped up to the plate, though his corrections are mild. ZDnet's article spun the facts to protect Microsoft. Changing the sending location from Zombies to China fits the reporter's goals, but it was not what Linford said and he should resent having the words put into his mouth.

I doubt that Linford himself would say something as stupid as "Russia and China 'behind current spam deluge' when Americans advertisers are paying for it and 80% of it originates on computers running a broken US OS. I also doubt that Linford would blame the Russian or Chinese governments for the actions of organized crime in their country.

Graeme Wearden should do some more research and think. There's a real story here and the pieces are being put together. Where is the spam really coming from? Follow them money. Does anyone really buy penis enlargers, diplomas and drugs from spam? What companies have recently announced profitable new email schemes that depend on the death of normal email? Could large ISPs run by unethical companies, that have a proven record of breaking competitor's service, be trying to break competing ISP's email service by deluging their customers with spam and then advertising spam blocking email of their own? Russian and Chinese criminals seem sensational, but the truth is always much more interesting.

Columbian cartels

[fejikso]

...with the Columbian cartels to get extra funding, ...

Columbian: relating to the United States or Christopher Colombus.
Colombian: relative to Colombia, a republic in northwestern South America.

Re:Columbian cartels

[marsu_k]

Wasn't sure about the spelling and didn't bother to look it up. Thanks. This is, after all, the place where spelling does indeed matter and is always perfect. (not to mention that English isn't my mother tongue, voimme jatkaa tätä keskustelua suomeksikin jos tuntuu paremmalta :P)

ISPs are a major part of the problem

[Skapare]

ISPs are a major part of the problem. They either know, or can know, that they have spammers and other criminals on board. Yet many do nothing about this because they would rather have the money spammers pay them. We need to stop peering with bad ISPs in every way we can.

Those who whine about their mail not getting through because they are using one of these bad ISPs are also part of the problem. They need to stop encouraging their ISP to continue, and force the ISP to decide between good and evil. If there's another ISP, switch. If there's only one and it's because the government gives them a monopoly, then the government is the problem and they need to fix that. If there's only one and it's not a monopoly, then they need to start their own ISP (and not allow spammers, lest they also be cast into the deep pink cyber oblivion).

Why laws and fines against the advertisers fail...

[NitroWolf]

Ok... lets say we "go after the advertisers and throw them in jail or fine them millions of dollars" for sending spam.

Great, and lets say that stops spam 100%.

Now... I'm pissed off at you. I forge a fake advertisement for a product, or better yet, I know you sell a certain product, so I craft a legitimate advertisement for that product without your knowledge.

Now I spam it out to billions of addresses and wait for the feds to come in and ruin your life. Oh sure, you'll claim that you didn't send the spam, but we're already on the warpath, and you're about to be steamrolled. Who's going to believe you didn't send that spam? Who's going to believe someone illegitimately created an advertisement and sent it out for free! Yeah right... off to jail for you!

That's why the government doesn't go after the advertisers... because it can be forged and used as a weapon against your competition or against people you aren't happy with. How do you prevent this?

Currently, you don't... the only solution in the long term is going to be to revamp email to make the senders accountable. Period. End of story. No other solution is going to work.

Certainly not more laws.

The solution is simple

[cjsnell]

It's not hard at all to block these cable/DSL/dialup hosts from sending you mail. Here's what I use:

1) A filter that looks for hostname patterns that look like consumer internet connections (DSL/cable/dialup):

[note: these are in Exim lookup-table syntax]

\N^(dsl|cable|adsl|dialup|docsis|pool|ppp|client |c lient2).*$\N
\N^.*\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3} .*$\N
\N^c\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\..*$ \N
\N^[sShH]\d{3,}.*\.[a-z][a-z]\.shawcable.net$\ N
\N^.*\d+\.charter-stl.*$\N

2) Next, you block known spam-source countries. Some may take offense to this but the company I work for only sells products to people in the US, so these filters aren't a problem. To accomplish this, I set up djb's rbldns server on one of my machines. Currently, I'm blocking netblocks from Brazil, China, Korea, Malaysia, Nigeria, Russia, Singapore, Taiwan, Thailand, and Turkey. These netblocks come courtesy of blackholes.us.

3) Anything that is not caught by those first two local options is run against the DNSBL list at SORBS. We choose to use their combined blackhole list but you could just as easily go with their anti-dialup/dsl/cable IP list.


If an e-mail makes it through all of that, it gets run through SpamAssassin and blackholed if the score is >= 7.0 and marked if the score is >= 4.0.
We're also doing a bit of tarpitting. Every time we get a connection from a blacklisted IP, we tarpit them for two minutes before spitting out a 550 error code.

Despite this, we still get some spam and dictionary attacks. The spam gets filtered by the client and the dictionary guesses are blackholed by the local delivery server, which is configured not to send bounces.

