Slashdot Mirror
Russia, China World's Biggest Spammers
An anonymous reader writes "According to this ZDNet article, The Spamhaus Project has warned that organised cirminal gangs in Russia are supplying U.S.-based spammers with details of compromised PCs that can be manipulated to send junk mail. According to Spamhaus director Steve Linford, the Russian gangs aren't constrained by any anti-spam or cybercrime laws in their home country and have no respect for legislation implemented in other countries. Also, apparently 70 percent of spam is sent from China by American spam outfits who in turn have hosting arrangements with Chinese ISPs."
User end filters are a necessity these days, and even then, I still spend at least 15 min each day dealing with the spam. My personal box - No One else knows the address, it is for my own internal network purposes, is chock full of the stuff.
What do other slashdot'ers do? What can we hope to see in the near future?
Physics is nothing like religion. If it was, we'd have an easier time trying to raise money!
If 70% 70 percent of spam is sent from China by American spam outfits, wouldn't that make the US the biggest spammer?
-- SYS 64738 --
Evil Russian spammers! Chinese spammers want to take down America!
And yet, in both cases there is plenty of demand from within the States. If it ain't rich kids experimenting, it's poor kids escaping with drugs from South America or Asia. If it's not a "bulk emailer" in California, it's a "clever marketer" in Florida sending millions of unsolicited email via servers in Russia or China.
Read the EFF's Fair Use FAQ
to see them embrace captialism so readily
we should be proud!
back in the day we didnt have no old school
That title is wrong.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Russia for mafia controlled zombies
China for high quality spam warez
Africa for business relations about that recently deceased relative.
GOT IT!
-Grump
Is it true that more people vote for the winner of American Idol, than vote for the president? -Ali G.
Headline should read, US Spammers using services of Chinese ISPs, Russian mob. The Spam originates here, and ends up here. The vast majority of Spam is in English, and targeting an American audience.
autopr0n is like, down and stuff.
President Bush just outlawed China forever. We start bombing in five minutes.
Seems like every day we have a story about such-and-such is the biggest cause of spam. In fact, I bet we've accounted for at least 400% of spam with all these stories combined.
If these trends continue, I'm afraid that one day soon I'll check slashdot and find out that 97% of all spam is coming from my IP.
It's interesting how the Russian Mafia is helping American Marketers take advantage of Chinese Equipment. My question is: How involved are the actual Chinese people? Are they all victims of circumstance, or are they helping in some way?
Really? That contradicts this story posted just two days ago:
The Register is reporting a study by Sandvine.com that blames Microsoft Zombies for 80% of all spam.
So which is it, then?
A simple solution to offshore spam would be to give users the ability to filter the originating mail server by allowed countries. The vast majority of my messages come from Canada and the USA, followed by a small number from Europe and South America. If I could tell my mail server to reject all but mail from my "usual" countries, I could avoid the Chinese mail bombs and bizarro unicode virus messages. The biggest prob I can see with this is offshoring - I recently started to get mail from an offshored IT unit belonging to Shell in Malaysia. That one I would have probably blocked accidentally.
Dear Sir,
It is common known that Russia and China are the source for White and Chinese mail-order brides. However their population has not the African type to satisfy your cravings. Therefore I and my colleagues who have the contact you for V aig r a already have prepared a business venture in which you can test your new supply. For only a small investment we will connect you to the premium provider of African mail-order operating out of our Locations in Congo, Liberia, and Somalia. Please reply post haste with your reply.
Sincerely yours,
DOCTOR M. BOKUZUWANDI
There was just an article on how it was infected windows PCs.... and I remember everyone assuming that it was PCs here, so are we talking about Windows in China, now? How do you plan on education in that case?
If 70% 70 percent of spam is sent from China by American spam outfits, wouldn't that make the US the biggest spammer?
That's exactly what it is, only we in the U.S. like to outsource everything we possibly can--tech support, call centers, software development--and that now includes everyone's favorite e-mail marketing substance, SPAM.
