Slashdot Mirror
Sophos Reveals Latest Spam-Relaying Countries
An anonymous reader writes "For the first time in more than two years, the United States has failed to make inroads into its spam-relaying problem. The U.S. remains stuck at the top of the chart and is the source of 23.2 percent of the world's spam. Its closest rivals are China and South Korea, although both of these nations have managed to reduce their statistics since Q1 2006. The vast majority of this spam is relayed by 'zombies,' also known as botnet computers."
I'm not sure why they divide by country. Are they implying that the laws and regulations of these companies should be stricter? Is this some sort of international contest to see who can restrict the rights of its internet users the fastest? The fact is that these nations are just relaying the spam. They might not be the origin of the spam so it's not like targeting a nationality will help.
Furthermore, these percentages don't appear to be normalized in any way. Does the United States contain more than 23% of the world's internet traffic? Probably. What about the sheer number of IPs assigned to citizens? Again, probably more than 23% of the world's total user population. Even if it isn't that high, it'd still show that countries like China are doing ok relative to the sheer number of users they have. I think this study only showed that spam is directly proportionate to internet usage. And nothing more.
Logically, you would divide by source or company or--better yet--ISP. I think the penalties should come from the companies that make money providing the internet service to the sources of the spam. Even if it's a bot or open relay for spam, the ISP should investigate it and shut it down. I honestly wouldn't be surprised to see Cox & Comcast show up on that list as they are so unbelievably careless.
I think laws against the internet service providers are in order to force this but it's difficult to track. That's why Sophos should publish names of internet service providers and drag them through the mud, I don't care about countries. And how about making the penalty for the ISP a bit tougher as in you get one warning about a particular user and then you're restricted from providing internet service?
In the end, you have to ask yourself--do we really want to make this a responsibility of all governments? I think the answer is 'no' considering that they can always just open up some operation in another nation and find an ISP dying for cash. Then you have to chase them there.
My work here is dung.
"Follow the money"
What's so hard here? The US has pushed for having banks and financial service companies to be more open with governments on who is doing what with transactions.
There's always the content, too. Just look in the emails and they have telephone numbers, web sites, the various means of seeing what these scumbags have to offer and how to contact them.
Educating the public is failing. Why? How many public service ads have you seen advising people how to protect themselves from being scammed, preventing identity theft, etc.? I've seen none. I see private ads OF the voice overs of the big dude with the girl's voice, where his identity has been stolen, I think it was for a paper shreader of all things.
Sophos must be with the terrorists as they are not proclaiming victory in the war on terror. Enough has been made of the suspicion (has anything been proved?) that terrorists raise funds this way. I wouldn't put it past them, but I also wouldn't put it past some russian teenagers with limited career potential in Putin's New And Improved USSR.
A feeling of having made the same mistake before: Deja Foobar
No wonder the tubes are jammed.
For the lack of a better sig.
... if you just opened up port 25 on EVERY machine and put some dummy SMTP recieve code behind it that did nothing else other than accept mail and then discard it, could we make it 500 million times harded for spammers to find an active and working open relay?
Sadly, any trick (even as drastic as I've suggested) would only be temporary. People still click on random .exe files (and scripts) as fast as they come in. Any Dilbert, South Park, or Pokemon screensaver will be clicked on my some nitwit. I see the forum posts about how certain screensavers don't work. Well, of course they don't -- they're not screensavers, they're little servers designed to relay spam.
Given the vast numbers of idiots, and amateurs online here in the U.S., of course we're in the lead. (I have two teens -- both of them have clicked on evil .exe's -- firing off malicious code warnings on the Windows machines).
Educating the gajillion newly techno-blessed is the only way to get this under control.
How hard is it to understand, "If a stranger gives you an apple -- DON'T EAT IT!"
My ZooLoo
At first I was looking at the numbers and wondering if Americans just have so many more Windows machines than the rest of the big relays out there, but once the numbers get into the single digits (everything after the US and China) I quickly realized that most of the people in those nations are probably using the same OS - Windows - as people in the US. So is it simply that the US comes out on top because we have so damned many computers - as opposed to other nations where they're sometimes uncommon in households and people use internet cafes? Or is it not a PCs-per-capita issue, but an issue of people in the USA simply being to stupid/lazy/etc. to secure their Windows machines? If the former is the case, we're in for some nasty spam as PCs per capita increase, and there are ever more systems begging to be infected. If the latter case is true, what will it take to finally get Windows users to start securing their Windows boxes?
