Comcast Port 25 Blocks Result In Less Spam

Dozix007 writes "Ars Technica reports that: 'After Comcast finally owned up to the massive amounts of spam coming from their network, they decided to identify spammers and zombie relays on their network and block port 25 traffic from those IP addresses. Comcast's efforts are starting to pay off. They announced the amount of spam from their network has dropped 35 percent since they began port blocking and traffic estimates from SenderBase seem to confirm the claims. Spam coming from Comcast subscribers who were formerly on AT&T networks also seems to have decreased'."

Comments

Good job on the cut and pase

[Anonymous Coward]

Here's the actual Ars Technica story that wasn't linked, but copied and pasted as the Slashdot story.

Something I've been wondering about though is SpamCop's yearly stats. Since April, spam reporting has been going down. Is it simply fewer people reporting/people reporting fewer spam, or is it a sign that actual spam is going down or at least being better handled? I know on my mail server I've implemented some straight blacklist checks primarily using sbl-xbl.spamhaus.org and it's been working great with no false positives. Some spam still gets through, but SpamAssassin usually catches it with other checks.

Re:Good job on the cut and pase

[neonstz]

My email account at work used to get about 100 spams/day earlier this year, now it's down to 60-70. (This is the spams that hits the spam filter, only 2-3 slips through each day).

Re:Good job on the cut and pase

[JumperCable]

Is it simply fewer people reporting/people reporting fewer spam, or is it a sign that actual spam is going down or at least being better handled?

I know I have stopped reporting all my spam. It took too much time. Now I just target the ones that make it past my spam filters (OK, I have kind of given up on that too).

But I have noticed a drop in spam recently. Maybe spammers are on spring break.

Re:Good job on the cut and pase

[silentbozo]

I think it's fewer people reporting spam. My spam count has increased (400+ a day), but I gave up reporting to SpamCop a number of months ago because I couldn't keep up. I emptied my held mail a few weeks ago, and had 6000+ messages on the system. I know SpamCop has been throwing away the older ones that I haven't gotten around to reporting/cleaning out, because I store a local copy of the mail going to SpamCop and I've archived WAY more than that...

Re:Good job on the cut and pase

[MinutiaeMan]

It's got to be that fewer spam messages are being reported. I've noticed lately that the amount of spam I've received has been slowly going UP, from around 80 junk messages per day to around 100.

Of course, any one e-mail address can't equal a scientific survey, but still...

Re:Good job on the cut and pase

[AaronW]

I'm a paying SpamCop reporter. It's just starting to get too expensive to keep reporting. I'll probably keep it up for a bit, but that 16MB quota disappears awfully fast now. Hopefully Comcast cleaning up its act will reduce the spam load significantly.

Re:Good job on the cut and pase

[WuphonsReach]

My email account at work used to get about 100 spams/day earlier this year, now it's down to 60-70. (This is the spams that hits the spam filter, only 2-3 slips through each day).

I started the year at 100/day... now rapidly closing in on 200/day. The only thing we block at the mail gateway is executable attachments (anything that is typically used by virus/worm such as EXE, VBS, SCR).

SpamBayes lets 1-2 slip through every few days.

2003-10 2950 - 94/day
2003-11 3225 - 108/day
2003-12 3775 - 122/day
2004-01 3250 - 105/day
2004-02 3600 - 124/day
2004-03 4150 - 134/day
2004-04 5150 - 172/day
2004-05 5450 - 176/day
2004-06 6250 - 208/day

Oops, we just crossed the 200/day mark. And that's just my own work e-mail address, which doesn't count all of the other users.

We won't truly see the impact of the Comcat move until at least the end of July.

Re:Good job on the cut and pase

[Night Goat]

I used to report spam more diligently than I do now. Nowadays my filtering does a pretty good job, and only occasionally when I am bored do I report spam. And I've given up on the Chinese spam. Those servers have admins who don't care. I used to think maybe it was the language barrier, but they must get enough e-mails with the word spam in them that it's got to be a word they recognize. So I think it's just people are reporting less spam.

Re:Good job on the cut and pase

[letxa2000]

Jun 2004 17084 = 573/day
May 2004 17327 = 559/day
Apr 2004 17764 = 592/day
Mar 2004 14119 = 455/day
Feb 2004 11848 = 409/day
Jan 2004 9910 = 320/day
Dec 2003 10002 = 323/day
Nov 2003 8423 = 281/day

This includes viruses that my Bayesian filter is catching, but since most of those viruses are probably to install spam-viruses that's probably a fair classification. Anyway, I can't say that I've seen things drop off this month. Seems to be holding steady the last 3 months...

Maybe we can make comments like Congress... "We've seen a reduction in the rate of increase of spam." :)

Re:Good job on the cut and pase

[ninjaz]

The most significant events I see which correlate with that graph are Memorial Day weekend and the start of summer. When I report spam to spamcop, it's usually in 15-20 message batches. Deleting the messages takes less than 2 minutes. Forwarding all the spam to spamcop, then clicking through all the pages for reporting each piece takes 30+ minutes.

I think what most of what you're seeing is people having more attractive things to do than report spam.

Re:Good job on the cut and pase

[thedillybar]

>I know I have stopped reporting all my spam. It took too much time.

I wrote a perl script that I can pipe to from pine. It does a quick check with whois.abuse.net and forwards it off. Soon I may be adding whois.arin.net checks as well as traceroutes to track down the abuse e-mail contact.

It's real easy to pipe 200 messages to a script everyday before you leave for the day...

Re:Good job on the cut and pase

[rjhall]

I use spamcop and I like it.
Perhaps I'm ignorant, but I've RTFF and can't find out how to report *attempted* spams.
For example, every day I see logwatch reporting:
Host x tried to deliver to info@domain.com
Host x tried to deliver to bog@domain.com
Host x tried to deliver to bill@domain.com
etc etc...where 'x' is the same, and the attempted (and failed) addresses have never existed.

Any way I can automate (or semi-automate) reporting the attempting spammers?

richard

Re:Good job on the cut and pase

[Kpt Kill]

I just wish spamcop would allow me to report spam without having to confirm them. I dont mind fowarding my 30 spams a day, but then having to click 30 links, along with my increasing spam, it just makes me wonder why i bother.

Re:Good job on the cut and pase

[Pharmboy]

I used to report spam more diligently than I do now.

Same, but now I filter through and make sure I report all Comcast spam, since it may actually make a difference. I have definately seen a reduction in spam from comcast since the report. We receive many THOUSANDS of spam messages a day for less than two dozen email addresses over 2 domains. I don't even log virus hits anymore, they just delete. A couple hundred a day. I only report spam to known major ISPs. Over 97% of the traffic at our mail server is spam or viruses. Sad.

Regarding chinese/russian/korean spam, I just block several thousand class B IP blocks. Yes, this is not the best method, but then again, since I don't email anyone in China, etc, perhaps it is.

Also, any domain that sends spam, and doesn't have an abuse@ address is blacklisted instantly. Several small ISPs fit into this catagory. I will NOT fill out a form on a fucking web page to report spam. No abuse@, no access.

optonline and adelphia seem to be the worst about not responding to spam, and verizon is the WORST. God I hate them, for so many reasons. I have the least problems/repeats with spam from rr.com and aol.com, ironically.

Re:Good job on the cut and pase

[spacecowboy420]

I di dthat for a while - with great results. Then my company open an office in Korea. I have to be able to receive mail from potential customers as well as the office personel. It was like opening the flood gates all over again.

Re:Good job on the cut and pase

[m.corum]

Hmm... Spam is high in carbs, isn't it?. Are you on the Atkins Diet by chance? But seriously, to what do you attribute the drop?

Re:Good job on the cut and pase

[WoodstockJeff]

verizon is the WORST

I don't bother reporting individual incidents anymore (hundreds of different IPs per day), but, when one IP or subnet gets agressive about spamming, I do report it. For Verizon, I have started by sending an initial report, pointing out how many attempts have occured so far. An hour later, I send a second message, detailing the number since the first report. An hour later, EVERY message I get from my servers about the bounces gets forwarded.

Usually only takes 4 or 5 hundred such reports to get the IP blocked on their end... B-)

Re:Good job on the cut and pase

[linux_author]

- how about a link to the script? sounds like a great idea!

Re:Good job on the cut and pase

[stry_cat]

Something I've been wondering about though is SpamCop's yearly stats. Since April, spam reporting has been going down. Is it simply fewer people reporting/people reporting fewer spam, or is it a sign that actual spam is going down or at least being better handled?

I use to report my spam to spamcop. Starting sometime this year, whenever I reported spam, I'd get 5-10 more spams the next day. I stopped reporting and suddenly my spam goes down.

I'm not saying spamcop is in league with the spammers (although I understand their new owner isn't an angel). I think the spammers are now able to figure out (even from the munged reports) which addresses are active and punish them with more spam. Am I the only one thinking this?

Re:Good job on the cut and pase

[gmack]

Don't get me started on the munged addresses. Unfortunaly there are people who will subscribe to something then complain to spamcop instead of unsubscribing. The munged email addresses make it a total pain to find out who was responsable for a given complaint and remove them.

As soon as I get enough free time I'm going to rewrite our software to add a cookie to the headder so I can track who it was that way. I can easily imagine some spammers doing the same for less helpful reasons,

Re:Good job on the cut and pase

[Anonymous Coward]

Fact: Over 97% of the traffic at our mail server is spam or viruses.
Fact: I just block several thousand class B IP blocks
Fact: any domain that sends spam, and doesn't have an abuse@ address is blacklisted instantly

And still you get 97% spam and viri?

Re:Good job on the cut and pase

[Pharmboy]

And still you get 97% spam and viri?

Yea, sad isn't it? Our email addresses MUST be published (we sell stuff) so they are out there. Plus we don't bounce invalid addresses, instead using a catch-all (a pain but needed for us). Also, the majority of spam does NOT come from china/korea/russia, its just that I can easily get rid of 1/3 of the spam by blacklisting the IP blocks of those areas (have to accept mail in most of Europe, since we do business there)

Most spam / viruses come from the US, from major ISP with clients that are properly pwned via trojans. I can't blacklist comcast, pacbell, swbell, and other ISPs.

Also, we don't use email for hundreds of incoming messages. Most of our customers call us on the phone. The vast majority of our email is actually OUTGOING, sending shipping notices, etc. We are one of those weird companies that actually lets customers speak to a real person when they call ;)

Re:Good job on the cut and pase

[MS]

The first big drop of about 30% was on 29.April, the day two spammers were arrested

The drop at the end of May was when Akamai was down, and afterwards Spamcop had some bugs...

On the other hand, the peaks in January, February and March are due to a new worm (e.g. Netsky), which Spamcop didn't recognise as such and accepted the reportings as spam.

Laws against spam are very efficient, if only they are applied!

Re:Good job on the cut and pase

[Anonymous Coward]

Hmm. I bought a 50MB block over 5 years ago. As of right now I have over 34MB left.

When the bl.spamcop is plugged into your mail server and you report whatever spam hits your mailbox, the feedback loop works great.

I have changed my reporting stance this year. Used to be I would report spam as old as SpamCop would let me go. Now I generally only report spam that was received within the last 12 or 24 hours. Sometimes I report every day so it's not a big deal, but occasionally I'll get busy and not report for 4 days, so a lot goes unreported...

BTW, I've had the same email address for over a decade, various people have plugged it into their websites, I used it in usenet back in the days before spammers started harvesting addresses from there (ah, those were the days), and other big no-nos from all the people who haven't had an email address for that long and therefore scold others for daring to give out email addresses so that people can contact you. Ah those were the days...

Spamford Wallace once contacted me because I sent a "That's it, I've had enough, you've had adequate warnings" email a couple minutes before his servers famously started to eat themselves. Someone managed to insert some of Spamford's own email addresses into his system, thereby creating a loop that ate up all available disk space in about an hour or so, or so the word on the street was (Spamford posted a press release stating they were going to vigorously prosecute the attackers, but never did, because it was his own ineptitude that caused the situation).

Re:Good job on the cut and pase

[msim]

Bah, i've only got 2 email addresses at my domain.

Anything sent to a diff to or cc address than either one of those gets binned immediately, no question about it.

It's sad, but it seems to save about 80% of my spam. a sidenote is once mistakenly put a bogus email address ONCE on a site using my domain. now i bleedingwell get about 20-50 spams to that email address a day. Those get binned at rule #1 on my mailfilter.

A lesson learned, where's my fecking shotgun?

But For How Long?

[gbulmash]

Those numbers are all really nice, but isn't this just putting one of those little dot band-aids on a stab wound? It seems to work for a while, but how long before the spambot authors come up with a way around the port 25 block? How long until new worms are traversing the net, creating worldwide bottlenecks, pinging out from newly zombied PCs to find the latest Windows vulnerability and install themselves?

Better yet, what if these zombied spambot-infected PC's have been creating a shadow P2P network so their makers can quickly and easily install patches, or send out network-wide commands to their armies of zombies? How long will the port 25 block remain effective then?

I give Comcast all sorts of kudos for doing something to try to staunch the spam spurting from their digital arteries, but I don't see this working in the long term.

- Greg

Re:But For How Long?

[Anonymous Coward]

"spam spurting from their digital arteries"? Are you saying spam is the fluid of life, without which comcast will not survive?

Re:But For How Long?

[rsmith-mac]

It seems to work for a while, but how long before the spambot authors come up with a way around the port 25 block?

They can't, that the beauty of it. Standard SMTP servers listen on port 25, as defined in the RFC; with port 25 blocked, it's simply not possible for spam zombies to talk to normal SMTP servers, period.

Re:But For How Long?

[.pentai.]

If access to my machine's port 25 is blocked up-stream from me, how can I work around this?

I could, of course, use another port! I mean they can't block ALL incoming messages, and it wouldn't be that hard to write a program to send mail via a slave at a port OTHER than 25...

Re:But For How Long?

[Anonymous Coward]

These little band-aids and steri-strips are fucking effective. try them out!

Re:But For How Long?

[Anonymous Coward]

It's not access to your machine's port 25 that is blocked. It is access from your machine to port 25 on other systems.

Re:But For How Long?

[MntlChaos]

You misunderstand. They block connections from their network to port 25 on any machine except their mail servers. Thus any slave computers can't send out e-mail without it hopping past their servers (and likely a quick phone-call from their abuse department).

Re:But For How Long?

[Anonymous Coward]

Oh... maybe ;)
-orangesquid

Re:But For How Long?

[irokitt]

So, anyone think there might be a IIS or Linux vulnerability that could change that?

I think the grandparent was being too depressed. Measures like this are about the only logical way to combat spam, short of having police raid everyone with a computer and force them to install patches, or sending them to the gallows if they're actually originating spam. And that isn't going to happen. So be happy that Comcast has done this, and hope that they'll continue to be diligent and block any work-arounds.

Re:But For How Long?

[Baron_Yam]

Which is why (some) Windows users learned to hide behind NAT or disable their Messenger service - because some spammers moved on from email to direct popups on the desktop.

Re:But For How Long?

[gbulmash]

"spam spurting from their digital arteries"? Are you saying spam is the fluid of life, without which comcast will not survive?

A few months ago, I had a bad staph infection in the groin. One morning, as I walked into the bathroom, a portion of it burst. Suddenly the bathroom floor was splattered, a puddle of blood and pus at my feet, more of it dribbling down my leg.

For the next week, I had to pack the area with fresh gauze 2-3 times a day, the used packing coming away from the wound tinted a sickly melange of yellowish-green and red.

That's more what I was thinking.

- Greg

P.S.: True story.

Re:But For How Long?

[NelsChristian]

Access to your trojaned machines port 25 is not blocked. Access from your machine to port 25 anywhere is blocked. They don't block incoming connections, they block outgoing connections.

Thus, a hijacked PC on the Comcast network will not be able to contact any SMTP server of interest to the spammer.

Re:But For How Long?

[irokitt]

Which is less of a problem provided you de-activate Messenger (the network service, not the chat program).

Re:But For How Long?

[Hrolf]

To the extent that Comcast can keep up with finding zombie PCs for which they provide Internet service, blocking port 25 will guarantee that zombie PCs on Comcast's network will not send spam. It's quite simple: in order to send e-mail, you must connect to a server listening on port 25 for the simple reason that that's where the receiver's SMTP server is listening by convention.

You seem to be complaining that Comcast's spam blocking techniques don't stop the spread of worms. The block is designed to prevent the worm from sending spam. If you want someone to whom to complain about the spread of worms, you might want to direct your anger at the blameworthy.

Re:But For How Long?

[silentbozo]

Thus, a hijacked PC on the Comcast network will not be able to contact any SMTP server of interest to the spammer.

Unless they do it via a trojaned proxy that is accepting SMTP connections from a non-standard port, or unless they are using their zombies to attack web-side mailing scripts in order to take over and use the webserver's local mail system to send out spam. Having been on the receiving side of multiple attempts to take over my mail forms (unsuccessful so far), I have to say, they're damned annoying.

Re:But For How Long?

[FlyingOrca]

OK, I've got the mod points, now where's "-1, Too Informative"? ;-p

Re:But For How Long?

[Anonymous Coward]

modded "Informative", hehe.

PS: you set up the whole thread, including the anonymous reply, didn't you?

Re:But For How Long?

[Sylver Dragon]

Let's just toss out an idea (poorly formed), but might work.
As each PC gets infected with the spambot, the first thing it does is try to contact a known SMTP server on the web. If it can get through, it sets up shop as normal, and opens up another port, lets call it port 12345 for now.
Now, if the spambot cannot contact the chosen SMTP server(might even go through a list of them), it starts scanning the internet for any IP listening on port 12345. If it finds an system operating on port 12345, it sends some sort of test string to that IP/port. The listening server responds with some pre-determined code. Once the originating system receives the expected response, it starts sending all of its email out using the other system as a proxy. Thus doubling the amount of bandwidth used on the proxy, but allowing the spambot to function on a "protected" computer.
Lastly, the proxy server should only allow a few connections, to keep from saturating the bandwidth available to it.
Granted, this isn't a whole solution around the port 25 block, but it may be a start of how it might be done, and something to watch for. Personally, I'm all in favor of ISP's blocking outbound port 25, and only opening it for those who request it specifically. My current ISP does this, and I'm perfectly happy with it.

