ISP Responsibility in Fight Against Spam

netpulse writes "Over at CircleID, John Levine shares a letter by Carl Hutzler, AOL Postmaster and Director, blaming irresponsible ISPs as key part of the problem in the long-term fight against spam. Hutzler says: "Spam is a completely solvable problem. And it does not take finding every Richter, Jaynes, Bridger, etc to do it (although it certainly is part of the solution). In fact it does not take email identity technologies either (although these are certainly needed and part of the solution). The solution is getting messaging providers to take responsibility for their lame email systems that they set up without much thought and continue to not care much about when they become overrun by spammers. This is just security and every admin/network operator has to deal with it. We just have a lot of providers not bothering to care.' To which John Levine adds: 'What do we have to do to persuade networks that dealing with their own spam problem, even at significant short term cost, is better for the net and themselves than limping along as we do now?'"

Comments

The problem

[Anonymous Coward]

Is that some of the worst offenders are the biggest. Do you want to cut off your customers from another ISP because the other ISP is an idiot? Maybe, until your own customers get upset because they no longer receive mail from their friends at the other ISP.

Re:The problem

[scooby111]

It's not even necessarily the ISP. I know that my mail servers aren't being used by spammers because I monitor them carefully. We have corporate customers that run their own email servers on our IP blocks that are overrun. We try to work with them to close down open relays or even suspend accounts when they seem unwilling or unable to stop spamming, but there's only so much we are able or willing to do to shut down a clueless netadmin's mail server.

In the end, they'll go somewhere else to spam and we'll lose the revenue.

Re:The problem

[scooby111]

Thanks. Do you honestly think that any ISP's admin gets to make revenue decisions. If I started shutting off customers because they are inept netadmins, I'll get fired. What good will that do. The only way that it's going to change is if the government makes the ISP liable for spam sent from it's ISP block. When that happens, technologies that can stop the spam cold will finally start to seem cost effective and rational. I suspect that many small ISP's will simply go out of business if it happens. In the end you'll be able to have AOL, Earthlink, or Comcast. Is that what you want?

Re:The problem

[Zocalo]

Or, to turn that on its head, when your RFC breaking "spamblocker-challenge" doesn't work (because it's an ill thought out hack) would you want to cut your customers off from receiving email from Europe and Asia just so you have less spam to deal with? Further more, despite numerous complaints from both your own customers, people trying to communicate them and the threat of a class action lawsuit, would you continue that practice for more than a month?

If you answered "yes" to those questions, then a career at Verizon is waiting for you, because that is exactly what they are doing. If ISPs are going to take responsibility for blocking spam and the prevention of the creation of BotNets that originate most of it then they need to take more care than these idiots.

Re:The problem

[MightyMartian]

Look, you have your IP block, and it's your damn responsibility to make sure that it isn't being abused. The problem is there are too many revenue hungry ISPs out there who refuse to take any damn responsibility for the crap being puked out of their networks, and when guys like me, suffering joe jobs and distributed dictionary attacks try to contact you guys, we either get no response, or just "we're merely the upstream provider, you'll have to talk to them".

Quite frankly, I think IANNA and the other IP provisioning authorities should start threatening guys like you with loss of your subnets if you don't start policing the traffic. Guys like you have cost my company thousands of dollars as we try to protect our customers (and in some cases our equipment) from attacks coming from lazy, greedy networks filled with simpering yes men and bloated CEOs and CIOs. Your attitude is typical of the irresponsible twits who have allowed this poison to screw things up.

Re:The problem

[scooby111]

I agree, it is my responsibility. Do you have any idea how to accomplish that? We monitor connections for suspicious activity. We watch logs of bouncebacks. When we get abuse reports, we investigate them thoroughly. We forward the abuse reports to the admin in question and they either ignore it or have no idea how to fix the problem. If they ask for help, we give them what help we can. If we keep getting abuse reports, we shut the account down.

Usually at this point, someone in management gets an angry email from the account threatening to quit and I get the directive to re-enable the account and I can't convince them other wise. Rinse, repeat.

What exactly would you have me do differently? We've discussed the ability to block outgoing port 25, but nobody in the front office wants to go for it. I for one welcome a law that finally allows me to enforce some filtering without getting fired for it.

Re:The problem

[techno-vampire]

In the long run, outbound port 25 blocking saves money. Instead of having to pay for the bandwidth used by a zombie to relay spam, all you get is a bunch of outgoing requests dropping on the floor. Suggest this to your PHB's and see if it helps.

Re:The problem

[sjames]

Look, you have your IP block, and it's your damn responsibility to make sure that it isn't being abused.

Actually, the more attention you pay to what your customers' customers are sending over your network, the more legally liable you might be held for anything that slips through. The phone company isn't held responsable if a bank robbery is planned over the phone only because they make no effort to control what is said. (In other words, because they are a common carrier).

As soon as you start controling what your users can put out on the net, you lose common carrier protections.