The old saying goes, "You can lead a horse to water, but you can't make him drink."
Updated, it'd be "You can lead a user to clue, but you can't make him think."
As it applies here, the average user isn't going to understand (or want to understand) what benefit these free items will give him/her. They've never heard of a firewall or a rootkit. All they really care about is how much it costs.
Now if a service could show better profits through these steps (from reduced expenses, including bandwidth, support, etc) then we might be getting somewhere. But you're never going to get anywhere trying to educate the user.
Never underestimate the power of stupid people in large groups.
As impractical as it might be, I, being a software developer think the best way to go about removing this crap isn't on the receiving end. It won't be fixed by filters. It won't be fixed by blockers. The way to fix it is through putting some sort of tax, fee, whatever you might have it, on email getting sent.
Before you flip out and throw the "OMGOOSES MY FREEDOM" argument around, answer me this:
If you were being sent text messages to your cellphone, and being charged ten cents per text message, how long would you tolerate that?
The reason nothing is being done to combat this is due to the fact that when people spend hours cleaning off spam, they aren't even thinkinga bout the "Time = Money" equation. If they were, I think they'd be pretty hot about getting the senders punished.
My experience is that around 60-75% of the spam I receive comes from China. On my home mail server I finally broke down and started blocking the worst offending subnets and the amount of spam I received dropped dramatically. There is a RBL for China, cn.blackhole.us, or a combination of China and Korea (cn-kr.blackhole.us), though these are no longer listed and will likely disappear soon.
? country=$ctry`;
print join "\n", /([0-9\.]+\/[0-9]+)/g;
I also use several other RBLs which have helped a lot.
I also decided to add the worst offending subnets in China as rules for my firewall to block. The worst offending subnet is 221.208.208.x where my firewall reports an almost constant barrage of IM spam, and from what I've read, this subnet has been a problem for years.
For your own blocking, the following script will get all the subnets used by China (or any other country you're interested in, just change $ctry):
#!/usr/bin/perl $ctry = shift || 'cn'; $_ = `wget -O - http://www.apnic.net/apnic-bin/ipv4-by-country.pl
At work, where I cannot do this, most of my spam is also received from China.
Out of the rest of the spam I receive, the US is actually pretty far down on the list of sources, though still much higher than places like the UK, Germany or France. The rest seems to come from places like Poland, Romania and Estonia.
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
And why not stop and look at your comment and others: other than *ownership* of computers, the other major common factor here is Windows. It certainly isn't as though Microsoft isn't complicit in this. Look at the security holes and exploits and everything else that can be laid at their doorstep over the last, well, 5-7 years.
And before someone here tries to flame or mod me and say that Windows isn't the only thing you can write viruses for, yeah, silly, I know that. It's just that writing a virus for W32 / WinNT-class environments has always been made pretty much brain-dead simple by those folks from Redmond. If you want to write a virus for anything else, you actually have to know what you're doing to write code. You know, like the "good old days" of MS-DOS and Win1.x/2.x/3.x. Or Apple II. Or Amiga, etc.
I tend not to pay very much attention to the reports on the state of Internet or individual computer security when it comes from most public authorities, since they all like to dance blithely and blindly around Microsoft's (however unintentional) part in all this noise and nonsense. "Criticize Microsoft? We can't do that! We'll just pretend these problems are part-and-parcel of owning a computer! Heh heh! Nobody will notice!" The media needs to get a clue.
Oh, wait, it's the media. Nevermind... :(
I haven't been keeping up on my anti-spam measures, lately, so I'm not sure if this has been considered, yet. Wouldn't it be possible to simply add a DNS record that allows a mail server to verify that the machine trying to send it mail is authorized to do so, for that domain?
A machine that supports it could ask the sending domain "Is this machine allowed to send email on your behalf?" The sending domain could simply answer "yes" or "no". That would immediately eliminate all the zombies, for those people who wanted to upgrade their DNS and mail software. It would also be backward compatible for people who couldn't. The best part is that could be controlled by the domain administrators, rather than some government agency or black hole list.
Sit, Ubuntu, sit. Good dog.
Its articles like these that lament people's basic misunderstanding of statistics. They use percentage of spam sent by countries in order to try to prove that spam is not being reduced in the United States. The problem is that simply relaying a percentage of total spam does not prove or disprove this point. It simply shows whether the US is changing more or less in proportion to other countries. Did the total number of spam messages go up or down? What about the total number of bot nets? The reality is that the total numbers could have gone down, and the US percentage still could have gone up depending on whether other countries went down further than the US. Percentages always add up to 100!