Chris

Re:The solution is simple

[hearingaid]

I really hate it when people indiscriminately block dialup IP mailservers. I hate it because I have one :)

But seriously, how much spam really comes from dialup mailservers? I mean, compared to places like university computer labs and the like. Not that many people run MTAs, compromised or otherwise, on their home machines. Whereas, if a spammer sneaks/breaks into a university lab (which as we all know are absolute paragons of security), it can install a whole bunch of MTAs on the machines and pump far more messages using the university's fibre backbone than it ever could off of a home broadband server (which usually have pretty small upstream bandwidth caps).

Also. Shouldn't the proper response to a blackholed IP address be to not pick up the phone when a call is made to port 25? I.E., just let them time you out, and cut the connection at the router level? You waste far fewer cycles that way, and also your SMTP server, SpamAssassin, etc. don't have to write anything in their logs.

Re:The solution is simple

[cjsnell]

You would not believe the amount of spam that comes from dialups. This spam is the result of home machines that have been comprimised by worms and exploited by spammers to send mass amounts of mail. For the most part, these dialup machines do not send mail to some previously collected list of addresses--instead, they use dictionary words and common names in an attempt to guess recipient accounts. They send these mails by the hundreds of thousands. My mail servers get, literally, 1-4 connections per second from dialup hosts. When they are allowed to connect and deliver, they can drop several hundred e-mails on my server in a matter of 30 seconds or so; almost every one of these e-mails will be bounced because the recipient does not exist on my system.

We are not alone in blocking dialups. Try and connect to AOL's MXes from your dialup mail server and see what you get.

Chris

Re:The solution is simple

[hearingaid]

Oh, I know.

I miss the old days, when I was in university, and my university was a DSL provider. Back then, I could connect to everybody, because my IP was listed as a university IP. Now I have to hack my way around.

But it can be done. It just shouldn't have to be. Log the evil IPs, and disconnect them. (My mailserver is also an MX of its own; I get plenty of connections from spammers. Most are not dialup, but are compromised institutional servers.)

Several hundred emails in 30 seconds? That's not a 56K modem connection. It just isn't possible. It's almost certainly a fibre connection of some kind, and probably not DSL; most DSL connection's upstreams peak out around 128Kbps. Most cablemodems peak out around 64Kbps for upstream. If you're getting several hundred emails in 30 seconds, then you must be getting tens of thousands of connections.

Re:The solution is simple

[cjsnell]

Several hundred emails in 30 seconds? That's not a 56K modem connection. It just isn't possible. It's almost certainly a fibre connection of some kind, and probably not DSL; most DSL connection's upstreams peak out around 128Kbps. Most cablemodems peak out around 64Kbps for upstream. If you're getting several hundred emails in 30 seconds, then you must be getting tens of thousands of connections

Nope. It's really easy to deliver several hundred identical messages in that span of time. All you have to do is specify the addresses during SMTP time (RCPT TO:). MTAs are capable of batching messages. To see what I mean, send an e-mail from Yahoo or elsewhere to five addresses at your local domain. Watch the mail server logs. All five messages will be delivered during the same SMTP connection. The message body only needs to be sent once. The sending MTA tells your mailer to deliver this same message to all five recipients.

Re:The solution is simple

[hearingaid]

Er, how big's your domain, then?

It sounds rather as though you're running a domain with tens or hundreds of thousands of email addresses off of a single MX server. Which seems unlikely :)

There will always be spam

[moofdaddy]

Spam is an inevitable by product of having a virtually free message delivery system.

As far as I can tell, this is the first time in the history of the world that a company, legit or not, could advertise their products and services for free. Every other method costs a hell of a lot more money and doesn't reach nearly the same audience. Be it paid tv advertising, direct mail, etc.

As long as email is free to send, boxes will always be full of spam. Spam will be the end of email, the problem is only getting worse, with no real hope in sight.

GWB reply

[kilimangaro]

They are the axies of evil !!! Lets nuke'm

But Dean hired a big spammer -

[watermodem]

Dean turned all the political scum on to spamming so it will be that much harder to be rid of.

At political parties and individual pols to your spammer service list.

Anti-American bullshit

[Infonaut]

Quit with the anti-American bullshit. Yep, the problem is here.

Whoa, sorry for pointing out that demand for spamming services is coming from inside the United States.

I simply intended to point out that while we're busy pointing the finger at Russia and China, the demand is being drummed up here in the States. The Russian and Chinese criminal organizations that deliver spam should be stopped, no question about it. But as an American, I think it's appropriate to bring up the fact that we can still do more to stop spam here in America.

I'm not sure how that makes me anti-American, but given the current domestic political climate I guess everyone is suspect.

Re:Anti-American bullshit

[Sycraft-fu]

It is the way you said it, and what speicifcly literally you wrote. Your intended enriched meaning may heave been a simple statement of fact, but the literal words you used to deliver that message gave a clear message of bias. They implied that the US was blaming the problem of SPAM on other countries when that is quite clearly NOT the case. The US DOJ is prosecuing the sources here. This article simply shows that most of the facilitation is non-US in origin.

