Slashdot Mirror
Hackers Blamed For MessageLabs Spam Blunder
littlekorea writes "MessageLabs claims to have discovered that the systems of one of its customers were hacked by spammers after an entire block of MessageLabs IP addresses was blocked by antispam service SORBS. Customers of the managed email service had problems with outbound mail last week after MessageLabs' IP addresses were included in SORBS' block list. The Symantec-owned service provider has assured customers it has systems in place to prevent such incidents from happening again."
Sorbs is a really poor block list which I don't think anyone should use.
I found that my mail server is listed in their list, because 3 years ago the same IP range was allocated to a dynamic IP range.
Even though it is now a static server address and the whois IP allocation records were long ago updated, and even has the reverse dns saying "static" in the format that sorbs demand, because the ENTIRE /24 network where my server lives doesn't confirm to their demanded reverse DNS standard, they refuse to delist it.
Their web service is a total nightmare and even their auto responder takes two weeks. As someone who has been working with mail servers on the internet since 1992, I would say please for the love of god, do not use sorbs as an email blocking list.
Check out Wikipedia for more info on them, they also solicit payments for some delisting which seems completely unethical.
Of all the companies that should have been most aware of the threat of spammers and hackers, it should be one of the ones who profit the most from selling anti- and counter-measures against their activities. They are the "experts" on the subject aren't they?
Sullivan said the email was "quite patently designed to mislead users of SORBS into believing that MessageLabs are the good guys and SORBS are the scum of the earth."
In my experience they are a bunch of bastards, the BOFH probably leads the SORBS team... :-)
Then again, we need them to be tough and love it when they give spammers crap. In a way they are the lone bad cowboys from the internet, fighting injustice in their own way and keeping it a little safer, but don't expect them to be polite or helpful. And when you are standing near a bad guy with a black hat when the cowboys show up, expect to be shot down in a heartbeat western style... real cowboys don't mess around discriminating bad guys from not so bad guys.
Doesn't it seem much more likely that the hack is what lead to the spam being sent, THEN the site got blocked as a result?
Having been caught in exactly this situation between these two companies before left me with a very bitter taste in my mouth towards SORBS
SORBS "require" a "donation" ( to a charity ) to get delisted.
Type SORBS and charity onto google and have a peek at what comes back.......
On the SORBS site ( I don't remember exactly where, but I do remember reading it last time I went through this crap ) they say that ( me paraphrasing ) they are probably not allowed to charge a fee for delisting for legal reasons, so the "require" a "donation" instead. Ohh yeah you can choose a SORBS approved charity and jump through hoops to prove your donation OR rather conveniently they have a charity that you can donate to which will place less hoops in your way. Which one you gonna choose considering people are yelling at you that their mail aint getting through?
Do a bit of googling and there are reports of people blacklisted by SORBS being asked to buy hardware for SORBS as the "donation" to get unlisted.
See much info on the SORBS site on what measures they take to prevent and deal with false positives? No? Well that's probably because when they are charging for delisting it's in their intererests to generate as much paying custom as possible.
Seems like a form of extortion to me........
Seconded. I tried using them a few years back and balked at the appalling quality of the data.
In any case, using greylisting, some basic header sanity checking and spamhaus kills 99%+ of the spam so there is really no technical need to use such an aggressive list.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
In addition to the complaints specific to SORBS, here's what the acme.com owner (who, more than half a decade ago, received an the order of a million spam mails per day) has to say about DNS-RBLs in his write-up on how to efficiently and effectively filter spam:
DNS-RBLs - Domain Name System Realtime Black Lists. In theory the idea is fine. You have a set of sites that you blacklist, and you want to let other folks use the same list so you distribute it using DNS, which is a nice efficient de-centralized database. What's not to like?
Well, I don't know why, but in practice every single DNS-RBL eventually comes under the control of power-hungry weenies. They start listing sites unreliably, and if you complain you find yourself listed. And there's usually no way to get off the list.
A lot of people tell me I'm wrong about this. They say that certain DNS-RBLs are ok, with objective criteria for inclusion and simple procedures for getting off the list. The thing is, they give conflicting recommendations for which lists are good and which are bad. Some of these folks recommend lists which I know from personal experience are bad.
This problem is really inherent in the way DNS-RBLs are set up. You cede control of your mail system to a third party, with no real possibility of checking how they are doing. The people running the lists get overwhelmed with bogus feedback from spammers and/or idiots, to the point where they assume all their mail about the lists is from spammers and/or idiots.
If the lists you use have not yet descended into corruption and chaos, consider yourself temporarily lucky.
Do not use DNS-RBLs.