Keep in mind that the same tactics that help you clamp down on spam will keep you from playing dumb when the Scientologists or others want to SLAPP your customers.

Other things that hinder spam prevention include pointy headed morons who report legitamate mails as spam because they can't be bothered to unsubscribe to double opt-in lists that they DID subscribe to, blackhole lists that carpet bomb large groups of people everytime one unrelated abuser sends a spam (even if that abuser is null routed), or who include sites that somehow offend their political or social values, or might have said something bad about them. There's a reason spamasassin doesn't just take any blackhole list's word for it. Anyone who can't be bothered to check if the From: field is forged before badgering half the world's postmasters, etc.

The last thing we need is to make sure the above foolishness becomes fatal to all but AOL and Earthlink.

Ultimatly, spam will go away when people stop buying things from spammers. Nothing else will likely manage it.

The natural extension to your argument is that automakers are liable for drunk drivers, the phone company is liable for telemarket scams, and of course, the post office is liable for mail fraud.

Re:The problem

[geminidomino]

In the end, they'll go somewhere else to spam and we'll lose the revenue.

So it's better for you to profit from the spammer than for someone else to, since someone is going to?

Congratulations, you are part of the problem.

Re:The problem

[Anonymous Coward]

We just have a lot of providers not bothering to care...In the end, they'll go somewhere else to spam and we'll lose the revenue.

Well I lost one two weeks ago for this very reason. The customer is a prominant business (one of the largest in one of the communities we service, in our area of about 1/4 of a state). They left for Qwest after a year of absolute refusal to address their IT disasters, leading up to the final "last straw" incident in December.

In typical "smaller business with bigger infrastructure requirements", this is a real estate office with several dozen workstations for agents. They have several NT4 servers (patchlevel zero - never been patched), running IIS, FTP, Telnet, Exchange, filesharing, etc. Internet access is critical for updating listings, and they had a dedicated connection through my network. Unfortunately, they inadvertantly became a hosting site for spammers. Not only does this consume network and server resources (and represents a significant security disaster), but this also invites retaliation. Three times during 2004, DDoS retailation caused significant impairment to my network and outages to their service.

Their response? Blame the ISP. Refusing to address their security nightmare, I had to rate shape them in order to restrict DDoS impact, filter countless port ranges and spend no less than 10 hours a month to dealing with their mess. Finally they solved it for us this month by replacing their dedicated service with a $50/month Qwest DSL line. I'm sure Qwest will give them the 24x7 on-call support we provided for this rate and allow them to exhaust Qwest's community network's capacity with DDoS attacks.

So yes, they will leave the ISP when security is taken seriously? I'd care only from the visibility this client has in their community, but fully recognize that if they continue to get hacked and ignore their responsibility for operating a reliable IT system, they will eventually suffer the consequences.

Now if we can get GAAP-like requirements for information security passed and make it a crime to run a neglected IT shop... but I digress!

Re:The problem

[einhverfr]

I run a small business. I run my own email and web servers. My ISP (Northwest Internet) allows me to do this, and they have been very helpful. Yes, I monitor my email servers, Yes, I test any messaging solution to make sure it is not an open relay before bringing it online. So what you are saying is that I should not be allowed to host my own email servers. That is not an acceptable solution for my business.

No, I don't send out UCE/Spam.

Now, my ISP is not lax about these issues. For example, many of my customers have received calls about them sending out mass mailers. If something seems amiss, they will certainly call about it first before they take any further action.

They will try to work with their customers to a) let them know there is a problem and b) give them a reasonable ability to solve it.

However, I am sure that if one abuses their network that they will pull the plug on the account. They just know that if they do this without making a good faith effort to make things work for the customer, they risk being sued by the customer (for lost business, etc). I have been relatively happy with their service.

Quite frankly, I think IANNA and the other IP provisioning authorities should start threatening guys like you with loss of your subnets if you don't start policing the traffic.

Hmmm.... I think that if there is a drought and you water your lawn, the city might be able to shut off your water if you want to set this sort of precident. Maybe they should. If you get heatstroke and require emergency medical attention, that is still *less than the monitary damage* that taking down my internet line would provide.

Guys like you would make it impossible for me to carry on my own operations and help my customers run their email servers on-site. This would have cost me hundreds of thousands of dollars too. So who wins? Furthermore, it would make it impossible for my customers to have third parties host their email because they need more accounts than their ISP gives them and this would cost each of them hundreds of thousands of dollars. Put simply, encouraging ISP's (using the means you suggest) to prevent their customers from running email servers will get everyone nowhere real fast including, I suspect, your business.

Look, the answer is to let the market work. We already have RBLs which help this happen. I have seen at least one ISP go out of business because they were blacklisted after spammers took over their email servers. That seems fair enough.