Outsource! It's the trendy thing to do!
or 1. people could just stop being assholes.
or 2. people could just stop reading it and buying the junk.
i would rather my first solution happens, because as a side effect there wouldnt be any more assholes. number two wont happen, because sometimes you just want to see if it really will make your junk bigger. your idea is GREAT, but... i dont really know what the new paradigm would be.
You know in the past month I have seen that 80% of Spam is caused by infected PC's in Windows. That 80% of Spam comes from China. That 70% come from Russia and China. That the US accounts for 60% of Spam. That Eastern Europe Accounts for 60% of Spam. So from this I know that there is 80+80+70+60+60= 350% Spam. This also tells me that Russia accounts for Negative 10% of Spam. Don't believe me, take this The Reg Story, http://www.theregister.co.uk/2004/06/04/trojan_spa m_study/, This one, http://www.theregister.co.uk/2004/05/25/spam_delug e/ and thats just El Reg. The only conclusive thing I have been able to determine is that these stories are worse than spam, not only are they useless, but we actually read these stories.
another possible explanation of this is illegal copies of Windows.
I was recently talking with a friend from hong kong; he mentioned that virtually no one buys legitimate copies of software because it's more expensive and less readily available.
he also said that users and companies using pirated software don't update it for fear of legal action--hence the huge number of zombies.
The USA is quite obviously the source of the spam. It is up to the USA to legislate in some way to stop the flood of spam that is hurting people all over the world. The real question is: how do you stop the spam when it is being sent from countries like China where the USA has no power to arrest spammers?
Well I think I have a possible solution and it can be illustrated by a case study. In Australia we had an international Paedophilia problem, Paedophiles were travelling to countries like Thailand where sex with children was not illegal and thus were not getting arrested. The solution that was eventually found was new laws whereby anyone who broke Australia's anti-paedophile laws could be arrested no matter where the offence was enacted. Offenders were met at the airport by police and arrested for crimes in other countries and the problem of "paedophile sex tourism" was solved.
My Solution to spam is similar. The USA needs to pass laws allowing them to track down the companies and individuals that are using the Chinese spam services and arrest them. Make the law such that sending spam is illegal no matter which country it is sent from. The spammers might get so scared they will stop Spamming
99 bottles of beer in 175 characte
That is the other (electronic) Russian Mafia. Unlike the dumb Italian teamstears who beat people with baseball bats, some of these guys are very skilled and intelligent. The counterparts of many American geeks in Russia couldn't find a well paying job, have plenty of time, and nowadays on the Internet, they have access to all the technical information they need on any subject. They will use the best asset they have, their brain, to make money or build recognition for themselves. And the way the laws are shady there they think they can get away with anything as long as its online. If spam will make a couple of hundred rubles - they'll get into spam, if they can extort money from banks by compromising their webservers, they will do that. How do I know all this? I grew up in those part and still visit friends and family once in a while...
http://www.spamhaus.org/sbl/howtouse.html/ 25_uribl.cf
http://www.spamassassin.org/full/3.0.x/dist/rules
Problem gone? Not by a longshot.
You only got 8,398 messages in one year?
I more than that in ONE WEEK. Each day, I average 1,650 email messages; with about ten of those being legitimate. With your recommended software, even with its "amazing" accuracy, I'd still be getting more spam passed through than legitimate messages.
(This is an old email address, used for well over fifteen years. It has been out in the public forever--used on things like domain registrations and Usenet--well before email addresses needed to be guarded, because spam simply didn't exist back then).
No, classification and filtering is not a reasaonble solution. You got 66 classification errors; how am I supposed to look through over 1,500 messages a day to pick out the one or two that actually were legitimate but got filtered as spam? It's insane, and I'm not going to do it.
We need a BETTER solution than filtering--because if this trend continues, within a couple of years EVERYONE is going to getting thousands of emails a day.
The USA is quite obviously the source of the spam. It is up to the USA to legislate in some way to stop the flood of spam that is hurting people all over the world. The real question is: how do you stop the spam when it is being sent from countries like China where the USA has no power to arrest spammers?
