back to article Most spam comes from just six botnets

Six botnets are responsible for 85 per cent of all spam, according to an analysis by net security firm Marshal. The Srizbi botnet is reckoned to be the largest single source of spam - accounting for 39 per cent of junk mail messages – followed by the Rustock botnet, responsible for 21 per cent of the spam clogging up users' …

COMMENTS

This topic is closed for new posts.

Page:

Thumb Up

I'm with Adam...

I agree with the mandating ISPs to block port 25 until it's specifically requested by the user (at which stage it should be required by law that they unblock within 24 hours). Brilliant idea... And I think it should apply to all service types too, since some businesses don't run their own SMTP servers, etc.

In addition, it should be legalised for ISPs to probe for open mail relays on services that have requested SMTP access. Say once a week or so, the ISP does a quick test to confirm there is no open relays, and if there is, they flick the block back on.

Simple, efficient and very easy to be done. This would fix almost all spam in a matter of weeks.

0
0
Anonymous Coward

Beating spam is easy

No client PC should *ever* submit messages using port 25. Port 587 is the correct submission port (port 25 is for relay by servers). If all ISPs blocked port 25 and mandated SMTP-AUTH on port 587 spam would die overnight.

SMTP_AUTH requires a username and password, but every ISP customer has a username/password to connect anyway so this could be reused.

The fact this is so simple suggests that ISPs have a vested interest in not killing the spam problem.

0
0
Thumb Up

@Brett Leach: Networthiness?

> Folk are not permitted to drive on the roads with dangerous/unroadworthy vehicles. Why not do the same for computers connected to the net.

If ISPs can indeed detect compromised spamming machines, I think that's a brilliant idea.

But also: imagine if Ford were selling vehicles which veered off the road at the slightest provocation - the slightest piece of less-than-perfect driving caused an instant pile-up. Something would probably be done to get Ford to stop this. So why isn't something done to Microsoft - why are they allowed to sell such operating systems that invite such horrors at the accidental click of a button?

0
0
Alert

2 answers

@Harry Stottle and the answers about joe-jobs: The concerns about joe jobs are of course well-founded, but the real reason that the perpetrators can't be tracked down is that the servers hosting the products advertised with spam are only up for a very short time following the spam run; typically a few hours or less. Also, they are hosted on "bulletproof" servers, i.e., unreachable by law (because they are situated in places like China and some other countries that don't have effective anti-spam laws) and normally are also protected against all normal modes of attack, including DDOS.

Re "Beating spam is easy"

Well, simple solution. Only it does not work. You see, spammers are already used to setting up bogus mail accounts with a wide variety of web hosters... so SMTP_AUTH wouldn't change a thing. Also, much spam these days comes from malware which includes its own SMTP server, so what the relaying server sees is not a client PC, but another server, which makes port 25 the correct port to do business on.

0
0
Anonymous Coward

Re: 2 Answers

"Also, they are hosted on "bulletproof" servers, i.e., unreachable by law (because they are situated in places like China and some other countries that don't have effective anti-spam laws)"

Which in turn are controlled by a few individuals in the good old US of A which apparently does not have effective anti-spam laws neither. If you're going to "follow the money" you have to follow it all the way to where the buck stops and not try passing the blame off on an intemediary.

0
0

Re: All post in this section

To all readers in this forum:

I'm sure most of you, if not all, would agree that Internet e-mail is a fantastically useful medium of communication; otherwise, I'd expect cries to shutdown all e-mail services instead of the usual block/restrain/limit/control requests in here.

That said, a fact that seems to have been missed by most people is that the reasons this technology is so ubiquitous and, indeed, fantastically useful in the first place is precisely *because* of its openness, decentralization and seemingly chaotic nature -- the very features that a lot of you seem to agree should be eliminated.

Point-to-point, centralized, authorized, and secure communications have always existed in the Internet, and they still do; however, e-mail, of all mechanisms -- for better or worse -- won out against others as the de facto messaging system for the masses.

This is not to say that it is a perfect technology -- far from it. It could, of course, use some improvements. But the solution is not to turn the e-mail system into something it is not: a centralized, controlled environment where all entry and exit points are known. This may sound good in theory for a mass communication medium, but its just another nail in the free and open network, and it's one more potential "toll gate" for the eventual gate keepers: ISP's, or heaven forbid, governments.

With this comes not only a monetary price, but the price of freely exchanged anonymous speech, the cornerstone of any free society. Secure and closed communications systems have their place, but the world should still have an open channel.

-dZ.

0
0
Anonymous Coward

@stizzleswick

A bogus mail account is no use. You need a username and password provided by the ISP to its customer to authenticate your SMTP submission. A spammer could abuse this, but not anonymously - I'm presuming an ISP knows who its customers are.

Malware does indeed come with an SMTP client (not server). That's why a key part of the solution I proposed includes *blocking* port 25.

0
0
Anonymous Coward

I will need the following...

A list of spammers' addresses

My bookstick and a bunch of plane tickets!

0
0

@AC

"A bogus mail account is no use."

Currently, bogus mail accounts are all the rage at mail providers like Google, MSN, Yahoo!... And no, those mail providers don't give a crap who their customers are; they just set up the boxes and let nature run its course until somebody threatens legal action because of the flood of spam coming from their servers.

If email were restricted to ISP-provided email only, then you have a point. Unfortunately, this is not the case, and moving several dozen million webmail users who do not currently use their ISP's email services (including yours truly) over to a new email address would prove rather impractical IMHO.

"Malware does indeed come with an SMTP client (not server)."

Yes, actually there are several strains out there that have their own server (not client).