Re:The problem

[Zphbeeblbrox]

I have little sympathy for users who and companies who get buried by spam. The solutions for their problems are out there. Any company not pushing a client like Thunderbird with "real" built in spam filtering deserve what they get. There is no excuse for using outlook anymore. I honestly don't have a spam problem. I may get 50+ spam mails a day but I don't see a single one of them. Every one except for the occasional mail a month gets swept into my spam box and then automatically cleaned out of there after a set period of time. Users will stop buying spam when spam stops showing up for them. And educating users on how to avoid it has to be part of the problem.

Dear every ISP in the world,

[Anonymous Coward]

Dear every ISP in the world including the ones in your parent's basement,

Please rid your servers of spammers.

Sincerely,
The Internet

ps Yeah, right.

More Law Suits

[XtremeGod]

So when will the law suits start coming out against the ISP's that Spammers are getting their Internet connections through?

Not caring?

[ZiZ]

Or perhaps just 'getting paid extremely well to host spammers'?

Re:Not caring?

[amuro98]

That's the majority of the spam problem right there.

So long as people can make money from it, they'll keep doing it.

Many large ISPs *knowingly* have contracts with some of the largest, criminal spammers on the planet. Why? Because money talks. It's a miracle that SPEWS hasn't pitched an entire backbone provider into its list by now.

Granted, even if the US companies, by some miracle, decided to "do the right thing" instead of just looking out for their own bottom line, you'd still have the cesspool that is China, Korea, Brazil, Russia, and other places where "right" and "wrong" have no meaning, and the only laws that apply are the ones made by those holding money and/or the guns.

But as folks already know, it's a lot easier to just wholesale blackhole an entire country, than to try to pick through a stream of garbage for the few legitimate messages that may exist in it.

He seems to miss..

[Anonymous Coward]

..that nearly all spam emails nowadays aren't sent over open relays but over 0wn3ed i.e. trojaned PCs on high speed (cable, xDSL) connections.

Re:He seems to miss..

[CrankyFool]

No. He doesn't. There's a reason why responsible ISPs (there's that word again) don't allow normal l0ser users to connect to port 25 outside their network.

The days of "Oh, here's your static IP and full internet access" are bhind us. I'm all for "if you demonstrate clue, you may have unfiltered unbound access; otherwise, no port 25 for you!"

(also: Port 587 is your friend).

Re:He seems to miss..

[pthomsen]

...nearly all spam emails nowadays aren't sent over open relays but over 0wn3ed i.e. trojaned PCs...

Really?

How do you know this? I'd love to see the stats that support this. I'm not trying to be facetious, I'd really like to get hard data like that.

I agree 100% with Carl. Forcing admins to get a clue about the state of their outbound mail is key. And as he says, there are ways to control all this stuff. Even trojaned PCs can be controlled, by limiting the number of outbound messages from that machine to something reasonably low (like 5/hour). If the machine goes over that, you have (most likely) found a trojaned machine.

Of course, there are going to be significant costs to this approach in the beginning, because of the (presumably) large number of pwned PCs in the world. However, the ongoing cost of keeping up with spam complaints, storage requirements, and bandwidth costs should exceed the price of handling a large load of complaints over a relatively short term (giving a quick ROI), which all PHBs (including myself) like to use to sell it to higher-ups.

Re:He seems to miss..

[DraKKon]

the ISP I use, DSLExtreme, blocks port 25 for all DSL/Dailup users..

"By default we filter port 25 to only allow outbound email through our mail servers."

You can request to unblock port 25 if you have a static DSL account... an on top of that...

"In addition, we will periodically scan port 25 over your DSL line to make sure your mail server is not an open relay. If we find an open relay on your mail server, the port 25 filter will be reinstated and you will be notified by the contact email address entered above."

If more ISP's were like that.. there wouldn't be as many z0mbi3z...

Re:He seems to miss..

[smart_ass]

This can be very annoying. Like lots of /.ers out there, I have a work laptop. I have it configured to use my companies ASMTP so that when I travel I don't have to reconfigure everywhere I go. This didn't work at home with my previous provider when then decided to cut off external Port 25 access without warning and without a grandfather clause to get mine opened ... since it required a static DSL account.

Blacklisting them publically.

[strredwolf]

For every listing backed by proof, post a large ad in the New York Times saying "THIS ISP SUPPORTS SPAMMERS" with the proof behind it. Enforce the PR leverage.

Re:Blacklisting them publically.

[sexistentialist]

I don't think that the average individual cares that ISP XYZ hosts spammers. If you were to take out an ad that told me the top 50 ISPs in Korea that supported spamming, not only would I not care, but Koreans wouldn't see your ad. Who should fund the advertisements?

a touch of psychology, a brickbat of capitalism

[ChipMonk]

What do we have to do to persuade networks...?

How about putting them on an RBL? When their customers can't send emails, and threaten lawsuits for breach of contract, the ISP operators tend to start paying attention.

