Slashdot Mirror
New Spam Zombies Use ISPs' Mailservers
RMX writes "CNet's reporting
that the new
spam zombie PCs are no longer acting as their own mailservers, but cooperate with the ISPs' recommendation that instead of running your own mail server, to use theirs instead."
Is this just doing what normal email clients do already? Why didn't they think of it earlier?
Yeah, and then all those zombies lose their ISP accounts, and suddenly become much more aware of the need to secure their PC.
There's a very simple solution that many webhosting companies already use -- the ISP should force their users to authenticate with the server, using secure SSL. It's good practice any way, and doing so would make even more work for the spam bots (they would have to find the user's login and password for the SMTP server).
Be relentless!
I really don't understand why they don't just use SMTP-AUTH. This shouldn't be something that's such a huge deal... and certainly shouldn't come anywhere near what this guy said in the article...
"The e-mail infrastructure is beginning to fail," Linford warned. "You'll see huge delays in e-mail and servers collapsing. It's the beginning of the e-mail meltdown."
500GB of disk, 5TB of transfer, $5.95/mo
Will many ISP SMTP servers get automatically blacklisted because of this?
I was reading about the "American GI (Joe) captured in Iraq" yesterday and the same thought crossed my mind today.
If you are going to tell everyone that spam zombies (or terrorist websites) are out there, why don't you give details like processname (or website URL)?
It does no one any good if you just say, "Hey, there's a chance your computer may be infected and is a zombie spammer," if you don't also tell us the zombie process name.
throttle the amount of e-mails a customer can send per time-period.. and the max amount of "BCC, CC" addressess.
It's just a hell and takes lots of time to go through contacting abuse-department of ISP's like AOL and Verizon who decide to block for very few spam-reports. Even though the damage of spambot-infested computers on your own network is limited.
Unlike when they did it on the clients, this puts it through a limited number of gates.
ISP's will likely start limiting outbound email to x email/hr. Companies and ISP's will likely start monitoring and kill quicker.
This will benefit spammers for a very short period, then bite them in the ass.
ISP's and companies aren't going to tolerate a spike in CPU usage, and possible blacklisting if they can take care of it. They will start blocking IP's from sending mail, etc. etc.
I would love to see a Special Ops unit bust down the walls of a spammer's house, beat him, gag him, beat him again, send him to Guantanomo Bay for eternity, and than C-4 the spam servers.
Everyone should write their congressmen requesting this.
If you're karma whoring, at least have the decency to format your text. Only some people hate whores, but everybody hates ugly whores.
English is easier said than done.
If we just switched to a secure email system (SSL/TLS, or whatever), a lot of these dumb problems would go away.
... they all know how.
Yes, I know some mail clients don't support this functionality, but come on. Name one of the modern clients that won't do it. Thunderbird, Mail.app, Eudora, Outlook
I suppose then you just have to convince users. This, though, should be the easiest part:
Dear User,
This email is to notify you that your neighbor has been recieving your monthly e-bank statements and password confirmation emails because you are stubborn and insist on using insecure email protocols.
Incidentally, we'd like to thank you for your subscription to DAILY LESBIAN ACTION MAIL!!!1
This is the best sign yet that we're winning the war on spam. This is exactly what measures like SPF were designed to induce - forcing zombies to go through the ISP rather than sending mail themselves.
Now all the ISPs have to do is to filter and detect sudden jumps in email traffic. It will be easy for them to detect systems which have been infected. This will catch the small number of users who suddenly start running high volume email lists from their home systems, but those cases will be few enough that they can be dealt with manually.
This is the beginning of the end for the zombie spam problem!
First of all, most ISPs require you to authetenticate in some way. Either they require a login/password or more often, they wait until you check your POP3 email and give you a 30 minute window to send email without authentication.
Secondly, ISPs often have a limit to how fast you can send mail or how many per day you can send.
I don't really see this as a problem.
Because I suspect it doesn't work as well. It's pretty easy for an ISP to notice 100,000 emails from one sender pumping through their SMTP server, but relatively difficult to notice those mails when sent directly through the net. Also, outgoing servers are often set up with throttling.
Of course, nowadays, ISP's have no excuse in either scenario. There are plenty of network monitoring tools that will notice spamming.
Depends how smart the ISP is set up. A smart ISP will separate their inbound and outbound servers, and only allow their own customers to connect to the outbound servers. An MX lookup would give the inbound servers, which customers would be blocked from using.
It's better to burn out than to fade away
You really don't even need to do that much. Outlook and Outlook Express both keep all of their settings in the registry. All a virus needs to do is to parse the contents of a certain registry key.
I don't know if the login/password is stored there as well, but the server information sure is.
Only on
I have a lot of customers that go on the road ... They just leave the SMTP set to us, and we have secure logins. Voila. Oh, but we can't use port 25 because a lot of ISPs block it.
You're using SMTP AUTH over TLS on port 587/tcp per RFC 2476, right? ISPs have fewer legitimate reasons (if any) to block 587/tcp out than 25/tcp out.
Just take a look at the statistics:
Europe has only had strict laws against junk communications for two years (Article 13 of Directive 2002/58/EC), they have only been in full force since November 2003 (and the provisions for criminal penalties are not even in place in each and every corner of the European Union yet) - but they mean pure and simple opt-in, and look how this continent's "spam output" already has become almost completely insignificant.
The U.S., I'm afraid to say, have put next to nothing in the way of these sociopaths: only a now-you-CAN-SPAM-more-than-ever Act that lives up to its name in the worst of ways, by legalizing most of the spam, enacting an unworkable opt-out onus on the users, and putting anti-spam warriors at the legal risk of interfering with (and being taken to court by the operators of) what is considered a legitimate "business model" except for some of the worst abuses - and for however little it is, all of this even an entire decade too late.
Reliance on technical solutions and minimal government intervention is just fine for many things - but it's failed in the fight against spam.
Here is how to do it:
That's certainly nowhere near rocket science, and if the above looks a bit complicated, that's probably just because- a directive is a (binding) template for lawmakers in all of the European Union's member states
- necessarily, the legal techniques as well as the "Legalese" itself vary between jurisdictions
- this is a great one-ban-fits-all provision that outlaws each and every flavor of spam at once
"First Amendment" implications: zero (and yes, of course there is freedom of speech in this part of the world as well, and even more of that speech could be heard if it wasn't drowned out by American spam - some of which comes relayed thru Asia of course) - it only bars some people from "pissing in everyone else's pool", but certainly not from speaking their mind!There is nothing wrong with following an example that works so well, even if it is from Europe...
Call your congresscritter now to outlaw unsolicited commercial communications, place a hefty fine and jail time on the offenders, and put an end to these abuses before they put an end to eMail itself.