0
0

@Brett and AC

Why are cars different from computers? Well, if cars go out of control, people die. If computers are compromised, the worst-case scenario is that your hard drive gets wiped - a scenario you should already be prepared for with backups, because hard drives have a finite lifespan. The less-worse scenario is that your machine becomes a zombie - no files are affected, but it'll hit your bandwidth usage and inflict spam on others. Either way, there's no loss of life and limited loss of money (unless zombies are used for DDoS, and this article is about spam, not DDoS).

In other words - get some friggin' perspective, guys!

And let's consider the case where this impractical suggestion was put into action. Letting a user shoot themselves in the foot would now result in lawsuits against the PC vendor. Every PC would therefore have to be fully locked down at sale time. You would be allowed the email clients pre-installed by the seller and no other client would be allowed to send email. Nor would you be allowed any other browser or IM client. File-sharing would be right out. Even downloading files would probably be blocked, because that's a potential route in. And of course you'd have to allow your PC vendor to remotely install updates on your machine whenever *they* saw fit, regardless of whether you wanted that update or whether you really wanted your bandwidth at that particular moment in your CS game.

In other words - you didn't think about the consequences before you suggested this idea.

http://craphound.com/spamsolutions.txt

"

Your post advocates a

(X) legislative

approach to fighting spam. Your idea will not work. Here is why it won't work.

(maybe) It is defenseless against brute force attacks

(X) Users of email will not put up with it

(X) Microsoft will not put up with it

(X) Requires immediate total cooperation from everybody at once

(X) Many email users cannot afford to lose business or alienate potential employers

(X) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

(X) Asshats

(X) Jurisdictional problems

(X) Willingness of users to install OS patches received by email

(X) Technically illiterate politicians

(X) Extreme stupidity on the part of people who do business with spammers

(X) Dishonesty on the part of spammers themselves

(X) Outlook

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever

been shown practical

(X) SMTP headers should not be the subject of legislation

(X) Countermeasures must work if phased in gradually

(X) Why should we have to trust you and your servers?

(X) Incompatiblity with open source or open source licenses

(X) Feel-good measures do nothing to solve the problem

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.

(maybe) This is a stupid idea, and you're a stupid person for suggesting it.

"

0
0
Black Helicopters

I like the idea of...

a 'good' virus/worm that fixes the zombies - just need the US DoD to setup some covert/deniable ops that distributes worms that fix the zombies. Without them the spammers capabilities are significantly reduced such that it would hopefully strangle their revenue stream.

It could end up being a bit or a war of attrition, but that would at least be more entertaining than just watching spam increase day after day

0
0

Chinas part in the spam industry

Seems odd to me that a country which blocks it's citizens from viewing anything that it doesn't approve of on the internet should actually be hosting the majority of the websites that the spam leads back to.

0
0
Pirate

@Chinas part in the spam industry

It's not really so odd if you've ever worked in a Chinese office. Most Chinese are pretty clueless about malware - every home computer, 'net cafe computer and even many major organisations are riddled with it. When it comes to the internet the majority of Chinese have almost child-like trust of what they find. So most computers have download managers, password managers, cute little desktop games, funny icons and all the other standard vectors for malware.

That's fine for home users - home PCs aren't switched on as much as they are in the West. Problem is that most Chinese companies exhibit the same child-like innocence, so few have even the most basic policy in place for controlling their workforce's habits. Result is that staff happily spend large chunks of the day on QQ and other social sites, happily downloading cute little desktop games, funny icons, etc all to their work PCs.

Certainly there are spam/bot controllers there - it has to be in Chinese language after all but they're helped by universal ignorance in the rest of the country.

0
0
Thumb Down

@Graham Bartlett

Actually the level of potential damage is essentially irrelevant. You are legally responsible for ensuring, by taking all reasonable precautions, that your property does not cause damage to another's. Spewing spam might not constitute harm/damage, but virtually any other use to which a compromised machine might be put certainly is. I don't believe anyone has been prosecuted for owning a zombie machine, but there is no legal reason AFAIK why someone couldn't be.

re: users shooting themselves.

Theoretically, PC vendors too, could find themselves in legal hot water under fitness for purpose and merchantability laws, inasmuch that a PC out of the box is very rarely in any fit state to be safely connected to the net.

If they are selling an out of the box experience, as they essentially do, often claiming that as a selling point, then the product they are selling should come pre-configured with all appropriate services enabled/disabled, a randomly generated admin password, at least one user account, also password protected. OS patches, Basic anti-malware (I believe most motherboards come with such software and a 6/12 month "first taste is free" license on the driver disk anyway) installed, activated and within a week or so of being up to date. And as suggested in comments on an article about vulnerable routers, they too should have more robust passwords (serial number was suggested) by default.

All of this would cost very little to implement, once a week the vendor would have to spend a few minutes bringing their install image up to date, and a few minutes on final configuration before each box went out the door. A few dollars per machine at most.

And having taken all reasonable precautions, the vendor is off the hook legally.

All future responsibility then devolves as it properly does to the buyer.

Repairable ignorance alone should never be a defense or an excuse.

0
0
Anonymous Coward

@stizzleswick

"Currently, bogus mail accounts are all the rage at mail providers like Google, MSN, Yahoo!... And no, those mail providers don't give a crap who their customers are; they just set up the boxes and let nature run its course until somebody threatens legal action because of the flood of spam coming from their servers."

These bogus accounts are accesses using webmail clients - you submit the email from a browser. Spammers do not submit spam this way - they use SMTP clients on a zombie. If you kill the ability to do this, as in my suggestion, spam ceases immediately.

"Malware does indeed come with an SMTP client (not server)."

"Yes, actually there are several strains out there that have their own server (not client)."

SMTP servers are used to receive email - somehow I don't think that's what spammers are in the business of doing !

0
0

Page:

This topic is closed for new posts.

Forums

Biting the hand that feeds IT © 1998–2017