Spammer DDoS-By-Virus On spamhaus.org

McDutchie writes "Steve Linford of Spamhaus announced in a press release that the latest Wintel virus, W32/Mimail-E, was created by spammers for the specific purpose of DDoS'ing Spamhaus, Spamcop, and SPEWS. It's becoming more and more clear that the spambags are the ones behind the recent mess with the Windows viruses. They must really be getting desperate."

Spam is dying

[GotAnMP3]

Seriously, I've been getting less spam lately thanks to filters. Sure, it's not gone entirely, but it's a lot less of a hassle than it used to be. I sure hope this is a sign of things to come... If they're this desperate to stop anti-spammers, they gotta be in their throws of death.

They're annoying

[0x0d0a]

Filters, yes. Spamassassin, yes. Antispam registries (think SPEWS), no.

Lists of IPs for "antispam" purposes, drive me bananas. I normally run an MTA on my machine, and don't see any reason to relay mail (slower notification of problems, have to remember to change the relay whenever moving from network to network, etc), and there are groups like the DUL that just block swaths of IPs from sending email.

I hate getting spam too, but not as much as I get screwed over by stupid antispam "fixes".

I'm all for

Re:They're annoying

[phaze3000]

Except, of course, that part of SpamAssassin's checks are to use the 'antispam registries' you are complaining about.

Quite frankly, with the current volumes of spam it is impractical to try and run a mailserver for more than a few thousand users without some form of blocklist or having extremely deep pockets. The problem with SpamAssasin is that it actually increases the load on ones mail servers - a variety of checks have to be run on every single mail. By contrast, using a blocklist means that spam can be rejected before the DATA stage, reducing the load on the server, and the bandwidth consumed by spam.

Re:They're annoying

[0x0d0a]

Except, of course, that part of SpamAssassin's checks are to use the 'antispam registries' you are complaining about.

Sure...but I don't use those. :-)

Reject before accept (was Re:They're annoying)

[Joel Rowbottom]

Seriously, if you want to reject stuff at SMTP time rather than accepting it then processing it, try using sa-exim (a freshmeat search will turn it up) - it fits into exim [exim.org] and rejects as soon as it's worked out it's spam - mid-DATA if need be.

Re:Reject before accept (was Re:They're annoying)

[dodobh]

You either interrupt transmission before the data phase, or after the data phase has been terminated by . (RFC 2821 mandates that data cannot be interrupted).
Interruption during the data phase will be considered as a network problem and the mail will be resent, for upto five days. Lots of bandwidth wasted.
Stopping before the data implies that only the helo/ehlo, mail from: and rcpt to: have been sent. Stopping after data but before the quit just implies that your server will not deal with the bounce. It does nothing to save your inbound bandwidth.

Re:They're annoying

[0x0d0a]

Quite frankly, with the current volumes of spam it is impractical to try and run a mailserver for more than a few thousand users without some form of blocklist or having extremely deep pockets. The problem with SpamAssasin is that it actually increases the load on ones mail servers - a variety of checks have to be run on every single mail. By contrast, using a blocklist means that spam can be rejected before the DATA stage, reducing the load on the server, and the bandwidth consumed by spam.

I'd rather jus

Re:They're annoying

[Reziac]

Sooner or later, every arbitrary limit comes back and bites legit users. Your comment is akin to saying that no email ever needs to be more than 50 lines long, so anything longer should be dropped. Or that no one ever needs to send more than 3 attachments with a single message, so any message with 4 or more should be dropped. (Which is exactly what AOL does, making attachments to/from AOL users an Adventure. Ditto for email over 20k in length, tho that "feature" seems to have mostly gone away.)

Here, you're assuming that everyone who has an occasional need to BCC more than 30 people must also have enough need and savvy to run mailing list software, and that's just not so. Occasional personal announcements are probably the leading realworld use of large BCC sets. And a BCC set may change from one use to the next -- why have to admin a mailing list for something that changes every time you use it? Why make life difficult for ordinary users just because spammers abuse the system?

Besides, most of the spam I get IS sent by mailing list, not by BCC.

Your solution would be be like if since one guy pees in the pool, EVERYONE has to wear diapers.

Re:They're annoying

[Analysis Paralysis]

Spamassassin, yes. Antispam registries (think SPEWS), no.

Hate to rain on your parade here, but SpamAssassin does use blocklists by default (as described in the FAQ [taint.org]). It is the existence of such blocklists that has forced certain major ISPs to stop writing "pink contracts" to known spammers and they are the only anti-spam measure that reduces the cost that ISPs have to bear in terms of mail-server storage and excess bandwidth that spam causes. Rest assured that the spam epidemic would be far worse without DNSBLs and the cost of Internet access far higher.

Whitelists may work for some people, but others may need to keep their inboxes open (e.g. vendor support).