Re:a touch of psychology, a brickbat of capitalism

[sexistentialist]

The problem with _this_ solution is with the validation of the complaints. Some people complain because they get emails from companies that they purchased items from after checking or not unchecking the "please keep me informed" box on the order form. User stupidity doesn't warrant blacklisting an entire ISP's network.

In my tenure as a network administrator at various locations I've seen the full scope of offenses, from those which are blatant violations of the AUP to those which are users complaining about emails they requested. I've seen one offender result in the blacklisting of an entire /19 netblock, and then I watched the RBL admins ignore all requests to have the block removed from the RBL.

RBLs with no oversight provide no real value to their subscribers. Again, it comes back to the issue of validation - who validates the complaints, and then who validates that the behavior of the ISP has changed, or that they've removed the offending party? This is no more than vigilantism, and the argument is that the RBL isn't doing anything other than providng something that their users have asked for.

In the same line as users being stupid and admins implementing mail systems with no real security, many people will subscribe to an RBL because they think it will solve a problem, failing to understand the ramifications and negative repurcussions associated with its use.

If the system generates a single false positive, then the system itself has failed.

Creds

[Transdimentia]

For as much as AOL stunk way back where this was concerned you have to give them props for mostly wrangling in their millions of lusers. I with some other cable and dsl providers would take this charge.

How about "accountability"

[digitalgimpus]

Accountability is the only thing that will stop spam:

- don't want your mail servers to be blocked? Secure them so spammers can't use them.

- don't want to be considered a "spamvertising company"? choose a legitimate ad agency.

IMHO a multi-level effort is needed:

- ISP's need to have a blacklist of customers who are known spammers. They need to share info.

- Consumers need to have a website where they can check the legitimacy of a website, and see if it spams to advertise.

- Registrar's need to stop issuing a bazillion domains to known spammers. When a dozen of a person's domains are referred to as spam sites... no more registration. Share data among registrars.

The problem now is that there are no consequences for spamming. An extremely low chance of a lawsuit or jail. Extremely low.

Spam is cheap, and apparantly somewhat effective.

Until you make it not worth the time... people will do it.

Nobody holds the companies who advertise in spam responsible. Nobody holds ISP's who turn a blind eye to it responsible.

Re:How about "accountability"

[Rizz]

Domain registration companies will never blacklist spammers -- that's how they make their money. Everyone knows selling domains leads to a big fat wallet at the end of the day, why would they want to reduce their profit forecast for some lowsy spam? ..and to those that see signatures: Go disable them. There's never anything useful anyway.

Sigh

[Anonymous Crowhead]

Longing for the good old days of when you got spam you fired off an email to postmaster, abuse and operator....

Clue in to human nature

[Ryan C.]

Wonderful solultion. So if people would just stop crashing cars we could get rid of all the safety features. If nations could just get along we could save billions in military spending.

The current email system does not take into account human nature and is therefore broken beyond all hope of an easy solution. It needs to be replaced with a system designed from the ground up with accountability in mind. Period.

Re:Block port 25 outbound?

[CrankyFool]

Why take advice from AOL?

Because their userbase is:
A) Enormous; and
B) Very, very stupid.

What does this mean?

Look, my ISP -- whose co-owners I've got on speed-dial, and is incredibly clueful -- doesn't have a user spam problem, because pretty much only geeks use them (we pay a bunch extra for the privilege, too). AOL, on the other hand, has the saddest, most pathetic users in the world -- people who are the prime target for PC-p0wning software. Add to that the fact AOL is, like, pretty much the easiest ISP to sign up for. In other words, they're the biggest, fattest, juiciest spam target out there.

And yet, having looked at the 23,507 spam messages I've gotten over the last 303 days, do you know how many came from AOL?

Zero.

I know Carl (not personally, but I'm on some mailing lists with him). He's pretty damn smart. He has to be. Same thing about the rest of the anti-abuse folks at AOL. They're smart, and they're dedicated, and they're very, very, very good.

AOL's spam policy is unreasonable

[ables]

On the surface, AOL looks like the good guys here. However, their draconian spam policy can be as harmful as the span it's trying to prevent.

Here's how it works: AOL receives N complaints calling something spam after users click on the "mark this as spam" button. So AOL looks at the previous link in the received-from chain and blocks that entire network.

Sounds good right? Wrong.

Say Joe User works at my company part-time from home. Instead of another pop account, he has a forwarding address with our company that forwards to his AOL account. Joe gets spam, and reports it to AOL. AOL looks to see who sent it, sees my company in the "received-from" chain, and blocks not only us, but every other company hosted with our ISP. Thousands of legitimate emails now can't get to AOL addresses.

It gets worse. Many people use the "spam" button like the "delete" key to get rid of stuff they just don't want right now. AOL doesn't educate its users to realize that reporting something as spam has real consequences, and so people mark real email they requested as spam just because it's easier than deleting around it.

Our fabulous domain host FutureQuest has had to ban forwarding to AOL addresses as a result. AOL has been completely unreasonable in accepting any responsibility for intelligent spam blocking, and their users and legitimate businesses are suffering.