Re:But For How Long?

[Glowing Fish]

Forgive what might seem like an ignorant question, but is it possible to forge a port number?
I don't even understand conceptually what that means, but I do know that just about everything can be done when people are inspired by other greed or boredom.

Re:But For How Long?

[Shishak]

Or, the virus could read the registry and use the smtp server defined in Outlook.

I'm on comcast and I send mail using SMTP_AUTH through port 25 on my work server. I haven't been blocked yet. When I am I'll just switch to SMTP_AUTH over TLS/SMTP which is port 465. What would stop a virus from reading the registry to find the SMTP user/pass and port settings. The virus would then send mail as an authenticated user.

The network cannot protect itself against viruses with port filtering. Viruses on the Internet are the same as in biology they will adapt and work around any blocks you put into place.

Re:But For How Long?

[SCHecklerX]

All they would need to to is smart-relay through the ISP's servers. Probably not all that hard to rewrite the zombies to do that, you know.

Re:But For How Long?

[WuphonsReach]

All they would need to to is smart-relay through the ISP's servers. Probably not all that hard to rewrite the zombies to do that, you know.

Which is good, because now the ISP has a central point where they can implement rate-limiting. Or at least maintain log files showing which users are sending large quantities of e-mail.

Even better, if the ISP forces SMTP authentication, it now becomes easy to tie a particular spam run back to an actual Comcast user account. Which gives the Comcast folks even more evidence for use if they decide to deactivate the customer's account.

(Most ISPs will probably install rate-limiting on their SMTP relay servers.)

Re:But For How Long?

[Anonymous Coward]

He just really likes telling the groin story, check out his journal for more details!

Re:But For How Long?

[smithwis]

Why would the spammer bother to use the proxy server to forward e-mail received on port 12345 to port 25. It seems to me a better use of resources would be to just originate the email from the computer with the unblocked port 25.

Re:But For How Long?

[ScrewMaster]

You know, I could have gone all year without reading that. Thanks for the mental image. But it's okay ... I'm through heaving now.

Re:But For How Long?

[Barlo_Mung_42]

Also, XP SP2 has Messenger off by default.

Re:But For How Long?

[almostmanda]

The thing is, the average user whose PC is loaded with viruses and spyware isn't likely to have a server running and won't have any need to use a different port. A slashdot reader like yourself would probably take care of his windows box and fix it if such a virus did come along.

Re:But For How Long?

[sentientbeing]

Jees. man. I agree.
though I suppose such mental imagery thrown randomly into a thread is an important element to a slashdot conversation

..otherwise youll never become desensitised to goatse guy...

Re:But For How Long?

[Anonymous Coward]

Yeah, it only took Microsoft 3 operating systems to figure that one out...

Re:But For How Long?

[Midnight Thunder]

Forgive what might seem like an ignorant question, but is it possible to forge a port number?

No. Think of a server listening on a port as waiter waiting next to window. Only requests coming in through that window will be served. Trying to talk to a window where the waiter is not will not be of use, since either there would be no waiter there or the waiter that is there wouldn't understand what you are asking.

Any solution to get round the problem would require hijaking a machine not in the blocked IP range, or the router.

My ISP, Sympatico.ca, blocks all outgoing port 25 requests by default, except those going to its servers. I would imagine that if you could argue a valid need to have it unblocked for you they would do it, but I am just guessing. Although it may be a bit heavy handed, for the majority of most home users this shouldn't cause any problem.

Re:But For How Long?

[pyrrhonist]

This wouldn't have been too bad if I hadn't eaten all that tapioca first.

I just love how you got modded "Insightful".

Please add this one to your journal for posterity and to augment the tale already there!

Re:But For How Long?

[lovecult]

Dude!
I was eating breakfast!

Re:But For How Long?

[Midnight Thunder]

My ISP, Sympatico.ca, blocks all outgoing port 25 requests by default, except those going to its servers. I would imagine that if you could argue a valid need to have it unblocked for you they would do it, but I am just guessing. Although it may be a bit heavy handed, for the majority of most home users this shouldn't cause any problem.

Just a note about this. Sympatico.ca (a DSL provider) uses dynamic addresses for its home users and they are very short term allocations. That is if you reconnect, you are unlikely to get the same IP address. From what I can tell what they did in blocking port 25 makes sense in this scenario (easier to control). Maybe they would have taken a different approach had they been allocating static addresses or very long term dynamic addresses.

Re:But For How Long?

[Anonymous Coward]

And it's about time.

Re:But For How Long?

[Anonymous Coward]

In the USA hooded stormtroopers will just break down your door, haul you off and detain you indefinitely without ever filing charges while they investigate the matter.

Re:But For How Long?

[TENTH SHOW JAM]

Forever with any luck. What this means is that people who do not pay for a permanant IP address cannot use their computer as an SMTP server. This eliminates trojan traffic and small operators from sending UCE. My ISP (Bigpond in AU) did this recently and has managed to keep off the ORBS lists a little more of late.

If spammers are reduced to using permenant IP addresses, it makes filtering for known spammers nice and easy. My receiving server can quickly reference a list of known spam sending IPs and choose to reject incoming messages using nothing more complicated than a firewall rule. If more ISPs follow this practice till it is considered the "polite" thing to do, the spam problem will quickly evaporate, with an option for people to pay their ISP a couple of dollars more to be on the "nospam" mail server that blocks traffic from known or likely spammers.

This is a good thing for the freedom not to listen people, and the freedom of speech have my permission to set up an SMTP like network on port 6025 for all I care. I can ignore this port, and they can sell viagra to each other without making my bayesian filter more educated.

Re:But For How Long?

[NanoGator]

"Those numbers are all really nice, but isn't this just putting one of those little dot band-aids on a stab wound?"

Somehow I doubt Comcast was trying to play anything but a small part in dealing with SPAM.

Re:But For How Long?

[isthisthingon]

Indeed!

And for that matter what I want to know is how the heck have these customers not just been disconnected altogether? A little reworking of the zombie, and the spammers are back in bidness, and the computers are again a liability to Comcast and the Internet alike.

It would seem that actual spammers on Comcast's network are shut down quite promptly by Comcast, so how is it that someone innocent isn't shut down equally quickly, too, whether or not they're guilty of intentionally spamming.

If you're not guilty, sorry, but you'll have to cleanup your infected machine before we'll put you back on our network.

A clean machine should be required for Internet access, IMHO, think of it as like a smog/safety inspection for your car. ;-)

Re:But For How Long?

[NanoGator]

" If you want someone to whom to complain about the spread of worms, you might want to direct your anger at the blameworthy [microsoft.com]."

Funny, I blame the guys that write those worms. Not even Linux is invulnerable to worms.

Re:But For How Long?

[Mycroft_VIII]

MORE DETAILS!!!!! I think I have a few to many as it is. o.k. more than a few too many. Sheesh I WAS planning on sleeping tonight. But not till I manage to erase that image from my mind. Crap, can't you go bonkers from lack of sleep?

Mycroft

Re:But For How Long?

[Anonymous Coward]

Um, no. I'd be happy if Comcast responded to compaints and outright cancelled customers who out of the blue ask me for nsiilog.dll and similar crap, polluting my log and wasting my bandwidth.

Re:But For How Long?

[drsmithy]

I'm on comcast and I send mail using SMTP_AUTH through port 25 on my work server. I haven't been blocked yet. When I am I'll just switch to SMTP_AUTH over TLS/SMTP which is port 465. What would stop a virus from reading the registry to find the SMTP user/pass and port settings. The virus would then send mail as an authenticated user.

This is certainly possible, but the big difference is that, at the very least, (hopefully) your mail admin will notice and query why your mail volume has gone from a few per hour to several hundred per minute.

Spam is much more controllable when it has to traverse systems that are properly managed.

Re:But For How Long?

[papercut2a]

Nah. Just kill 'em both. If you need to IM, use gaim instead of MS Messenger.

Re:But For How Long?

[avida]

Hopefully the workarounds by the spammers will create a unique signature that makes it easier to detect and block zombie machines. The arms race works both ways.

Re:But For How Long?

[Zork the Almighty]

Yeah, the blocked computer's time is much better spent looking for new hosts to infect.

Re:But For How Long?

[bickerdyke]

Is it possible to forge the recepient adress of a letter?

Re:But For How Long?

[steve_l]

That is kind of brutal.

My ISP (plus.net) blocks port 135 outbound. or to be precise, if you keep trying to open port 135, your network access gets taken away. They try and do it to control windows-based worms, but outlook 2003 has exactly the same signature of the worms.

Re:But For How Long?

[fucksl4shd0t]

No kidding. I actually got a tad paranoid when I read about Comcast taking this measure. I'm happy they've only chosen to single out machines that send buttloads of emails. I use postfix to send all my email from my machine because Comcast's smtp servers aren't particularly reliable. At least with posfix I know that if my computer is running I can always send email. (Not to mention Comcast's smtp servers have some arbitrary max size you can have an email and I occasionally need to send email that's larger to accounts that can receive it)

I wonder what Comcast'll do on a day when I actually send a bunch of emails. ;) Seriously, I can't imagine ever having enough email to write of my own that I'll look like a zombie PC sending spam.

Re:But For How Long?

[fucksl4shd0t]

They're also not blocking all connections, they're only targetting the ones that appear to be sending spam. Two ways spammers can deal with this. One, they decrease the volume each computer sends so that it's below the Comcast's threshold. Two, they setup their own P2P network and just relay spam to hosts that *can* send.

In any case, I'm on comcast's network and I use postfix locally to send mail and haven't had any problems. Logically this means that I send less than their threshold that indicates spamming, and I'm happy about this because Comcast's smtp servers aren't as reliable as my own. ;) (That is, when my computer is on, I can send email. Comcast can't match that sort of weird uptime that isn't even in the high 90's some weeks)

Re:But For How Long?

[walt-sjc]

A vulnerability is Can't Possibly change the standard any more than it can paint my house pink. Port 25 is SMTP. That's it. If it's blocked, it's blocked.

Re:But For How Long?

[vettemph]

Perhaps you should see a doctor about that.

Re:But For How Long?

[Anonymous Coward]

#1) This has already happened. I have reported a number of zombies running SMTP on ports other than 25. These zombies have sent e-mail into me as spam. The reason, however, is detection. SMTP on a nonstandard port such as 56741 is harder to detect than a quit port 25 scan over a netblock.

#2) It is virtually pointless to do this, though, if the entire netblock has port 25 blocked. there is no benefit to running a zombie SMTP server on a different port. The only possible benefit it to make it harder to track the spammer down., but the benefit of COMCAST blocking port 25 is not lessened because of this.

Re:But For How Long?

[b1t r0t]

If you really want to erase that image, just look at tubgirl for a few seconds. It makes for a good mental cauterization.

Re:But For How Long?

[mwood]

Hear, hear. Kudos to Comcast for doing this the right way:

1. Identify the source of the problem

2. Attack the source with a well-fitted solution.

They could have gone with the typical "attack legitimate customers and hope you hit the bad guys too" approach. :-P

Re:But For How Long?

[mwood]

All you're doing is extending the network of machines which cannot deliver mail. As soon as a bunch of blocked machines contact an unblocked one, it gets noticed and blocked. At some point you have to be able to connect() to port 25 or you don't deliver. It's much more effective to just write off the blocked systems and find new unblocked ones to simply get the mail out (until they are blocked) than to set up a complicated relay network that winds up doing the same thing using much more bandwidth.

Re:But For How Long?

[mwood]

It makes no sense whatsoever. *Incoming* port 25 requests would be kind of pointless if the client can never find you, but blockage of *outgoing* port 25 requests means you can't send mail except through the ISP's email-laundering service. It works to curb the problematic behavior, but it's a bit like curbing vandalism by putting *every citizen* in jail preemptively.

Re:But For How Long?

[Tassach]

It would seem that actual spammers on Comcast's network are shut down quite promptly by Comcast, so how is it that someone innocent isn't shut down equally quickly, too, whether or not they're guilty of intentionally spamming.

Because Comcast cannot afford to piss off large numbers of paying customers. Comcast does not have a monopoly on broadband internet, therefore they cannot do anything which would encourage customers to go to the competition. They may be able to get away with strong-arm tactics in some rural markets, but most other people have a choice and won't put up with too much crap.

A large proportion of cable modem subscribers (perhaps even the majority) can also get DSL service just as easily as they can get the cable modem. Since virtually all cable modem subscribers are also cable TV subscribers, their fear is that if they piss their broadband customers off to the point where they switch their internet to DSL, they will also switch their TV to a satellite service. For every 1000 customers lost this way, they're losing at least 1.2M in revenue (figuring $100/mo for internet + basic cable).

Re:But For How Long?

[xoff00]

Also, XP SP2 has Messenger off by default.

And the software firewall is on by default.

Thats a great idea, but it kills the network scanning some Universities are doing to look for infected machines.

Re:But For How Long?

[schon]

A little reworking of the zombie, and the spammers are back in bidness

How is that, exactly?

If outbound connections to port 25 are blocked, how are the zombies supposed to connect to port 25? No amount of 'reworking' will allow the zombie to connect to a blocked port, because the block happens upstream.

As someone else said, the only change the spammers can make is to route through the ISP's mailserver, which is (or should be) rate limited.

Re:But For How Long?

[Mycroft_VIII]

Fourtunately I have somehow missed that one. I don't even know what sort of gross/sick it is.
I have no plans of gaining first hand knowledge eigther.

Mycroft

Re:But For How Long?

[msim]

But by that logic if someone is installing SP2 on XP they surely have some clue about system maintanence (my spelling sucks today, so shut up) and would be looking at things like an antovirus product, or even something like spybot/adaware?

Then again if someone has the release of XP with SP2, surely they are going to be marginally less vulnerable to being scanned (until their idiot owner clicks on a cutesey wutesey email and are 0wn3d)

Re:But For How Long?

[b1t r0t]

It's refreshing to know that there's at least one non-stupid person out there. In the past when I've said about it, "do NOT look at this site, seriously", no link, just the name, usually quite a few people just have to see what it's about.

Re:But For How Long?

[Mycroft_VIII]

I ONCE got fooled by a goatse.cx link, and at the time I was wondering how bad could it be. Now I know, I have no intention of finding out how bad somthing could be. I don't even have a rough description of the tubgirl, yet despite my dangerously high level of curiousity (about everything) I've witheld following the link the few times I've seen it.

Mycroft

Does Bittorent need that port?

[Anonymous Coward]

I am with comcast and the last 2 days I can't get at all to bittorent downloads. Does bittorent needs port 25?

In the last few months I didn't have a problem btw, only the last few days.

Re:Does Bittorent need that port?

[sploo22]

No, port 25 is used solely for sending email. It has absolutely nothing to do with BitTorrent. Not only that, but Comcast is only blocking it for spammers and open relays.

Re:Does Bittorent need that port?

[IthnkImParanoid]

Err, do you spam or have an 0wned box? I think that's the only way you'd need to worry.

Anyway, the BitTorrent clients I've used have by default used ports 6889-6989, or thereabouts.

Re:Does Bittorent need that port?

[NSash]

Does bittorent needs port 25?

No. You may specify any port (or range of possible ports) for BitTorrent.

Re:Does Bittorent need that port?

[dave420]

You have read about TCP, haven't you? You can use whatever port for whatever purpose you want. You can have your bittorrent client running on port 25 if that floats your boat. You can run SSH, RDP, POP3, IMAP, HTTP, FTP, whatever all running on port 25. Ports are just ports. No one piece of software owns them.

OK, that's step 1...

[WIAKywbfatw]

Step 2 is to take these selfish bastards to court. They were clearly breaching the terms and conditions of their accounts, so proving a case against them won't take more than five minutes.

Once a few of these spammers have lost everything including the shirt on their backs then you'll see a serious drop in the number of people who think that spamming is a quick and easy path to riches.

Re:OK, that's step 1...

[cmowire]

The problem is those machines aren't actually the spammer, they are comprimised machines that the spammer is controlling.

Although, it seems to me like it would be a nice project to send a Comcast truck around the neighborhood with a list of comprimised machines, armed with a laptop running an ethernet sniffer, then use that information to track down who's controlling the machines.

Only problem is that it probably leads to machines not within the reach of US-based subopaenas.

Re:OK, that's step 1...

[Vaevictis666]

Keep in mind that the blocks are on what are very likely zombied, trojaned, infected machines and that the users/owners of said machines dont even realize it.

Re:OK, that's step 1...

[paitre]

Ok. Now how to you distinguish between innocent bystanders (ie. the zombie relay folks) and the fartknockers actually doing the spamming?

You can't.

As nice as it would be, you really need to be -absolutely- sure you've got a spammer before you try to ruin their life with the court system.

Re:OK, that's step 1...

[stefanlasiewski]

Step 2 is finding the spammers, since it's likely that most of these spam machines are comprimised machines running windows, the machine's owners are probably oblivious that their home machine is sending Spam.

Step 3 is take these selfish bastards to court.

Re:OK, that's step 1...

[Anonymous Coward]

d'oh, you must be new here. of course you vpn your botnet through foreign servers

Re:OK, that's step 1...

[AKnightCowboy]

The problem is those machines aren't actually the spammer, they are comprimised machines that the spammer is controlling.

Why would a legitimate businessman in the bulk e-mail industry use hacked machines? That'd be clearly illegal. Oh that's right, sometimes I forget, they're fucking scumbag criminals who would steal their parents' social security checks if they could get away with it.

Re:OK, that's step 1...

[NanoGator]

"Although, it seems to me like it would be a nice project to send a Comcast truck around the neighborhood with a list of comprimised machines, armed with a laptop running an ethernet sniffer, then use that information to track down who's controlling the machines."

Heh I doubt Comcast will ever do that. That's a bit spendy. However, I wonder if Comcast has the means to flag a particular account in such a way that no matter what web page they visit, they're taken to a Comcast page that reads "your machine is causing problems. Call us." or something like that. It'd be annoying to the victims, but I personally wouldn't mind an inconvenience like that which would force me to troubleshoot my machine. There are a few little hiccups in an approach like that (like how would one get virus updates if they only go to Comcast's site?), but I imagine they're solvable.

