Slashdot Mirror
Hackers Blamed For MessageLabs Spam Blunder
littlekorea writes "MessageLabs claims to have discovered that the systems of one of its customers were hacked by spammers after an entire block of MessageLabs IP addresses was blocked by antispam service SORBS. Customers of the managed email service had problems with outbound mail last week after MessageLabs' IP addresses were included in SORBS' block list. The Symantec-owned service provider has assured customers it has systems in place to prevent such incidents from happening again."
Doesn't it seem much more likely that the hack is what lead to the spam being sent, THEN the site got blocked as a result?
Seconded. I tried using them a few years back and balked at the appalling quality of the data.
In any case, using greylisting, some basic header sanity checking and spamhaus kills 99%+ of the spam so there is really no technical need to use such an aggressive list.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
In addition to the complaints specific to SORBS, here's what the acme.com owner (who, more than half a decade ago, received an the order of a million spam mails per day) has to say about DNS-RBLs in his write-up on how to efficiently and effectively filter spam:
DNS-RBLs - Domain Name System Realtime Black Lists. In theory the idea is fine. You have a set of sites that you blacklist, and you want to let other folks use the same list so you distribute it using DNS, which is a nice efficient de-centralized database. What's not to like?
Well, I don't know why, but in practice every single DNS-RBL eventually comes under the control of power-hungry weenies. They start listing sites unreliably, and if you complain you find yourself listed. And there's usually no way to get off the list.
A lot of people tell me I'm wrong about this. They say that certain DNS-RBLs are ok, with objective criteria for inclusion and simple procedures for getting off the list. The thing is, they give conflicting recommendations for which lists are good and which are bad. Some of these folks recommend lists which I know from personal experience are bad.
This problem is really inherent in the way DNS-RBLs are set up. You cede control of your mail system to a third party, with no real possibility of checking how they are doing. The people running the lists get overwhelmed with bogus feedback from spammers and/or idiots, to the point where they assume all their mail about the lists is from spammers and/or idiots.
If the lists you use have not yet descended into corruption and chaos, consider yourself temporarily lucky.
Do not use DNS-RBLs.
As you can see, he addresses the specific problems with SORBS ("in practice every single DNS-RBL eventually comes under the control of power-hungry weenies. They start listing sites unreliably, and if you complain you find yourself listed. And there's usually no way to get off the list"), gives a reason for why this is ("the people running the lists get overwhelmed with bogus feedback from spammers and/or idiots, to the point where they assume all their mail about the lists is from spammers and/or idiots"), draws his conclusions ("this problem is really inherent in the way DNS-RBLs are set up. You cede control of your mail system to a third party, with no real possibility of checking how they are doing") and arrives at a recommendation ("do not use DNS-RBLs").
Having been caught in exactly this situation between these two companies before left me with a very bitter taste in my mouth towards SORBS SORBS "require" a "donation" ( to a charity ) to get delisted. Type SORBS and charity onto google and have a peek at what comes back....... On the SORBS site ( I don't remember exactly where, but I do remember reading it last time I went through this crap ) they say that ( me paraphrasing ) they are probably not allowed to charge a fee for delisting for legal reasons, so the "require" a "donation" instead. Ohh yeah you can choose a SORBS approved charity and jump through hoops to prove your donation OR rather conveniently they have a charity that you can donate to which will place less hoops in your way. Which one you gonna choose considering people are yelling at you that their mail aint getting through? Do a bit of googling and there are reports of people blacklisted by SORBS being asked to buy hardware for SORBS as the "donation" to get unlisted. See much info on the SORBS site on what measures they take to prevent and deal with false positives? No? Well that's probably because when they are charging for delisting it's in their intererests to generate as much paying custom as possible. Seems like a form of extortion to me.......