Ask Slashdot: Dealing With Anti-Spam Service Extortion?

An anonymous reader writes "I work for a European ISP, and lately we're receiving quite a few complaints from customers about not being able to send emails because of UCEProtect's listings. After checking with their site, we found out that our whole AS (!) was blacklisted. Their 'immediate removal policy' asks for money, around 90 euros Per IP for end users and 300 euros for ISPs, and their site has bold statements like 'YOU ARE LOSING YOUR RIGHT TO EXPRESSDELIST YOUR IP IF YOU ARE STUPID AND CLAIMING THIS WOULD BE BLACKMAIL...' Could this be considered extortion-blackmail ? Has anyone else on Slashdot dealt with this service before?"

Comments

Re:I always go along and pay

[Anonymous Coward]

I used to run the AHBL (for those wondering, I am Andrew Kirch), my advice is this. UCEProtect isn't a protection scheme. They're just people who run a DNSBL and got tired of dealing with spammers lies for free. I am incredibly sympathetic, though I did not go the same route. I've been lied to, threatened, received death threads, etc. Eventually you stop doing it for free, and since I was unwilling to charge, I simply stopped. If you want to be delisted, pay, if you don't, don't. If one of your customers/friends/whatever is using UCEProtect, you can also contact them and ask them to stop. I've used it in the past, but not on a block outright basis. My policy applies only to my mail server though, and not yours.

Do you know how hard it is to update their DB?

[hxnwix]

Adding an IP address to their whitelist is no easy thing. You see, they hire only blind, deaf quadriplegics, so each octet is entered in binary through a mouth open/close morse code interface. But that's only after your request makes it through the queue to be read through tactile forehead tapping tty... Perfectly understandable that these folks detest spam, isn't it?

Re:People still use blacklists???

[DarwinSurvivor]

I get my internet through Shaw which, unless you pay extra, uses dynamic IPs. By dynamic, I mean "technically" dynamic, but keep the same IP for at least 6-8 months at a time. Shaw also uses blacklists, one of which is Spamhaus among others. Shaw has a policy where they reject E-Mail if a SINGLE blacklist has you listed for ANY reason. Spamhaus has this annoying feature where they add all dynamic IP addresses to their blacklist. Basically, shaw is auto-blocking their own f*cking customers and nobody in the tech support chain seems to understand this.

Some Suggestions

[Anonymous Coward]

Firstly, as Pamela Jones over at Groklaw would tell you in a heartbeat, convince someone at your company to take legal advice. If your company is contemplating action of any kind in response to what has happened, it is critically important that you understand that your intended steps will not undermine you at some later date. Only a legal professional can tell you that. So please, get proper legal advice.

Secondly, thinking about the relationship between yourself and the party you believe to be performing the blocking/spam filtering. Is the issue between your company and the third party, or your *clients* and the third party? I can understand that you are coming under fire from your clients, but please refer back to the first point, above.

Third, go get familiar with the relevant legal frameworks. Your legal support, when you hire, them, is going to start asking legal questions. You understand the tech, but take the time to familiarise yourself with the law. Start with: RIPA (the Regulation of Investigatory Powers, which, IIRC, makes it illegal to intercept any communication between two parties), PEC (the Privacy in Electronic Communications Act [2003]), and take a quick look at the DPA (Data Protection Act [1998]) inasmuch as the data being generated and acted upon by the third party [email addresses] was created for the express purpose of *routing email traffic*, not *filtering* email traffic. There may be an argument that the filtering is inappropriate. See how a lawyer (I'm not one) can help you here???

Fourth, are there any professional trade bodies or organisations that both your company and the third party subscribe to (i.e. a UK Association of ISPs) that may have a dispute handling process? Are the two parties able to sit down with an arbitrator? If so, this might be a free service that you could try?

Fifth, if all of the above fail, then use of the Internet in the UK is regulated by various Government departments and Quango Regulators, such as the ICO (Information Commissioner's Office) and Ofcom (the Communications Watchdog). As above if you have taken proper legal advice from a law firm with expertise in this area, they should advise you on the best method of engagement.

I understand that you want to help your clients, but in this case it's critically important that any steps you take don't make it worse. Legal advice must be step 1.

Hope this helps...