Re:OK, that's step 1...

[cmowire]

True, but if ROSKO is to be believed, there aren't actually that many spammers out there.

My point is, if you can better establish a link between spammers and virus writers, you increase the likelyhood of being able to actually raid spamhausen for widespread computer crime.

Re:OK, that's step 1...

[cmowire]

Your sentence makes no sense. The cognitive dissonance from seeing the phrase "legitimate businessman" and "bulk email industry" coupled with an "in the" is too much. What were you trying to say?

Re:OK, that's step 1...

[Anonymous Coward]

Bah, take them to court?

I think we finally found a use for the Patriot Act...no court date for these "terrorists" hacking the computers of innocent Americans! ;)

Incoming or outgoing 25?

[Anonymous Coward]

I suppose it's port 25 outgoing, right? The same one that Earthlink has blocked for ages. (not sure if they still do) The same one that won't let you send SMTP mail with a different domain even if you owned the domain name?

I understand it's for spam-fighting and they only go after the uber-offenders...but it's definitely something to watch for since the ability to send mail (through the domains of our choosing if we own it) should be a fundamental feature of an ISP.

Re:Incoming or outgoing 25?

[Anonymous Coward]

The same one that won't let you send SMTP mail with a different domain

That's completely wrong.

I have Earthlink DSL at home and I have never had a problem sending email through their servers, with my work email address in the "from" field. I've been doing it for years - and did it as recently as this morning. The only catch is that outgoing mail *must* be directed through their servers - which is not a problem.

They're only doing this so that they *could* identify spammers if they wanted to. Since they already know who you are since you authenticated and logged on in order to use the network - they are now able to trace you back through their mailservers if they had any need to (a simple correlation of the mail sender IP vs the user's IP when they logged on).

Re:Incoming or outgoing 25?

[wwrmn]

Well I certainly HOPE it's outbound, that's all that makes sense. I was a DirecTV-DSL subscriber running my personal domains when they 'got out of the business'. When I came up on Earthlink, I was greeted by that same port 25 outbound block:

# echo "relayhost = mail.earthlink.net" >>/etc/postfix/main.cf

Works for me... If I'm a spammer or have a mis-configured MTA that allows open relay, I would totally understand them blocking me. My neighbor I allow to slurp off my DSL via WIFI runs XP and I found I was blocking port 25 traffic from him! If he was still using their dialup (or broadband) and they didn't have that block in place, he'd have been the classic '70 yr old running a spam relay'.
He now understands the joys of AV and Spyware, and LOVES mozilla.

I'd much rather the IP space I'm living on not end up on a RBL and live with the thought they *might* be reading the mail sent from my domain.

I can't fold tin-foil well enough to create a fashionable hat.

Re:Incoming or outgoing 25?

[ScrewMaster]

No, that is a problem. As a software developer, I frequently send large attachments to customers that have no other means of receiving them. Being forced to bottleneck ALL my mail through an ISPs mail server (with all the irritating limitations that entails) is simply unacceptable. Furthermore, I personally have Comcast and they were the reason I originally set up my own mail server: theirs was so unreliable that about 20% of my mail just never got through it. Supposedly they've improved that, but I still have my system set to try a direct connection first and only route through Comcast's SMTP server if the direct attempt fails.

Furthermore, given that the court system has decided that it is entirely okay for ISPs to read their customers' mail at will, I don't necessarily want my confidential emails passing through, and being logged by, their mail server. Perhaps you don't particularly care about that but many people do. Yes, I know they can monitor my IP traffic any time they wish, but there isn't any reason to make it easy for them by just stuffing my messages onto their hard disks.

Fortunately, at this point Comcast has not chosen to simply block all SMTP transfers, just those from known abusers, so I don't really have a problem with that (for now.) But I do think that reducing or eliminating the capability of the Internet is not the way to solve problems like this, because once ISPs get in the habit of limiting what we can do with the network we will be hard pressed to get back the freedom we have now. I like the fact that any computer on the Internet can connect to any other and communicate in ways defined by the users of those machines. That fundamentally egalitarian aspect of the Internet is what makes the network so useful (and so scary to certain powerful people.) Allowing those that provide our connectivity the power to pick and choose how we communicate is a bad precedent, and one that we will regret. It won't be long, mark my words, when Port 25 access is simply GONE for anyone but a big corporation or Internet provider, unless you want to pay a monthly "SMTP access charge" or something similar. There's already been talk of charging for access to specific types of connectivity. Imagine having to pay an extra $5.00/month "Instant Messaging access charge" for ICQ users, or a "mandated RIAA maintenance fee" for P2P. Keep the damn ports open, block those systems that cause problems, and let the rest of us use the Internet in ways that benefit us.

Re:Incoming or outgoing 25?

[mabinogi]

If it's confidential, encrypt it.

That is, and always will be the only answer to privacy concerns about email.

Port 25 is for non encrypted, non authenticated mail traffic. There are other ports for authenticated, SSL encrypted mail sending (of course, the email itself is plaintext to the server, so you'll still want to use pgp, gpg, S/MIME or whatever).

If you have another server that you send mail through, then set it up to handle authenticated SMTP and use it that way.
Port 25 for mail sending needs to die. It's mostly OK for server - server delivery though.

Re:Incoming or outgoing 25?

[Kiryat Malachi]

If you're a software developer and have a business case for direct port 25, here are your choices:

Convince Comcast to open port 25 for you. If you have a legit reason, they may. Of course, if you're trying to do business on a residential connection, they might not.

SSH or VPN to a corporate machine, where presumably you have port 25 unblocked, and can send that way.

Send it through Comcast's server.

I have no issue with there being limits, so long as those limits are not universal. If its something you need, pay for the access in one way or another (cash or time spent convincing Comcast to let you through).

Re:Incoming or outgoing 25?

[Anonymous Coward]

You make several points so I'll make several counterpoints.

Email is not the way to transfer large files. It might work, but it is normal for mail servers to reject extremely large messages or take an exceptionally long time to deliver them. Send them a link instead and drop it on a webserver or ftp server. Add basic auth and you are much better off than email.

As for ISPs reading your mail. It happens when trying to track down problems. Perhaps mailboxes got corrupted due to a disk failure or any number of other problems. They take a quick look at the potentially affected accounts. Or, somehow you manage to get a trojan that starts spamming a lot of people. A sudden spike of 1000's of emails an hour and they'll take a look to see what they are. If you don't want it read, use encryption. You isp doesn't care. They can still do anything they'd need to do with it even if it is encrypted. They don't care about the contents, only that they are entact and appear to be legit.

Finally, reducing the capaility of the internet is an unfortunate concequence to it being used in a different way from what it was designed. The internet was basically a way of connecting networks via redundant links. You talk mostly in your network. There is a link to another network which is used to transfer stuff from one to the other where it can be distributed. Think uucp, or usenet.

Now, however, you have mostly a bunch of leaf nodes never talking to other leaves on their own network. The redundant links are used less for protection from failue, and more for increased bandwidth. The core routers don't even use IP. They encapsulate it into a more eaily routable stream. The internet is held together with ducttape and chewing gum.

DOS attacks are a fundemental problem of the internet. You allow anyone on it to do anything they want and require the other end to deal with it. Sure, I can ignore it but it doesn't mean I'm not affected. By bandwidth is saturated and my cpu is maxed trying to find the legit traffic in the background noise. The solution to this problem is to filter the troublemaker as early as possible. The ISP usually blocks it at the border routers. Luckily the core routers can handle it. DDOS attacks are much harder to deal with. The legit traffic often looks just like the problem traffic. You can try to throttle it but that requires a lot more horsepower than the border routers can spare and they aren't designed for that sort of thing even if they did have the power to do it. They often end up switching to a different IP and flat out rejecting all of the traffic which doesn't pick up the change.

The parallel between this is spam isn't too hard to see. When a single company spams you, its not too hard to block it at your end. You just automatically filter by sender. WIth zombie machines you are basically facing a ddos. You can try to wait it out, or you can switch email addresses. We've tried waiting it out. It hasn't stopped. So do you want to keep switching email addresses? The proper solution is to filter it as close to the source as possible. Thats what they are doing.

Re:Incoming or outgoing 25?

[KjetilK]

As a software developer, I frequently send large attachments to customers that have no other means of receiving them.

You mean that in todays world there are still people who do not have access to the web? Or at least FTP?

That's the only reason I can think of why anybody would do this rather than just dump the large file on a web server, possibly protected with a password and send the URI (+password if needed) in an e-mail.

Takes a second to set up, and makes people happy because they get a better idea of what the large thing is before downloading it.

And binary attachments are a big waste of bandwidth you know, because of base64.

Re:Incoming or outgoing 25?

[Anonymous Coward]

Email is not the way to transfer large files.

Please stop with this crap - No skating, no snowboards, no same sex marriage, no dildos in Texas, no P2P traffic, no streaming video, no iso's, no running servers, no viewing bad content.

Some people really get off on telling other people how to run their lives, their business and their methods of communication. Everybody is so quick to tell people how to move large files around, here's an idea - Shut Up!

It is the customers who pay for the damn bandwidth, they should be able to play smtp-based pong if that is what they want to.

Let me guess, you work for an ISP or are a self serving net admin and think that you "own" the badnwidth, right?

Get an underpowered 486, put OpenBSD and spamd on it and I'll bet you won't have your "bandwidth saturated" and your "CPU maxed".

Re:Incoming or outgoing 25?

[ScrewMaster]

Yes, and when possible I will use FTP. But my company deals with organizations (generally petroleum companies, and/or companies that service them) in third-world nations that are lucky to have email. My point is that all this talk about how "obsolete" SMTP on Port 25 is are completely irrelevant: until enough people over the entire planet have upgraded to the (currently non-existent) successor to SMTP it is the only alternative some people have. And I have to deal with them on a regular basis.

Re:Incoming or outgoing 25?

[unics]

not a problem. so you use SMTP AUTH to authenticate to comcast's email server and relay all your mail for the domain you own through that. I already do that to send my juno.com mail outbound from Outlook Express.

Re:Incoming or outgoing 25?

[dkf]

Sounds like you've got a business case for buying the additional access.

Re:Incoming or outgoing 25?

[Anonymous Coward]

No business case personally. My home domain is purely for fun and free software projects.
I'd gladly pay for a static IP that would satisfy many blocklists that refuse to even bother to see if the connecting IP is the MX record for the domain the e-mail purports to be coming from.
However, Comcast then expects me to shell out hundreds more a month to upgrade to a business account.
I do use their servers when I have to - however even sending out a BCC or maintaining a small mailing list is impossible with them due to their extreme limits on usage of their servers.
There's no reason for it, and I'm glad Comcast isn't putting in a global block just because you can't be bothered to do more intelligent filtering.

Re:Incoming or outgoing 25?

[ScrewMaster]

Thank you! Finally someone who understands the point I was (trying) to make.

Re:Incoming or outgoing 25?

[JohnFluxx]

He did say "no other way of sending" so they don't have ssh or vpn (otherwise you could scp or whatever)

Re:Incoming or outgoing 25?

[orangesquid]

Uhh.. how is this flamebait?

Re:Incoming or outgoing 25?

[orangesquid]

[ :) Whoever you are, I'm friending you. Also, if that A.C. manages to show up as a user, I'll friend him, too. ]

If I want to shove a tuna fish sandwich through port 25, then, dammit, I will.

Re:Incoming or outgoing 25?

[ScrewMaster]

Absolutely. Just give me the damn fat pipe and don't concern yourself about what I use it for as long as I'm not spamming the planet, hacking the planet, or trying to blow up something. Of course, this is all in the general "get outta my FACE!" category, something that the powers-that-be should start doing before things get really ugly.

Re:Incoming or outgoing 25?

[msim]

on my ISP ( iinet ), the default is to have outbount port 25, inbound 80 & 13x blocked. You have what's called a "toolbox" where you can view your connection & billing stats, and under one of those options is the opportunity to unblock the ports to leave it for yourself to battle the spammers and virii.

Now i joined these guys long before this happened (they had the block in place before then unless you were a business customer on a fixed IP address), i wasn't happy with that, but aside from that minor inconvenience i liked it. Now it's just damned convenient.

A big dent

[koreth]

I noticed a big drop in the daily message traffic to my mail server (which receives about 85% spam, last I checked) around the time Comcast put their policy in place. It seems like about a 25-30% drop in overall message traffic, which is in line with the numbers they quote.

Kudos to them for doing a good job of it -- my home Internet connection is through Comcast, and I haven't experienced any trouble sending mail to my own SMTP server on another network. They could so easily have just gone the "all SMTP traffic must go to our hosts" route, but they're doing it the right way instead. Nice to see.

Re:A big dent

[egarland]

They could so easily have just gone the "all SMTP traffic must go to our hosts" route, but they're doing it the right way instead. Nice to see.

Absolutely! I have a mail server sitting on my Comcast account and I send and receive with it. It would have been a major pain if they blocked all SMTP traffic since they probably wouldn't relay my mail for the addresses on my domain. I would have had to route mail through another machine on another port which is a horrible solution. Eventually I'd end up having to change ISP's which would be quite painful.

Kudo's for making an effort to not break email for those of us who don't use their email system.

Re:A big dent

[Enry]

Comcast will route for your domain - I've been doing it for 9 months.

Incoming still comes direct to my machine, but I route through them. I figure if it's important enough that Comcast not see what I'm sending, I can use GPG.

Re:A big dent

[egarland]

Comcast will route for your domain - I've been doing it for 9 months.

Good to know!

Re:A big dent

[ttyp0]

I haven't noticed much of a drop. My small mail server handles a few thousands messages a day and if you look at the graph, spam has been steadily increasing over the last 9 months. Rejected emails are represented by the red line. I'm also on comcast and blocking port 25 for everyone would be a good thing. With new worm infections it must be a daunting task for them to keep up. I use Sendmail which by default also listens on port 587 which is handy for many of my clients who are on networks that block port 25 (eg: charter)

Re:A big dent

[msim]

I just had a look at your graph's, and it pretty much reflects what i've noticed.

Prior to early last year (june), i had a spamrate of 1%. I got on a spamlist about late august, and it's slowly gotten worse. The last 4-5 month's have been absolutely shit with approximately a 90% of my email now spam.

I rarely buy software, but this was a very worthy investment.

Now all they have to do to make me happy is to nuke wanadoo & that damned brazilian community IP space and i'll be home free!

flipside

[name773]

this is grand and all, but i run my own mailserver (merely to get a 5gig inbox and the username i want), and since it's on a residential cable line (dynamic address), aol, rr.com, and email.com all reject my e-mails. and no, i never send spam.
spammers aren't the only ones being blocked by spam prevention

Re:flipside

[prockcore]

and since it's on a residential cable line (dynamic address), aol, rr.com, and email.com all reject my e-mails. and no, i never send spam.

Don't talk directly to their mail servers.. talk to the outgoing mailserver provided to you by your ISP. Sheesh.

I'm always amazed at how many people "run my own mailserver" yet have no idea how mail is supposed to work.

Re:flipside

[batkiwi]

Look into "smarthost." Every MTA I know of supports it, and it's the proper way to do it.

Re:flipside

[Anonymous Coward]

Thank the spammers. Seriously, a very good read, if ever in doubt who deserves your anger.

Re:flipside

[phallstrom]

can't you configure your outbound mail server to just relay the mail to your provider's mail server?

Re:flipside

[jfengel]

Many ISP mail servers refuse to relay mail. If neither the FROM nor the TO addresses belong to that server, they'll reject your message. That means you end up receiving mail on the ISP's mail server, and that completely obliterates the point of running your own mail server.

The reason for that is obvious: it prevents the mail server from being used to relay spam. But it's also very frustrating if you want more flexbility and you're not a spammer. I don't know comcast's policy; perhaps they'll accept relaying from inside their network.

Re:flipside

[e9th]

Read the previous article in yro. If you let your ISP forward your mail, he can read it (at least in the First District) with impunity.

Re:flipside

[Mudcathi]

Don't talk directly to their mail servers.. talk to the outgoing mailserver provided to you by your ISP. Sheesh.

"Sheesh!" is what I said when I tried what you recommended, and over half my emails got bounced against everyone's "no relay" policies.

Re:flipside

[FattMattP]

Then configure your MTA to use your ISPs SMTP server as a smarthost. All your outgoing mail will be routed through your ISPs mail server and won't be rejected by AOL and others.

Re:flipside

[cheekyboy]

set it in your email CLIENT, as outgoing server = your ISPs mail server. not your sendmails outgoing relay.

Re:flipside

[19thNervousBreakdown]

I don't know of a MTA that doesn't make it incredibly easy to use a smarthost.

Re:flipside

[bourne]

Don't talk directly to their mail servers.. talk to the outgoing mailserver provided to you by your ISP. Sheesh.

I'm always amazed at how many people "run my own mailserver" yet have no idea how mail is supposed to work.

No, thanks. I prefer my mail without random 24-48 hour delays and invisibly dropped messages. That's not how mail is "supposed to work."

Re:flipside

[gr8fulnded]

Configure Postfix to send mail to *aol.com, *rr.com, and *.email.com to relay through smtp.comcast.net (or whatever your isp is). I did that for the longest time- even wrote a quick script to do auto detect a bounce message, add the domain to the proper file, restart postfix, and resend the message. Took abt 30 minutes to work-around (was new to Postfix at the time).

Re:flipside

[Pharmboy]

you can always send email to your home network, and have your home network relay through your home ISP. Since you are on that network, they will accept it.

You can access your home network securely on the road in several ways, through squirrelmail, getting your current ip address and make an exception in your sendmail access files long enough to send mail by sshing in if you prefer to use pop, etc.

If you don't want to use squirrelmail, but have a web server up, it would be easy to get a perl script that would mail it locally. Very easy. The only disadvantage is having to use "sendmail -f name@isp.com" which triggers a point or two in spam checks on the receiving end. You will have to password protect the directory (.htaccess) or program, also.

Me, I would just write my email in a text program, then ssh in, use sendmail locally, and paste the message. Its not that hard. But then again, I just leech space and a dedicated IP on the work T1 so I don't need to bother.

There are other ways as well, but they are more complicated, and probably not an option.

Re:flipside

[Some Dumbass...]

