Slashdot Mirror
Is Eccentric Sven Olaf Kamphius To Blame For Spamhaus DDoS?
RougeFemme writes "Sven Olaf Kamphius, self-described 'Internet freedom fighter,' is reportedly at the center of the investigation into this week's alleged cyber-attack against Spamhaus, a group that fights Internet spam. Mr. Kamphius became incensed when Spamhaus blacklisted two companies that he runs, including Cyberbunker, a company that, earlier this week, claimed be under attack from Dutch swat teams. Though he initially solicited support for a DDoS against Spamhaus, he now disavows any direct role in the cyberattack, which threatened to slow some web traffic to a crawl."
Yeah, I know, dutch double vowels are confusing...
I heard an interview with this guy on the dutch radio and he is obviously a moron. He managed to contradict himself three times in as many sentences and obviously has no idea about how SH works. His servers are on our blacklists too and with good reason...
For those who can't read Dutch, and thus rely on second hand sources:
http://www.automatiseringgids.nl/nieuws/2013/13/cyberbunker-niet-meer-in-bunker-kloetinge
Claims Cyberbunker hasn't used the bunker location since 2010. I guess that explains why the claimed SWAT thing wasn't reported in Dutch news (and also why they waited to pose so nicely on the picture). The bunker location is currently property of http://www.bunkerinfra.com/ which apparently has several such locations and has nothing to do with the old occupant.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
They never said once they were under attack by SWAT teams, their website merely states they have in the past successfully slept-through an attempted SWAT raid that failed at the blast doors. Whether or not this is even true is questionable. It was most certainly not recent however.
If someone had objective evidence, as opposed to an opinion or a feeling, that Kamphius had masterminded or participated in the campaign, then they would have already come forward publicly. They certainly would not withhold the information and then suddenly be inspired to reveal their secret just because Slashdot decides to speculate about it. Asking the question here just generates traffic but does nothing at all to answer it.
I find this hilarious. I am picturing some 1's and 0's threatening some other 1's and 0's.
From TFA:
"He describes himself in his own Web postings as an Internet freedom fighter, along the lines of Julian Assange of WikiLeaks, with political views that range from eccentric to offensive. His likes: German heavy metal music, "Beavis and Butt-head" and the campaign to legalize medicinal marijuana. His dislikes: Jews, Luddites and authority."
Anyone want to put that profile on a dating site to see if it garners interest?
I know. It's not fair to blame robbers -- locks are too easy to fix.
Everyone hates SPAM, so obviously Spamhaus is good and Cyberbunker is evil... ...except, SPAM exists because SMTP is broken, and we can't fix SMTP because of the network effect, and SMTP is not really awful enough to fix because ...wait for it ...Spamhaus. So, it is not entirely clear to me that this guy who fights for a free and open Internet is really the bad guy. Wouldn't it be better if we actually FIXED THE PROBLEM instead of suppressing anonymity to compensate?
No pancake is so thin that it has only one side.
And Charles Manson was an activist, too.
Deliberately misuing a tool for illegal activity just because it CAN be miused doesn't exonerate ANYONE.
Good God, you fucking moron.
It sounds like you are suggesting...spam filters, hashcash, and greylisting. Oh, wait, we do that already.
The reason SMTP endures despite numerous attempts to replace it is that it does one thing and it does it well. Spam exists because SMTP is so good at delivering messages, and because it does so cheaply. I will not be parting with email any time soon.
Much as I dislike Spamhaus, it is hard to side with someone whose grievances include "Jew lies."
Palm trees and 8
It is amazing that you can now do any crime you like, no matter how criminal like massive DDoS, and when caught you just have to say "I'm an Activist!".
You wait until the muggers, drug dealers, bank robbers, and serial killers hear about that one.
For decade cyberbunker is not in a bunker.
It's pretty good protection actually. This guy tells everyone the servers are in a bunker and it takes a huge amount of effort before anyone finds out they are not.
Meanwhile he is charging his spammer friends bunker prices for dedicated servers with a bit of network redirection on them.
What technical fix do you suggest?
I run mail servers. I'll happily change them if I never have to see spam again. The problem is that everyone has to change theirs too which might just be possible given that the entire world hates spam.
