Slashdot Mirror
Fighting "Snowshoe" Spam
Today Spamhaus announced they are releasing a new list of IP addresses from which they've been receiving "snowshoe" spam — unsolicited email distributed across many IPs and domains in order to avoid triggering volume-based filters. "This spam is sent from many small IP ranges on many Internet Service Providers (ISPs), using many different domains, and the IPs and domains change rapidly, making it difficult for people and places to detect and block this spam. Most importantly, while each host/IP usually sends a modest volume of bulk email, collectively these anonymous IP ranges send a great deal of spam, and the quantities of this type of spam have been increasing rapidly over the past few months." A post at the Enemies List anti-spam blog wonders at the impact this will have on email service providers and their customers. The author references a conversation he had with an employee from one of these providers: "... I replied that I expected it to mean the more legitimate clients of the sneakier gray- and black-hat spammers would migrate to more legitimate ESPs — suggesting that it was, in the long run, a good thing, because ESPs with transparency and a reputation to protect will educate their new clients. His reply was essentially that this would be a problem for them in the short run, because it would swamp their new customer vetting processes and so on."
Whoever keeps naming things with these slightly-plausible analogies, please stop.
Okay okay! I heard you all the last time I brought it up. But the results are simply awesome. And greylisting is perfect against these snowshoe distribution methods. The downside might be the database filling up.
Sounds like a good idea until one of your systems gets compromised and you receive the bill for the millions of emails that were sent through it. Perhaps you should go to prison if someone uses your car without permission and kills someone too?
IP reputation and RBL will always be vulnerable because the attackers just hide within the population, like guerrillas or terrorists. If you block legitimate ranges or addresses because you saw a spam come from there, it's like bombing a village because someone shot at you from one of the houses. You may kill the bad guy but you make the population REALLY mad. This is consistent with recent findings that >50% of spam actually originates from "trusted domains."
I'm looking over the wall, and they're looking at me!
This isn't going to be popular, but its true...
The thing is, what exactly is a 'legitimate mailer'? Defined by US law, its somebody who honors the provisions of CAN SPAM. As the US Appeals court so eloquently stated, "As should be apparent here, âthe lawâ(TM) that Gordon purportedly enforces relates more to his subjective view of what the law ought to be, and differs substantially from the law itself.". You seem to be losing sight of the fact that you are not law enforcement officers. You are vigilantes making up the law as you go along. Right or wrong, there is no law in the US requiring anything other than honoring opt-outs, proving a physical address in emails, and not falsifying headers. And the fact is in your efforts to "stamp out" spam are just making the problem worse because emailers just send out more spam to compensate for your efforts. Here is reality: email marketers aren't going anywhere. Organizations such as Spamhaus have failed to eliminate spam industry as any efforts to shut down a mailer are temporary at best. Gordon lost everything. With this kind of a victory on their side, its just a matter of time before emailers start standing up and suing the anti-spam crowd into oblivion for restraint of trade.