No, thanks. I prefer my mail without random 24-48 hour delays and invisibly dropped messages. That's not how mail is "supposed to work."

You mean that's not how _e-mail_ is supposed to work. I'm pretty sure that's exactly how regular old _mail_ is supposed to work, and the postal service is doing a great job of implementing that system, thank you.

Re:flipside

[bigberk]

I'm always amazed at how many people "run my own mailserver" yet have no idea how mail is supposed to work.

SMTP certainly does not demand that all mail be sent through a higher-tier relay. Rather, SMTP was designed to provide diverse, peer-to-peer mail transaction facilities. It allows arbitrary hosts to exchange mail with their peers and this flexibility is what's let SMTP revolutionize communications!

Pretty much the only prerequisite condition for establishing a proper SMTP node is having a reliable, stationary position.

That's the whole beauty of it. Imagine the unreliable, fragile, and slow communications we would have if every small service provider had to relay its mail through its upstream's relay, until all email was handled through: MCI, UUNet, AOL, etcc. Instead, the point of SMTP is that if your host has its own reliable connection, it can send the mail directly to the destination domain.

Re:flipside

[Mycroft_VIII]

It's a good link folks. It points out how many of things we now consider bad, like open relays and un-munged email adresses in online forums, used to not only be good, but expected or else you were a brainless barbarian.

Mycroft

Re:flipside

[prockcore]

That means you end up receiving mail on the ISP's mail server, and that completely obliterates the point of running your own mail server.

That's what the REPLY-TO header was created for. Like I said, no idea how mail is supposed to work.

Re:flipside

[name773]

thank you!
i just looked up how to do this in qmail, turns out you just have to put .aol.com:smtp.isp.com
in /var/qmail/control/smtproutes

Re:flipside

[Anonymous Coward]

Then pay $20/year for a service like No-IP's Alternate-Port SMTP and stop your bitching.

Re:flipside

[jfengel]

Reply-to, which not every mail client honors.

Re:flipside

[vyrus128]

Silence, troll. Some of us prefer to use the Internet as its creators intended, rather than bowing before our corporate ISP overlords. I'm paying for a pipe, and I damn well want a pipe. (Note: My ISP, DSLExtreme, does in fact give me an unfiltered pipe. So I'm sure not complaining.)

Re:flipside

[gr8fulnded]

For anyone else reading this thread and having the same problem, the file is /etc/postfix/transport in Postfix. Syntax like this: .aol.com smtp:smtp.comcast.net .hotmail.com smtp:smtp.comcast.net .netscape.net smtp:smtp.comcast.net

After that, run a 'postmap transport' to rebuild the transport.db file. I haven't run into a domain yet that wouldn't accept my mail after a quick reroute.

Re:flipside

[cpghost]

Your ISPs mail server generally accepts only mail from one domain, the one you've purchased from them. If you own multiple domains, you need your own mail server!

Re:flipside

[Anonymous Coward]

DSLExtreme requiers registration and showing of papers to get port 25 unblocked and you will be scanned and monitored for being an open relay which is the same as watching airports for terrorists - they have both moved on to other methodologies.

Re:flipside

[Anonymous Coward]

Should be DSLExtreme "now requires" registration and showing of papers to get port 25 unblocked.

Re:flipside

[bourne]

Then pay $20/year for a service like No-IP's Alternate-Port SMTP and stop your bitching.

Hey, there's an idea! Allow one set of corporate bastards who try to constrain how I use my IP connection to fit their business model to drive me to another company who makes money by routing around the unnecessary damage caused the first company!

Sorry, I believe in an internet of peers, not consumers. It may be a cable modem, but it should never become cable TV.

Re:flipside

[Anonymous Coward]

Right but then all the idiots who think that the reverse lookup of your MX or outgoing mail server should be the same as the forward lookup, complain and mark you as spam.

And please no replies saying it is in "the RFCs" because it is not (and please someone start up about the forward one being necessary, so I can punk you out on that one, too). You have:

outmail.mycountyabuseshelters.org 123.45.67.89
outmail.burningantswithmagnifiers.co m 123.45.67.89
outmail.ilikebigbutts.com 123.45.67.89
outmail.potatogardening.org 123.45.67.89

because god knows that IPv4 addresses are more precious than gold so you have jam everything onto a few or less addresses. The PTR record can't guess which one to return. Everybody here is great about pontificating how things should be done, but reality is less than perfect...

Re:flipside

[Anonymous Coward]

No, thanks. I prefer my mail without random 24-48 hour delays and invisibly dropped messages. That's not how mail is "supposed to work."

I agree about the no dropped messges. 24-48 hour delays are perfectly acceptable for a MTX. If your UUCP connection only connects to your upstream provider once/day and their line is busy half the time, you should expect exactly random 24-48 hour delays.

This is OK. (by the email RFCs)

Silently dropped messages like some spam filters are NOT OK. (by the email RFCs).

If you want instant messaging (complaining about delays) use an instant messenger. If you want reliable delivery, use email

Re:flipside

[bourne]

I agree about the no dropped messges. 24-48 hour delays are perfectly acceptable for a MTX. If your UUCP connection only connects to your upstream provider once/day and their line is busy half the time, you should expect exactly random 24-48 hour delays.

This is OK. (by the email RFCs)

I agree completely that the SMTP RFCs set no standard for response times, and that SMTP is a best-effort, deliver-when-I-can protocol.

If I was using UUCP... I'd expect UUCP responsiveness. But I'm not. I'm using a cable provider that boasts they're upping the download bandwidth from 1.5 to 3 MBps. The only excuse for extended mail lag is a lack of interest or an inability to scale (the latter of which is, of course, a sign of the former).

Do I blame them for this? Not really. That's their priority, and most of the users will never notice or understand the poor lag they're seeing. However, I do notice, and I choose to work around it, by behaving as a peer on the Internet and not a consumer. As long as they let me do it (subject to me doing it responsibly), we've got a good arrangement. Which takes us back to the beginning of this thread...

Lost Port 25 traffic

[Anonymous Coward]

It's a small price to pay for a wick3d screensaver.

Port 587

[Anonymous Coward]

Or 465. There are alternatives for sending authenticated and encrypted email to third party, non-ISP mail servers. We should work on grandfathering port 25 for mail senders and leave 25 only for server to server traffic.

Re:Port 587

[Anonymous Coward]

And how many mail servers listen on those ports?

Re:Port 587

[Anonymous Coward]

Mine do. If your's doesn't, do it or request your admin do it. If you're paying someone to handle your mail, they should listen else you might go elsewhere.

Now can we get un-blackholed?

[tjgrant]

I have a little mail-server on the end of my cable line for my domain which has three mail accounts on it. I always find it immensely frustrating that my mail server is on MAPS DUL list and people who subscribe to MAPS block my mail.

It's not been a big enough issue that I've installed SASL for my postfix server, but it would be nice to get off the list.

Re:Now can we get un-blackholed?

[paitre]

Very, _VERY_ unlikely.

One of the tactics that pretty much -all- DNSBLs (and even some ISPs wholesale - like Comcast, incidentally) is to simply not receive email from dial-up type networks. Comcast's consumer-level cable modem service really is no better than dial-up service from a certain point of view (ie. every j6p is able to use it - and they aren't exactly concerned about security).

The odds of a cable modem network getting out of MAPS is as likely as my winning a million bucks tomorrow - nil.

Re:Now can we get un-blackholed?

[Anonymous Coward]

You of course realize that running your mail server is against Comcast's terms of service.

Re:Now can we get un-blackholed?

[b1t r0t]

I run my own domain too. I did a little research and chose two blackhole lists which were concerned with known zombies, then added a third one to catch a few that got through the first two. Now I'm down to maybe 10-20 a day. (Don't ask me which ones. Not only am I too lazy to look them up, there's no need to effectively slashdot them by encouraging more people to use them.)

It's enough of an improvement that mail.app's spam filter doesn't have enough samples to properly detect them all.

Re:Now can we get un-blackholed?

[msim]

What about getting off SORBS?

Those mofo's still have my host on a blocklist due to someone co-lo'd in the same datacentre 12 months ago starting to send spam. They got away with it for a brief period of times before being booted out of that co-lo.

Now were stuck with sorbs, and aside from paying some penalty for something we didn't frickin do, were stuck on that bloody list. And i might add the guy is out there spamming away his printer toner cartridges still. /bitch session

AT&T - Comcast

[murderlegendre]

Spam coming from Comcast subscribers who were formerly on AT&T networks also seems to have decreased.

Seems as as we are *still on* an ATTBI network. I was originally an ATTBI subscriber, and the Comcast transition occured many months ago. Interestingly enough, my rDNS still resolves to:

[ip].[state].client2.attbi.com

Seems awfully odd that this remais.. one would think, at least for the sake of the brandname, that this would be reporting comcast.net

Re:AT&T - Comcast

[Anonymous Coward]

You're not the only one! Mine resolves to ne1.client2.attbi.com too. I've been a subscriber long before Comcast took over. When I roam on neighbor's wireless networks (naughty I know, but they're all wide open!) most of them show Comcast, so I think it's customer specific and not area specific.

Re:AT&T - Comcast

[LetterJ]

4 years ago I signed up with MediaOne cable, which became RoadRunner cable, which became AT&T broadband, which finally became Comcast. Along the way, each left traces that took *years* to finally transition all of the way.

Re:AT&T - Comcast

[Anonymous Coward]

i only joined comcast two months ago and i've got the attbi thing going too. a friend of mine's had cable 'net access through comcast for a year, same deal. we're all in the boston area...

Re:AT&T - Comcast

[Anonymous Coward]

AT&T Broadband sold their customers to Comcast. AT&T still manages the network, provisioning, and servers for Comcast, as well as Mediacom and Insight broadband.

Re:Yea right...

[batkiwi]

Not only can you not read the article, you can't even read the story text.

Here, I'll help you:

"spam from their network has dropped 35 percent"

The important thing is HOW MANY OF THOSE 500 ARE FROM COMCAST'S NETWORK?. Also, compare that to your 2 months ago rates of spam coming from comcast's network.

Come on, how hard is it REALLY to read THE TEXT ON SLASHDOT?

"Paying off" ?!?

[Anonymous Coward]

The other way of looking at this is that despite the draconian measure of blocking port 25, 65% of spam is still getting through.

C minus. Must try harder

Less Spam

[radiumhahn]

... To make up for the difference spammers are making their emails more offensive.

Sheesh. yourselves

[bstadil]

Let me see. You are travelling and want to send email from a mailserver while logged in via Wifi.

Now does the mailserver "Provided by your ISP work? No, they block any IP not their own. Now if port 25 wasn't blocked you could use your own and avoid having to change the Client setup.

I have exactly this problem and have to pay $10 / year to have access to a smtp server that will allow me to log-in from any IP.

Re:Sheesh. yourselves

[cheekyboy]

if you are travelling, just use a webbased email client via your personal server, use squiralmail, jeeeez, sure its different, but its the best remote way and its not like ur some exec ceo that does 7 trips a month.

Re:Sheesh. yourselves

[mi]

By letting you download an SSL certificate, your (or any) ISP can allow you (and any of their customers) to relay mail through their servers.

Sendmail supports client-side SSL certificates, as does Mozilla. KDE does not :-( But outlook, probably, does, and that's all that matters.

That your e-mail is protected from sniffing over the WiFi, while you send it, is just gravy.

Re:Sheesh. yourselves

[Karrots]

Both Comcast and my dial up ISP let me relay email if I first login with SMTP-AUTH. Now my university doesn't but thats just because the network admin insists on having the CISCO PIX smtp-fixup turned on which doesn't allow ESMTP to communicate.

Re:Sheesh. yourselves

[cas2000]

> I have exactly this problem and have to pay
> $10 / year to have access to a smtp server that
> will allow me to log-in from any IP.

boohoo....$10/year. that's almost 3 cents a day. my heart bleeds for you.

Re:Sheesh. yourselves

[bstadil]

Both Comcast and my dial up ISP let me relay email if I first login with SMTP-AUTH

Good tip, I will try that Thanks

Re:Sheesh. yourselves

[Anonymous Coward]

Sendmail supports client-side SSL certificates, as does Mozilla. KDE does not :-( But outlook, probably, does, and that's all that matters.

Outlook and outlook express do NOT support client-side SSL certificates for SMTP. They will use server-side certificates for sending, and they will use SMTP AUTH, which is good enough.

Outlook and OE can use client certificates to encrypt/sign email messages, but that is very different.

Re:Sheesh. yourselves

[Kiryat Malachi]

How much do you want to bet the mailserver provided by the ISP of the moment - the wifi provider - works?

Your ISP is the person providing your pipe, not the person you pay at home. If you aren't at home, you might need to use a different server - how hard is that to understand?

Re:Sheesh. yourselves

[Anonymous Coward]

how hard is that to understand?

Hard apparently, since everyone has lots of great theoretical crap to say when this topic comes up, but it all boils down to "Why are you on the river without the proper paddle, lifevest, map, GPS, food, survival supplies, wet suit, radios, batteries and water proof matches?"

And the answer is - that's life, sometimes the river comes to you - you don't always have what you need, every wifi hotspot doesn't have a dedicated smtp server some are just a netgear antenna plugged into the wall - every situation isn't clean and well stocked with the appropriate supplies and equipment.

Re:Sheesh. yourselves

[Kiryat Malachi]

Let's say, for theory's sake, that this netgear antenna plugged into a wall is where we are.

Who provides their upstream? Is it Comcast? SBC? Verizon? Qwest? Whoever it is, I bet the upstream has a SMTP server. Almost all of them will accept and route mail from clients on their network.

The provider of the pipe is the ISP. Not the antenna you're attached to, necessarily - in fact, not usually the antenna you're attached to. The provider of the antenna's pipe.

Re:Sheesh. yourselves

[mi]

[Outlook supports] SMTP AUTH, which is good enough.

Is it good enough? Can't one sniff the SMTP AUTH session over WiFi or similar and then proceed to relay tons of spam pretending to be you?

Why just the port?

[jarich]

I understand that these machines have been hijacked and the owners aren't at fault (unless you count negligence)... but all that being said...

1) Contact them and tell them what you've learned. Give them 30 days to get the machines patched or cleaned.

2) Terminate their service OR allow their service to continue but charge them an extra amount of $$ per month to cover the "blocking service".

Don't just block the port and let the owners continue in ignorance. You've identified them. Now do something with that information that effects long term change!

Re:Why just the port?

[cdavies]

The problem is, none of that is in the best commerical interests of comcast, so they won't do it.

Actually contacting people costs money because a human has to pick up the phone. Terminating their service costs money for obvious reasons, and charging them for a dubious "service" is likely to get your customer angry at you and waste time and money in calls to your help line.

In the short term, automated blocking and letting the user ride along is blissful ignorance is the only viable strategy. Isn't capitalism great?

Re:Why just the port?

[StuWho]

I believe a home visit by a cattle-prod wielding Company Representative would also do the trick, and I'm sure myself and other recipients of offers such as "Increase Your Penis Size While Improving Your Search Engine Placings On Google" would willingly fund this if neccessary.

Re:Why just the port?

[aldoman]

I'm sure they actually don't know who is sending the spam. They are probably just blocking 25 ports and not routing it out onto the internet.

Comcast probably has hundred-gigabit connections to the internet - do you know how much it would cost to inspect all those packets in real time and record IP addresses? A lot more than you probably think.

Not only that, comcast is a horrible network. They have had multiple takeovers of smaller cable customers, most of which they haven't integrated into a unified network (if they even have one).

Then you are talking about $20/customer for all the admin work - multiple phone calls, tracking them in a database, looking up their IPs throughout etc etc.

It's much easier to just ignore the problem

Re:Why just the port?

[jarich]

The problem is, none of that is in the best commerical interests of comcast, so they won't do it.

Sure it is... by charging extra $$, they make more $$. How many people will ignore that extra $5 a month on their ISP bill?

I do like the redirection to an informational web page idea though... let them click on past it but at least they've had a chance... and that could pass for the notification as well.

Re:Why just the port?

[jarich]

Dang... I know most people don't read the article, but you didn't even read the post! ;)

'After Comcast finally owned up to the massive amounts of spam coming from their network, they decided to identify spammers and zombie relays on their network and block port 25 traffic from those IP addresses.

Re:Why just the port?

[nacturation]

Actually contacting people costs money because a human has to pick up the phone. Terminating their service costs money for obvious reasons, and charging them for a dubious "service" is likely to get your customer angry at you and waste time and money in calls to your help line.

One possibility is to increase the monthly fee for *all* subscribers but have a "clean PC" discount which makes it less expensive than before. For example, if Comcast now charges $40 a month for X service, they can raise the price to $50... but customers who don't have zombied computers automatically get a discount to make it $38 a month. Not perfect, still need to accurately identify the zombie from the clean PCs... but a financial penalty would certainly motivate more people to do something about the problem.

Imagine if someone's fax machine were hijacked and used to send out death threats. How long would that be allowed to go on before police would come knocking on the door? Spam isn't quite as serious, but some days I wish it were treated the same -- or at least treat the spammers as murderers. :)

Re:Why just the port?

[Pharmboy]

I believe a home visit by a cattle-prod wielding Company Representative would also do the trick, and I'm sure myself and other recipients of offers such as "Increase Your Penis Size While Improving Your Search Engine Placings On Google" would willingly fund this if neccessary.

I don't know about you, but I have been responding to all the "Increase your Penis" ads, and now my wang is so big, I had to buy new pants. Thanks to all those guys in Africa, I have more money in my bank account than I could hope for. I used it to buy stocks based on tips that these guys have been sending me, and have doubled my money in a week every time. Of course, it doesn't really matter, because I am buying software for 80% off retail, get people sending me really cool screen savers for free, and refinanced my home at unheard of interest rates.

Now I'm getting tons of email from girls that want me to meet them and their coed girlfriends, so the new, bigger penis will come in handy. I even ordered some discount Viagra so I can keep it going all night. I think what really impressed them was my new university diploma, that I received for my lifelong accomplishments.

Gotta run, looks like someone just sent me a greeting card. Hope its one of the hot college chics. I still don't see what all the fuss is about...

Re:Why just the port?