>slow some web traffic to a crawl
didn't notice shit. next.
I don't think many people noticed shit. This may have been a massive attack but the effect was little to none.
No pancake is so thin that it has only one side.
You haven't tried my Mobius pancake recipe.
"...except, SPAM exists because SMTP is broken"
SPAM exists because it works, people are clicking/buying stuff advertised through SPAM.
There is nothing wrong with email if you consider it the equivalent to mail. Anybody can stuff your mailbox with stuff you think is undesirable, only difference is stuffing your emailbox costs less.
Mr. Kamphuis’s current nemesis is Spamhaus, a group based in Geneva that fights Internet spam by publishing blacklists of alleged offenders. Clients of Spamhaus use the information to block annoying e-mails offering discount Viagra or financial windfalls. But Mr. Kamphuis and other critics call Spamhaus a censor that judges what is or isn’t spam. Spamhaus acted, he wrote, “without any court verdict, just by blackmail of suppliers and Jew lies.”
What about the idea that Spamhaus, by being a blacklist, is denying service to all sorts of websites itself? Why is a DDOS attack that much different from what they do every day?
I mean, sure, they block a lot of spam, but what about all the times someone's domain gets blacklisted and it's not spam? And yeah, I realize domain admins opt in to use their blacklists.
I don't think you really understand what you're talking about. First of all, Spamhaus isn't denying service to web sites; they're listing IP addresses of known spam sources. Mail administrators use the list to block email - not web sites - from those IPs. Spamhaus is just one of many such services, but Spamhaus happens to be the best. Why is that? Exactly because they keep the false positives to a minimum. What you're talking about theoretically COULD happen, and certainly does happen with other blacklists, but the reason we mail admins use the Spamhaus SBL-XBL lists instead of the other blacklists is because we DON'T see legitimate servers getting blocked. Believe me, if we were blocking legitimate mail, our users would complain. It's not happening.
It still does not change the fact it's a denial of service, coming from a self-appointed body that is in no better position to judge what is and is not spam than anyone else.
They are in a better position. I don't know how they do it, I don't know how they got into that position, but they've managed to pull it off.
A real common tactic with political campaigns is to sign up for the opponents mailing list on an AOL account, wait for them to send you an email, then complain you are receiving spam. AOL turns around and gets that domain blacklisted. Then it takes time and resources to resolve the issue.
I just don't see much of a difference.
The difference is that while this happens all the time with AOL's internal blacklist, Spamhaus doesn't work this way.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Spamhaus are not self appointed.
We, the system administrators, choose to use or not Spamhaus' black list (or any black list) in our systems to reject potential spammers.
And we, the system administrators, are responsible for consequences of choosing to use a black list in our systems, including the possibility of rejecting legitimate messages and users and all that stems from it, from complains from your users to your boss yelling at you because the e-mail system rejected that important e-mail he was expecting.
Many of us choose to use Spamhaus' black list because they do a good job at a) identifying spammers b) keeping legitimate users out of their black list. They help us keep our jobs.
And if you care, Spamhaus are in a better position to identify what is spam and what is not than most.
They have spent the last 15 years building up the means and experience to identify spammers, without falling victim of such simple tactics as complaining that you're being spammed by a mailing list you've subscribed.
I would add to those two, and for the same reason, something equally important : you don't need anybody's permission to use it
My next sig will be ready soon, but subscribers can beat the rush
The problem is there is no connection between sending and receiving MTAs. But what your idea has been implemented lots of time:
-SPF
-DKIM
-DMARC
-you could use BATV as sender verification
They all fail in someway, and spammers are always the first to implement this in order to avoid spam scores.
What you suggest is being done, see Sender Policy Framework and DKIM.
And it does help a lot.
However, it's not a solution to end all spam.
- Many domains don't yet publish SPF/DKIM, so they can still be spoofed.
- Spammers often use hijacked legitimate e-mail accounts.
- Spammers sometimes spam from a domain which they do control.
Have you ever watched a professional thief (or run of the mill locksmith) pick a deadbolt lock? It's so quick it might as well not matter. Yea we should stop using locks too.