Re:They're annoying

[0x0d0a]

Hate to rain on your parade here

You aren't. No need to worry.

but SpamAssassin does use blocklists by default (as described in the FAQ). It is the existence of such blocklists that has forced certain major ISPs to stop writing "pink contracts" to known spammers and they are the only anti-spam measure that reduces the cost that ISPs have to bear in terms of mail-server storage and excess bandwidth that spam causes. Rest assured that the spam epidemic would be far worse without DNSBLs and the cost of Int

Re:They're annoying

[gowen]

I normally run an MTA on my machine, and don't see any reason to relay mail ... Free Email Everywhere Just Doesn't Work.

Ahh, I see. Everyone in the world must jump through the painful, non-functioning hoops of whitelisting, just because you don't want the minor inconvenience of relaying.

Thats really grown up of you.... People like you should be forced to use carrier pigeons.

Re:They're annoying

[0x0d0a]

Ahh, I see. Everyone in the world must jump through the painful, non-functioning hoops of whitelisting, just because you don't want the minor inconvenience of relaying.

No. If IP lists really were an effective solution to spam, then you wouldn't hear a peep out of me.

However, IP listing is an extremely poor solution to the problem. It takes an approach that is simply not tenable in the security world -- attempting to secure *everyone else's system* rather than your own (you have a list of evil servers,

Re:They're annoying

[RT Alec]

While it is true that some DNSBLs block entire netblocks, those lists are used by the fewest people. There are a great many DNSBLs one can use to block mail, some are maintained better than others and most have different criteria for inclusion and removal. Use the ones that match your philosophical opinion of spam, don't use the ones that you feel are too extreme.

It's all about freedom of choice!

Re:They're annoying

[Rasta Prefect]

But they aren't. They're run by people who think it is a good idea to blacklist entire datacentre netblocks because one guy was running a vulnerable formmail, and once blacklisted getting off the blacklist is often nearly impossible because they seem to want everything up to, and including, stone tablets carved by the hand of God as proof that the problem has been delt with.

Not all block lists are the same. The only one I can think of off hand that displays the above behavior is SPEWS. And they don't

Re:They're annoying

[0x0d0a]

So don't use the extremist ones like SPEWS. There are plenty of other DNSBLs to choose from.

In a sane world, your response would be correct. Everyone could choose their own degree of filtering.

Unfortunately, that just isn't the case. I can't control the degree of filtering that happens that the compay where I work, as I'm not a member of IT. Furthermore, I cannot control the degree of filtering that happens to other people that I need to send mail to from *their* IT departments.

ISPs aren't so bad on

Re:and SBC DSL services...

[Abcd1234]

My parents have an SBC DSL account and now I can't send them email from my server (admittedly hosted on a roadrunner cable modem) because they're blocking everything from 'dialups'.

Then relay your mail through your ISPs SMTP server and move on with life. Suddenly, everything works, and you still have control over your own mail server. This also offloads SMTP re-sends, etc, onto the ISP mail server, rather than your own, which is rather nice.

Re:They're annoying

[mjh]

Everyone in the world must jump through the painful, non-functioning hoops of whitelisting...

Just out of curiosity, what about whitelisting do you think is non-functional? I've been using a program that, among other things, is an automated whitelist management program. It's called TMDA [tmda.net] and it works fantastically. There are other similar programs.

I'm just curious as to why you think whitelisting is non-functional.

Re:How spammers will get around C-R

[mjh]

Well, if you use TMDA, you can configure it to avoid what you're talking about. [tmda.net] With TMDA, it can detect whether or not an email was sent in response to an actual email that you sent. If so configured, then any challenges that you get from someone will only be delivered to your mailbox if you actually sent the original email. If a spammer, right now, sends an unsolicited challenge to my mailbox, I'll never see it.

So, exactly the contrary to what you're saying. The wider spread the use of C/R like TMDA,

Re:They're annoying

[Nogami_Saeko]

Spamassassin is great for ISPs and other companies that need rule-based spam checkers that are sort of "generic".

For personal filtering, nothing beats a good bayesian filter. I use POPFile myself and it's approaching 99% accuracy and I _LOVE_ it.

Spam very, very rarely makes it past, and if it does, it's the generic "check out this site" type message with no other information. Even spammers trying this technique aren't having much success as I'm seeing less and less of it (maybe 1 or 2 message a month make it past the filters).

The next step in anti-spam evolution will be spam-scanning software that automatically follows links back to webpages and looks for "spammy" content and tags the message as spam in the email system.

For those out there that havn't tried a bayesian form of filtering yet, give POPFile a try: (http://popfile.sourceforge.net/). Just be sure to read the instructions.

FWIW, Spamassassin can do Baysian

[0x0d0a]

Spamassassin has Baysian filtering, in addition to the extensive ruleset it uses.

It can also optionally "autolearn", where decisions about what is spam based on existing knowledge can be used to provide automatic learning input for the Baysian system for future emails.