[sporty]

Because, blocking the port is a "better" cost effective measure to/for them.

Instead of installing monitoring the line, having people paid to doing this beaurocracy plus the machine power to filter on rules.

they rather...

Globally block the port on the firewall. After all, they have one in place somewhere, just have to add a rule.

I don't disagree with you. I'm just pointing out the reasoning :)

Re:Why just the port?

[Mycroft_VIII]

Only problem is, everyone will say hmmm, comcast is $50 and fooisp is $40. Then they bitch and/or switch.
I think I'd start out with a simple re-direct of thier first webapage grab everytime they log on (or every 2 hours if thier always on) to a page explaining thier machine has been dected sending bar (spam, virus packets, pictures of goatse.cx guy, etc.) and that they have x days (for a reasonable x) to eigther fix the issue or contact the isp to clarify the issue if they believe there is a mistake. Warn them that thier machine will only be severly restricted to contacting the isp only after x days if the issue is not resolved, and thier account suspended after x+y days. End with appropriate links, including one to the page originally requested.

Mycroft

Re:Why just the port?

[msim]

That's possible,

Other solutions include sending them harrassing emails advising them to use windows update *chortle*. :-)

Re:Why just the port?

[Mycroft_VIII]

The only thing that worries me is if some idiot decides because thier doing this then thier liable for every virus/spammbot/whatever connected to thier network.
This is where they need to have a good AUP in place that specifies that they MAY do this but are in no way liable if they miss one and that all liability for compromised machines belongs to the owner of said machine.
I hate punching holes in my own ideas, but honesty requires it when I see one potentially that bad. Then again IANAL so maybe I'm worried over nothing.

Mycroft

Re:What a crock0sheet

[Anonymous Coward]

Just a thought...send the list of IPs to abuse@comcast.net?

Re:Yea right...

[tarquin_fim_bim]

This is about normal

The unfortunate truth is that we have come to accept wholesale abuse of our collective inboxes as 'normal', SMTP is woefully inadequate, the next time saving technological advance will probably be the rediscovery of pen, paper and stamps.

Comcast blocking me....

[whoever57]

Oh wait, no! It's just that my Comcast-owned cable modem won't talk to my computer for the n'th time today.

Really! It looks like the equipment they provide now is pure junk. Before it was rock solid, now it goes down many times per day and the only solution is to pull the power connector.

But seriously, why has the spam from Comcast not fallen further? Is Comcast only running a trial on part of its network?

I'm still seeing lots of Comcast IP addresses blocked by using the XBL.spamhaus.net RBL -- how is it that Spamhaus is better at detecting these machines than Comcast?

Re:Comcast blocking me....

[Anonymous Coward]

Maybe you should trash the modem they gave you and go get a good one! I've got an older Toshiba cable modem (a PCX1100, Pricegrabber lists it for $64 right now) and it is absolutely rock solid. Never unplugged the thing in 3 years, except to get the speed doubling they promoted a little while back!

Re:Comcast blocking me....

[yamcha666]

I don't know what kind they gave you, but my Motorola Surfboard SB3100 they gave me 3 years ago, when AT&T Broadband was my ISP, is still kicking and screaming. It's actually outlasted my Linksys BEFSR41 Router in lifespan. I have noticed those newer Surfboard's seem kind of flimsy as if they're made of cheap plastic.

Re:Comcast blocking me....

[Anonymous Coward]

You probably have a signal quality problem. Perhaps even an intermittent problem.

I've had cable modem service for several years and both installations have required repeat visits to attain long-term stable signal strength/quality.

They've always been happy to roll the truck to repair my complaints; eventually you get someone competent enough to resolve the problem(s) correctly. I would assume your branch is equally willing to send someone out.

Comcast has impressed me lately. They appear to be changing their ways; time will tell if this extends to the IP attorneys and related mgmt decisions there.

I might as well sign up with AOL...

[xiang shui]

I take offense to this kind of thing. I live in northern Alberta, and my ISP, Telus, recently began blocking a wide range of ports, most of which I had previously noticed heavy worm activity on. So I must presume that is their rationale behind filtering these ports. But this worm activity didn't bother me, since I have my machine properly secured. It's none of my concern if some people don't. Now I feel as if I don't have a REAL TCP/IP connection to the internet. I have 65355 ports on my TCP/IP stack that I should be able to use, as I please. But I no longer can, because of this. I run an HTTP server as a testing ground for some of my web projects, and an FTP server so my friends can transfer files to and from my machine. And I'd like other people on the internet to be able to access these ports, since that's what the internet DOES. That's what it's for. If I wanted a private company to dictate how I could use my computer and my internet connection, I would be a regular Microsoft customer. Admittedly, this situation is a little different than the one in the article - since comcast only blocked port 25 of computers known to be transmitting spam. But the situation with Telus is a blanket filtering of these ports for all DSL users, which I completely disagree with, and it actually angers me. Now I have to find a new service provider, and believe me, this isn't easy in the small community where I live.

Re:I might as well sign up with AOL...

[imroy]

I think you'll find that Comcast is only blocking outgoing connections TO port 25, and only after your behaviour has been deemed suspicious. They're not blocking incoming ports, if I understand it correctly. Your ISP however, is probably acting more out of a no-server policy rather than a desire to block spam.

Re:I might as well sign up with AOL...

[Jeff DeMaagd]

If you want unfettered internet access, it is called a T1. Look it up. You signed up for a less expensive service in exchange for a few restrictions. No consumer-level ISP is out to provide you 100% unfettered service. You should have checked your terms of service before you signed on, the ISPs I've seen have it pretty clear that subscribers are not allowed to run servers through that link.

I know you don't care about the worm activity, but it costs the ISPs a lot of money to be hauling that traffic.

Re:I might as well sign up with AOL...

[WaKall]

Check your terms of service. Most ISPs have a clause preventing you from running Servers on well-known ports (http, ssh, telnet, smtp, etc). This is partly to minimize your bandwidth usage, and partly to make you pay for the 'business' package which lets you run servers to your heart's content.

Regardless of what you thought you were getting, there was a set of rules for your use of that connection, and they may be well within their rights.

Re:I might as well sign up with AOL...

[Tripster]

Umm, it is quite easy to get the blocked ports unblocked with Telus .. sign up for a business account and you'll get that plus 2 static IP addresses.

I haven't looked at their TOS yet but I'm pretty sure it will mention residential accounts are meant for incoming data mostly and that public servers are a no-no.

As admin for similar ISP situations I can vouch that blocking worm and SMTP ports on residential accounts works wonders, and for most clients they don't even know the difference.

One thing I dislike about how Telus is doing this however, they will deny they are doing it and pass blame onto the other end (hosting providers for example).

Re:I might as well sign up with AOL...

[Anonymous Coward]

Get over it. You signed up with a service that reserves the right to do what's in the best interest of their entire customer base and the entire rest of the internet. You have no right to get uppity at them for taking away your "testing ground for your web projects" if it reduces the global amount of spam by 30%. Think your web projects are more important than that?

Re:I might as well sign up with AOL...

[deflin39]

The problem is ISP's keep changing the TOS and keep RESTRICTING the usage of their network. The noose is getting tighter and tighter, but the cost still keeps going up?!?

Re:I might as well sign up with AOL...

[Anonymous Coward]

>>I take offense to this kind of thing. You say you properly secure your system but you allow FTP access?

Passwords are flying across the network in plaintext. you're probabably hosting a bunch of war3Z

Re:I might as well sign up with AOL...

[The Meshback]

It's called Terms of Service--which you agreed to when signing up for your service. You don't own the line coming into your house, your ISP does. If you don't like it, go ahead and pay for that T1 on your own.

I've heard this same, 'oh, xxx ISP blocks my ports, i'm leaving' complaint a dozen times. Most broadband ISPs are blocking ports. It's the give/take of availability of high speed internet against uninformed users.

Either learn how to use different, unblocked ports for your services or deal with the result that the internet is not just for you.

Re:I might as well sign up with AOL...

[WuphonsReach]

If you want unfettered internet access, it is called a T1. Look it up. You signed up for a less expensive service in exchange for a few restrictions. No consumer-level ISP is out to provide you 100% unfettered service. You should have checked your terms of service before you signed on, the ISPs I've seen have it pretty clear that subscribers are not allowed to run servers through that link.

(Or business-class DSL/cable. Unfortunately, my static IP falls into a dial-up block... sigh... but that's another battle.)

Exactly, if you want an unrestricted account then you need to be willing to pony up the monies to pay for the support costs associated with that account. Consumer-level service is cut-rate and anything that causes additional support costs will quickly be written out of the contract. To do anything else would quickly drive the ISP out of business. It's like complaining that you don't get first class service when you're flying in cattle class.

(I pay around 4x the going rate for my DSL service. When it goes down, I get to go to the head of the queue to get it fixed. They've never sent me an overusage notice or bothered me in any other way either.)

Re:I might as well sign up with AOL...

[jcorgan]

I have 65355 ports on my TCP/IP stack...

What happened to the other 180 ports?

Re:I might as well sign up with AOL...

[foniksonik]

If you want a server... get a server in the ISP... co-locate, whatever, or get a business account. If you make money with the service you WANT to pay for a dedicated connection for business... this way you can WRITE IT OFF as a business expense.. they do have that in Canada right? This way you get better service, a dedicated server, a better connection and 24x7 guarantee and a tax deduction. If you only need it for testing, you don't need an internet connection... ever hear of localhost?

Re:I might as well sign up with AOL...

[Anonymous Coward]

I had a clients web/mail service go down when Telus implemented that change. What Telus did was block outbound only on these ports for residential customers. The Client was an old account, and for some reason was recognized as a residential account. We got that cleared up, and their web/mail was back online.

If you want to use web/mail services with your ISP (telus), then switch to a business account. The terms of service for residential do not allow web/mail server operation.

Re:I might as well sign up with AOL...

[rossz]

You should switch to sonic.net if they are available in your area. Great service. No port blocking. Static IP. You can run a server.

They _will_ shut your ass off if you get infected and start spewing out spam or hitting other systems to infect. They'll at least try to call you first, but if they can't get in touch with anyone, they turn you off and wait for you to call.

Someday they may grow so big that they can no longer provide the wonderful customer service. That will suck.

Re:I might as well sign up with AOL...

[rossz]

Oops. You're canadian. No chance you can get sonic.net. Sucks to be you.

Re:I might as well sign up with AOL...

[dave420]

You can change the ports services run on, btw... it's not that hard :-P

Re:I might as well sign up with AOL...

[Anonymous Coward]

Of course it's well within their rights.

But it doesn't mean you have to like it and you can move on to another ISP.

You see that's the point of capitolism. You don't like it you don't pass a law about it or try to threaten anybody, you just give your money to somebody else.

Then the compition will resolve any bad things that you don't like out of the equation.

Many people do like blocked ports, it saves them a little bit of effort to stop worms. I don't like it though. But to each their own.

Blocking connects from broadband subscribers

[perp]

After I first read about this Comcast thing, I looked into how to block connections directly from spambots on home machines to the corporate mail server I admin (~500 users). I set Postfix up to check_client_restrictions and look up the connecting machine's name in a file that lists all the broadband domain names I could find. The results were so good that I have now added every little ISP whose machines send me spam and started using regexes to catch the ones where if I blocked the domain I'd also block their mail server.

The results are truly staggering. I have cut the incomimg spam by 80-90%. I cut incoming spam by 50% just by blocking client.comcast.net, client2.attbi.com and cpe.net.cable.rogers.com. The users think I'm a miracle worker. So far I blocked 2 legit messages ... one guy with a home mail server and one guy whose Telus mail server I accidentally blocked with my filter. The error message says to mail abuse@mydomain if the message is blocked in error and, of course, check_client _restrictions is turned off for the abuse account.

I was amazed at how little "legitimate" spam there is out there. It is almost all hijacked home machines.

Re:Blocking connects from broadband subscribers

[TubeSteak]

Not to jinx it, but what if some jerk starts spamming your abuse account?

Re:Blocking connects from broadband subscribers

[perp]

Not to jinx it, but what if some jerk starts spamming your abuse account?

I'd have to track them down and kill them :-). Actually, postmaster and abuse are two accounts that every domain has, but they hardly ever get spam, because spammmers are afraid of us (insert demonic laugh here). Or perhaps it's just because they know that we will trace them back and report them, since we can read email headers better than your average user.

Re:Blocking connects from broadband subscribers

[Rasta Prefect]

I'd have to track them down and kill them :-). Actually, postmaster and abuse are two accounts that every domain has, but they hardly ever get spam, because spammmers are afraid of us (insert demonic laugh here). Or perhaps it's just because they know that we will trace them back and report them, since we can read email headers better than your average user.

Lucky SOB, most of mine get spammed to death right along with everything else. See rule number 2.

Re:Blocking connects from broadband subscribers

[geminidomino]

In my experience, if a spammer has the balls to attack role accounts (abuse@, postmaster@, admin@), they are PROBABLY (not 100%, see rule #3) on a "bullet-proof" host who isn't likely to do anything about them, even if they get complaints. That's where I 'ssh heimdalr' and add a few more lines to rc.ipfw

Re:Blocking connects from broadband subscribers

[WuphonsReach]

Not to jinx it, but what if some jerk starts spamming your abuse account?

That's what SpamBayes (or other client-side filtering) was invented for!

Seriously, our postmaster@, webmaster@, abuse@ addresses are all prime targets... all spammers do is take the list of all domain addresses in the world, prepend one of those 3 names on the front and then sell the list. Monitoring those accounts has always been an exercise in frustration.

Re:Blocking connects from broadband subscribers

[klang]

I've had my private domain for almost 7 years now and I have never recieved any spam on the webmaster@ account. Truth be told, the webmaster@ address is not written anywhere on my site (the "If you can't figure out it's an active account, I don't want your mail anyway" philosophy applies here).

Actually, the trash@ account I use every time I have to write an address somewhere gets virtually ZERO spam (i.e. 1-2 msgs a year)! I don't understand this part at all!

Re:Blocking connects from broadband subscribers

[dbullock]

200,000 pieces of spam a week here (75 user corporate mail server) to a domain that's about 10 years old.

I did the exact same thing -- post Postfix in front of Exchange and setup filters to block just as you did. Got the exact same results too.

Re:What a crock0sheet

[Anonymous Coward]

You're kidding, right? abuse@* don't pay attention to anyone but the FBI and RIAA. Sometimes not even the FBI.

IPs or users?

[PrvtBurrito]

those IP addresses I hope they are blocking users and not IPs, because a lot of the offenders are probably on dynamic IPs....

Re:IPs or users?

[pknoll]

Actaually, though the IPs provided by Comcast (and previously AT&T) are served by DHCP, they're effectively static. Since they use the MAC address of the connected machine to authenticate* legitimate clients, you end up getting the same IP every time thanks to:

host yadda { hardware ethernet [MAC...]}

directives. I assume that's what they're doing; I've had the same "dynamic" IP for a bit over three years now.

* In this case, "authenticate" means identify, so they can refuse to give more than 1 IP per client connection in the markets where this is enforced.

Re:IPs or users?

[m1dlg]

if ISP were made by law to block all (but the essental few) ports till a user required them, (by default,) the problem would be cut over night. the only requirement for the user to have a port (or ports) opened would be a reason to have the port open. i.e. the user couldn't e-mail in just in case some one spoofed his / her e-mail, requesting a port to be opened, but it would be easy to check with customer if the request was real. this would be difficult to start with, but it would cut unnessessery traffic to less than 5% over night - hell it might even put server companys out of buisness as those servers that work flat out shifting spam around lie dorment, the inital costs would be high as people would need to be told what is happening, and other countrys would need to do this too, the other costs would be staff at isp's would need to hired to handle the customer calls increase. this would have to implimented globally and only ports used for basic access to the internet like telnet /finger /ping /shttp/ ftp /http /email /P2P allowed to start with. it would be better to do it now too, as the internet is getting bigger - fast.

If anything I'm seeing more spam

[csk_1975]

I'll check my logs when I get into the office, but if Comcast has reduced the flood of spam from their netblocks then someone else has more than taken up the slack.

Normally I get between 2,000-2,500 spam a week in a mailbox I use as a spamtrap. In the past month this has ramped up and last week there was over 4,500 and since monday there are 2,485, um 6, um 7, spams in this particular mailbox. So in 4 days I've seen as much as I normally see in a week - and its not even the weekend yet when the real flood of spam kicks in.

Re:What a crock0sheet

[Anonymous Coward]

I could try to log it, but I got more important stuff to do. Like block wanadoo and verizon and swbell and roadrunner and adelphia and mindspring and hinet and all the other DSL providers in the world. I'm about ready to pull the plug on the mail server and just tell people to call me on the phone. E-mail is about useless any more.

And did you ever get any response from any ISP's abuse@ email? Seriously, I used to believe in that fairy tale too, but in the real world abuse@ emails either bounce or go to /dev/null.

Agreed

[TubeSteak]

It'd make much more sense to notify them or do a page redirect than to charge extra or shut 'em down. The odds are, if they're acting as a spam relay, their machines aren't patched, running a virus scan, a firewall, etc. So at the minimum, redirect them to a page with a comcast hosted online virus scanner & windows update. I know I'd suggest Ad-Aware & Spybot & a firewall, but if comcast tells you to use anything... they're stuck having to provide tech support when it screws up.

No blockage?

[Fenis-Wolf]

I'm on Comcasts network, and I haven't had any problems sending email, and I'm not using their email servers. This seems to be an isolated policy perhaps?

Re:No blockage?

[Staos]

You don't even have to RTFA for this... Did you just skip directly to the comments?

I'm reporting less

[mr_rangr]

I have a paid SpamCop account. I used to report everything, but it just takes too much time and the amount of spam continues to rise. I will not be renewing my SpamCop account once it expires next April.

I'm happier with using good spam filtering (Spam Assassin/Spam Sieve) and just ignoring the problem. I see much less spam this way, compared to looking at each and every spam I report.

Comcast isn't the world

[Chatmag]

Just in the last few minutes, and checking headers, the spam I recieved came from Sweden, Korea, and one from...drum roll...Comcast. But seriously, most of the spam is coming from not just the USA.

