Slashdot Mirror
Washington Post Blog Shuts Down 75% of Online Spam
ESCquire writes "Apparently, the Washington Post Blog 'Security Fix' managed to shut down McColo, a US-based hosting provider facilitating more than 75 percent of global spam. " Now how long before the void is filled by another ISP?
The badness attributed to McColo was not limited to spam. It included child pornography sites; sites that accepted payment for spam and child porn; rogue anti-virus Web sites; and a huge malicious software operation that apparently stole banking and credit card data from more than a half million people worldwide.
And they operated for how long before they were shut down ... as a United States based hosting provider?
... I'm all for user privacy policy from an ISP but obviously these people are criminals.
If they have evidence of these things, I certainly hope that The Washington Post turns any evidence over to the FBI or at the least the local law enforcement where McColo is operating. And I hope a warrant is obtained through the appropriate channels to collect evidence from Hurricane Electric & Global Crossing
My work here is dung.
I had ONE spam message last night. I average probably 20 a night.
Sometimes it's best to just let stupid people be stupid.
Seems like McD is moving quick:
http://inventorspot.com/articles/mcdonalds_japan_goes_nobrand_with_quarter_pounder_shops_19505
as the title says. if it gets them "off the air" is this a public service or a criminal act (or both)?
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Or change the protocol set to something that can still work with anonymous yet non-commercial/legal mail. I can't think of a single person that would mind changing their email address or taking a few steps to eliminate the spam they get.
---- Teach Peace. It's Cheaper Than War.
According to the article, the provider hosted servers that provided child porn.
1: Is that really possible for kiddie porn sites to be active in the US?
2: If its true, would that company be partially responsible legally speaking?
When it comes to these sorts of things, oft times law enforcement and intelligence agencies who know about a source of major operations DON"T shut them down, so as to build a case against the bigger players or to maintain the ability to track what is going on. Given that this is a US-based corporation with US-based servers, I wonder if this shutdown has seriously compromised on-going monitoring and criminal cases. While this has almost certainly seriously disrupted operations of the various bad guys for now, I would give it only a few days before they're back online based at overseas locations where they're less easily reachable. Except for some script kiddies, the operations are all sophisticated enough to use standard techniques such as multiple hardcoded fallback IPs. DNS redirection, and using fake BGP announcements to hijack IP blocks to get back online.
--Paul
proxy anonymity. someone will think it up and make it work.
---- Teach Peace. It's Cheaper Than War.
Usually when people make absolute/exclusionary statements, like "the ONLY way", they end up being not entirely correct.
While going after the advertisers could solve the problem, that assumes you could track them down AND have any control over their actions. Jurisdictional hurdles and similar problems are obvious with this approach.
Fortunately tho, that's not the ONLY way to address the problem. It'd be good if ISPs had incentives to address the problem - large scale bittorent protocol usage is something that wreaks havoc on the ISPs network and many ISPs are actively trying to come up with solutions to ease their pain. If there were an incentive for ISPs to monitor for abuse over SMTP, then perhaps another solution to the SPAM problem would be possible.
Theres lots of "answers". Any answer you provide to this problem falls prey to the same general set of problems tho. Theres a standard form slashdotters post in response to suggestions like this, and by checking off the correct options it can shoot down any possible solution you can think of.
Overclockers
I use GMail with email addresses on my own domain (and it's free!)
The only downside is having only 7GB of mail storage space.
GMail's spam filtering is indeed second to none, I'm piping one of my old yahoo accounts through to my new address, and yahoo lets a few spams through per day, and then gmail blocks all of those.
This couldn't be by volume. Given the amount of spam that everyone receives every day, I don't think a single ISP could possibly generate 75% of it. It would take multiple gigabit connections and I'm sure someone would have already noticed that kind of traffic coming from one place.
I use a procmail filter that sends mail from known addresses into my mailbox, and dumps everything else into a "garbage" file that I check every morning before deleting it, (on the off change that a friend or business has sent mail from a new address). This morning for the first time in *years*, the file was empty.
...once the folks who sell spam and porn find a hosting provider who turns a blind eye, they tend to stick with it and consolidate their operations. Paying attention to Spamhaus and the more reliable botnet trackers tells me where these operations are located, and helps me write good gateway filters for my employer, my house, and my friends. Cutting off internet access tends only to disperse the nere-do-wells rather than stop them, and I have to start over again tracking and writing new filters. In other words, I like to know where these guys hang out so I can avoid them, the same way I avoid the riff-raff in the physical city where I live.
