Slashdot Mirror
Amazon's EC2 Having Problems With Spam and Malware
jamie pointed out a story about the recent problems Amazon's EC2 service has been having with malware and spam. "EC2 space is now actively blocked by Outblaze, and has been listed by Spamhaus in their PBL list [...] However as Seth Breidbart noted in the comments, 'note that Amazon will terminate the instance. That means that the spammer just creates another instance, which gets a new IP address, and continues spamming.' True enough -- as described, instance termination simply isn't good enough."
While I'm against the death penalty, I might be willing to consider it for spammers.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
They have the credit card numbers of these people, no? Add a $1000 (or more) charge to the TOS each time someone gets caught spamming through them. That should make a pretty clear point.
Why aren't Amazon terminating the accounts of offenders, and blacklisting whatever payment method they're using? It's a paid service, it's not like spammers can register for new accounts as much as they like, they're going to run out of credit card numbers (well, assuming their activities aren't more nefarious than mere spam).
It's not in Amazon's interests to have EC2 blacklisted.
Somebody finally solved the ????? = Profit equation. What's everyone getting so worked up about?
Everybody's a libertarian 'till their neighbour's becomes a crack house.
The hoster terminates the client and won't sign him up again. Amazon could easily do he same but doesn't. Instead the only terminate the instance.
The top hit from Google would have told you. It's Amazon's Elastic Compute Cloud.
I'm afraid taint.org might not be safe for work.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Once they have the name of the instance, they also know who launched it -- after all, they are billing someone.
I like the suggestion to charge a large fee to the credit card they have on file, but what about simply banning the account in question?
Don't thank God, thank a doctor!
No, it's apparently something in the Amazon. I guess Brazilian deforestation is a major contributor to the global increase in salted canned pig meat.
The UK Honeynet Project spotted this a few days earlier :)
http://www.ukhoneynet.org/2008/06/30/it-had-to-happen
Here is a wild idea... WILD.. Off the hook insanity....
Just block ALL of EC2 from being able to send out anything on port 25 and 587.
Problem solved. Last time I checked EC2 has a lot more interesting uses than running mail server software.
EV certificates cannot sign mail, only server to server communication. E-mail signing certificates cost about $30, and require absolutely no proof of identity, just existence. This is no barrier whatsoever.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
I think all the ideas of placing a deposit or putting an extra charge per message are against the EC2 model. The whole idea is to offer a high capability solution at a low entry price that scales easily.
Spammers and abusers tend to have distinctive patterns and this what Amazon should be paying attention to. Ie. some guy using a US credit card, logging to his instance from eastern Europe and sending a zillion emails messages the second day after sign up should raise some doubts. Manual inspection of suspicious traffic can be very costly but they can easily build a growing list of trusted customers who use the service for legitimate reasons and monitor suspicious traffic from new registrations.
Wikipedia says it's the north eastern corner of the city of London, roughly. I don't get the article, either.
Stasis is death. Embrace change.
why not run an inward facing IDS- something like snort. It's easy enough to setup a script that automatically terminates accounts of people sending abuse, and to do it on the first instance of that abuse.
Ah, the PBL. That's where your argument falls to pieces.
From http://www.spamhaus.org/pbl/index.lasso :
PBL IP address ranges are added and maintained by each network participating in the PBL project, working in conjunction with the Spamhaus PBL team, to help apply their outbound email policies.
So, your ISP told Spamhaus that mail shouldn't be coming from the range your IP address is in. Not Spamhaus making a trite, petty and vindictive block for the fun of it. Not some blacklist deciding in error to block a whole /24 full of static addresses with REAL rDNS records for most of it because they found a couple of zombied machines with vaguely generic-looking PTRs in it. This is a case of the people you pay for connectivity telling Spamhaus that the rest of the world should not accept mail from your IP address or others near it until further notice - they're being good neighbours, and are to be applauded.
If you have a static address you can poke a hole in the PBL for it pretty easily - *you* can provide that further notice:
A feature of the PBL is the elimination of 'false positives' with a server-identifying and automatic removal mechanism for single IP addresses. This allows end users with static IP addresses within a larger dynamic pool, and legitimate mail server operators, to assert that in their opinion their IP addresses are a trustworthy source of email and to automatically remove (suppress) their IP addresses from the PBL database. Safeguards are built in to prevent abuse of this facility by spammers (and particularly by automated bots).
Do your research. The PBL is pretty damn useful, and you probably qualify for free use. If you have an unfiltered postmaster address on your domain (you do, don't you?) the smart thing would be to start blocking with it but make sure the rejection contains something like "Rejected: $IP_ADDRESS listed in Spamhaus PBL ( http://lookup-urlip_address/ ) - please contact postmaster@whineyblacklisthater.org for assistance if required" - you'll find that the "false-positives" for it are almost invariably from people who don't know what the PBL is and want to do their own thing, regardless of the practicalities the rest of the world has to face. Why should I or anyone else accept mail from somewhere your own ISP or their upstream provider has said I shouldn't?
Why do all the antispam nazi's solutions ignore the collateral damage to innocent by standers? "They should educate themselves" "they should switch providers" they scream. Black lists do nothing but break the system. I'd rather get all the spam than have important mail bounce. Just last week I had a mission critical email bounce because of some lame blacklist. This email not getting to its recipient would have basically ruined my life. Its a good thing I have the ability to send mail from more than once source.
If you formulate your mails the same way you usually formulate your posts on Slashdot , I'm really not surprised, Mr. Fr0sti P1ss GNNA.
All those moments will be lost in time, like tears in rain. Time to die.