Slashdot Mirror
Spammers' Upend DNS
Saint Aardvark writes "eWeek reports on the latest trick of spammers: getting around DNS-based lookups. By registering a domain *after* the spam goes out advertising it, they can get around blacklists. However, that causes all sorts of problems for ISPs and anti-spam services. Paul Judge, CTO at Ciphertrust, says "Even in large enterprises, it's becoming very common to see a large spam load cripple the DNS infrastructure.""
Until they pass a law that makes it completely legal to kill spammers, the spam problem will not go away.
I'm a big tall mofo.
Thank goodness we can now register domains and have them active within 30 minutes!
Oh look, my foot's bleeding. Someone must have shot it.
cyn, free software and *nix operating systems enthusiast.
The article goes on to say that some anti-spam applications do as many as 30 dns lookups. This is a design problem with the apps, not with DNS. Do less lookups, minimize the problem. I'd venture that after checking with a few of the major blacklists, you've pretty much hit the point of diminishing return in distinguishing spam/ham.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
yeah! and make drugs illegal too! that'll teach 'um.
"Nobody owns the fucking words man." - James Dean
When a DNS query goes to an ISPs DNS server, and the entry does not exist, does it go to the root servers?
Secondly, do invalid domain names get cached (I'm thinking not)?
Some anti-spam group should set up a spam filter that looks for domain names, and registers any that it sees that aren't valid. They would point to a web site that politely explains to users how stupid they are for clicking on a link in spam.
I expect spammers would drop that technique quite quickly if that were done.
DNS could play a role in beating spam. DNS servers suffering from "spam overload" can see that they're handling a lot of the same lookups, that are overloading them. They could flag their responses back to the isolated SMTP servers that are processing the spams, which can tell that they're all the same message. So the distributed network can identify spams, and at least require the senders to share some of the processing load (through another extension to the SMTP and DNS protocols). A more severe response that might affect mere mass-mailers (different from "spam" because content is either noncommercial, or was solicited by the recipient) would be to report such spam-suspects to blacklist servers, which in turn inform users spam filters.
Having had several mass-mailed (big Cc: lists) urgent messages filtered out by corporate spam filters in the past couple of months, I know we need a much better system. Spam is taking down DNS, blocking SMTP, and, even worse, censoring legitimate message needles in the spam haystack. We need network protocols to get smarter, taking advantage of the distributed intelligence that can kill spam. Can the IETF overcome its interest in perpetuating the spam that pays for so much of the Internet, in leading us out of the spam trap?
--
make install -not war
You've misunderstood the problem ...
The domains sending the email exist, but the ones advertised in the email do not. Because SpamCop (et. al) punish not only the sending IP block, but also the advertised host/IP block, spammers are advertising sites that won't exist for a few hours, tricking SpamCop (et al) into reporting on domains that don't exist and therefore cannot be penalized.
2advanced.net - Business Quality Hosting
BIND, at least, does negative caching. Surely this means the load on DNS servers due to looking up the non-existent spam domains is minimal.
Also, once the mail server has decided that a bounce reply is undeliverable (because of no DNS records), surely it is going to dump the email immediately, rather than continuning to attempt to deliver it?
So is this a case of SOME brain dead implementaions of DNS and mail servers, or a real problem for all?
The real "Libtards" are the Libertarians!
Yup. If it shouldn't come in, and it can't be returned, drop it on the floor.
So often times my (l)users ask me why they received an email saying their computer is infected with a virus (bogus bounces due to a virii changing their source addresses)
My servers drop anything that doesn't seem right: virus infections, RBL tagged connections, obviously forged senders, etc. When a message gets delivered to the bit bucket; no more processing, no more network traffic, no more (l)user complaints.
And I never get a complaint.
What's that smell? Ah, that's my karma burning...
..."the wholesale abandonment of email as a viable communication platform?"
And the alternative with the same capabilities is...?
Ignorance is curable, stupid is forever.
Overall I agree with this, but my concern is that if you parse the message and find invalid url's then a valid message will be dropped because of a malformed text string. While I suppose that's better than letting more spam through, I would be uneasy about the increase in false positives.
-nB
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
The article is just wrong, and there's a feedback post on the same page that explains why very well. (Although, what's with the stupid formatting?)