Slashdot Mirror
Fighting "Snowshoe" Spam
Today Spamhaus announced they are releasing a new list of IP addresses from which they've been receiving "snowshoe" spam — unsolicited email distributed across many IPs and domains in order to avoid triggering volume-based filters. "This spam is sent from many small IP ranges on many Internet Service Providers (ISPs), using many different domains, and the IPs and domains change rapidly, making it difficult for people and places to detect and block this spam. Most importantly, while each host/IP usually sends a modest volume of bulk email, collectively these anonymous IP ranges send a great deal of spam, and the quantities of this type of spam have been increasing rapidly over the past few months." A post at the Enemies List anti-spam blog wonders at the impact this will have on email service providers and their customers. The author references a conversation he had with an employee from one of these providers: "... I replied that I expected it to mean the more legitimate clients of the sneakier gray- and black-hat spammers would migrate to more legitimate ESPs — suggesting that it was, in the long run, a good thing, because ESPs with transparency and a reputation to protect will educate their new clients. His reply was essentially that this would be a problem for them in the short run, because it would swamp their new customer vetting processes and so on."
Whoever keeps naming things with these slightly-plausible analogies, please stop.
As a Canadian I figured I'd better look that up.
http://www.spamhaus.org/faq/answers.lasso?section=Glossary#233
Okay okay! I heard you all the last time I brought it up. But the results are simply awesome. And greylisting is perfect against these snowshoe distribution methods. The downside might be the database filling up.
That's going to be annoying. I will never in a million years find myself in the market for snowshoes.
from the typical spambot? Any big enough botnet dedicated to send spam could have millons of nodes.
Of course, most of those nodes are located in residential IP ranges, not meant to have mail servers usually. There are blacklists for that since a lot ago. That combined with greylisting (some spambots can handle greylistings, some not), and content filtering could reduce a lot the impact of that kind of spam.
It's completely different. Snowshoe spam does not come from infected PCs (proxies or bots), it comes from *static* IP addresses *bought* by the spammers from ISPs. The spammers have been buying IP ranges, class Cs, directly from ISPs and filling these ranges with 'nonsense' domains, each one sending 'a bit' of spam is order to spread the load across the whole class C to lessen complaints.
Sounds like a good idea until one of your systems gets compromised and you receive the bill for the millions of emails that were sent through it. Perhaps you should go to prison if someone uses your car without permission and kills someone too?
Why is this being presented as if it were something new?
As early back is 2001, as an admin for an ISP, I would see what I called a "spam attack" - a large number of emails sent over a 24 hour period or so, adding up to (typically) around a million attempted emails to random addresses at the domain name(s) for which I administered.
We used greylisting to stop these attacks, but it was *very* taxing - in a typical attack, I logged well over 10,000 source IP addresses.
These so-called "snow-shoe" spam attacks are pretty much exactly what I saw some 8 years ago.
Everything old is new again...
I have no problem with your religion until you decide it's reason to deprive others of the truth.
IP reputation and RBL will always be vulnerable because the attackers just hide within the population, like guerrillas or terrorists. If you block legitimate ranges or addresses because you saw a spam come from there, it's like bombing a village because someone shot at you from one of the houses. You may kill the bad guy but you make the population REALLY mad. This is consistent with recent findings that >50% of spam actually originates from "trusted domains."
I'm looking over the wall, and they're looking at me!
I think a better idea...
Stop filtering spam at all. For a whole week.
Let the spammers break the system.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Greylisting won't help against any competent snowshoe spam operation.
Greylisting is useful against ad-hoc connections from botnet hosts that are unlikely to try to resend a message within in an appropriate interval. Managing resending in the botnet environment is challenging.
Snowshoe spamming is, in some small part, probably a response to the decreasing likelihood that random, compromised, home machines will be able to deliver much spam -- a decrease that is probably partially attributable to greylisting. The snowshoe approach is very different from the malware/botnet approach. The spammer buys bulk hosting from a colo facility and set up real honest-to-god email servers on dozens to hundreds of IP addresses. Then the spammer dribbles messages in relatively low volume from these large number of IP addresses. If one of the spam servers encounters a host with greylisting, it requeues the messages to retry later just like a normal email server will because it's a normal email server. The spammer merely maintains and manages a large number of these servers on commercially hosted connections, and distributes his spam payload across them. Distributing the spam load across these many servers reduces the likelihood that any particular server will be quickly blacklisted, and if it if is blacklisted it may go dormant until automatically delisted, then start spamming again.
Many of the bulk "bandwidth providers" don't seem to give a fuck if this kind of thing is taking place on their networks, although in the end it will pollute and devalue or render useless large swaths of IP space at these providers. I'd name names, but am not in any mood to get sued.
Greylisting is useless for most snowshoe spam. Take it from someone who has been watching these tactics for the last couple months.
I don't think you realize just how protected you are from fraud and similar crimes by the fact that they are crimes. You can knock our justice system for being imperfect, but you can't knock it for being ineffective. ('cepting the "war on drugs", of course)
The truth is that we have a first-rate police force and criminal investigation system that is quite effective at enforcing laws of commerce - protections that provide you with a refund if the item purchased didn't work out, etc - that you use so casually, you hardly know they are there.
And that leaves a population terribly unprepared for the wild wooly Internet, where those protections so painstakingly put into place mean almost nothing. You can talk all you want about education and eliminating the source of the problem, but it's never worked before and all of social commerce is set up to work the other way.
So, good luck with that.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
The Spamhaus article really describes one of the most frequently encountered behaviors we see by looking at our spamd logs. Each machine does not necessarily send a large number of messages (although some do, hanging on for weeks on end in extreme cases), but once a machine has tried to deliver mail to one of our published trap addresses (see the list at http://www.bsdly.net/~peter/traplist.shtml ), we keep them occupied and publicly shamed (see http://www.bsdly.net/~peter/nameandshame.html as well as the exported blacklist) for 24 hours, or longer if they keep coming. I wrote about these things in some blog posts earlier that were /.ed, and of course the generated lists are free to use, see the URLs and the blog posts.
-- That grumpy BSD guy - http://bsdly.blogspot.com/
I'm getting 1000+ spam messages a day going to my Gmail spam folder.
Spammers are not giving up.
Democrats or Republicans. They are both taking us to the same place and they are not afraid of us anymore.
In other words we've come full circle and are back to the days when spammers were actually hosted somewhere. Only this time in a bit more of a distributed fashion.