Hey, what a brilliant idea. We currently have only a hundred or more anti-spam laws across the world, most in the US. Let's pass a few more. I am certain that when we pass the 500 anti-spam law mark, spammers will suddenly start to cower in their boots and realize that 500 anti-spam laws that aren't being enforced or have no legal/civil/criminal teeth are a formidible obstacle to overcome!
"According to Spamhaus director Steve Linford, the Russian gangs aren't constrained by any anti-spam or cybercrime laws in their home country and have no respect for legislation implemented in other countries."
Criminals with no respect for the law! This world is surely going to the dogs!
---
"The chances of a demonic possession spreading are remote -- relax."
I have gotten quite a bit of spam that is actually written in Chinese. I don't think I have gotten any spam in Russian. I actually got a piece of junk mail that I thought was funny once. The subject was "Hard times ahead!" and I thought it would be about saving money, but it was for viagra or something.
Click for offensive t-sh
I implemented some new spam fighting techniques last night. The most effective one from logs since implementation was making HELO checks mandatory in Postfix. If the sending client doesn't submit an EHLO response, Postfix rejects the client. Since this happens before message transmission, it seems that not nearly as much bandwidth is being used (haven't verified that yet.) I'm surprised this isn't on by default in Postfix, but it sure is funny to see all these hosts rejected. None of them even resolve, there's no way that it's legitimate mail. If it is, too damn bad.
"Why do you consent to live in ignorance and fear?" - Bad Religion
PS "cirminal": Jesus, Timothy, you're actually paid to edit this?
Did anyone see that awesome interview with Scott Richter (spammer overlord) on the Daily Show? It was so hilarious. He calls himself a high volume e-mail deployers that send useful services to people.
The best is when they posted Scott's e-mail address on national TV, which is: scottrichter442@yahoo.com
This site here has the video available of that Daily Show clip. Please try not to slashdot the site, maybe someone setup a mirror or something.
"There is no spoon." - The Matrix
Some analysis of my rejected mail logs over the last 24 hours revealed this:
Total rejected spam: 16235 (and 8178 accepted messages)
Confirmed Chinese spams: 1229
Confirmed Korean spam: 1414
Confirmed Canadian spam: 264
Confirmed Polish spam: 342
Confirmed US/comcast spam: 1363
Confirmed French spam: 181
Confirmed Southwest Bell spam: 382
Confirmed Italian spam: 114
Confirmed Spanish spam: 167 (TDE must have finally gotten their act together)
Confirmed German spam: 967
Confirmed Netherlands spam: 452
Confirmed Brazillian spam: 864
This is by no means a scientific analysis - it's based on hard-coded IP-based blacklists that are caught before standard blacklists are checked.
Spamcop RBL rejects: 5460
Spamhaus RBL rejects: 1509
Njabl RBL rejects: 1807
Homebrew RBL rejects: 6382
The big three spam sources have traditionally been Korea, China and Brazil. Comcast has been the big US spammer. France (wanadoo) has also been a major contributor though it doesn't seem to be reflected in this days' logs.
People want an open public form of communication, but are unwilling to accept email from people they don't want to hear. I think its interesting that people expect others (i.e. government) to go after these individuals in the hopes that it will put an end to all unwanted email (especially when the individuals are in other countries). If you sat down in the middle of times square, do you think its fair to expect people to stop yelling, the cars to stop honking, cellphones to stop beeping, or the people to stop shuffling past you? The truth is, you will always get unwanted email if you aren't going to actively manage what email gets to you. Do you ever get SPAM from IM? No. The reason why is because you have actually personally networked who you want to talk to and eliminated all others. I believe the future of email communication will be based around a networked process of individual/group permissions. Till that day, people are going to be lazy, unhappy, and wishing for something impossible -- that SPAM will end if they do nothing.