At least they're trying, but they're far from the good guys here.

How the presentation will go

[SamMichaels]

You: "What do we have to do to persuade networks that dealing with their own spam problem, even at significant short term cost---"

Boss: "Thanks for your concern."

Try #2...the CTO...

You: "What do we have to do to persuade networks that dealing with their own spam problem, even at significant short term cost---"

Director: "Cost? My hands are tied...shareholders are disappointed and the board needs convincing anyway."

Try #3...the board...

You: "What do we have to do to persuade networks that dealing with their own spam problem, even at significant short term cost---"

Board: "What is this 'spam' nonsense you're talking about? You know, when I was your age we never had all these technology woes. I don't see how this will benefit anybody. Next on the agenda....."

Caution

[Anonymous Coward]

Lets be careful about what ISPs have a "responsibility to fight". Today its spam, tomorrow it could be "terrorism" (read: your privacy).

Spam is annoying for those who get any but it doesn't justify the hysteria, IMHO.

Spam from home users?

[trawg]

Does anyone have any figures that detail how much spam come from zombie home user PCs? I thought the amount was significant, but the quote in this post seems to imply that the vast majority of it comes from less scrupulous service providers.

(aside: we host a few websites, one of which we discovered was running an exploitable version of PHPNuke - but not before a spammer did and pumped ~20,000 emails into our queue. I noticed it pretty quickly and deleted them and blocked this webmail software across all these sites lest it happen again - but it was an interesting demonstration to me that spammers look for any and every leverage they can get. I keep a much closer eye on our mail queue statistics now!)

Re:Spam from home users?

[sqlrob]

The number I last saw was 80+%.

I've seen known compromised machines spewing for over a month after abuse@ was notified, so it's still an ISP issue.

Sasktel, I love you!

[Txiasaeia]

"The solution is getting messaging providers to take responsibility for their lame email systems that they set up without much thought and continue to not care much about when they become overrun by spammers."

My ISP, Sasktel in Saskatchewan, Canada has recently implemented a spam filtering service that has so far resulted in 2 false positives and no delivered spam. It completely blocks all virused emails as well. Finally, it sends out an email every once in a while to remind me to check the status of spam at the online message centre, where you can look at all email sent to me that is "suspicious."

They also have a fairly comprehensive policy against hosting spammers, which is nice to hear. I know that many of my friends who use other ISPs have been recently flooded with spam, but I've not had any problems thus far. It's nice to have an ISP that cares about its customers!

If they make enough money spamming...

[VernonNemitz]

Then why aren't spammers already their own ISP outfits? Obviously if spamming is their business, getting obstructive middlemen out of the way is a priority!

Re:If they make enough money spamming...

[rawg]

Because they would be blocked instantly. By using everyone else, they have a better chance of getting their junk out. It's hard to justify blocking all of Earthlink, AOL, and MSN.

Re:If they make enough money spamming...

[fimbulvetr]

Because mini-isps generally have their own legit cidr blocks. It also implies some type of permanence. These are the two things that keep spammers out of our hands:
#1. They hide behind real isps cidrs, meaning we'd have to block that isps ip range to stop them, and most of the time they have legit users and this is bad.
#2. Their ability to pick up and move about. They can move as soon as they are blocked, and are constantly pulling up roots and moving to the next provider that they can suck on for the next 60 days until they are kicked off.

Gonna have to come from the top down...

[HEMI426]

Unfortunately, one of the only things that's going to force most ISPs to start caring about the amount of spam coming from machines living on their netblocks is going to be the ISP's providers threatening to cut the lower-tier ISPs off if the lower-tier ISPs don't do something about their spam problems.

I used to be completely against ISPs blocking port 25 from non-MX machines to the outside world. Unfortunately, I've had to change my opinion. The vast majority of the spam that ends up in my spam mailbox (thanks, SpamAssassin and procmail!) and the mailboxes of my users comes from zombied/trojaned machines on residential, always-on internet connections (read, cable and DSL). Most of the e-mail gets tagged properly by SA, however if the ISPs themselves blocked outbound e-mail not relayed through the ISP's mail machines, things would work out much more nicely, the total volume of e-mail hitting other MTAs would drop, etc. There would be much rejoicing.

SPF is nifty, but it doesn't fix the underlying problem...It just allows for easier identification of mail that's coming from machines it shouldn't come from, etc. Actually getting lots of ISPs to adopt SPF is proving to be a slow process as well.

In short, ISPs aren't going to do anything to fix the problem unless they have to. Buying a few more boxes to handle the e-mail load (a huge generalization, but you get the idea) of the rampant spam is less of a problem for them than actually sorting out their mail systems to help fix the problem. A good place to start would be some method of making the top-tier connection providers responsible.

