Botnet-harbouring survey fails to accounts for sinkholes

My thoughts? Are C&C the best counterpoints?

While I approve of anything that bothers the spammers and reduces the spam, I'm not convinced that the C&C servers are the best points of attack. This is fundamentally a kind of arms race situation where the spammers always have the initiative. Each time the spammers devise new ways to hide their C&C system and new ways for the zombots to find them, the defenders are put back on their heels trying to figure out what has happened. Actually, if you believe that computer security is possible, doesn't that mean the spammers have the advantage here? The problem of concealing a clandestine network is fundamentally a security question.

In contrast, there are areas where the characteristics of spam prevent the spammers from hiding, and I think that is where we should focus the anti-spam efforts. "Follow the money" and cut it off. Most concretely, the spammers need to have visible servers where the suckers can go before they can send the spammers any money or be fooled into installing zombot software. Those servers and the DNS registrations that lead to them are better loci of attack because they cannot be hidden from the suckers and the spammers want the simple-minded suckers to connect as easily as possible.

The other characteristic of spam that should be exploited is that there are far more people annoyed by spam than there are suckers who fall for it. I think this argues for a crowd-based approach that will assist the large number of people (even if only a small percentage want to help in fighting the spam) in cutting the spammers off from their small supply of suckers. Essentially I think the major email suppliers (as in Google before they went evil) should offer something like SpamCop on steroids. An interactive form that will analyze the spam intelligently (perhaps in two or three rounds) to direct more effective responses against the spammers and all of the spammers' accomplices. (I think this system should also route replies to the secondary victims of spam, such as the legitimate companies that want to defend their valuable brands from the spammers' exploitation and devaluation.)

I think such a system could really make the bathwater too hot for the spammers. I'm not saying they would miraculously become decent human beings. I'm just saying the spammers would move under less visible rocks. They are fundamentally lazy scumbags and scammers looking for easy profits, and spam email should NOT offer those profits.

The anti-MS icon for this comment? Because I feel that most of the zombot part of the current spam problem is an externalized cost and liability that Microsoft has shed and forced everyone else to bear. Again, follow the money.

Some do care

Having had a server hacked and a bot installed I can say that some ISPs do care. The bot was spotted quickly and the server shut down as a result. The ISP was Intergenia and the report that the bot was active came from 1&1.

1&1 has a *huge* data centre in Karlsruhe and many of the ISPs in Germany have pretty big data centres. AFAIK it's still a requirement in France to host .fr sites in France. Obviously the more sites you host the more C&C bots you will have all things being equal.