Dear Dr. Bokuzuwandi,
Your prosal intrigues me, as I am always seeking to expand my business to new countries whenever possible. You must understand, however, that I cannot simply blindly enter into deals with people who I have never met. As such, I will require a sign of TRUST from you, in the form of photograph identification. Please understand that I will not be able to accept normal government ID cards or an international passport for this endeavour, as such things are easily forged. Instead,I shall give to you a password phrase, and you must have a photograph of yourself holding up a large and clear sign that displays this password phrase. Scan this photograph in and email it to me as an attachment. When I have received it, I will be 100% ready to trust you with your business proposal.
I do apologize, but until I receive this form of identification from you, I will not be able to provide you with any further information about myself.
The password phrase is "I LOVE ARSE FORKING"
Yours Very Truly,
Pastor Phil McCracken
(Hey, it worked before!)
Now if only I could find a way to similarly humiliate the spammers who advertise pirated software or penis pills...
STOP MISUSING APOSTROPHES, YOU MORONS!!!
I filter based on those.
.mail domain is just dense and turns e-mail into a commodity controlled by big business instead of what is basically seen as something for everyone.
Current List of Domains
At the time of this posting it's at 2209 domains. In a day or so it should go up several dozen when I do an update.
It's the only thing in a spam that can't be obfuscated or it simply won't work. At best they can do one to one character codes. Occasionally a spammer will try to be clever and request the user copy and paste the link into their browser. I tend to catch those when I examine what got through but the pay off from those is probably so low that the spammer goes back to links. It's hard enough to get someone to click.
The other advantages of blocking based on click-me domains is that the header is irrelavent (it doesn't matter where it came from) and that it's the only thing that costs the spammer real money. And it's the only thing guarenteed not to be in a legitimate e-mail ever.
I've gotten several occuraces of dictionary words inbetween the same obvious spam domain entry. It's quite simple to see which are the filler to fool fully automated anti-spam systems and which are the real links.
The long and shot of it is that if you can use it, so can spammers. Charging thousands for a
You have to deal with spam within the rules that spammers set. You can't invent rules and then pretend spammers are going to follow them. After an update it takes a few days for the spam to pick up again. If major players would stop worrying about where spam was coming from and start dealing with where it's pointing to, this problem would be a lot more managable.
I've started sending my hotmail spam off to my mail server to help build the filter. It'd be nice if other people were building reliable lists so that I could premptively filter more domains. Nobody really takes it seriously though. They'd rather blacklist countries since it's "easy."
Ben
Work Safe Porn
This is simply presenting more of the story. SPAM is an international enterprise. Most of the instigators are here in the US, as are most of the compramised computers. However it sounds like from this and other articles is that much of the hacking work is being done by criminal syndicates (huge shock there) and that most of the websites the spammers are setting up are in China.
/., if you bothered to read it.
This does NOT mean that the domestic spammers are being ignored. One has already been convicted, Microsoft and Time Warner are suing a bunch more, and the justice department says it is prepping 50 criminal cases under teh new SPAM law. This was all announced on
Quit with the anti-American bullshit. Yep, the problem is here. We know, we finally have a law for it, though not as strong as we'd like, and the wheels are in motion. Doesn't mean that the US is solely responsible. I do not at all think it is unreasonable that Chinese hosts should show the same standards demanded of US hosts in not hosting SPAM sites.
But people are banning entire countries, not ISPs. That leaves those who live there no reason to choose a "good" ISP over a spam haven; all are discriminated against. If you're going to be punished for living in the same country as spammers you might a well get the benefit from using a service subsidised by them.
The Spamhaus Project has warned that organised cirminal gangs in Russia
When will they learn... Cirm doesn't pay...
"Was it a millionaire who said 'Imagine No Posessions?'" -- Elvis Costello
Since it seems that foreign ISP's are in league with organized crime, then i'd say that this is a threat to national security. Therefore, I recommend that all TLD providers remove all references of the suspect ISPs from their databases, including blocklisting their POPs and SMTPs.
It'll be a double-edged sword, I know, but in this matter, it'l hurt them more than the rest of the world. Boycott and Blacklist all *.ru and *.cn servers until this matter has been settled.
First rule of holes; When in one, stop digging.