Re:AOL doesn't check complaints before banning

[MightyMartian]

We managed to get into AOL's blackbooks after one of our dialup customers (of all things) got a worm that was firing out SPAM at an impressive rate for a 56k modem, and doing it over a four or five hour period. That's what finally tipped the balance and lead us to block port 25 traffic to everything but our mail servers. Any customer wanting to run a mail server has to get permission from us, and it's rightly understood that they will go down before we get into trouble again.

At any rate, once we cleaned up the problem, I emailed AOL and let them know we'd dealt with it and all was good.

If you want to talk about an ISP that was tough to deal with, it's RoadRunner. Somehow we got on their block list. They wouldn't respond to my emails to their abuse address, just a standard email with instructions. Even managed to get someone down in Florida who knew a friend of a friend of mine to call and complain, the technician got me a phone number to their security center in Virginia (or wherever it was), and all I got was a recorded message to email them, and then it hung up without even giving me a chance to leave a message.

I eventually gave up, blocked all RoadRunner addresses going in. Six months later I checked, and we were off the blacklist.

ISP's over-sell their lines, use that knowledge.

[khasim]

Do you honestly think that any ISP's admin gets to make revenue decisions.

They would if they phrased it correctly.

Suppose you are an ISP with a single T1.

You don't just sell the available bandwidth. You over-sell it. You might sell 2x your bandwith or 3x or 4x or 5x.

You do that because you know that each of your customers will not be using their entire bandwidth all the time.

But spammers use up a lot more bandwidth than the average customer.

If I started shutting off customers because they are inept netadmins, I'll get fired.

You don't do that. You show your boss how that idiot is using 10x the average bandwidth but only paying 1x the average fee.

That should be easy to do.

The only way that it's going to change is if the government makes the ISP liable for spam sent from it's ISP block.

There isn't one government. I get a ton of crap from .ch domains now.

In the end you'll be able to have AOL, Earthlink, or Comcast. Is that what you want?

I don't think that will happen. There is a market for the small, local ISP.

The key here is money. The people who behave irresponsibly use more bandwidth than the responsible people (yet pay the same monthly fees).

If you want to clean your own house, that's the way to do it.

That's the carrot. The stick is when your entire block is blacklisted because you did NOT deal with the problem that you knew about.

we block europe and asia...

[bani]

...at customer request. we give customers switches on their webpage-control-panel and they can block anyone and anything they want. a huge percentage of customers block china, korea, russia, etc. because they dont speak mandarin, cantonese, or read BIG5 or EUC-KR or KOI8. customer's choice. boo hoo for the spammers.

Just a thought

[okorpheus]

Before the flames roll in, let me say I'm not advocating a view, just throwing it out for thought. Let's say someone tries to draw some conclusions about the general opinions of slashdot posters. How do we reconcile the beliefs that ISPs are responsible for spam going through their systems, but not pirated files.

Re:Just a thought

[divot2001]

If a group of terrorists armed to the teeth managed to break into a building monitored by a single security guard would we draw the conclusion that security everywhere is useless? Of course not, just that for this particular situation some highly trained criminals exploited a poorly guarded target.

It's the same with mail servers, fix one problem and another appears, ad infinitum. Bottom line; SMTP is useless and should be relegated to the dark ages when only scientists and soldiers used email.

SMTP requires trust in others mail servers' good faith (a) adherence to RFCs and standard practices, and (b) prevention of malicious intent. Close an open relay and reinstalling W2K server with the default options opens another one at least for a bit. Shut down an ISP haven for hackers and some shmuck running an NT 3.51 server on a Commodore 64 down in Kenya will decide to try to setup a webserver without deselecting SMTP from the other Web services.

The whole system of SMTP is a mess of patches, fixes, and outright nonsense that requires less ingenuity to circumvent than it does to repair. As a matter of fact, the smarter you are the more you work around the rules such as using relays and Deny Lists to either fabricate your own information or else restrict communications on the Internet. Which is worse lying about something with good intentions or following the rules and violating the basic principle the Net was founded on?

A nation of zombies.

[khasim]

Distributed processing is where it is at.

If you own your own ISP, you're limited to the bandwidth that you're paying for (and you can be blocked easily).

With a bunch of zombie machines, you have TONS more bandwidth and you're not paying for it!

Plus - all those processors sending spam.

Just 10 zombies on 256K upload cable modems is 2.5Mb.

A regular T1 is only 1.54Mb.

oh really ? Have you tried to call AOL lately?

[LullySing]

You know what? When that dude talks about how the problem is solved, maybe he should stop pretending he's above us, and maybe start looking at the kind of system he's got.

here's a post i made in my blog about a situation that arived because of AOL's "system". Ever since that episode, i haven't been impressed at all by these people.