Re:Just wanted to let you know:

[Anonymous Coward]

Dear User,

your Internet Protocol number has been logged for legal purposes in accordance with our efforts to reduce the increasing amount of sexually abusive language on this site and to comply with the Rules Of Governance In Electronic Media as required by Californian law.

We are to inform you of the legal steps taken against the holder of mentioned number, which we hereby do.

Please refer to the Bureau Of The Attorney Of Los Angeles (CA) county to request your case number, as this message is generated electronically and we have no means to determine the case number at this moment.

Thank you.

Disable their Internet connection

[mikeg22]

I don't see the problem here. These machines have been *hijacked* so there should be no issue cutting them off from the internet if not for the internet's sake, than for the sake of the owner of the computer! I mean, if the machine has been comprimised, there could be a keylogger running just as easily as a spambot program. Pull the damned thing off the internet and tell the user to fix their machine. If they don't know how to do this, charge them $20 for a technician to come out there and run adaware, S&D, etc...or offer to send them these programs on a CD through the mail or for pickup at the ISP office.

There is no excuse for not securing your computer. If people don't want to take the half hour it takes to learn how to download and run adaware, S&D, and/or an antivirus program, they should NOT be allowed to connect to the internet. Is this so unreasonable?

Re:Disable their Internet connection

[timmarhy]

too right brother. people should get a license to have kids AND have a computer

Re:Disable their Internet connection

[almostmanda]

If you want to make money, then yes. If my ISP shut off my internet access with no warning for whatever reason, that would sound like the perfect time to switch my provider. People get pissed when they can't check their email.

Re:Disable their Internet connection

[mikeg22]

Ok, your internet connection no longer works. You call up your ISP and they tell you your computer has become hijacked and taken off the internet for your protection. They then give you clear instructions on how to un-hijack your computer, which you follow, they test, and now you are back on the internet.

Tell me again why this will make the ISP lose money? If anything the ISP will save money on not having to support the bandwidth required by thousands of spambots churning out hundreds of thousands of emails a day.

Re:Disable their Internet connection

[nick0909]

Because it will take call centers with trained people able to help morons undamage their computer. And from the number of compramised computers, it would take a WHOLE LOT of call centers and trained people to undo what the morons have done to themselves. That would cost way more than if the ISP just pretended not to see it and kept collecting the checks.

Then there is the liability if they do it wrong and destroy more data on the computer of said moron user. It is just a whole mess that would not get the ISP anything but more phone calls, which is what they like to avoid.

Re:Disable their Internet connection

[almostmanda]

If your phone company shut off your phone service because your son and his friends were making prank phone calls, would you be ok with that?

Re:Disable their Internet connection

[mikeg22]

If your phone company shut off your phone service because your son and his friends were making prank phone calls, would you be ok with that?

If there was a phone number that was making prank calls 24 hours a day, 7 days a week, I certainly hope the telephone company would feel compelled to shut down the line.

However, this is not in any way analogous. An analogous situation would be if somebody went out to the telephone pole outside my house, hacked into my line, and started making cold calls to random numbers selling fake viagra. Yes, once again I would at the very least, want the phone company to close down the line until the problem was solved!

Re:Disable their Internet connection

[Battle_Ratt]

It could be done in a more user friendly manner than just cutting them off.
Switch them to a DNS that is configured to work for those that are compromised.
Default 99% of the internet to route to a self help page, that has links to spambot removers, ad blocking software, and such that will resolve correctly.
Then have a way for said help page to mark them as clean after they have made the necessary fixes.
Tell them to re-boot, and give them back access to the standard DNS.
Infected again? Lather, rinse, repeat.

Re:Disable their Internet connection

[Anonymous Coward]

You'd likely punish your son and tell his friends parents before getting ticked off at the phone company. Prank calling is a legit reason for them to turn off your service. It's also a criminal act.

Re:Disable their Internet connection

[randomencounter]

So charge for it.

If you can detect infected computers, block traffic to and from the computer, redirect all port 80 requests to a notification page with references to the phone numbers of local companies that specialize in computer maintenance.

Do NOT let these people stay on the net and be a risk to themselves and others.

Re:Slashdot Quiz

[xanadu-xtroot.com]

4. Is God the all-powerful and all-knowing Creator of the universe, and does he still rule it today?

What do you mean by "God"? Is it Good Orderly Direction? Is it the "God" that's in the Christian Bible? Is it the "God" that came from Finland and wrote an OS? Is it the God that comes in a wrapper of cellophane?

The term "God" is extremely vague. I suggest that you re-word your troll some, it might actually mean something.

Thanx.

C0mc@$t with few problems

[Anonymous Coward]

I'm a Comast customer. I also run my own mail server, and have four separate domains receiving mail. But, I also know how SMTP is supposed to work, and have a fallback-mx-relay configured to send mail out throuth smtp.comcast.net if I can't send directly. In other words, no problems.

But, I got a warning letter from Comcast that they noticed me sending out too much mail, which I have taken up with their abuse department because they obviously don't check their logs.

Of the four domains I receive mail for, I receive over 3,000 pieces of email per day.

I also use ASSP (assp.sourceforge.net), and have ASSP set to forward every piece of SPAM to uce@ftc.gov.

Over 85% of all mail received is marked spam. That's over 2,000 pieces of spam that's automatically being forwarded to the FTC, and over Comcast's mail servers, and they're complaining!

Jesus. I'm actually doing something to help stop the problem.

If only T-1 lines were cheaper.

Let's look at some numbers

[bigberk]

Comparing to these measurements I made when Comcast first announced its strategy...

Looking at Comcast's IPs appearing on realtime blocklists, today:
CBL: 17132 (Comcast is 1.3% of CBL)
WPBL: 4779 (Comcast is 9.6% of WPBL)

Compared to the number of Comcast IPs that were spam sources two tweeks ago (19897 and 5199) it does appear that there are fewer Comcast spam sources. However the overall proportion of Comcast IPs in the entire lists haven't changed much from (2% and 10%)

I stopped reporting for two reasons

[Mustang Matt]

1. I couldn't keep up and my efforts didn't seem to make much difference.

2. Spamcop got stricter and a simple copy and paste from the outlook express headers stopped working. At the time I was using spamcop I wasn't willing to switch email clients. Now thunderbird is almost up to par with everything I need.

meanwhile, Comcast's SMTP server is slow as hell

[adpowers]

Yay! Now we are all forced to forward our mail through Comcast's SMTP server.

Actually, I have been sending all my mail through Comcast's SMTP server for a while now, because AOL blocks mail directly from my (semi-)dynamic IP address. So, if I want to send mail to AOL users (well, the rest of the family using the SMTP server), I have to send it through Comcast's slow-as-hell mail server.

When I send mail to Gmail, for example, directly from my server, it takes just a few seconds to appear in my inbox, but when I forward it through Comcast, it often takes an hour or more.

Now, this is not completely Comcast's fault, AOL is to blame as well. It really pisses me off that I lose the speed and privacy that comes with having my own SMTP server just because the big providers can't figure out any ways to deal with spam. Fun.

Andrew

RTFA

[Peyna]

They didn't block port 25 for everyone; only the people that were sending a crapload of spam.

I've noted a recent increase in spam.

[Da w00t]

Some spammer decided to joe-job me. Very annoyed. At some point, my domain that they're spoofing mail from is going to get blacklisted -- not because mail is coming from it, but because it appears to be. I havn't seen any spamcop reports or anything similar, but I've seen metric fucktonnes of Win32 worm messages coming into email addresses that never have existed at the same domain that's being joe-jobbed. I really need an antivirus solution built into sendmail. Spamassassin works for 99% of my spam, but these god damn worms are driving me absoltuely insane.

There isn't really all that much you can do about being joe-jobbed, 9 times out of 10 the "admins" for the zombified machine doesn't understand that I'm not the spammer, eventhough I received the bounce for the spam.

Anyone have any good results at trying to get a joe-job to stop?

Re:I've noted a recent increase in spam.

[Anonymous Coward]

I'm currently being joe-jobbed (fortunately on a domain that's never been used for incoming email). There's no much you can do except to add an SPF record for the benefit of the four people in the world who honor them, and setup an incoming mail filter to automatically catch and destroy the bounce messages.

Re:I've noted a recent increase in spam.

[Alioth]

Blocking worms is easy. Just reject all Microsoft executables. Tt's not too difficult to configure a filter to do it in most MTAs.

Re:I've noted a recent increase in spam.

[Just Some Guy]

First, install ClamAV and tell Sendmail to use it as a milter. It's surprisingly effective and lightweight; the load on my mailserver actually went down after installing it because it's no longer attempting to deliver tens of thousands of viral messages.

Second, configure SPF records for all of your domains. It may not help today, but an increasing number of mailservers are rejecting mail that fails SPF validation.

Third, learn to love your access file. Mine contains lines like:

erin@honeypot.net "550 This account was spoofed by some jackass spammer. It doesn't exist and never has."
michelle@honeypot.net "550 This account was spoofed by some jackass spammer. It doesn't exist and never has."
mike@honeypot.net "550 This account was spoofed by some jackass spammer. It doesn't exist and never has."
mikey@honeypot.net "550 This account was spoofed by some jackass spammer. It doesn't exist and never has."
misha@honeypot.net "550 This account was spoofed by some jackass spammer. It doesn't exist and never has."
richard@honeypot.net "550 This account was spoofed by some jackass spammer. It doesn't exist and never has."

Mail coming in to any of those accounts is rejected before it can even be transmitted. You still have to spend a TCP connection on the message, but minimal bandwidth and no storage space.

Re:I've noted a recent increase in spam.

[Da w00t]

I'd love to do that :( I'm picking up my email via fetchmail, from a qmail catch-all.

Re:I've noted a recent increase in spam.

[Just Some Guy]

Ahh. Do you have a static IP or access to dynamic DNS? If so, you could configure the Qmail server as a secondary MX and your machine as the primary MX for your domain. If you're online, people can send directly to your local server. If not, then the Qmail machine stores it until you come online and send an ETRN command, at which point it flushes its queue and you can reject it at appropriate.

The comcast USERS get it even worse

[thegoogler]

one of my friends has comcast and he quit using his comcast email because it was getting spammed big time before he had even used it for anything, so its even worse for the users, there not blocking port 25 within there own network are they?

Re:The comcast USERS get it even worse

[mikrorechner]

there not blocking port 25 within there own network are they?

Yeah, why doesn't Comcast simply block their own incoming port 25? That would get rid of spam for good.

Please, think for a second before you post.

Re:What a crock0sheet

[Nintendork]

Use DNS Blocklists. There's a few of them out there that allow you to reject SMTP servers on Dynamic IPs. I use dul.dnsbl.sorbs.net and dynablock.njabl.org since sometimes an IP will be on one, but not the other. Even better, use these ones as well.
relays.ordb.org
bl.spamcop.net
list.dsbl.org
xbl.spamhaus.org

I've got all six of them running on my company's mail server. It's set up to respond to rejected emails with instructions for contacting me via phone in case there's a false positive. That way, I can whitelist the sender and sometimes help them if they have an open relay and didn't know it. I've had one false positive in the last year. That's for 50 users in my company, some of which post their email address everywhere and use it in Banzai Buddy forms. ~90% of spam destined for valid mailboxes is blocked. Not bad considering it's free, easy to set up, and maintenance free.

-Lucas

And you can use all your 65355 ports because...

[toofast]

TCP/IP has 65535 ports (excluding port 0).

If only MY ISP would read this...

[Quixadhal]

Being a subscriber to my local cable monopoly (Cablevision), I've enjoyed the reverse situation for several years.... namely, they block traffic going INTO port 25 on my machine. I can send out all the mail I want, but to receive mail directly, I have to have a friend on another network accept it (MX records don't yet allow port specifications... sigh), and then transfer it via fetchmail/ssh.

Note to Cablevision.... I still get lots of spam, it just sits on YOUR disk instead of mine... way to go guys!

Re:What a crock0sheet

[rockmanac]

Actually,

I got Hotmail to shut down an account that was sending me offensive email via their abuse@hotmail.com e-mail address.

-A

Comcast is behind the times.

[RyuuzakiTetsuya]

Cox ahs been doing this for years. surprised the hell out of me when I oculdn't use anything but cox's SMTP server. Bloody brilliant.

Re:Comcast is behind the times.

[Anonymous Coward]

and I dropped COX as soon as I realized I couldn't send mail through our company's SMTP. Behind the times indeed.

Re:Comcast is behind the times.

[RyuuzakiTetsuya]

Fuck off. COX's SMTP server isn't that bad.

besides, if you're worried about having a home connection that'll be used for business, yous hould really be using cox business services.

Big Deal

[pbrammer]

Cox blocks ALL outbound port 25 traffic unless it's going through their servers.

Probably Already Been Said

[SolidiusRock]

That aside, I find this to be a double edged sword. On one note, we see that spam is going bye-bye, on another... we're losing what the internet is. Completely open to all the world is what the internet became, but is no longer. Now we have ISP's dictating what ports we can use, and what we can't. Provided that this is a business and you're "buying" a service, it's generally nigh impossible for the average joe to just jump on the internet all by his lonesome without having to pay and arm and a leg for a dedicated, unbridled line... As such, there should be laws in place to protect what the internet is, yet give appropriate power to stop things like spam and kiddie porn.

I will also be switching from Telus

[MochaMan]

I'm in the exact same boat. I use a laptop. I am on Telus' network during mornings and evenings, and during those times, access to port 25 is limited to one maching: smtp.telus.net. I *pay* for .Mac email (and webdav, and homepage) service, and they are denying me access to that service.

As soon as I leave home, and arrive at work, I connect my laptop to the local network there and, because they are not on Telus' network, I can no longer access smtp.telus.net. As a result, I have to edit my email application's SMTP settings twice a day simply to send email. This is NOT a solution. They provide no way to access smtp.telus.net from outside their network, even via authenticated connections. It's ridiculous.

I've contacted the other big ISP around here (though in the interests of being balanced, I'll leave it to you to do your own research) and they don't have this limitation. I'll be switching away from telus as soon as I get connected with my new ISP. I would suggest that other Telus customers complain (I did, and they sent me three essentially form mail responses amounting to "too bad") and hope they come up with a workable solution. If not, do what I'm doing and deny them your money.

Their customer service has been rated among the worst in BC, and my experiences confirm this. What a pain.

Re:I will also be switching from Telus

[WuphonsReach]

I'm in the exact same boat. I use a laptop. I am on Telus' network during mornings and evenings, and during those times, access to port 25 is limited to one maching: smtp.telus.net. I *pay* for .Mac email (and webdav, and homepage) service, and they are denying me access to that service.

Which is a problem with the .Mac service not Telus. They need to add an alternative authenticated SMTP port to their service. Complain to them, because the better mail services (e.g. FuseMail) all have alternate ports (587, 2525) which do not fall victim to the port 25 block.

And if you didn't see the writing on the wall about port 25 blocking, then you haven't been paying close attention the last 2-3 years.

Re:I will also be switching from Telus

[MochaMan]

Which is a problem with the .Mac service not Telus.

It is a problem with both Telus and .Mac. Both of them should provide an authenticated means of connecting to their SMTP servers ideally on ports other than 25. But who's to say Telus (and other ISPs) won't block those ports too? Apple does provide (and, in fact, require) authentication -- however it uses port 25. Telus provides no means of authenticated connection off network. In this regard, Apple is ahead of Telus.

And if you didn't see the writing on the wall about port 25 blocking, then you haven't been paying close attention the last 2-3 years.

Great point, I'll remember to use such an argument next time someone complains about the erosion of civil liberties in the US due to legislation such as the Patriot Act.

Easier just to switch to an ISP that provides a means of connecting to whatever ports on whatever servers I like.

Re:I will also be switching from Telus

[platipusrc]

I don't know what OS you're using (assuming OS X), but there are email programs that handle using different transports fairly easily. Take Kmail for instance. It easily allows you to switch mail transports whenever you're composing a message, and it keeps that setting for each subsequent sending until you change it again. If you didn't want to do something like that, you could always set up a text based reader like Mutt and just ssh into your machine at one location and have all of your mail facilities available from wherever you happen to be as long as you can ssh...

Re:I will also be switching from Telus

[MochaMan]

Excellent points. I'm actually using the default Mail.app client that comes with OS X. I'm relatively pleased with it, and it does allow you to set up multiple SMTP servers per account -- you set them up once, then just select from a drop-down list after that. It's not that painful to do, but it's in the preferences, rather than on the email message. While composing you have a choice of which "account" to send from, but they're listed as outgoing email addresses (associated with accounts defined in the preferences).

Kmail sounds like it has an elegant solution to this problem. Thanks for pointing it out; perhaps if Apple gets enough requests for something like this on their Feedback page, they'll implement it in Mail.

It's nice to see KDE apps offering this kind of flexibility. From a usability perspective, flexibility is one area that Apple/Microsoft could stand to learn quite a bit from the open source development community... and ideally contribute something back (like the gcc and KHTML patches) I would hope.

Re:I will also be switching from Telus

[DreamerFi]

I've simply set up multiple accounts (well, it's really the same account, but with slightly different settings depending on the network I'm on), and Mail.app will silently and automatically pick up which account works and which smtp server works. I can move from home to work (two different firewalls, one my own, one from the company) and never change a setting.

Re:I will also be switching from Telus

[displaced80]

Apple's Mail.app is fully scriptable. Just create an applescript that says something along the lines of:

tell application "Mail"
set smtp server of account "My Account" to smtp server "smtp.blah.com"
end tell

*googles*.... ...ah :)

Here's a macosxhints.com article about this. One of the comments includes a script that will link your SMTP server to your Network Location (see Apple Menu -> Locations). You can then set up network settings for your two locations, and have Mail automatically adjust itself when you switch between the locations.

Hope that's some use!

Re:I will also be switching from Telus

[displaced80]

Ah, crap.

The 'autosmtp' script referenced in the comments leads to a dead web page.

I *think* I've got a copy of this on my Mac at home. Let me know if you'd like me to send it to you -- otherwise, perhaps Google will find a copy of it somewhere for you.

Re:I will also be switching from Telus

[Anonymous Coward]

I don't know how long you've been with Telus but it been like that for at least the last five or six years. Yes, it means you can use your mail app to send email (you can still receive it) but there's nothing from stopping you from using Webmail.