Dmitri: So Vladimir, whatever area do you specialize in these days? ...
Vladimir: Smuggling, my friend. Vodka, narcotics, humans... If it can be smuggled, chances are I smuggled it some time...
Dmitri: Sounds good, how about you, Ivan?
Ivan: Weapons trade, of course. Got a few good high-up friends in the Red Army that are willing to relinquish some surplus material to me at a good price, which I sell in Africa and the Middle East.
Dmitri: Good to hear you two are making a nice profit.
Vladimir: How about yourself?
Dmitri: I rent out hundreds of cracked computers to US based companies.
Ivan:
Vladimir: Dmitri, you suck.
banning entire countries has become a last resort. some countries have a rather cavalier attitude toward abuse, like china. the chinese state operated national networks had an official autoresponder which responded to _all_ abuse complaints with the lie:
"In your SPAM eMail,I can't find the IP or the IP is not by my control.Please give me the correct IP.Thank you."
it's no wonder china is one of the most regularly firewalled networks. besides them being a spam haven, their _official policy_ regarding abuse is to do nothing at all, and lie about it!
so really, in china there really aren't any "good networks". they are _all_ bad.
as for banning korea etc. well, i have absolutely zero reason to receive email from anyone in korea nor do i read korean. so into the bin goes *.kr. how exactly does that hurt any koreans?
answer: it doesn't.
Why are we not punishing the fools who hire these spamming bastages to promote their business?
After all if the source of the spammers income dwindles then they wither. Perhaps I'm being overly simplistic.
-- What's this '-r *' file doing here? -- Oh well, a simple 'rm' should do the trick.
I know I'm repeating myself, but, we have to make sure that headline appears in the "mainstream" media, not just in places that only us geeks look.
Joe 6 pack needs to be routinely reminded that "spammers=criminals", and "buying from spammers=giving money to the Russian Maffia".
I think those of us who are familliar with the problem, need to take the initiative to contact our local media and help them understand what's going on. Lay it out for them: virusses -> zombie PCs -> mail relays -> spam -> criminal gangs.
And then repeat to make sure they get it: "Aunt matilda's computer is being used to make Big Money for the russian maffia.", and "buying from spammers finances the creation of more virusses".
The fewer people who buy from spammers, the less spammers can afford to stay in business. Shout it from the rooftops.
---
"I can't complain, but sometimes still do..." Joe Walsh
I just installed an anti-spam appliance yesterday. So far, over 80% of the Spam that is blocked has come from DSL and Cable lines, presumably from compromised machines.
"The natural progress of things is for liberty to yield and government to gain ground." - Thomas Jefferson
As somebody who lived on the territory of the former USSR, I am not surprised that the majority of spam arrives from Russia and that kiddie pr0n sex rings are linked to companies in Belarus. Why does that happen? Well, compared to the United States those countries have virtually zero law enforcement and high levels of corruption.
Even with Vladimir Putin, Russia still lags behind in terms of law enforcement when it comes to protecting human rights, technology, women, children, etc. When I traveled across the republicts of the former USSR I was surprised by the amount of counter-theft goods that one could get through local flea markets. You can get CDs full of the latest software, like 3D Studio Max, for $2-3USD. If you get a several CDs, you get a discount. When you pop one of those puppies in your drive and read the instructions, they'll say "Please run a program called crack.exe in order to activate the product." Activation my ass. The same applies to DVDs, and brand-name products.
According to my friend who travelled to China, that country is pretty much in the same spot. Yes, they are good at banning people from accessing forbidden sites. Yet at the same time you can to to a street market and purchase a fake "NorthFace" jacket for $20USD or less; In the states you'd pay up to ten times as much. Then there are corrupt politicians and cops who can close their eyes provided that you pay them a certain amount of money. With that in mind, it is not a surprise that China and Russia lead in spam.
There is a lack of sync between technology and the laws that govern it in the countries that are not, well, *that developed* yet.
