Slashdot Mirror
New Spam Zombies Use ISPs' Mailservers
RMX writes "CNet's reporting
that the new
spam zombie PCs are no longer acting as their own mailservers, but cooperate with the ISPs' recommendation that instead of running your own mail server, to use theirs instead."
I really don't understand why they don't just use SMTP-AUTH. This shouldn't be something that's such a huge deal... and certainly shouldn't come anywhere near what this guy said in the article...
"The e-mail infrastructure is beginning to fail," Linford warned. "You'll see huge delays in e-mail and servers collapsing. It's the beginning of the e-mail meltdown."
500GB of disk, 5TB of transfer, $5.95/mo
throttle the amount of e-mails a customer can send per time-period.. and the max amount of "BCC, CC" addressess.
It's just a hell and takes lots of time to go through contacting abuse-department of ISP's like AOL and Verizon who decide to block for very few spam-reports. Even though the damage of spambot-infested computers on your own network is limited.
I work for a ISP and our mailservers do get blacklisted by AOL sometimes. Some of our customers complained and that is how we found out.
The ISP I work for mandates the use of their mailserver for outgoing e-mails and limits the number of mails that can be sent in a certain timeframe.
So... something like Vipul's Razor?
It's not quite as trivial to set up as you suggest, because of two things...
Fortunately, people are already working together to make this work. Pyzor is another similar effort.
Spamassassin has hooks built in to interface to both Pyzor and Vipul's Razor.
Maybe ISPs should just start running spamassassin (or something similar) on all outgoing email and blocking everything that scores too high... this would slow down their servers slightly, but would cut spam drastically across the board.
I'm going to assume you mean "Outlook Express" when you say "Outlook", otherwise your argument has no merit. Even then, Outlook Express isn't as bad as you make it out to be. For example, both Outlook and OE support SMTP-AUTH, via SSL or not (as well as both POP3 and IMAP-v4 over SSL). That addresses your first problem, which at this point is an ISP issue rather than an MTA issue. Your second point is really only valid for OE, and then only if you've never bothered to use Windows Update (in which case you're asking for other problems anyway). Outlook has blocked bad attachments since a service pack for Outlook 2000 (there have been two versions of Outlook since then, XP/2002 and 2003). Outlook 2003 (which is the only version I have installed right now, so I can only speak to other versions on memory) will also block malicious content in the body of the message itself (scripts, images linked to external sites, etc). If you're still getting infected by email viruses while using Outlook, you're either running a ridiculously old version, or you're explicitly overriding Outlook's protection mechanisms.
Moving everybody back to pine (or better, mutt, but that's my own personal preference) via ssh is not an acceptable solution. Forcing everybody through a webmail interface is only slightly better, but even that is not very desirable (see the new Outlook Live service from Microsoft that lets you read your hotmail email via Outlook rather than the web page, or RPC over HTTP in Exchange 2003 that lets you access corporate email without a VPN rather than using OWA).
Trust me, I've set it up.
It probably won't. Your e-mail client likely remembers your password for you, no? So if your mail client knows the password, what's to stop the Trojan from pulling the password out of where the mail client stored it? And since you're probably using Outlook Express, the Trojan knows exactly where to go. Thank you convenience features.
This is a loss. The ISP *can't* detect this without huge amounts of effort *and* the probability of pissing off lots of customers.
PS, blocking port 25 for customers is just plain dumb -- I have a lot of customers that go on the road and don't want to reconfigure their laptop to use the local dial-up access SMTP server for two hours, then do again in the next city.
They just leave the SMTP set to us, and we have secure logins. Voila. Oh, but we can't use port 25 because a lot of ISPs block it.
- Michael T. Babcock (Yes, I blog)
Spammers are using Microsoft's Hotmail servers as Spam servers, and sending out hundreds (of millions) of emails each day to unwilling recipients.
Come on, this is hardly news worthy on the front page of Slashdot...this kind of thing has been going on in one way or another for a long time.
As a former Comcast employee yes they do cap your emails. Try and send 20 Emails in less then 1 Mins sometime. You will get an error. Use to popup with people on laptops who built up email during the day and sent there when they got home.
Depends how smart the ISP is set up. A smart ISP will separate their inbound and outbound servers, and only allow their own customers to connect to the outbound servers. An MX lookup would give the inbound servers, which customers would be blocked from using.
It's better to burn out than to fade away
You really don't even need to do that much. Outlook and Outlook Express both keep all of their settings in the registry. All a virus needs to do is to parse the contents of a certain registry key.
I don't know if the login/password is stored there as well, but the server information sure is.
Only on
Dear Angry AC,
Hello, my name is the Constitution. I'm here to let you know that, indeed, my first ammendment (that very one that allows free speech) is still here in on the front of me. Uncle Sam and I thank you for your service. And remember, you still have the right not to read anything you don't want to.
Your pal,
The Constitution
I have a lot of customers that go on the road ... They just leave the SMTP set to us, and we have secure logins. Voila. Oh, but we can't use port 25 because a lot of ISPs block it.
You're using SMTP AUTH over TLS on port 587/tcp per RFC 2476, right? ISPs have fewer legitimate reasons (if any) to block 587/tcp out than 25/tcp out.
