Slashdot Mirror
New Spam Zombies Use ISPs' Mailservers
RMX writes "CNet's reporting
that the new
spam zombie PCs are no longer acting as their own mailservers, but cooperate with the ISPs' recommendation that instead of running your own mail server, to use theirs instead."
Is this just doing what normal email clients do already? Why didn't they think of it earlier?
Yeah, and then all those zombies lose their ISP accounts, and suddenly become much more aware of the need to secure their PC.
There's a very simple solution that many webhosting companies already use -- the ISP should force their users to authenticate with the server, using secure SSL. It's good practice any way, and doing so would make even more work for the spam bots (they would have to find the user's login and password for the SMTP server).
Be relentless!
I really don't understand why they don't just use SMTP-AUTH. This shouldn't be something that's such a huge deal... and certainly shouldn't come anywhere near what this guy said in the article...
"The e-mail infrastructure is beginning to fail," Linford warned. "You'll see huge delays in e-mail and servers collapsing. It's the beginning of the e-mail meltdown."
500GB of disk, 5TB of transfer, $5.95/mo
MMMMmmmmm Brai.... Opps MMMMmmmmm Spam
This is where we are, our rock we stand, among the world, looking forward, eternally.
Will many ISP SMTP servers get automatically blacklisted because of this?
I was reading about the "American GI (Joe) captured in Iraq" yesterday and the same thought crossed my mind today.
If you are going to tell everyone that spam zombies (or terrorist websites) are out there, why don't you give details like processname (or website URL)?
It does no one any good if you just say, "Hey, there's a chance your computer may be infected and is a zombie spammer," if you don't also tell us the zombie process name.
throttle the amount of e-mails a customer can send per time-period.. and the max amount of "BCC, CC" addressess.
It's just a hell and takes lots of time to go through contacting abuse-department of ISP's like AOL and Verizon who decide to block for very few spam-reports. Even though the damage of spambot-infested computers on your own network is limited.
Unlike when they did it on the clients, this puts it through a limited number of gates.
ISP's will likely start limiting outbound email to x email/hr. Companies and ISP's will likely start monitoring and kill quicker.
This will benefit spammers for a very short period, then bite them in the ass.
ISP's and companies aren't going to tolerate a spike in CPU usage, and possible blacklisting if they can take care of it. They will start blocking IP's from sending mail, etc. etc.
You gotta love a Zombie that plays by the rules...
It'll be interesting to see how this effects ISP's Service Agreements:
"The customer, nor any device connected to the customer's network will not for any reason, send emails regarding 'P3n15 Enl4rgm3n7!!!', etc.. etc.."
Buuhahaha...
I would love to see a Special Ops unit bust down the walls of a spammer's house, beat him, gag him, beat him again, send him to Guantanomo Bay for eternity, and than C-4 the spam servers.
Everyone should write their congressmen requesting this.
If you're karma whoring, at least have the decency to format your text. Only some people hate whores, but everybody hates ugly whores.
English is easier said than done.
> I know two wrongs don't make a right, but--grrrrrrr--I HAT how these spammers work.
I fail to see the second wrong. Perhaps you are equating legality with morality?
If we just switched to a secure email system (SSL/TLS, or whatever), a lot of these dumb problems would go away.
... they all know how.
Yes, I know some mail clients don't support this functionality, but come on. Name one of the modern clients that won't do it. Thunderbird, Mail.app, Eudora, Outlook
I suppose then you just have to convince users. This, though, should be the easiest part:
Dear User,
This email is to notify you that your neighbor has been recieving your monthly e-bank statements and password confirmation emails because you are stubborn and insist on using insecure email protocols.
Incidentally, we'd like to thank you for your subscription to DAILY LESBIAN ACTION MAIL!!!1
Since they're cooperating so wonderfully, has anybody thought to ask them to stop sending spam?
"The e-mail infrastructure is beginning to fail," Linford warned. "You'll see huge delays in e-mail and servers collapsing. It's the beginning of the e-mail meltdown."
Quattuor res in hoc mundo sanctae sunt: libri, liberi, libertas et liberalitas.
This is the best sign yet that we're winning the war on spam. This is exactly what measures like SPF were designed to induce - forcing zombies to go through the ISP rather than sending mail themselves.
Now all the ISPs have to do is to filter and detect sudden jumps in email traffic. It will be easy for them to detect systems which have been infected. This will catch the small number of users who suddenly start running high volume email lists from their home systems, but those cases will be few enough that they can be dealt with manually.
This is the beginning of the end for the zombie spam problem!
First of all, most ISPs require you to authetenticate in some way. Either they require a login/password or more often, they wait until you check your POP3 email and give you a 30 minute window to send email without authentication.
Secondly, ISPs often have a limit to how fast you can send mail or how many per day you can send.
I don't really see this as a problem.
So... something like Vipul's Razor?
It's not quite as trivial to set up as you suggest, because of two things...
Fortunately, people are already working together to make this work. Pyzor is another similar effort.
Spamassassin has hooks built in to interface to both Pyzor and Vipul's Razor.
Maybe ISPs should just start running spamassassin (or something similar) on all outgoing email and blocking everything that scores too high... this would slow down their servers slightly, but would cut spam drastically across the board.
Because I suspect it doesn't work as well. It's pretty easy for an ISP to notice 100,000 emails from one sender pumping through their SMTP server, but relatively difficult to notice those mails when sent directly through the net. Also, outgoing servers are often set up with throttling.