ISPs are a major part of the problem. They either know, or can know, that they have spammers and other criminals on board. Yet many do nothing about this because they would rather have the money spammers pay them. We need to stop peering with bad ISPs in every way we can.
Those who whine about their mail not getting through because they are using one of these bad ISPs are also part of the problem. They need to stop encouraging their ISP to continue, and force the ISP to decide between good and evil. If there's another ISP, switch. If there's only one and it's because the government gives them a monopoly, then the government is the problem and they need to fix that. If there's only one and it's not a monopoly, then they need to start their own ISP (and not allow spammers, lest they also be cast into the deep pink cyber oblivion).
now we need to go OSS in diesel cars
Wasn't sure about the spelling and didn't bother to look it up. Thanks. This is, after all, the place where spelling does indeed matter and is always perfect. (not to mention that English isn't my mother tongue, voimme jatkaa tätä keskustelua suomeksikin jos tuntuu paremmalta :P)
It's not hard at all to block these cable/DSL/dialup hosts from sending you mail. Here's what I use:
t |c lient2).*$\N} .*$\N$ \N\ N
1) A filter that looks for hostname patterns that look like consumer internet connections (DSL/cable/dialup):
[note: these are in Exim lookup-table syntax]
\N^(dsl|cable|adsl|dialup|docsis|pool|ppp|clien
\N^.*\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3
\N^c\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\..*
\N^[sShH]\d{3,}.*\.[a-z][a-z]\.shawcable.net$
\N^.*\d+\.charter-stl.*$\N
2) Next, you block known spam-source countries. Some may take offense to this but the company I work for only sells products to people in the US, so these filters aren't a problem. To accomplish this, I set up djb's rbldns server on one of my machines. Currently, I'm blocking netblocks from Brazil, China, Korea, Malaysia, Nigeria, Russia, Singapore, Taiwan, Thailand, and Turkey. These netblocks come courtesy of blackholes.us.
3) Anything that is not caught by those first two local options is run against the DNSBL list at SORBS. We choose to use their combined blackhole list but you could just as easily go with their anti-dialup/dsl/cable IP list.
If an e-mail makes it through all of that, it gets run through SpamAssassin and blackholed if the score is >= 7.0 and marked if the score is >= 4.0.
We're also doing a bit of tarpitting. Every time we get a connection from a blacklisted IP, we tarpit them for two minutes before spitting out a 550 error code.
Despite this, we still get some spam and dictionary attacks. The spam gets filtered by the client and the dictionary guesses are blackholed by the local delivery server, which is configured not to send bounces.
Chris
Spam is an inevitable by product of having a virtually free message delivery system.
As far as I can tell, this is the first time in the history of the world that a company, legit or not, could advertise their products and services for free. Every other method costs a hell of a lot more money and doesn't reach nearly the same audience. Be it paid tv advertising, direct mail, etc.
As long as email is free to send, boxes will always be full of spam. Spam will be the end of email, the problem is only getting worse, with no real hope in sight.
Be better in bed. Wikiafterdark!
Why is the article titled "China and Russia 'behind current spam deluge' when they are just the ISPs? It's Americans paying for it, so they are behind it.
..." you just have to have it)
Of course, the lack of respect for US spam policy does not help the situation - but this is not surprising, given that the unstated rule of almost all American policy is "If you have enough money you can get away with whatever you like". (Note that this isn't "If you give me enough
Selling junk to idiots, America's number one industry.
For outgoing SMTP connections to send email:
1) POP-BEFORE-SMTP and/or
2) Route ALL port 25 traffic through the ISP's mailserver.
For incoming SMTP connections to receive email:
ONLY ACCEPT CONNECTIONS FROM FELLOW DNS-IP-VERIFIED SMTP SERVERS. NO EXCEPTIONS!
Alas, as long as hosts continue use 'hidden mailservers' that are not officially on file with a DNS lookup, spam will continue to plague the Internet.
In a perfect world, directly delivering email to the recipient's mailserver should only be done by a fellow mailserver offically on file with the DNS system. When a 'non-mailserver' IP does this, the practice screams spam....