According to the Computer Industry Almanac the U.S. uses 25% of the world's PCs. While I know our broadband penetration is not has high as other countries, we sure have a lot of hardware. Another thing to look at would be total messages in/out versus total messages claimed as spam. Sophos doesn't give us that piece of information. At least last year, Andrei Serjantov and Richard Clayton had done some work along those very lines in a paper found here. I don't know if they've updated it.
"It's worrying to see so many pump-and-dump emails - often with embedded graphics included - being spammed out to the general public," added Cluley. "The people that act upon these emails aren't skilled investors, and don't realise that purchasing the shares is likely to reap no reward, benefiting only the spammers, while creating a financial rollercoaster for the organisation in question."
Why is this worrying, in the sense that it needs to be mentioned explictly?
Most of the general public is not medically educated either, yet we have received spam about all sorts of pills for a long time.
And many do not know what 419 is, yet lots of those mails are sent as spam.
Lots of the spam I receive is in far-east languages which most western citizens are not skilled to read.
SPAM in itself is worrying, but there is nothing especially worrying about pump-and-dump.
Alternatively, if the spammer/zombie computer has port 25 open itself, have a netfilter rule that rewrites the destination address to that of the sender, increases the TTL, and sends the packets back in duplicate. Again, this is a resource-draining scheme. If it's an open relay, it'll get the spam and resend it. I believe the hop count for SMTP is something like 30 and each packet will go two ways along the wire, so it'll take 2^31 as much bandwidth overall, if a sufficiently large number of users set up this kind of loopback. Companies that simply don't care if their machines are zombies will suddenly notice a degradation of their networks but any packet monitoring they do will show all of the packets to have the IP addresses of their machines for both source and destination. At least some will zombie detox to save their sanity.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Well I always go back to the example of a relative of mine who asked "What in the world would some hacker want with my PC"? They don't have a grasp of what access to even a Pentium 100 on a dial-up can be used for. They don't realize that spamming is pulled off with a "death by 1000 paper cuts" approach. How many average users could even grasp the concept of a computing cluster? Not everyone can or wants to understand this stuff. To them, it's just more time wasting useless crap when all they want to do is get on the net and play.
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
Probably very few. If it is your own system you have to pay for the bandwidth. Or for even less money you can rent time on a botnet that runs on two thousand exploited Windows boxes. There are even Web based interfaces that will walk you through sending your spam. People who want to run their own spam service on legitimately owned and linked machines have been priced out of the market. Both are equally illegal, so no motivation there. Sure there might be a couple run by someone clueless, but the numbers won't compare to the thousands a botnet herder can put together in an automated fashion.
I see this illistrated every time I listen to the podcast of Leo Laporte's KFI radio show. Every show he has at least one call about spyware where he tells people the exact same things: Get a router, run spybot, adaware, windows defender. The people seem so clueless when he tells them that. I can understand that people aren't experts on things, but it is litterally the same advice every week. Weren't these people listening last week? If they've never listened before, then how did they know about the show in the first place? It just baffles me. Whether or not you think that is the best advice, I just don't understand how these people haven't heard it before.
http://www.popularculturegaming.com -- my blog about the culture of videogame players
None of it would exist at all if the END USER stopped buying viagra every time they get an offer in their inbox..
However, I would applaud a spamming company that slowly removed non-responsive email addresses from their spam lists and tailored their spam only to those few users who respond
Will program for karma.
My provider prevents me from sending to SMTP ports outside of my domain, for better or for worse. This got me thinking:
- would it be possible to selectivley block ports?
- provide an ISP based UI, where you could unblock ports based on your account?
- if both above are doable, what over head would this provide?
- maybe provide different default configurations based on the type of user you are (technophobe, newbie, average home user, business user, power user, etc)
- how well would such a solution go down?
Sure you could ask everyone to install the equivalent of zone alarms, but this is not always going to happen.
Jumpstart the tartan drive.