Most locks are for privacy, not security. If you want security, use steel reinforced concrete and armed guards.
227-3517
Believe me, if we were blocking legitimate mail, our users would complain. It's not happening.
How would they know they're not receiving email? I'm all for what Spamhaus does and have used their lists on many mail servers, but I have also been on the receiving end when they had it wrong.
I was abroad, and the ISP I was using was blocked. Spamhaus basically tells you "talk to the ISP", but if you're dealing with a large ISP the theory that they will pay any attention to you doesn't always work. It wasn't difficult to solve (just grabbed a Yahoo account), but Spamhaus *can* get in your way, especially if you hang off a shared IP address.
Insert
He is not fighting for a free and open internet. CyberBunker says it accepts business from any site as long as it does not deal in “child porn nor anything related to terrorism.” This tells you immediately he is NOT fighting for a free and open Internet. He is fighting for the right to spam because he deems spam acceptable. I'm in favor of a free and open Internet. Completely free, spam, porn, games, copyrighted content, etc... I also believe in being allowed to use RBL's to filter out spamers like Kamphuis. I don't give a rats ass what people are into. Regulating avenues of communication will never have a positive affect on society He needs to stop pretending to be our friend. He isn't and deserves to get bitch slapped for it.
Having to work for a living is the root of all evil.
Simple: Spamhaus blocks not a single thing. Anywhere. Ever.
I block things by configuring my servers to check Spamhaus' list and use it to control what I accept and what I reject. If I choose not to use Spamhaus' list, Spamhaus can't and doesn't do a single blessed thing to prevent e-mail from a domain they list from being accepted by my server.
By saying you don't want Spamhaus to be able to work, you're saying you want to deny me any right to control my own servers.
And yes, Spamhaus does expand it's blocking beyond just the source of the e-mails. That's why they're effective. They only expand blocking when the service provider for the source of the spam declines to take any action. That's because service providers of that sort generally only react when their customers complain, and the recipients of spam aren't their customers. So if they won't act, Spamhaus makes the problem the provider's customer's problem. Now the provider has to decide whether the spammer's worth more than the rest of their customers. Call it the free market in action. And as for signing up for a mailing list and then reporting it as spam, it generally won't work. The most popular block list Spamhaus runs detects spam via the use of spamtrap addresses, not random user submissions. If your ISP is trusted by Spamhaus, it's unlikely they'll report a source of spam just on the say-so of one or two random users without doing any investigation. Over the years I've found that Spamhaus is at least 99.9% reliable, and the handful of "false" positives have been otherwise-legitimate e-mail sourced through a third-party service known to also serve spammers. And my comments to the senders tend to run along the lines of "If you don't understand why using a service that caters to spammers is your problem, it's not worth my time to educate you. And if that means I won't be able to do business with you, then I guess it's your competitor's lucky day, isn't it?".
It's not an *attack*.
That is all.
Not an idiot just applying the classic Big Lie Strategy, whilst most experts are still blustering at the absurdity of the lie; he's moving on to announce his next big lie.
Then you should have switched ISP. By paying an ISP that didn't deal with spam, you were part of the problem, so your inconvenience leaves me cold.
No no, It's a fair point. Sometimes switching ISPs isn't that simple, and the user has no way to know an ISP's reputation as a spam source before signing up with them.
But (to the GP) do you really mean ISP or email hosting provider? If you're relaying through your hosting provider but the mail is being rejected because your ISP is blacklisted, then somebody is doing something wrong (I do not condone using Spamhaus in this way). If you meant to say your email hosting provider is blacklisted, well, that's a problem.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
The ISP was also providing email, but yes, the technically correct expression should have been "email provider".
There is a degree of irony in this. Many years ago, I was behind the cleanup of a VERY large email provider in Hong Kong who had so many spam problems in their client base that we had to start with a network containment process before we started to tackle the clients, so it's not that I'm unfamiliar with the problem or unsympathetic to Spamhaus - I just observe that from a neutral perspective, Spamhaus is not perfect.
Realistically, they can't be, because the sheer volume of spam they deal with makes anything but automation impossible and it is thus important that you have measures in place to detect being blacklisted. It may not be your fault, but you will suffer the effects.
Insert