Of course, nowadays, ISP's have no excuse in either scenario. There are plenty of network monitoring tools that will notice spamming.
It probably won't. Your e-mail client likely remembers your password for you, no? So if your mail client knows the password, what's to stop the Trojan from pulling the password out of where the mail client stored it? And since you're probably using Outlook Express, the Trojan knows exactly where to go. Thank you convenience features.
But more significantly, it represents a massive opportunity cost. There are all sorts of cool things we could have created for our users that we haven't been able to get to because we were tied up with weekly SpamAssasin upgrades. Spam is short circuiting the work of a lot of the most brilliant people into totally profitless endeavors.
With a regular zombie, you really can't email the person controlling the machine (or the one who has it in his house).
With an ISP's mail server, you can.
And they should be more interested in shutting down the thousands of spam messages so that their regular mail can be sent.
Spammers are using Microsoft's Hotmail servers as Spam servers, and sending out hundreds (of millions) of emails each day to unwilling recipients.
Come on, this is hardly news worthy on the front page of Slashdot...this kind of thing has been going on in one way or another for a long time.
Depends how smart the ISP is set up. A smart ISP will separate their inbound and outbound servers, and only allow their own customers to connect to the outbound servers. An MX lookup would give the inbound servers, which customers would be blocked from using.
It's better to burn out than to fade away
You really don't even need to do that much. Outlook and Outlook Express both keep all of their settings in the registry. All a virus needs to do is to parse the contents of a certain registry key.
I don't know if the login/password is stored there as well, but the server information sure is.
Only on
I have a lot of customers that go on the road ... They just leave the SMTP set to us, and we have secure logins. Voila. Oh, but we can't use port 25 because a lot of ISPs block it.
You're using SMTP AUTH over TLS on port 587/tcp per RFC 2476, right? ISPs have fewer legitimate reasons (if any) to block 587/tcp out than 25/tcp out.
We host email for a lot of small domains. Many of our customers are using SBC Global for their DSL.
We had everyone doing authenticated SMTP through our server for outbound but SBC shut that down and forces them to do authenticated SMTP through their servers now.
I have absolutely no problems with this except two small issues...
1. They didn't let anybody know. (To my knowledge) There was no press release on the home page or any instructions emailed out to inform customers how to update their mail settings. Since of course they only officially support their email addresses any non-technical customers that called in to SBC royally messed up receiving mail from our servers.
2. There is no non-customer technical support period. You can't make your way through their automated system and they have no way to contact any body on an ISP to ISP level that I could find.
I even contacted some marketing person at their HQ that I managed to find contact info for and explained the situation. They even tried to contact support and couldn't figure out how to do it. Very sad. Glad it wasn't an emergency.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
even if it doesn't; what's to stop the zombie process from intercepting outbound smtp traffic (as most virus scanners already do) and sniffing the password the first time you send a legitimate email?
Forcing mail through the ISP's mailserver is a great first step; clearly enough ISP's are doing this that it's come to the attention of the malware writers.
The next step is to limit outbound mail at the ISP; 20 messages per day for ordinary home users should be plenty, and you can allow more (as many as you need, 20 messages at a time) by going to a webpage somewhere (no standard; leave it to each ISP to decide the best method for this).
Commercial accounts decide for themselves what's a reasonable limit; pay a deposit and you can have 'no limit' but if you get infected you forfeit the deposit..
Another idea might be to scan outbound mail for known viruses, likely virus attachments (who the hell legitimately mails screensavers and/or control panel components..?) and 'spam indicators' (large variety of different from addresses, etc). If it looks suspicious and/or there's an unreasonable amount of it, block all further mail until someone checks it out and turns it on again..
455fe10422ca29c4933f95052b792ab2
Just take a look at the statistics:
Europe has only had strict laws against junk communications for two years (Article 13 of Directive 2002/58/EC), they have only been in full force since November 2003 (and the provisions for criminal penalties are not even in place in each and every corner of the European Union yet) - but they mean pure and simple opt-in, and look how this continent's "spam output" already has become almost completely insignificant.
The U.S., I'm afraid to say, have put next to nothing in the way of these sociopaths: only a now-you-CAN-SPAM-more-than-ever Act that lives up to its name in the worst of ways, by legalizing most of the spam, enacting an unworkable opt-out onus on the users, and putting anti-spam warriors at the legal risk of interfering with (and being taken to court by the operators of) what is considered a legitimate "business model" except for some of the worst abuses - and for however little it is, all of this even an entire decade too late.
Reliance on technical solutions and minimal government intervention is just fine for many things - but it's failed in the fight against spam.
Here is how to do it:
That's certainly nowhere near rocket science, and if the above looks a bit complicated, that's probably just because- a directive is a (binding) template for lawmakers in all of the European Union's member states
- necessarily, the legal techniques as well as the "Legalese" itself vary between jurisdictions
- this is a great one-ban-fits-all provision that outlaws each and every flavor of spam at once
"First Amendment" implications: zero (and yes, of course there is freedom of speech in this part of the world as well, and even more of that speech could be heard if it wasn't drowned out by American spam - some of which comes relayed thru Asia of course) - it only bars some people from "pissing in everyone else's pool", but certainly not from speaking their mind!There is nothing wrong with following an example that works so well, even if it is from Europe...
Call your congresscritter now to outlaw unsolicited commercial communications, place a hefty fine and jail time on the offenders, and put an end to these abuses before they put an end to eMail itself.