As you can see, he addresses the specific problems with SORBS ("in practice every single DNS-RBL eventually comes under the control of power-hungry weenies. They start listing sites unreliably, and if you complain you find yourself listed. And there's usually no way to get off the list"), gives a reason for why this is ("the people running the lists get overwhelmed with bogus feedback from spammers and/or idiots, to the point where they assume all their mail about the lists is from spammers and/or idiots"), draws his conclusions ("this problem is really inherent in the way DNS-RBLs are set up. You cede control of your mail system to a third party, with no real possibility of checking how they are doing") and arrives at a recommendation ("do not use DNS-RBLs").
> it has systems in place to prevent such incidents from happening again
care to put a bounty on that ?
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Having been caught in exactly this situation between these two companies before left me with a very bitter taste in my mouth towards SORBS SORBS "require" a "donation" ( to a charity ) to get delisted. Type SORBS and charity onto google and have a peek at what comes back....... On the SORBS site ( I don't remember exactly where, but I do remember reading it last time I went through this crap ) they say that ( me paraphrasing ) they are probably not allowed to charge a fee for delisting for legal reasons, so the "require" a "donation" instead. Ohh yeah you can choose a SORBS approved charity and jump through hoops to prove your donation OR rather conveniently they have a charity that you can donate to which will place less hoops in your way. Which one you gonna choose considering people are yelling at you that their mail aint getting through? Do a bit of googling and there are reports of people blacklisted by SORBS being asked to buy hardware for SORBS as the "donation" to get unlisted. See much info on the SORBS site on what measures they take to prevent and deal with false positives? No? Well that's probably because when they are charging for delisting it's in their intererests to generate as much paying custom as possible. Seems like a form of extortion to me.......
....has assured customers it has systems in place to prevent such incidents from happening again...yeah right, that's what they said about Death Star 2."
He who knows best knows how little he knows. - Thomas Jefferson
>Sorbs is a really poor block list which I don't think anyone should use Could not agree more! Anyone that uses SORBS as a blacklist deserves not to receive any email. There are tons of good lists to use - why use one that tries to extort money from people and is completely unresponsive to any form of enagegement. SORBS is a public nuisance in my opinion. I also have to question how many people were really dropping email from the messagelabs servers - hardly anyone uses SORBS anymore due to their complete lack of credibility. My adive to anyone being listed by SORBS is to simply ignore them. And mail server admins - do not use SORBS. And by the way this is no "blunder" by Messagelabs - this kind of thing goes on all the time - anti spam systems are by no means perfect.
We had these issues recently. We're with MessageLabs, but I thought the incident was isolated to us and didn't have anything to do with MessageLabs IPs.
We tried disabling our firewall temporarily while diagnosing some TCP reset issues. Usually we only allow SMTP traffic from MessageLabs servers, but since our server isn't configured as an open relay then disabling the firewall shouldn't be a big deal.
Unfortunately I tried running an open relay test on our server and found out that even though our server is by definition not functioning as an open relay, it still failed a couple of tests they had (something like 2/19 tests). Those tests were for attempts at sending mail to our internal domain, which doesn't count as a relay from the definitions I've seen, so I think it's strange to count that as a relay. Can anyone provide more info on that?
Considering one of MessageLab's clients is currently sending me spam with no way of opting out, I'm going to be a lone supporter of SORBS :)
Any RBL which demands some form of compensation, monetary or otherwise to de-list you should be avoided at all costs.
Even IF they list your servers, you simply tell the people you run across that uses them to switch over to another service which does not have these policies in place.
I typically have to swap over 2-3 sites a month from using the SORBS service due to this. The policy is simple, we do not pay, ever.
SORBS does create problems, but in this case, they got it right. ML was passing spam through their network. SORBS identified it and blacklisted them. There are plenty of reasons to speak badly of SORBS, but this isn't one.
Pull my finger for my public key.
Pro-tip: Starbucks also sells decaf.
This is a very poorly written article which seems to cast Symantec's Messagelabs in a bad light when infact it should be SORBS.
SORBS is a horrible black list and no one should use it. They are slow to de-list unless you pay an extortion fee. They probably put Messagelabs on their block list at the slightest provocation. I work with Messagelabs frequently and I have seen first hand how Messagelabs throttles connections from IP's and shuts them off automatically when they detect spam. I think the scope of the "spam" problem was likely limited to a couple hundred pieces, at most, more likely even less.
I question the source of the article and whether the writer received some sort of payment to create it to look so good towards SORBS. Now that Messagelabs is owned by Symantec, they may be considered a "big dog" in the industry and prone to these sorts of negative press articles designed to attack at them. I don't feel that this is legitimate.
Yup. Blacklists are questionable at the best of times, and SORBS has long been one of the worst.
The world's burning. Moped Jesus spotted on I50. Details at 11.
It's less of being added to a blocklist, and more of being unable to get removed without paying and going though the other hoops.
I went through a real pain in the ass experience trying to get some domains delisted from SORBS a few years ago. The one "person"(ahem...) who runs SORBS has waaaayyy too much power in their hands. Also, I can't believe these douchbags who use SORBS to get their blacklists.