I see a number of people asking the question "But how many computers are there per country?" I found the numbers at:
http://www.c-i-a.com/pr0904.htm
Here's what they show. I've added the % of spam coming from each country as the last entry in each line:
Top 15 Countries in Internet Usage
Internet Users (#X1000) Users% Spam%
1. U.S. 185,550 19.86 23.2% of spam
2. China 99,800 10.68 20.0%
3. Japan 78,050 8.35 1.6%
4. Germany 41,880 4.48 2.5%
5. India 36,970 3.96 N/A
6. UK 33,110 3.54 1.8%
7. South Korea 31,670 3.39 7.5%
8. Italy 25,530 2.73 3.0%
9. France 25,470 2.73 5.2%
10. Brazil 22,320 2.39 3.1%
11. Russia 21,230 2.27 N/A
12. Canada 20,450 2.19 N/A
13. Mexico 13,880 1.49 N/A
14. Spain 13,440 1.44 4.8%
15. Australia 13,010 1.39 N/A
Top 15 Countries 662,360 70.88
Worldwide Total 934,480 100
It looks like the USA's numbers are right about on track with most other countries with China way out in front as to percent of the spam problem compared to percent of Internet connected computers. What's this? France has twice the percent of spams relaying through their country compared to the percent of Internet users? For shame!
But why is the rum gone?
Last time I posted, I somehow offended a few americans who mistakenly took my attack on climate-change nay-sayers as an attack on America and americans as whole: it resulted in DoS on my sites and a joe-job campaign against my public mail servers.
Polute the world, polute our mailboxes, and be damned anyone who dares question whether this is moral or not!
Funny thing is: my spam filters are now much improved! Thanks!
TODO: 753) write sig.
I would like to see a per-capita or per-connection statistic for this. I notice that Canada isn't up there on that list, but they do have a lesser population than China/USA (though probably more than many of the others), and alternately a pretty high ratio of connectivity per household/business.
How about a graph of "# of known connections in country vs amount of spam). If country X is only contributing 2% of the spam, but they've got 2% of the overall population and only 25% of that is connected... it shows a little more how the local control on such things may be a bit... lax.
Who says it has to be one or the other?
Your mom probably doesn't need to run an email server. Neither does 99% of other ISP users. The far less than 1% (of which I'm included) that need specific ports opened up can do so by working with the ISP.
That would eliminate 99% of zombie spam right off the bat, without significantly affecting anyone. It may take you 5 minutes on the phone with tech support, but it closes a HUGE whole that is actively exploited by the spammers.
Bye-bye spam. It also takes a way a LOT of the motivation for creating zombie machines, so bye-bye much of the spyware and viruses (not all, but probably a noticeable amount).
So we aren't sacrificing freedom for security. We're tolerating a 5 minute phone call for 1% of users so that everyone can enjoy the internet far, far more.
Well worth it, if you ask me. Absolutely nothing is lost. A whole lot is gained.
Lose Weight and Feel Great with Isagenix
The internet is very analogous to the highway system in most countries. Commercial drivers create increased risk to all drivers on the road, and thus require training and registration for the safety and benefit of everyone involved, including each other.
The commercial drivers could (and may) complain that it's unfair that they have to go through the hassle of getting licensed and registered, after all, each thinks he is a perfect driver and poses no risk whatsoever. But I think most people would agree regulation of commercial drivers is a good thing and everyone benefits.
Likewise, those (myself included) wanting to do more than normal with the information super highway would likely complain if we had to take an extra step before being able to do what we want on the internet, such as running a web server or email server. But again, I think the benefits outweight the inconvenience 100 times over. I could call my ISP and be added to their open ports list in 5 minutes (ONCE), but I easily spend 10 minutes A DAY on spam, and often more.
Mind you, this is only on dial up and broadband accounts. Most T1 lines, etc, used for business wouldn't need this requirement as they already have administrators that keep things secure and zombies to a minimum, and RBL's already deal with most of the rest.
Lose Weight and Feel Great with Isagenix
Anyway, users, as you said, aren't too bright. Just put the firewall setup and de-rootkitter (and whatever else) into a CD labled "Setup" and the user will pop that right in.
And their computer will be clean and safe... right up until the baddies start handing out their own CDs.
- USA: 23.2% of world spam, 20.1% of world internet users
- China: 20.0% of world spam, 10.9% of world internet users
- S. Korea: 7.9% of world spam, 3.3% of world internet users
So adjusted for internet user population, the US puts out 23.2/20.1 = 1.15, or 15% more spam than expected. China puts out 20.0/10.9 = 1.83, or 83% more spam than expected. South Korea puts out 7.9/3.3 = 2.39, or 139% more spam than expected. I got the internet population stats from: http://www.internetworldstats.com/top20.htm