If you want to point out a fact and nothing more, do so with neutral, direct speech as I'm doing here. They way you wrote your post is highly likely to be interpreted as having a slanted message.

Yes, but...

[Slinky Saves the Wor]

Who gives a hell where it comes from?

Isn't it the BUYERS who buy all that stuff advertised in spam we should be worried about? They are the ones who make it worthwhile. They are the ones which cause spam to be sent, and they are the ones for which all of us have to suffer in the form of bandwidth wasted for nothing.

Judging from my limited incoming spam experiences, I feel USA might contain most if not all of the buyers. Some people I know get French spam, and spam in other languages, but that's a very small minority.

And if you check out those domains to where the URL inside the spam points to, and do some digging, you end up with some Hicksville, USA company.

Why would anyone buy anything from a spammer, that's something I can't understand.

Re:Yes, but...

[jnicholson]

It might not be the buyers. Advertisers don't know for a fact that their advertisements have an effect on sales; they're usually making educated guesses.

Have you every filled in one of those "how did you hear about us" customer response forms? Do you see a "by badly-spelled unsolicited email" on there?

I would love to know whether it's really effective, or the marketing departments are just wasting their money on crooks.

Re:Yes, but...

[Slinky Saves the Wor]

Most (well, almost all meaning practically every single) spam advertises companies of dubious nature. Companies I've never heard of, or companies I never want to hear from.

I've never received spam from any of the biggest or well-known companies. I don't think anyone has, but this is a subjective opinion.

If so, I think it concludes that spam is ineffective as a marketing tool. If it had any positive net effect, I'm sure a bunch of Fortune 500 companies would be using it already.

Not to mention they'd have hammered through some spam-happy law in the US Congress.

Why does it say "china and russia"

[jfdawes]

Why is the article titled "China and Russia 'behind current spam deluge' when they are just the ISPs? It's Americans paying for it, so they are behind it.

Of course, the lack of respect for US spam policy does not help the situation - but this is not surprising, given that the unstated rule of almost all American policy is "If you have enough money you can get away with whatever you like". (Note that this isn't "If you give me enough ..." you just have to have it)

Selling junk to idiots, America's number one industry.

150% of all spam comes from...

[kwiqsilver]

From this article:
apparently 70 percent of spam is sent from China by American spam outfits.

From this article:
Infected Windows PCs Now Source Of 80% Of Spam.

That explains why we're getting so much spam. The current level of spam is at least 150% of the current level of spam. Why am I reminded of a quote from The Simpsons?

Insightful? LOL!

[mangu]

Leave it to /. mods to give (Score:5, Insightful) to a post that deserves (Score:10, Funny)...

Cyber warfare anyone?

[Cow007]

We should launch a major DOS attack! We are at defcon 1 here!!! (just kidding)

There's only one problem I can see.

[hearingaid]

It's that email by its nature lends itself well to fraud schemes. For example:

1. Competitor A and Competitor B both sell low-interest mortgages.
2. Competitor A is better at identifying good risks than Competitor B, and gets fewer defaults.
3. Competitor B notices that the U.S. Congress has passed a law against spamming, which allows the FBI to imprison people whose services are advertised using UCE.
4. Competitor B says "Aha!" and hires Evil Taiwan Spammer, Inc. to advertise Competitor A's services.
5. Competitor A is thrown in jail.
6. Competitor B gets a monopoly, and profits.

Nah. Technological solutions are best. What I'd like to see is PGP/GnuPG signing of all emails. If emails were signed, then we could filter out all non-signed emails, and that would pretty much be the end of spam. To this end, I think the listserver community should really investigate linking majordomo or something to gnupg, so this policy could be implemented without giving up listservs.

Re:Korea Try http://www.blackholes.us for IP lists

[iamcf13]

Try http://www.blackholes.us

They have lists of IP ranges assigned by country and ISP.

A simple idea to curtail *LOTS* of spam....

[iamcf13]

For outgoing SMTP connections to send email:

1) POP-BEFORE-SMTP and/or
2) Route ALL port 25 traffic through the ISP's mailserver.

For incoming SMTP connections to receive email:

ONLY ACCEPT CONNECTIONS FROM FELLOW DNS-IP-VERIFIED SMTP SERVERS. NO EXCEPTIONS!

Alas, as long as hosts continue use 'hidden mailservers' that are not officially on file with a DNS lookup, spam will continue to plague the Internet.

In a perfect world, directly delivering email to the recipient's mailserver should only be done by a fellow mailserver offically on file with the DNS system. When a 'non-mailserver' IP does this, the practice screams spam....

Chinese ISP's getting USA spammer's business!!!

[epistemology]

More damn outsourcing. US spammer's have kids to feed, too.