--------(start idiotic message from AOL)----------
Date: Mon, 5 Apr 2004 09:04:13 -0400 (EDT)
From: postmaster@aol.com
Subject: AOL email concerns for isp-where-i-work-abuse.net
To: abuse@isp-where-i-work-abuse.net
X-Scanned-By: MIMEDefang 2.39

Dear isp-where-i-work-abuse.net,

You are receiving this message via our automated "Report Card" process (which helps analyze AOL's Internet inbound mail) because our available data indicate that isp-where-i-work-abuse has risen above the acceptable threshold for complaints:

Total number of AOL member complaints: 186

AOL takes proactive steps to contact owners of mail servers whose e-mail transmissions are impairing the functioning of AOL's proprietary e-mail system, or causing significant levels of AOL customer complaints.

AOL requests that you take immediate steps to resolve the issues identified in this AOL Report Card. In the absence of a satisfactory resolution, AOL reserves the right to take measures to protect its email network and its member goodwill from any possible damage. These measures may include declining to accept e-mail transmissions from isp-where-i-work-abuse.net through AOL's proprietary e-mail network.

AOL strives to provide the best online experience possible for our members, and we pride ourselves on being intensely focused on consumers and their needs. Email is a core feature of the AOL service, and the proper functioning of AOL's e-mail system is vital to our members' goodwill.

Please review AOL's e-mail policies and guidelines, as well as other technical details concerning e-mail on the AOL network, at http://postmaster.info.aol.com
------------(end message)--------------

Ooohhh, AOL's proprietary e-mail network. No information that is gonna be any use in determining WHY people are complaining at all. I guess this should not be a surprise, considering this crap is coming in from AOL! So i do the next available thing , i go to the website. Result : No information that is gonna be any use in determining WHY people are complaining at all. But there's a phone number.

Result of calling 1-888-212-5537:
*dials phone*
"The holding time for the next available consultant will be more than ten minutes." ...( silence )
"Thank you for calling America online ..."
*spits water all over desk, workdesk and papers*
(musak)
(an hour later)
Hello, this is postmaster helpdesk, can i help you? ...And here i am explaining to the bloke on the phone the situation, namely that we are getting "Report cards" without any kind of information as to why people are complaining, with no headers or anything at all to help us.

REP:"oh, that's because you don't currently have a feedback loop with us."
ME : "huh? but we received your report cards in the abusemail box."
REP:"Yes, but you don't have a feedback loop with us"
ME :"You know, there are databases on the net where you can get the abuse contact information for ISPs and things like that."
REP:"Yes, but we made our own database"
ME :"Couldn't you have used those as a base for your own database?"
REP:"I cannot comment on that" ... and here are some other juicy interesting tidbits of information from this conversation...

REP: So what are your mail server's IP adresses.
ME : We have several : we're an ISP.
REP: Alright, then give em to me.
ME : That's why we use DNS names for our mail servers : if one breaks, we change the IP to another server while we fix the previous one.
REP: So you can't give me the IPs? ...

Re:ISPs need to do more to stop spam zombies

[WolfWithoutAClause]

According to his presentation at the HOPE conference, John Draper (aka Captain Crunch) recently implemented a honey pot system connected up to an automatic mailing program.

When his honey pot receives mail it tracks down the mail to the sending machine, works back to the ISP and mails a report to the ISP admins in realtime. If the PC is own3d then the admins usually disconnect it from the net fairly soon until the owners have fixed it, so the machines can only be used for a short time.

Because the admins work in parallel on the problem worldwide, apparently it's making a noticeable dent in the DDOS population; he connected to IRC and listened to the spammers bemoaning the fact that their favourite toys are getting fixed too quickly. :-)

Corner pay phones don't accept incoming calls.

[khasim]

I agree with most of that, but you're off on the "common carrier" bit.

The phone company isn't held responsable if a bank robbery is planned over the phone only because they make no effort to control what is said. (In other words, because they are a common carrier).

As soon as you start controling what your users can put out on the net, you lose common carrier protections.

The phone company won't control what you say, but they can do some things like having the corner pay phones only able to make outgoing calls so that criminals won't be able to setup shop with them.

The same methodology can be used to fight spam.

You don't care what is in the email the customers send, they just have to send it via your email server. This will stop almost every zombie spammer out there.

And that's how spam will be fixed. By looking at each characteristic of spam and dealing with each one, individually.

Other things that hinder spam prevention include pointy headed morons who report legitamate mails as spam because they can't be bothered to unsubscribe to double opt-in lists that they DID subscribe to,...

I've had users specifically request info from a site and then dump the email with that info into the spam folder.

Fortunately, Spamassassin handles enough so that I only have to confirm 10 - 15 of those a day.

Ultimatly, spam will go away when people stop buying things from spammers. Nothing else will likely manage it.

If so, that day is very far away. People do buy things like penis pills and they do it online because they feel better not having to face another human being while doing it. Sad, but true.

Re:Corner pay phones don't accept incoming calls.

[sjames]

Can you help us understand why you cant test your email server from remote location when your ISP is blocking OUTBOUND email ( unless you relay it through them ). If you are from linuxlabs I am guessing you know how to use sendmail's "smarterhost", or postfixes "transport" to make your email go through a upstream provider.