Sorbs will add you to their list for sending a single email, not a spam a single email. If one of your users typos the domain and it goes to one of the zillion spam trap domains they use you get added.
Everyone that disagrees with me is a paid shill
I can't think of another internet product or service that has improved my quality of life as much as Message Labs has.
I have not gotten a single email with a virus/trojan attached since we signed up for their service several years ago.
I get maybe up to a dozen spam messages a day (probably half of them semi-legitimate attempts to sell me stuff as opposed to pure broadcast drug spam etc.) but the Message Labs stats show they're deleting hundreds and hundreds of spam messages a day directed at me. I never need to bother obscuring or hiding my primary email address on the net. I use it openly on Usenet and web pages and I'm still almost completely free of spam.
I've never had a false-positive problem.
I can recommend them very highly if you get a lot of spam / virus email and you just want the problem to go away with essentially no work on your part.
G.
This is the response I got from ML when complaining about a 100K image laden pile of HTML tag soup one of thier customers had sent to my address as well as three of my spamtraps. Note ML first asked if I would provide the domain(s) of my spamtraps so they could ask thier cleint to add my spamtraps to thier stoplist.
full discussion on the now defunct spam-l list - note that NOONE stodd up for ML.
Pretty much every commenting stated that ML are hot on inbound spam and dont give a shit about outbound.
They consider themselves TBTB (too big to block)
Messagelabs_Support wrote:
Hi Jacqui
I am writing from Messagelabs in regards to a matter whereby you have been receiving unsolicited mail.
We have been in contact with the senders of this mail and they have agreed to remove you from their mailing lists.
I would have expected that you would have been asking for details
so that you can ask them to provide proof of opt-in to yourself.
Given the above statement there is no way I could provide unredacted information
without compromising what is to all intents a spam trap.
However, for them to do so, could you please let us know the full e-mail address that this is being sent to as in your posts you have removed the domain name.
You are joking? They have not only hit "web-scrape only" addresses that are
now used as spam traps ( with the odd real request) but they have hit real
life spam traps on systems I manage. This (to me) screams list purchase
or they are running a very cheap web crawler.
Once we have this we can go back to our client and get them to remove you from your list.
No thanks - obviously you believe that the UBE your client "excretes"
is more important than your reputation. Did you bother to look at the
content (including the very large in-line images) and tag soup HTML.
I ran it through S::A and is screamed SPAM at me!
We look forward to hearing from you so that we can get this resolved.
I dont know what I can say to this. You obviously have no interest in stopping
these people sending out this trash.
Jacqui
I agree with SORBS on this. If you run email through a provider which allows any form of "bulk email", "opt-in" or otherwise, once in a while, some spam will come out of their system. That apparently happened here, and SORBS, correctly, blocked them. That's the risk you take if you sign up with an email provider that isn't sufficiently aggressive about spam.
Notice how fast MessageLabs cut off the spam source, and how much effort they put into fixing the problem. Without punishment from an external checker on their behavior, the spam probably would have continued for weeks, if not indefinitely. Because of SORBS' action, the problem is already fixed.
SORBS has, at various times, blocked Google outgoing mail and Postini outgoing mail. As a result, Google and Postini (now owned by Google) had to become much more effective at knocking off spammers. That's what you want to happen.
If security is to be effective, incidents like this have to occur. There will be some collateral damage.
SORBS Doesn't charge for delisting any more (at all)
http://www.sorbs.net/faq/spamdb.shtml
Agressive or not, agree with them or not, MessageLabs has definitely suffered from a major outbreak over the last few weeks. However, so have several other well known Spam Filtering technologies..
"If security is to be effective, incidents like this have to occur. There will be some collateral damage." - by Animats (122034) on Friday November 12, @12:48PM (#34208634) Homepage
Well put, & per my subject-line above, I agree... 110%!
E.G.-> I go thru "false positives", (and yes, their removals too) while I build a custom HOSTS file here, so the idea's much the same!
(Except perhaps for the fact I have sources & sites I can "verify against" as far as a site being a false positive, and my sources also put out "removal lists" for sites/servers/hostsnames/domainnames that clear their criteria (or have cleared themselves up & proven to have done so)).
It happens, and yes, it's a fact of life with blocklists/blacklists, of any kind!
APK
P.S.=> Thank goodness the "false positives" rates are SO tiny though, @ least on HOSTS files (less than .001% so far for the past 15 or so years of mine's total entries, which is built off all the reputable & respected + well-known HOSTS files out there today)... apk
LONG LIVE SORBS
Worst block list ever.
As a service provider - we have given up - if an address is listed we send an email off and then move about our path in life.
Always sucked, always will, users who use SORBS deserve what they receive, unfortunately.
Mike Horwath