As for the original poster, Get a small business account. I did when Telus started blocking my server's ports a few years ago. I broke the TOS and got busted (they never said anything, just blocked the ports) so I made up for it.

It works so well that...

[pyrrhonist]

It works so well that even access to Comcast's own server (smtp.comcast.net) is blocked for their own users.

Oh wait, it's probably just down again.

Spammers don't care about abuse@/postmaster@

[Jonathan Quince]

Actually, postmaster and abuse are two accounts that every domain has, but they hardly ever get spam, because spammmers are afraid of us (insert demonic laugh here).

I've said the same thing before, and it did seem to jinx my role accounts. abuse@ has been getting the crap spammed out of it lately on several domains I own.

Of course, I did put my abuse@ addresses in a very bad position: I use them in my domains' WHOIS records. I did this specifically on the logical presumption that spammers would automatically strip abuse@ off of their lists. Whoops.

I have also received spam SMTP envelope addressed to postmaster@ - and to add insult to injury, it appeared to have been part of a dictionary attack. (I've never listed postmaster@ for those domains anywhere that a spambot could pick it up.)

Listwashing of known active spamfighters aside, spammers truly don't seem to care what addresses they have on their lists. AFAIK, they typically get paid for how big those lists are (i.e., their scum clients pay them to "spam 27 million people" or whatnot). So there's no financial incentive at all for them to use clean lists: If it got sent, they got paid for it, even if it bounced from a non-existent address or went straight to an abuse@ role account. In their eyes, bigger lists are better lists with no other considerations.

Re:Spammers don't care about abuse@/postmaster@

[perp]

I hope I haven't jinxed myself. My abuse address isn't listed out there anywhere but these reject notices. Maybe I should set up another account to use for the rejects so that I don't spoil my abuse account, which is kind of necessary.

I'm sure you're right that spammers don't care what addresses are on their lists, curse them.

bah - you're too easy on 'em.

[Jonathan Quince]

Step 2 is finding the spammers [...] Step 3 is take these selfish bastards to court.

No, Step 3 should be a re-education process that ideally would include a 2x4, a rat in a bucket, a red hot poker, a pair of pliers, and one of these.

(And see previous posters' comments about shock prods...)

Sheesh on you

[chamblah]

The ISP I work for allows you to use remote access for sending and recieving you email while not on our network.

We have users log in using ports 465 & 995 and they have no other issues with sending/recieving their mail while on trips etc...

Might want to see if your ISP has something like that set up.

less spam isnt acceptible, the only answer is NONE

[Indy1]

Comcast (hereby referred to as Spamcast) has ignored their massive spam problem for years now. Fortunately for me the solution was to firewall all of their dynamic space from my mail server.

Apparently Spews thought nuking the dynamic users wasnt enough, and blacklisted all of their dynamic space plus most of their corporate servers as well.

One of these days Spamcast will wake up and realize that a huge chunk of the internet has blackholed them. I only wonder how many months or years it will take for the clue to sink in.

Re:Yea right...

[NanoGator]

"Over 500 spam messages so far today on a domain I've had since the mid 90s. This is about normal and what I've come to expect at this point."

I'm disappointed. The gov't raised interest rates by half a percent, but my bank account is exactly the same as it was yesterday.

Using the ISP's server is not a cure-all

[scotpurl]

A couple of years ago (2001?), Verizon had a five-day SMTP server outage. (I was a customer then.) No email got in or out. They were accepting email for 4 days of that five that was arriving from outside Verizon's network, but were then throwing the email away.

Moreover they had the policy that outgoing mail had to have the From: and Reply-To: addresses be verizon.net email addresses. Which meant that I could not use the email address that I've had for years, nor could my wife use her work email address.

Using the ISP's outgoing SMTP server only works if:
1) the server actually works
2) the ISP has things configured in a correct manner.

My only choices in this situation were to build my own mail server, or get a free webmail account somewhere. The ISP fell far short of what anyone could deem acceptable. Using the ISP's SMTP server is a good idea -- if the ISP knows what the hell they're doing. At that time, Verizon clearly didn't.

Mrs. spammer, will you....

[zogger]