NEVER trust and AC

[SmallFurryCreature]

NEVER trust an AC. The TRUTH is RIGHT there on the linked page

FREE OF CHARGE REMOVAL:

There is no need for you to request removal, if you do not want to pay.

Every IP address temporary listed as Level 1 expires automatically 7 days after the last spam email from it hits our SPAMTRAPS. This means your IP address will be removed, lesson learned, no more spam from your computer.

The FREE option is listed FIRST, you ONLY need to pay if you want someone to manually check your SPAM sending IP can be cleared. Spammers LIE, they will abuse ANY complaint system and this costs time and energy.

Spammers rely on the low costs of their operation to remain profitable, they spend nothing and instead leech from others people infrastructure, efforts and time to make their money. The easiest way to combat this is to cost the Spammers time, energy and money. That hurts their profits the most and is the only way to hinder them.

Yes it sucks to hell and back if you are caught in between with your "legit" reasons to run a mass emailer from your own computer. But the needs of the many outweigh the needs of the one. Don't like it? You PAY ME then to deal with spam. You don't want to pay? Well... then what do you want? Email was ruined by the spammers, the old idea of anyone being able to mail anyone else is GONE thanks to them. You fix the spammers then because I am NOT going back to the days when 99% of email hitting my systems was spam.

Frankly there are so many alternatives to sending mass mail from your own system, only highly suspicious people want to go around this. And yes, loss of freedom for one means loss of freedom for all... but the costs associated with combatting spam all on your own are just to big. Installing a DNS blacklist is a cheap reliable option and the number of people hurt by it are statistical rounding errors. Really, nobody I know still uses their own email system but instead uses something like gmail with their own domain name. I use Amazon. And gosh, it just works.

Basically, it all comes down who has to spend time and effort. The recipient or the mailer. Do YOU have to make sure as a sender that your system can send to everyone OR does the recipient have to make sure that he can receive from everyone?

The recipient is the person with the least interest here in case of spam AND indeed in regular emails. If some entity wants to mail me from some home IP in black listed range. What is my motivation in wanting to receive said message? The spammer/sender is the one who needs the message to be received.

AND ALL THIS BLACKLIST REQUIRES: Is that AFTER your system has been caught sending spam, it stops sending spam for 7 days. That is all. Just 7 days without spam. The AC whiner clearly is running a system that sends endless spam. He needs to deal with that and NOT demand the entire rest of the world open their system to his spammy criminal customers.

When you sign up for Amazon EMS there are several security measures in place to avoid you using their systems to send spam. That is because Amazon and other email providers spend a LOT of money making sure their IP range remains unblocked and they do this by having people actively making sure no spam is send through their system.

Is it that difficult to ask that an ISP does the same?

Again yes it sucks if you are caught in between but hey, there are alternatives and YOU are FREE to come up with a better system. In the meantime, I take my DNS blacklist thank you very much and not shed a tear about your home mail setup. Hey, at least it is better then in the old days when many including me would just black list entire regions of the world. Still do for that matter, you would be suprised how much less attempts at hacking you get on a small webserver if you just block Africa, Asia, Middle Eaast, East-block, South-America etc etc. But you might get a legit visitor from those regions! For a local amateur soccer club home page?

My time is money,

Re:People still use blacklists???

[Depili]

The way this is handled in Finland that each isp has one outgoing SMTP-relay server that you have to use, you can't send the mail directly out. You can receive all the mail you want but the outgoing pipe has restrictions to prevent open/miss-configured servers, works great. (I have my own mail server with such arrangement on a static IP)

If you are a ISP I would suggest a similar arrangement to prevent all your customers sending spam :)

UCEProtect is a spammer.

[Anonymous Coward]

I've had to deal with UCEProtect in my job as a system administrator. Whenever we got listed it was because their spambots (that send mail coming from the droppatrol.de domain) managed to get a bounce out of our system. We allow our users to forward mail offsite and some do to sites that are far far less permissive then us, and when that happens we properly send the bounce.

I would say that running spam bots, and then asking someone to pay to get off a blacklist that their spambots got you onto, is effectively organized crime type extortion.