We host email for a lot of small domains. Many of our customers are using SBC Global for their DSL.
We had everyone doing authenticated SMTP through our server for outbound but SBC shut that down and forces them to do authenticated SMTP through their servers now.
I have absolutely no problems with this except two small issues...
1. They didn't let anybody know. (To my knowledge) There was no press release on the home page or any instructions emailed out to inform customers how to update their mail settings. Since of course they only officially support their email addresses any non-technical customers that called in to SBC royally messed up receiving mail from our servers.
2. There is no non-customer technical support period. You can't make your way through their automated system and they have no way to contact any body on an ISP to ISP level that I could find.
I even contacted some marketing person at their HQ that I managed to find contact info for and explained the situation. They even tried to contact support and couldn't figure out how to do it. Very sad. Glad it wasn't an emergency.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
even if it doesn't; what's to stop the zombie process from intercepting outbound smtp traffic (as most virus scanners already do) and sniffing the password the first time you send a legitimate email?
Forcing mail through the ISP's mailserver is a great first step; clearly enough ISP's are doing this that it's come to the attention of the malware writers.
The next step is to limit outbound mail at the ISP; 20 messages per day for ordinary home users should be plenty, and you can allow more (as many as you need, 20 messages at a time) by going to a webpage somewhere (no standard; leave it to each ISP to decide the best method for this).
Commercial accounts decide for themselves what's a reasonable limit; pay a deposit and you can have 'no limit' but if you get infected you forfeit the deposit..
Another idea might be to scan outbound mail for known viruses, likely virus attachments (who the hell legitimately mails screensavers and/or control panel components..?) and 'spam indicators' (large variety of different from addresses, etc). If it looks suspicious and/or there's an unreasonable amount of it, block all further mail until someone checks it out and turns it on again..
455fe10422ca29c4933f95052b792ab2
We do this on our campus networks. Basically we get pissed off people calling us and we provide them with a disk containing a virus scanner(McAffee in our case) and some antispyware tools(Ad-aware for now, although MS's adware offering is looking surprisingly promising ATM) and a page with instructions on how to install the software and run the scans.
The pages even have lovely pictures so the users can't(read: shouldn't be able to once they have removed their heads from their asses) make a mistake.
When the user think that they are clean we rescan their network traffic and if everything checks out we place them back on the standard network.
Last year almost the entire campus fell victim to adware, spyware, and virii... this year only a handful. It seems to work. If they get re-infected they lose their internet access again.
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu
Just take a look at the statistics:
Europe has only had strict laws against junk communications for two years (Article 13 of Directive 2002/58/EC), they have only been in full force since November 2003 (and the provisions for criminal penalties are not even in place in each and every corner of the European Union yet) - but they mean pure and simple opt-in, and look how this continent's "spam output" already has become almost completely insignificant.
The U.S., I'm afraid to say, have put next to nothing in the way of these sociopaths: only a now-you-CAN-SPAM-more-than-ever Act that lives up to its name in the worst of ways, by legalizing most of the spam, enacting an unworkable opt-out onus on the users, and putting anti-spam warriors at the legal risk of interfering with (and being taken to court by the operators of) what is considered a legitimate "business model" except for some of the worst abuses - and for however little it is, all of this even an entire decade too late.
Reliance on technical solutions and minimal government intervention is just fine for many things - but it's failed in the fight against spam.
Here is how to do it:
That's certainly nowhere near rocket science, and if the above looks a bit complicated, that's probably just because- a directive is a (binding) template for lawmakers in all of the European Union's member states
- necessarily, the legal techniques as well as the "Legalese" itself vary between jurisdictions
- this is a great one-ban-fits-all provision that outlaws each and every flavor of spam at once
"First Amendment" implications: zero (and yes, of course there is freedom of speech in this part of the world as well, and even more of that speech could be heard if it wasn't drowned out by American spam - some of which comes relayed thru Asia of course) - it only bars some people from "pissing in everyone else's pool", but certainly not from speaking their mind!There is nothing wrong with following an example that works so well, even if it is from Europe...
Call your congresscritter now to outlaw unsolicited commercial communications, place a hefty fine and jail time on the offenders, and put an end to these abuses before they put an end to eMail itself.
Not all of those attachments are "clearly malicious". I've emailed COM, EXE and BAT files to people when they needed a quick bug fix or a new feature. I can think of situations where I might need to send someone other files that are on your "clearly malicious" list.
Mea navis aericumbens anguillis abundat
Good luck on getting a root or intermediate CA certificate.
Most root CAs (at least the ones that are found in browsers' CA list) charge a fortune to let an ISP have an intermediate CA certificate that can signoff additional client CA certificates.
Plus, business sense forces the buyer of intermediate CA certificate to recoup the exhorbitant cost by charging all those who wants to have their CA tied to the intermediate CA server.
Not worth it. Just go self-signing and distribute the trusted root to the customer. A lot cheaper (its free).
even those great ones with .scr's from v1agra@sh0p0ur31337store.ch.
Why does everyone pick on Switzerland as being the source of spam? I would have thought .cn (China) would be more appropriate...
Ydco co
The throttling is another issue, however.