...carry this suitcase with you on the flight for me? I have an emergency and had to cancel, but the suitcase has my nephews books for college? He will meet you at the next landing. You will? great! thanks!

~~~~ later on at the security gate~~~~

whoop whoop whoop! I'm sorry mrs. spammer, the machine has detected something in your carry on luggage, we'll have to inspect it.

ok

hmm, seems we have a kilo of heroin here, two grenades, a vial marked botulism, and some kiddie porn and what's this ?? NAIL CLIPPERS!!11

mrs. spammer -BUT I DIDN'T KNOW! I WAS JUST TRAVELING, AND THIS MAN ASKED ME TO CARRY A BAG FOR HIS NEPHEW IN COLLEGE AND...! IT'S NOT REALLY MINE, I AM INNOCENT! OHHHHH SOOOOO SINCERELY AND TRULY INNOCENT! REALLY! IT'S NOT MY FAULT, WAHHHH!

sorry ma'am, have to read you your rights. I guess you should have paid attention to what you were doing, you'll have to sort it out in court with the judge now. You know in todays world you have to *pay attention to what you are doing*, you can't *assume* anything. Traveling is not that hard, but there are some COMMON SENSE things that you should have been doing, like not taking strange packages from strangers, or assuming you know what's in something and..and....... etc etc

No reason this can't happen with compromised machines and their owners in some manner. They download the crap, refuse to use firewalls or antivirus, won't learn how to use a browser, just assume, assume, assume. they carry contraband from strangers, then other people get hurt. Tough love. wake up call. Hello, this is the real world. They are doing it with downloaders of music, they can do it with people who get zombiefied because they lack common sense, refuse to get even a basic knowledge of what they are doing.. Make the users responsible in some form,not just blocking a port, make them actually responsible, maybe a few of them might wake up, see if they can do something different than just blindly trusting what microsoft and the vendors sell them. Then, if a few thousand or tens of thousands go to court, they MIGHT just turn around, get evfen nastier lawyers, and sue the crap out of the perps who sold them the machines and software that came thoroughly pre-borked out of the box, the same smiling rich guys who told them they buy their products, and that they could then get on the internet no probs, and took their money for it.

my point of view (not that you asked)

[XO]

My spam load has decreased DRASTICALLY in the last two to three weeks. I thought it was because my ISP had me offline for almost 2 weeks, and therefore 2 weeks of over 1000 SPAMs per day bouncing might have gotten me taken off of some lists.. that might have something to do with it.. but.. now i'm under 200 SPAMs a day.. I'll take an 80% reduction in SPAM anytime! (and i'd like another please!)

MOD PARENT UP

[yem]

No, thanks. I prefer my mail without random 24-48 hour delays and invisibly dropped messages. That's not how mail is "supposed to work."

The company I work for provides an Email->SMS gateway. When we get complaints about delayed message delivery and check the Received headers on one of the emails we usually find they routed out from their Exchange server (!) via their ISP and the ISP decided to hold onto the email for a few hours.

This is why I run my own little mailserver at home. It does hardly any non-spam traffic, but at least I can check the logs and know that my email got through.

Blocking port 25 leads to less SPAM

[Anonymous Coward]

Who would have thunk?

Re:Yea right...

[Anonymous Coward]

read? I just look at the pictures. Oh wait we're not talking about the magazines under my mattress....

great

[Anonymous Coward]

Now if only comcast would stop all those cmd.exe win dows attacks I might actually be able to read my apache access logs.

stendec@gmail.com

That's interesting

[Servo]

when I switched from Optimum Online to Comcast, I quit getting ANY spam at all. Obviously this is only talking about folks on their network sending.. but its good that they are being proactive about blocking both incoming and outgoing.

Re:less spam isnt acceptible, the only answer is N

[Anonymous Coward]

And this, fellow Slashdot readers, is what we call an "extremist."

Have you tried SpamCop's "quick reporting"?

[Alexey Nogin]

Do you know that SpamCop has a "quick reporting" option (you have to ask to get it enabled for you)? With quick reporting, you only need to submit the spam via email and the source IP gets automatically reported (but no reporting of spamvertized web sites this way). This way you do not have to go to clicking through their web site, and the bl.spamcop.net still gets all the data.

Re:Have you tried SpamCop's "quick reporting"?

[julesh]

but no reporting of spamvertized web sites this way

As a web developer who hosts sites for his clients, I can only say this is a good thing, after one of my *!^#+:> clients decided to hire a company to send "ten thousand opt-in advertising e-mails" for him and nearly got all of my sites blocked.

Opt-in my arse.

Have you tried SpamCop's "quick reporting"?

[Alexey Nogin]

See my post above.

Have you tried SpamCop's "quick reporting"?

[Alexey Nogin]

See my response to the parent post.

Re:meanwhile, Comcast's SMTP server is slow as hel

[baywulf]

Have you tried asking Comcast tech support about SMTP performance? I have Comcast broadband and most email takes a few seconds to recieve at the most.

my daily spam count dropped by nearly 50% today

[Narcocide]

from a daily average of ~98 to 54

thanks comcast. you bastards.

Oh, yeah, it's working just great

[Anonymous Coward]

Here's yesterday's comcast and attbi spam attempts from my mailserver logs:

11:17:30 1 SMTP-074(pcp03798560pcs.galitn01.tn.comcast.net) Return-Path '<vernon@seznam.cz>' rejected: routed to ERROR
11:17:37 1 SMTP-076(c-24-245-53-31.mn.client2.attbi.com) Return-Path '<inderpal@seznam.cz>' rejected: routed to ERROR
11:18:13 1 SMTP-083(pcp02218985pcs.echryh01.nj.comcast.net) Return-Path '<dain@t-online.de>' rejected: routed to ERROR
11:18:16 1 SMTP-084(c-24-5-18-39.client.comcast.net) Return-Path '<raffi@t-online.de>' rejected: routed to ERROR
11:18:48 1 SMTP-091(c-67-167-67-156.client.comcast.net) Return-Path '<trent@seznam.cz>' rejected: routed to ERROR
11:19:10 1 SMTP-094(h00095b8f289b.ne.client2.attbi.com) Return-Path '<dorit@t-online.de>' rejected: routed to ERROR
16:29:41 1 SMTP-130(c-24-15-176-110.client.comcast.net) Return-Path '<rakesh@t-online.de>' rejected: routed to ERROR
16:29:57 1 SMTP-133(c-66-176-92-94.se.client2.attbi.com) Return-Path '<kuo-juey@seznam.cz>' rejected: routed to ERROR
16:30:13 1 SMTP-135(c-24-8-29-151.client.comcast.net) Return-Path '<shih@seznam.cz>' rejected: routed to ERROR
16:30:22 1 SMTP-136(c-24-126-93-71.we.client2.attbi.com) Return-Path '<eleni@t-online.de>' rejected: routed to ERROR
16:31:04 1 SMTP-143(c-67-166-120-177.client.comcast.net) Return-Path '<axel@seznam.cz>' rejected: routed to ERROR
16:31:10 1 SMTP-144(c-24-5-242-4.client.comcast.net) Return-Path '<julia@t-online.de>' rejected: routed to ERROR
16:31:13 1 SMTP-145(c-24-5-194-85.client.comcast.net) Return-Path '<farhad@seznam.cz>' rejected: routed to ERROR
16:31:16 1 SMTP-146(c-67-173-26-207.client.comcast.net) Return-Path '<alun@seznam.cz>' rejected: routed to ERROR
16:31:44 1 SMTP-149(c-67-163-74-4.client.comcast.net) Return-Path '<kyra@seznam.cz>' rejected: routed to ERROR
16:32:28 1 SMTP-155(c-24-12-225-17.client.comcast.net) Return-Path '<amy@seznam.cz>' rejected: routed to ERROR
16:32:48 1 SMTP-157(h00e0183d6b85.ne.client2.attbi.com) Return-Path '<leison@seznam.cz>' rejected: routed to ERROR

This is but a fraction of the spam attempts I see on my server-- they are nearly all from zombied home Windows machines sitting on broadband. They show up in the logs in several clumps of nearly-simultaneous attempts, so it's obvious they are all under the control of a small group of spammers. The next step Comcast makes should be to monitor inbound traffic to the zombied machines on their network... theoretically they should be able to locate the controlling entity by detecting the shitload of inbound traffic to their client IP ranges from a single source.

Re:Oh, yeah, it's working just great

[Anonymous Coward]

Um, the spam is sent by whoever is selling the products advertising it. Easy enough to track down as it is.

Why don't you just use the Spamhaus SBL?

[Phil John]

...they do all the hard work for you, and if your company can afford it they could even pay them so you can do a zone xfer. That way you're blocking spam easily plus supporting a valuable organisation.

-1, didn't read the post

[Anonymous Coward]

Did you read even the Slashdot blurb, let alone the article? They are blocking port25 for computers that are apparent infected zombie hosts or spammers ONLY, not broad blocking of all port25 from all customers. Assuming you aren't a spammer, this won't affect you.

Comcast _has_ found a way to deal with spam coming from their users. AOL is another matter (re: blocking incoming from comcast users), but maybe that will change now that Comcast is policing its network.

Re:-1, didn't read the post

[adpowers]

I know they are only blocking spammers, but how good are they at identifying spammers? "You sent 200 e-mails today, you have been shut off for spamming." I don't trust Comcast to figure out what is spam and what isn't, not with all the times they have fucked up in the past.

If Comcast was a trustworthy company and I had good experiences with them, then it wouldn't be a problem, but they have given me too many problems in the past.

Andrew

Now that almost everyone has ~24 hour connectivity

[Peaker]

Why do we need the mediating storage anymore?

Why not move to use "instant messaging" methods of direct connectivity between the sender and recipient, and only falling back to server storage when necessary?

This allows for much better knowledge of successful/failed delivery.

It may move more control of message reception to the recipients, allowing them to implement extra protections. For example, requiring arbitrary/configurable amounts of computation on the behalf of the sender to send them a message (increasing the cost of a message send) (unless ofcourse the sender is on a white list of known correspondents).

Is any such transition feasible in the near future?

Re:Now that almost everyone has ~24 hour connectiv

[cranos]

I hate to tell you this but the majority of internet users do not have 24/7 connectivity. Most are still on dial up.

Until prices come down and rural areas are better served broadband is not going to be even remotely universal.

The other 65%

[HermanAB]

are paying spammers I suppose...

So they are just clamping down on the freeloading spammers.

I see no other logical explanation for that remaining 65%...

ALL ISP's should be filtering port 25

[humankind]

The bottom line is that ALL responsible ISP's should be filtering port 25 traffic. This also stops the propagation of the majority of worms. It's a lot easier for those who want to run SMTP servers to request permission to have port 25 allowed, and otherwise block everyone else.

You can bet that Comcast has only done this in response to lots of responsible ISPs starting to wholesale-block all port 25 traffic from their IP space. RBLs continue to be not only the most effective method of stopping spam, but also the only effective method of forcing ISPs to control the rogue behavior of their users.

Re:ALL ISP's should be filtering port 25

[TheAwfulTruth]

Bullpucky.

The blocking of outbound port 25 (Which Cox has been doing for years) is the begining of the end of the internet.

When ISPs start deciding what their customers can and can't do on the internet, it's the end of everything. Every ISP will just become an small island of service. What next? Block 21? Hey how about blocking everything but 80? But wait, zombie mail relays can be setup on any port, so set them up on 80, now Comcast can't block outbound 80 can they?!?!? So it solves nothing in the long run.

I need port 25 open so that I can send email through my workplace server. In order to do that I now have to send mail to a third party server at port 2525 and SPOOF the return address. But what happens when spoofing is no longer allowed?

Whiolesale blocking of port 25 is a lazy, destructive answer to the problem. It may stop the flow of zombie machine spam in the short term, but it also seriously harms legitimate users of their network.

At least Comcast has the sense to block it for identified zombie machines and not for every IP they own like COX.

Re:ALL ISP's should be filtering port 25

[tokul]

RFC2476 - Message Submission
Some servers support it.

There is also smtps

Re:ALL ISP's should be filtering port 25

[Anonymous Coward]

Just recently, my ISP has blocked all port twenty-five traffic. The ISP that I have is not a big one with barely any spammers. I simply do not see a need for such blocking. This is the Internet. The users of the Internet are entitled to 65355 ports to be used however they wish.

Re:ALL ISP's should be filtering port 25

[raynet]

Humm.. Why do you need to send the mail through your workplace server? Why not send it to your ISPs SMTP server?

If you really need to connect to your workplace SMTP server, you could use SSH (assuming there is atleast one server allowing SSH connections at your workplace) and just port forward your local port 25 to your workplace server's port 25.

Re:ALL ISP's should be filtering port 25

[TheAwfulTruth]

COX does not allow spoofing through their mail servers... I was doing this for a few months, then they started disallowing spoofing as well as blocking port 25.

Re:ALL ISP's should be filtering port 25

[dbullock]

Chicken Little.

Sure, zombie relays can be setup on any port, but they can't connect to any mail server directly on any port, they have to relay through Comcast.

This is nothing different than any commercial network does. If you need to send email through your workplace server, then have your IT dept get you a VPN client, that's what I do for my users. Works like a charm.

Score: 4, Interesting
Score: 5, Fails to Understand Networking

I did get some stats from my logs...

[csk_1975]

I checked my logs and worked out some stats and it actually does look like there is a decrease in spam from comcast.net! In the last four weeks I've received, 14658, 14057, 12535, 12209 and so far this week 7765 spams from the dynamic comcast.net address spaces.

It was actually instructive to do some log analysis and it looks like there are spam zombies basically everywhere, pacbell.net, swbell.net, ameritech.net, tpnet.pl, wanadoo.nl, giga.net.tw, axelero.hu, tiscali.fr, tiscali.il, sympatico.ca, rr.com, verizon.net, charter.com, ocn.ne.jp, bbtec.net, bigpond.net.au, optonline.net, dion.ne.jp, hiway.net.tw, hinet.net, netvigator.com, hkcable.com.hk, maxonline.com.sg, t-dialin.net, supercable.es, alkimnet.net, hispeed.ch, netvision.net.il, netvisao.pt, home.nl, rima-tde.net, chello.nl, btopenworld.com, cox-internet.com, veloxzone.com.br, brasiltelecom.net.br, prod-infinitum.com.mx, telesp.net.br, - just to name a few. These are in no particular order just places that lots of spam from IPs with dsl, adsl or ppp in their rDNS arrived from. The list goes on and on and on. :-(

Submitting SPAM to spamcop

[gurubert]

I have written a little python script that does the job of confirming SPAM for me. I would have posted it here but the /. junk character filter was catching on the python syntax. ;-)

If anybody is interested I may publish it on a website.

Re:Submitting SPAM to spamcop

[dj_paulgibbs]

I'd like a copy - djpaul@gmail.com - thanks.

Re:What a crock0sheet

[toadlife]

"It's set up to respond to rejected emails with instructions for contacting me via phone in case there's a false positive"

I hope you've set your mailserver to remove all attachments before boucing them. If not, you are propogating viruses.

extremist? no, just protecting my property

[Indy1]

no, just a mail admin that doesnt put up with spammy abusive networks. I am sick and tired of paying for the bandwidth and have spammers treat my mail server as their dumping ground for advertising, porn, viagra, 419's, viruses, you name it. My inbox stays damn clean anymore, and i like it that way. Your more then welcome to use hotmail or yahoo, or whatever, and get your inbox flooded with crap. My server, my rules, my firewall.

Re:extremist? no, just protecting my property

[Anonymous Coward]

And for those of us who run a real business or acutually do any sort of real communication, this type of overzealous blocking is absurd and costs more money than it saves.

If I started blocking Comcast customers and said "SWITCH ISPS IF YOU WANT TO DO BUSINESS WITH US", they would be more than happy to take their business to our competitors. Your attitude is stupid in the real world.

Re:extremist? no, just protecting my property

[Anonymous Coward]

Well, I can tell that you do not admin a server of any regard because the networks you imply as being "spammy" are the ones that most people are on. How exactly do I tell my grandparents that I refuse to accept their emails because I am 'boycotting' their ISP due to SPEWS?

LOL.

Eliminate spam

[DMUTPeregrine]

It's easy. Bring back bang path e-mail addresses. No more problems tracing the sender.

re. shesh yourselfs

[Anonymous Coward]

Come on... just of of the top of my head I can think of 4 ways to send mail if I am on the road somewhere and port 25 is blocked.

1) web mail (either set it up on one of your own servers or use aol/yahoo)
2) SSH into one of your shell accounts and send it from there vie pine or even plain old mail.
3) Open a machine for relay at work or home... whichever is not blocked and send it through there. (Be sure to close the relay when you are done or the spammers will find it)
4) ssh worksshserver -L 2525:workmailserver:25 then point your mail program to send through localhost:2525 .

Puh-lease...

[LuckyStarr]

...disable your catchall-address on your 4 domains, and only set up the addresses you need. You will see that the rate of spam you get will drop.

Furthermore the overall traffic you cause on the net will drop also, because the spam will be blocked directly at the mailserver with a 550. The mail will not be transmitted at all.

There are at least a dozen of other methods to block mail from entering a mailserver (given you really have admin-rights on the MX of your domains). There is no need to forward 3000 mails a day to some unlucky bureaucrat.

Please see:
Greylisting - the next step in the spam-control war (generic)
Anti-UCE Cheat-Sheet (Postfix)
Security-Sage Anti-Spam Guide (Postfix)

Re:Slashdot Quiz

[meringuoid]

Do you believe absolute moral truths exist? Is absolute truth defined by the Bible? Did Jesus Christ live a sinless life? Is God the all-powerful and all-knowing Creator of the universe, and does he still rule it today? Is salvation a gift from God that can't be earned? Is Satan real? Does a Christian have a responsibility to share his or her faith in Christ with other people? Is the Bible accurate in all its teachings?

How strange. After answering all those questions I instinctively continued with 'Oh mama mia mama mia, mama mia let me go, Beelzebub has a devil put aside for me!'

I wonder why that might be?

SPEWS is overzealous and racist

[Anonymous Coward]

Well, as if there isn't enough that has been already said about the questionable practices of SPEWS, but it seems like it bears repeating for this audience once again.

First off, they block entire ISP's instead of offending netblocks or IP addresses. This works nicely to "encourage" their customers to switch, thereby presuring the ISP to switch. However, in many areas, there is only one viable ISP for a type of service or area of service. These customers are forced to deal with SPEWS blocking with the few places that do use it. On top of that, is it reasonable to ask people to be blocked for weeks at a time because of a small spammer that you have nothing to do with who got out of control for a few days?

Another one of SPEWS' rather unfortunatnte polcies is their blocking of entire countries. I agree with SPEWS that some countries, namely many Asian and South American ones, have gotten very lax with spammers, however that is no justification to cut off an entire culture from everyone else at your own whim. Thats downright wrong and its racist.

As if that is bad enough, there is the story of when SPEWS came to head with a rather large website, Something Awful who it would cost alot of money to move their servers and data over to new people (and not to mention the increases in monthly cost it would incur to them that would probably shut them down or restrict them) in order to avoid being unfairly blacklisted by SPEWS' block on their ISP's IP range. This did not sit well with their users, who lodged a protest with SPEWS en masse. This resulted in a counter DDoS from SPEWS members, which is documented here and many other places. Do you want to support an organization that does this type of activity to people who disagree with them?

In my mind, SPEWS is no better than the spammers, and quite a few others agree with my sentiments.

Of course, most of the people using SPEWS don't ever have to receive emails of any importance from clients or customers. How would you explain to your customers that they have to switch ISP's to do business with you and expect to still have them as customers?

However, of the anti-spam groups, I happen to like SpamCop (there are other respectable ones, I just dont have any level of experience with them). They do a damned fine job of blocking spam very fast and would reccomend them in a heartbeat.

Re:What a crock0sheet

[Anonymous Coward]

dont forget sbl-xbl.spamhaus.org , its a marger of the two blocklists and spamhaus.

Pity my shitty antispam software only supports two rbls :(

Re:Now that almost everyone has ~24 hour connectiv

[hawaiian717]

ICQ has the delivery system you want... Messages to users who are logged in are delivered immediately. Messages to offline users are stored and delivered when the recipient logs in.

50 per cent drop

[Anonymous Coward]

I've seen a 50% drop in spam recently

Re:Now that almost everyone has ~24 hour connectiv

[cpghost]

You can do that on a store-and-forward network too. Every mail server could require the computation of a challenge before accepting a message for storage.

Oh, and BTW, only a small minority has 24/7 connectivity (and I'm not even talking about third world countries!).

The end of the internet? Definitely not!

[LuckyStarr]

Thats exact the same arguments people had against RBLs (Realtime-Blackhole-Lists): "Wholesale blocking of a complete machine is a lazy, destructive answer to the problem. It may stop the flow of spam in the short term, but it also seriously harms legitimate users of the machine."

I use relays.ordb.org, opm.blitzed.org, block.dnsbl.sorbs.net, zombie.dnsbl.sorbs.net, socks.dnsbl.sorbs.net,misc.dnsbl.sorbs.net,smtp.dn sbl.sorbs.net,web.dnsbl.sorbs.net and sbl.spamhaus.org on a VERY large mailserver and had 2 complaints in 2 years! For comparison: Every day 200.000 mails are beeing relayed through that system.

So I think if the automation isn't totally braindamaged, you can use them (RBLs) without harming innocent bystanders. Blocking ports in a network is technically EXACTLY the same thing as blocking IPs on a mailserver. Given a list of targets, you block a resource. See?

Heck, they could (and probably do) even use the same RBLs for the port-blocking.

The concern here is not that they DO block, but on what data-source the block and how long.

Re:The end of the internet? Definitely not!

[a24061]

I think the blacklists you mentioned are all based on evidence of wrongdoing (spamming, zombies, open relays). Wisely, you are not using dynip blacklists to stop responsible broadband customers from routing their own mail.

Blocking port 25 for everyone, like using dynip blacklists, is condeming all users of a certain class as guilty without evidence and with no way for them to get unblocked.

Agreed

[LuckyStarr]

In my opinion Comcast should use a silimar system like cbl.abuseat.org. However, they should ensure that spam-zombies can not automatically remove themselves from the list. Perhaps removal should require the dialup-password or something similar.

As for spam-blocking dynamic ips:

For all IPs in dialup-rbls, IPs without a reverse-ptr and IPs with more then one digit in the hostname I use greylisting with a delay of 300 seconds.

This has served me equally well with a maximum efficiency.

Zombies seem to be highly localized.

[LuckyStarr]

I did not see any drop of traffic today. I checked the logs and saw a 50% reduction in spam coming from comcast and attbi. I also saw a 50% increase of spam coming from t-ipconnect and others.

For me this didn't work.

not everyone needs access to external servers

[C0vardeAn0nim0]

they're quite happy using their ISPs SMTP server to relay their messages, so "blocking por 25 is the end of the internet" is a bogus argument.

for the 1 or 2% of the users who really need access to external SMTP servers comcast could set up a "white list" to allow them such access.

in other words, what comcast is doing is firewalling in behalf of their users since most of them have no idea what a firewall is.

I don't get it

[Moraelin]

I see all this pining for the "way the internet was". And I don't get it.

All the problems we're having are precisely _because_ of the open and unregulated way the Internet was. The Internet was designed on the assumption that everyone will be nice, stick to the RFCs religiously, etc. Noone put much thought into the "well, what if they don't?" part. That's the worst design anti-pattern possible and the nemesis of security.

And unsurprisingly that shiny-happy-optimistic approach has failed again and again. E.g., it didn't even take _that_ long for someone to figure out that by intentionally not conforming to the RFCs they can syn-flood and crash a machine.

It's like preaching the ideal society where there are no laws, rules or authorities, and everyone can do whatever they please. It will be such an awesomely nice place, as long as everyone will be nice to each other. But they surely will, right?

Except it's not a realistic scenario.

Re:I don't get it

[SolidiusRock]

By no means am I saying that we shouldn't have regulation, but who enforces it and who decides who get's regulated? You have to be careful with situations like this, as previous history dictates, give 'em inch, they'll take a mile.

Re:What a crock0sheet

[time4tea]

spfilter

Brings in all these, updated daily.

They won't be able to stop at 25

[mactari]

Talking to an SMTP server is easy. Don't believe me? Telnet to your ISP's smtp server (port 25, obviously) and send the bytes for "HELP". Poof, 99% of the time you'll get every command that server accepts. It doesn't take long to figure out how to use it, even if you are too lazy to read RFC 821 (start at "APPENDIX F" and I bet you're telneting email via telnet in 30 seconds or less).

But wait, were you telnetting *from* 25? Of course not. Yet, somehow, it still worked (likely only if your "rcpt to" entry had a local domain).

Malware can use any port they want to relay from a zombie box to smtp.openSmtpRelay.com 25 as well.

Another thread on this /. discussion deals with issues "underground" relays present, but just remember this -- the SMTP servers you're relaying to don't really care if you're sending from port 25. That's convention. You're likely to find SMTP at smtp.myisp.com's port 25, but it really doesn't make any difference, and even in some email clients it's an option to change.

It's issues like those described in that thread that'll help ultimately bring down spams. Telling malware writers to use another port, which is all Comcast's doing, as others have pointed out, will just have ISPs blocking ports until there are no more ports to block.

Re:They won't be able to stop at 25

[Just Some Guy]

It's issues like those described in that thread that'll help ultimately bring down spams. Telling malware writers to use another port, which is all Comcast's doing, as others have pointed out, will just have ISPs blocking ports until there are no more ports to block.

What are you talking about? Comcast is blocking outbound connections from customer machines to port 25 on remote servers if those machines are exceeding certain transmission limits. Comcast couldn't care less what local port the customer machine is using. In order for spammers to work around this, they'd have to convince people running the mailserver to which they want to send spam to configure those servers to listen on a different port than 25, and the configure their zombies to send to that new port. That just isn't going to happen.

In pseudocode, their filters look like

if (isSpamZombie(src_address) and dest_address == 25) { reject(); }

which is entirely different than

if (isSpamZombie(src_address) and src_address == 25) { reject(); }

Re:They won't be able to stop at 25

[Chester K]

But wait, were you telnetting *from* 25?

You do realize you can block traffic based on the target port, not just the source port, right?

Re:Now that almost everyone has ~24 hour connectiv

[TheRaven64]

And even those of us who do have 24/7 internet connectivity don't necessarily leave our computers on all that time (at least those of us who pay the electricity bill). It seems more efficient to leave email on a server used by a lot of people while I am asleep than for each user to run their own.

Less spam coming from Comcast but .......

[rspress]

Less spam coming from Comcast but the same amount or more seems to be coming in. Most of it seems to be address to me and must have come from the sale of AOL addresses. Since anyone with an AIM address, which is probably most people, got their real email addresses sold to spammers I am sure we can count on are mailboxes being stuffed for sometime to come.

The should really slam it to the person who stole the list from AOL. Tracing the list and going after the people who bought it would be a great idea as well. Until then thank god for Apples mail.app's Bayesian filtering!

Not just comcast

[SComps]

A quick check of some of the other major US ISP's as shown similar reductions in outbound mail. Could it be that we're just in a lull and the pee-pee peddlers are just trying to come up with a new way to spell V|@gr@?

On HTTP, SMTP, etc

[JoelClark]

Why does anyone still use SMTP and mail readers? I cannot understand this at all. I have used Yahoo for years now, and I don't regret it in the least. I can check my e-mail from anywhere, their spam filters work like a champ, 2GB of space.

If the ISPs were smart, they would quit giving out e-mail addresses and shut down port 25 till you ask for it to be open. Businesses, corporations, etc aside, SMTP has been abused to the point where it would probably be better left for dead.

Flame on..

Blocking port 25 is lame

[j-turkey]

While it is difficult to argue with the results, if I can help it, I will never purchase Internet service from a company who arbitrarily blocks ports (especially ones that I may want to use...outbound port 25 being one).

When I buy Internet service, I want the whole Internet -- I don't want surprise ports blocked when my ISP thinks it's convenient. What's worse is that they typically don't inform users that the ports are blocked. You just have to figure that out.

At work, I have users who work at home and use dialup and broadband service from providers like Cox (cable), Comcast, and Earthlink. All of these providers block port 25 in at least a few regions. This is a major PITA, since I need company mail to come thorugh company mail servers (various reasons, one being that many of these ISP's don't have particularly good SMTP service and I deal with calls like "X didn't get my email, what's up?") I've set up service on a separate port, but it just adds one more configuration step for users who are already completely lost.

Again, I understand why ISP's are turning to this, and I can see the results, but it's still a lame policy. If I can help it, I won't buy Internet service (business or personal) from any company that blocks port 25.

Re:Blocking port 25 is lame

[Anonymous Coward]

Try reading the article jackass ....

they decided to identify spammers and zombie relays on their network and block port 25 traffic from those IP addresses

They should block it for every IP...

[Anonymous Coward]

... and then open it up for individual users on request. Anybody who knows enough to ask for a port to be opened for them is likely not going to have a problem with a spamming trojan anyway.

Relaying is not a workaround...

[Otto]

The point of having multiple spam bots sending your crap out is to increase the amount of crap you can send. If they are going around setting up SMTP relay bots, then whole exercise is rather pointless, as the bandwidth is still all being shuffled through that relay.

Look at it like this:
With two computers, I've got twice the bandwidth as one computer, and so can send twice the spam.
But with one computer relaying through the other, the bandwidth of that computer is now irrelevant, everything has to go through the relay. Instead of having a relay, it's more efficent to just send the spam from the relay.

Relaying doesn't fix the problem for spammers. And your idea about originating ports is useless, because they're blocking based on destination port, not originating port. Nobody gives a shit about originating port, for almost any protocol. If you want to send spam to ISP's, then you have to connect to SMTP servers to send your spam to, and you have to connect on the port they use, which is port 25 by convention. You cannot work around that fact.

Re:Relaying is not a workaround...

[Anonymous Coward]

I don't quite understand why Otto's post only has a rating of 2, and mactari's post which is just crap has a score of 4!!

So don't use it

[Fencepost]

First, as others have noted you appear to have not read the post. I'm not at home so I can't verify that it's *not* blocked for everyone, but I doubt that it is.

Second, unless you're running your own server and connecting directly to remote systems why use straight SMTP? If you're connecting to a SMTP server at a hosting company, see if they do (or will) support SSL encoded SMTP on port 465 - if you're using a hosting company's server you're probably authenticating as well, so this is also a way to avoid doing so over a clear channel. On the other hand, if you are running your own server and going direct you're probably having a fair percentage of your messages dropped as an increasing number of sites refuse to accept messages sent via direct connections from dialup or broadband ISP client addresses.

Idiot --They won't be able to stop at 25

[mactari]

As someone's pointed out (and as I tried to submit 2 minutes after I posted; assumed it went through -- perhaps there's a spam filter on Slashdot where I can't post twice quickly? How ironic...), the port blocked is the destination port. I'm an idiot. The original post is BUNK.

As as I tried to point out at 09:14, mod me down, I completely missed the point originally. Hope you enjoyed the RFC link. *sigh* I even previewed.

What AT&T Worldnet (dial-up ISP) does

[Fencepost]

I actually don't mind their policy - it's a little annoying at first, but that goes away quickly.

By default, they block all outbound SMTP - it's just not available. It's easy to get it unblocked for your account - there's no charge, just get in touch with their tech support folks and it's a simple matter. There's only one catch - you can only get it opened up after you've been a customer for a month.

Show us the code!

[p.rican]

How about sharing the code with us?

Re:Show us the code!

[msim]

Not to be a "me too"-er, but mee too!!!

I mean i've had jack of having to arse about with mailfilters and wasting time yes/no-ing my inbox (which is a f*@#ing pain to do).

This would just be plain neat and very useful...

That is if the ISP's actually gave a damned about your complaint.

Re:Just wanted to let you know:

[Anonymous Coward]

stfu

Re:less spam isnt acceptible, the only answer is N

[Chester K]

less spam isnt acceptible, the only answer is NONE

You're absolutely right. If they can't completely stop spam, they shouldn't even try! In fact, they should send more spam, since less spam isn't acceptable!