Re:Someone is full of himself

[Nossie]

been hiding under a rock much?

http://en.wikipedia.org/wiki/The_Abusive_Hosts_Blocking_List, considering his own name is HARDLY spattered over the internet as a karma whore / full of himself - I would be much more likely to to believe him than some trolling A/C that has what, committed translations from English UK to English US? Of course that is on the assumption that the poster is who he says he is but if you did actually google rather than being arrogant and full of yourself - then you would find that the guy has indeed been rather involved in anti spam lawsuits etc.

http://www.declude.com/Articles.asp?ID=262
OR
"My name is Andrew D Kirch, I'm one of the founders of the AHBL, and served in that capacity until 2008. I've been harassed, extorted, sued, and defamed by a Mr. Richard Morton Scoville, a resident of San Antonio, Texas for a period of 7 years. During that time I have suffered nearly irreparable damage to my character, and public reputation. I've been questioned by police, and my customers, and I have incurred over $10,000 in legal costs defending myself in court against this person."

So, AC - is your code contributions worth $10k to you?

OR
http://www.ahbl.org/legal/scoville/courtdocs

Let me just make another assumption here, You are American and don't know who "Tim" Berners-Lee is either? I actually couldn't care less if you do or don't know who he is - but my point being is you wouldn't do the extra effort to look it up.

not posted anon, because I've not been a pussy since 1994.

There is a reason you are listed.

[strredwolf]

There is a reason you are listed:

* You have spam originating from your system for too long of a time.
* You are unresponsive to reports.

So, your entire network range is listed. Everyone is bouncing emails. Everyone is complaining to you, and you've noticed. You've been forwarded the site, and you're contemplating just paying them off... except that it just won't work. You'll be relisted again, and with reason -- someone on your network spammed and nobody's listening.

Thus:

* If you haven't done so, open up abuse@ and point it to somebody with the power to diagnose, disable, and close accounts.
* If the guy behind abuse@ doesn't have said above power, GIVE IT TO HIM.
* If the guy behind abuse@ does, but doesn't use it, FIRE HIM.
* If you haven't done so, disable outbound port 25 at your border router with the exception of an out-bound SMTP server.
* Put an outbound spam filter in place.

If you are unwilling to do the above, then there is one last thing you will eventually do: CLOSE SHOP.

These blacklist services break normal email

[andycal]

Years ago I was running an email server, (Very low output 3 to 5 users personal email only, no lists) and we had some inbound addresses that were overloaded with spam, so we abandoned them. But rather than just discarding email sent to those addresses ( for fear that someone didn't get the new address) I set them up so (via a piped script in the aliases file ) to fail on receipt with the message "your message to abandoned@email can not be delivered, please use the webform here to send your message"

So we got blacklisted, and checking the logs we had *NO* outgoing email at the time of the accursed spam message(s). The blacklist service didn't give me the whole message, but it contained enough for me to find reference to it in my log.

Near as I can figure, some spammer sent email to us through an open relay, using a honeypot (you get classed as a spammer if you send email to this address ) as his spoofed 'from: address'. My mailer refused to accept the email to the abandoned address, so the relay returned the 'undelivered' message to the honeypot address.

Now I had several problems with this. First, to avoid blacklisting, I had to remove this helpful service. Now those messages go to /dev/null. second, I didn't actually send the email, but we got blacklisted simply because our IP adress was in the chain of Received headers in the email header.

More recently, I had newsletter messages sent to a members of a private club bounced by their local ISP. The sending IP address was not listed in any blacklist I could find. The ISP was just refusing connection, No message, nothing. (I could send email to that ISP from other services like gmail) They wouldn't take my call ( I'm not their customer) so I had some of their customers call and ask "Why am I not getting these newsletter messages?" . I wasn't on the call, but it sounded like they just played dumb. A few of the list members gave us non-local-isp addresses (gmail , yahoo) and now they get the newsletter there.

Again, legitimate email loses out.

And finally, Just about every time, my "password reset" messages end up in people's spam folder. This is one of my most common support calls. (this even after the page where they request the password reset says right on it "check your spam folder" ) There are lots of false positives on spam.

Re:Stop sending spam then.

[Lazy Jones]

If you don't want to be blacklisted, then stop sending spam. Simple.

You're an ignorant fool. Unfortunately, too many sysadmins are just as ignorant, so they trust these badly-run, possibly with malicious intent, services. We've never sent 1 spam e-mail in 12 years doing business online and have been blacklisted several times by UCEprotect due to them recycling old domains (which were used by users to register on our site) for use as spam honeypots. They wasted countless hours of our time for nothing.