Because the email server in question is not on my machine here, it resides on an unrelated network. I would very much like to telnet to it on port 25 and manually step through a transaction (in part to make sure it correctly refuses to relay without authentication). How in the HELL would my configuring my home machine to use my ISP here as a smart host help with that? In other cases, I may want to see specifically how it is responding to inbound mail. Once again, to do that, I need a telnet connection to port 25, not a smarthost. In other words, to test an INBOUND connection to my remote mail server, I'd need an OUTBOUND connection from home (which is blocked).

Nahhhhh.. Even if you know what AC & DC mean. It keeps the rest of us safe that you are not allowed to tap directly into generators.

In a sense, we all have such a tap, it's just that it's shared. The only thing keeping me from pulling the whole neighborhood down is common sense, responsability, and lack of need for that much power.

"ISP" fronts for Spammers - Moving Target

[billstewart]

Every big spammer knows about AGIS, the big ISP that lost all its connections to the rest of the Internet when their spammer-friendliness became well-known enough that they not only couldn't get peering with other ISPs, but couldn't even buy transit from anybody and their last few upstream providers kept getting pressured by the rest of the world. Lots of smaller spammers try the smalltime fake-ISP-front game - the ecology of hosting centers is sufficiently dense, with colocation companies renting rack space and bandwidth or crossconnects to ISPs and computer hardware leasing companies which lease them to managed operating system companies which lease them to managed hosting application companies which provide web page hosting service to end customers, wholesale email service to freemail providers, and virtual machines to end users, and you can play whack-a-mole for a long time before you find which layer is really the spammer, which layer is a fictitious business name also run by the spammer, which is a spammer-tolerant service provider company, which is an innocent but clueless company that really had bad customers paying them with stolen credit cards, and who needed whacking.

Scotty Richter's OptInRealBig gang had their big pet ISP, named something along the lines of "wholesale bandwidth". AFAIKT, they mostly did business for Scotty, but they also sold bandwidth to other people, and they normally dealt with problems by explaining how they were shocked, shocked! to discover that one of their customers was a spammer! and would take care of them right away, usually by having their "customer" list-wash the complainer's address (they really *were* scrupulous about taking complainer's addresses off the list, though I had no way of knowing if they also resold the lists of complainers to other spammers), or worst case, by "getting rid of" their "bad" customer (i.e. renaming herbal-fake-viagra.com as fake-herbal-viagra.com with a different IP address on a different virtual server in their /19 block, or sometimes even "getting rid of" a whole virtual server, and giving it a new IP address.) Because they were pretending to be an honest, CAN-SPAM-law-abiding whitehat spammer, using their own IP address space, it was easier to trace them than the usual zombie-burning spammer, and I helped out with one or two rounds of complaining to their upstream providers when they got kicked off of one and found another. It usually required a couple exchanges of "No, I wasn't complaining to you to get them to 'investigate' and take my email address off their list, I was complaining to you to get you to cut them off unless they stop spamming entirely, which they're still doing, and I won't give you the email address they spammed, just the headers, and by the way they appear to be abusing a supposedly-inactive BGP Autonomous System Number" until they were cut off. Companies that *are* trying to hide are much tougher to get rid of.

a serious problem

[cg0def]

Spam has been a huge problem for quite some time and the way that AOL deals with it is just shameful for them. I can't send emails to aol users from my sendmail server because AOL recognizes it as junkmail and refuses to accep it. Come on what's next blocking all OSS mail server just because people that uses them pay no royalties? AOL needs to seriously adjust their filter or maybe their spam strategy.

Re:Spamblocking Whole Countries and DSL ISPs

[isdnip]

Why does anybody's choice of connectivity provider have anything to do with their choice of email provider? Sure, my DSL ISP gives me a mailbox and a shell account, but all I do with that mailbox is set it to forward to my real email to handle occasional administrative messages from the DSL folks.

Don't worry, Verizon is working hard to prevent you from doing that! They and BellSouth have petitioned the FCC to allow them to cut off all other ISPs' access to their raw DSL services. They're also making it harder for CLECs to offer DSL in competition with them. So you will get Verizon Online or nothing on DSL. If you don't like this, go the http://www.fcc.gov/ , go to e-filings, ECFS, read the comments and then leave one of your own on "04-440" (Verizon) or a Reply Comment (closing later this week) in "04-405" (BellSouth). SBC and Qwest will no doubt get the same privileges that the other Bells get.

I don't know if Verizon Online blocks Port 25, but if you use their mail server, you must have "@verizon.net" in the From: field. If you try to use your own domain, you commie terrorist spammer punk, your mail will be blocked. And if you want mail from foreigners, you commie terrorist, they will tell you to use Hotmail.

And if the FCC accepts their Petition, you won't have a choice if you want DSL. At least Comcast has a smart Port 25 filter (passes a limited number of mails, blocking spam blasters) and allows From: whatever.