Slashdot Mirror
New Spam Zombies Use ISPs' Mailservers
RMX writes "CNet's reporting
that the new
spam zombie PCs are no longer acting as their own mailservers, but cooperate with the ISPs' recommendation that instead of running your own mail server, to use theirs instead."
Yeah, and then all those zombies lose their ISP accounts, and suddenly become much more aware of the need to secure their PC.
There's a very simple solution that many webhosting companies already use -- the ISP should force their users to authenticate with the server, using secure SSL. It's good practice any way, and doing so would make even more work for the spam bots (they would have to find the user's login and password for the SMTP server).
Be relentless!
Will many ISP SMTP servers get automatically blacklisted because of this?
Unlike when they did it on the clients, this puts it through a limited number of gates.
ISP's will likely start limiting outbound email to x email/hr. Companies and ISP's will likely start monitoring and kill quicker.
This will benefit spammers for a very short period, then bite them in the ass.
ISP's and companies aren't going to tolerate a spike in CPU usage, and possible blacklisting if they can take care of it. They will start blocking IP's from sending mail, etc. etc.
Not only does it authenticate the user, it also provides a way to revoke authorization on a per-user basis in a way that still allows the user to receive a mail explaining why they're unable to send mail -- simply shutting off the user's internet access doesn't do this, and putting in ACLs to block only port 25 from their IP probably isn't practical on many ISPs' infrastructures.
500GB of disk, 5TB of transfer, $5.95/mo
I would love to see a Special Ops unit bust down the walls of a spammer's house, beat him, gag him, beat him again, send him to Guantanomo Bay for eternity, and than C-4 the spam servers.
Everyone should write their congressmen requesting this.
If you're karma whoring, at least have the decency to format your text. Only some people hate whores, but everybody hates ugly whores.
English is easier said than done.
If we just switched to a secure email system (SSL/TLS, or whatever), a lot of these dumb problems would go away.
... they all know how.
Yes, I know some mail clients don't support this functionality, but come on. Name one of the modern clients that won't do it. Thunderbird, Mail.app, Eudora, Outlook
I suppose then you just have to convince users. This, though, should be the easiest part:
Dear User,
This email is to notify you that your neighbor has been recieving your monthly e-bank statements and password confirmation emails because you are stubborn and insist on using insecure email protocols.
Incidentally, we'd like to thank you for your subscription to DAILY LESBIAN ACTION MAIL!!!1
This is the best sign yet that we're winning the war on spam. This is exactly what measures like SPF were designed to induce - forcing zombies to go through the ISP rather than sending mail themselves.
Now all the ISPs have to do is to filter and detect sudden jumps in email traffic. It will be easy for them to detect systems which have been infected. This will catch the small number of users who suddenly start running high volume email lists from their home systems, but those cases will be few enough that they can be dealt with manually.
This is the beginning of the end for the zombie spam problem!
That presumes that the process name will be pre-defined. We already have viruses that generate a new name for their executable, or library, and use that name to modify the workstation or server's database to automatically launch it each time the computer is rebooted. If this virus also is generating spam, it will be run with the process name of the executable or library, and at best you will see a process name that you don't recognize. Considering the fact that a significant percentage of the population of computer users do not even know how to bring up the task list, much less know what each process that normally runs is, is named, or does, telling them to kill off any process that looks like 'libraryname0.dll' is not going to be particularly helpful.
Your best bet is to find a personal firewall that asks you if application x is allowed to generate network traffic. Hopefully the firewall will tell you more, such as the type of traffic the application is attempting to generate, but even that can be more information than a general user is prepared to try to asses.
If your firewall tells you that 'tobmaps.exe' is trying to send e-mail to your isp's mail server, you might tell it no, don't allow that sort of traffic. If it tells you that 'tobmaps.exe' is attempting to connect to login.yahoo.com via http, you might inadvertantly allow it, even though login.yahoo.com is the first step towards sending e-mail through Yahoo.
In most cases however you can probably tell your personall firewall to block all traffic to any IRC network, unless you speicifically approve the app, and know what you are doing. Of course over time spambots are going to move on from IRC channels to Instant Messaging services, to various p2p applications, if they haven't already.
Saying 'kill off any process named xyz-abc.exe' is all well and good, but is probably going to be a one shot solution to a small subset of the people infected with a spambot.
-Rusty
You never know...
Because I suspect it doesn't work as well. It's pretty easy for an ISP to notice 100,000 emails from one sender pumping through their SMTP server, but relatively difficult to notice those mails when sent directly through the net. Also, outgoing servers are often set up with throttling.
Of course, nowadays, ISP's have no excuse in either scenario. There are plenty of network monitoring tools that will notice spamming.
I have a lot of customers that go on the road ... They just leave the SMTP set to us, and we have secure logins. Voila. Oh, but we can't use port 25 because a lot of ISPs block it.
You're using SMTP AUTH over TLS on port 587/tcp per RFC 2476, right? ISPs have fewer legitimate reasons (if any) to block 587/tcp out than 25/tcp out.
Just take a look at the statistics:
Europe has only had strict laws against junk communications for two years (Article 13 of Directive 2002/58/EC), they have only been in full force since November 2003 (and the provisions for criminal penalties are not even in place in each and every corner of the European Union yet) - but they mean pure and simple opt-in, and look how this continent's "spam output" already has become almost completely insignificant.
The U.S., I'm afraid to say, have put next to nothing in the way of these sociopaths: only a now-you-CAN-SPAM-more-than-ever Act that lives up to its name in the worst of ways, by legalizing most of the spam, enacting an unworkable opt-out onus on the users, and putting anti-spam warriors at the legal risk of interfering with (and being taken to court by the operators of) what is considered a legitimate "business model" except for some of the worst abuses - and for however little it is, all of this even an entire decade too late.
Reliance on technical solutions and minimal government intervention is just fine for many things - but it's failed in the fight against spam.
Here is how to do it:
That's certainly nowhere near rocket science, and if the above looks a bit complicated, that's probably just because- a directive is a (binding) template for lawmakers in all of the European Union's member states
- necessarily, the legal techniques as well as the "Legalese" itself vary between jurisdictions
- this is a great one-ban-fits-all provision that outlaws each and every flavor of spam at once
"First Amendment" implications: zero (and yes, of course there is freedom of speech in this part of the world as well, and even more of that speech could be heard if it wasn't drowned out by American spam - some of which comes relayed thru Asia of course) - it only bars some people from "pissing in everyone else's pool", but certainly not from speaking their mind!There is nothing wrong with following an example that works so well, even if it is from Europe...
Call your congresscritter now to outlaw unsolicited commercial communications, place a hefty fine and jail time on the offenders, and put an end to these abuses before they put an end to eMail itself.