I think its great that someone is doing something about the problem, but I don't think it should be the ISP. We already have laws against spam and certain porn, and it should be up to the government to enforce those laws. Vigilantism is never the answer.
The tried-and-true way works: if you have evidence, take it to the police. If the police won't do anything, take it to the press. Sure it takes a little longer, but it keeps - in this case your internet connection - safe from the Random Crusader. And the criminals may actually get arrested.
You'd have to ask my greylist, mimedefang, and spamassassin filters, as most of it gets killed before even making it to the 3rd, which kills the rest. Stuff in that small threshold I allow, maybe 1-2 every couple of months gets through, and that's usually from a company I actually had done business with in the past.
Mimedefang rejections on dumb things at the helo/from stage, and greylisting kill most things without ever having to receive or process it.
So, how much spam does everyone get each day on average?
Well, according to my mail logs, my mail server that currently provides mail service for myself in the past 8 hours:
Has blocked 2879 messages, based simply on the IP address, using RBLs.
Has blocked 1013 messages, based on some early tests in mail delivery.
Has passed 176 messages on for further filtering, with my address. I haven't checked how many were to my wife or to invalid addresses. Typically that's several hundred an hour.
The next level of filtering:
Dropped 18 messages completely.
Filed 127 messages in the "probable spam" box, where they will be deleted within a week.
Delivered 31 messages to my home server.
Of those messages, about half of those were filed as "spam" by Apple's Mail.app.
That's pretty low by my standards. Good work.
...or at least, no judgement or legislation in the US has ever held ISPs to be common carriers in the sense that phone companies are.
http://www.spamcop.net/spamgraph.shtml?spamweek
Look at Tuesday's sharp drop off coinciding with the shut down.
If I can not smoke in heaven, then I shall not go. -- Mark Twain
I also am running all of my domain email address through Google Apps. I run all of my own servers. Because of this, my email server is setup to download all of the email from the Gmail accounts and sort it locally into the users mailboxes. This is difficult to setup and initially though it does allow you to use Google's amazing spam blocking options and still use your own "unlimited" storage. Currently my 50 or so users are sharing a 1TB drive. I'm not certain how much control you have over your servers and such, but just to let you know about my setup.
I prefer to believe that the endless line of morons are the people who think that they can make money by becoming a spammer (or that is, purchasing spam runs from the real spammers).
Maybe there are hundreds of thousands of people who repeatedly try to purchase drugs and other crap from shady online retailers, but I don't really think so.
Nerd rage is the funniest rage.
From their press release: "In the afternoon of Tuesday 11/11, IronPort saw a drop of almost 2/3 of overall spam volume, correlating with a drop in IronPort's SenderBase queries. While we investigated what we thought might be a technical problem, a major spam network, McColo Corp., was shutdown, as reported by The Washington Post on Tuesday evening."
...because you never know who you're dealing with.
Gmail holds spam in a separate folder for 30 days before deleting them. Usually I have around 3000 emails in there, around 100/day, but at the moment I only have 1442; over the last 4 days I've only averaged 30 spam emails a day (900ish a month).
Sounds about right.
I spent significant time yesterday, concerned that recent firewall and DNS changes had had unintended side effects: my inbound mail volume dropped by about 70% around 16:30 eastern.
Thank God the washingtonpost.com guys posted to netnews (almost) right away.
Do daemons dream of electric sleep()?
So, I don't mean to be a dick here or anything, but you had those kinds of problems with a vendor you were using as a data centre not just once, but over a timespan measured in YEARS.
While you anecdotes indicate that HE does have problems, I think the bigger concern is that they have customers who put up with those problems. What golden nugget are we missing? Do they have higher than normal payouts for failing to meet SLAs?
Now it's time for some federal law enforcement action. Over at McColo, there will be records that indicate who's behind the spamming and botnet operations. They'll know who paid for servers. There will be phone records showing who made support phone calls to McColo.
McColo is in San Jose, and the San Francisco office of the FBI, which covers Silicon Valley, has a Cyber Intrusion Squad. It's their job to start digging and find out who's behind the spam operations.
Even if the people behind the spamming tried to stay anonymous to McColo, the odds are that they slipped up somewhere.
By doing this, not only does the press shut down a major thorn in internet's side, but also show that the stupid feds/cops are either on the take with this, or just too incompetent.
Either way, it does not look good for the feds/cops
Maybe if you used fewer parentheses...
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
Down from about 6,000msgs/minute (since forever ago) to about 2,000msgs/minute as of yesterday evening. This one actually seems to have made a difference (unlike the HerbalKing group's 'shutdown).
Omeganon