Re:They're annoying

[archeopterix]

The next step in anti-spam evolution will be spam-scanning software that automatically follows links back to webpages and looks for "spammy" content and tags the message as spam in the email system.

Dear dumbass:

That would let the spammer know your email address is active.

Not if done at the ISP level.

Re:They're annoying

[berzerke]

... like Bayesion filtering as well, though it needs to be smarter about the insertion of HTML comments in the middle of words (Viagra), punctuation (V'i'a'g'r'a), additional spacing (V i a g r a), etc. to get around the latest bag of tricks.

I'm seeing a different tactic to get around the bayesian filtering. I've noticed large sections of text, totally unrelated to the product being sold in the body of the spam message, i.e. parts of books (I recongnized Dracula in one), space shuttle reports, etc. Th

Re:Spam is dying

[kfg]

Seriously, I've been getting less spam lately thanks to filters.

Getting less spam lately or seeing less spam?

The distinction is critical.

KFG

Re:Spam is dying

[Eggplant62]

Seriously, I've been getting less spam lately thanks to filters. Sure, it's not gone entirely, but it's a lot less of a hassle than it used to be. I sure hope this is a sign of things to come... If they're this desperate to stop anti-spammers, they gotta be in their throws of death.

No, I cannot concur here. In the last two weeks, I've noticed that the reject rate on my filters has gone up by a surprising amount. I use a custom access table, backed up by several RBL lookups done by postfix, with SpamAssassin on the backend to catch anything that does make it through the initial gauntlet.

Looking back through my logs, I've only got three weeks saved, but here's the breakdown of rejects for each week:

Week ending Oct 18 - 122
Week ending Oct 25 - 250
Week ending Nov 1 - 214
0400 Yesterday through now - 37

Note that I'm seeing hits on addresses that have never existed here, i.e. webaster@$mydomain (yes, the spelling mistake in webaster is theirs, not mine), spammers_lie@$mydomain (non-deliverable, harvested from my usenet posts), mers_lie@$mydomain (trying to remove the obfuscation I might have put in), and now I'm seeing the idiots try to get their crap through by using a non-existent address, john@$mydomain, as the "mail from:" value to attempt to get their crap through.

Yes, they've become so desperate that criminal methods aren't below them. All the filtering that's being done has lowered their response rates to where it's no longer as profitable as it used to be. Of course, the mindset of these idiots is that they'll just crank out the spam all that much harder, in all that much more quantity, in order to get the rates back up to something manageable. Of course, it's beyond them to think that if people are no longer interested in their pitches, they might check employment opportunities at the local McDonald's, as that might be more a more lucrative situation for them.

End of the line:

[eliza_effect]

Ironically, the spammers who try to "get tough" in this way will probably end up putting themselves out of business. They've only survived this long because of relative obscurity, but once these extra-malicious spammers are caught, there won't be much in the way of goodwill for the other, questionably legal ones. Good riddance.

Re:End of the line:

[DNS-and-BIND]

This isn't spammers, it's organized crime. And they won't be caught, either, until law enforcement infiltrates someone in, or someone gets caught for something else and agrees to turn the rest of them in for leniency.

DDoS

[Anonymous Coward]

I wonder if this will be quickly followed by a press release on being slashdotted..? The world's friendliest DDoS attack..

Chris, taffie down under..

This is nothing new

[Anonymous Coward]

Spammers have been DOSing internet email for years. Now they're simply adding their attacks to another protocol. Think about it.

I like this one better...

[jollis]

I like this NANAE post [google.com] by Steve Linford much better. Especially the last paragraph.

Re:I like this one better...

[McDutchie]

FWIW, I linked to that thread in the original submission but it was edited out. (Which is good for you - enjoy the karma. ;) )

This oughtta help

[_LFTL_]

W32/Mimail-E, was created by spammers for the specific purpose of DDoS'ing Spamhaus, Spamcop, and SPEWS.

And in phase two of the attacks spammers craftily create stories containing links to the target spam lists and post them on slashdot. LFTL

Computer Crime

[silentbozo]

I've said it before, the feds should stop looking for super-uber-mega crackers. The biggest, most expensive, and most damaging ONGOING computer crime is spam. They're not idiots, and they're not harmless nuisances. They're quite capable, and have hired on many technically proficient guns to do their dirty work, cracking systems, running hordes of zombies, and trying to find exploits in every commercial and non-commercial system so they can send out ever more spam.

Get to work on eliminating spammers and much of our current crop of computer-related woes will just GO AWAY. The only people who would hate for this to happen are the spammers, the hired guns, and companies like Symantec...

Re:Computer Crime

[D.A. Zollinger]

Get to work on eliminating spammers and much of our current crop of computer-related woes will just GO AWAY. The only people who would hate for this to happen are the spammers, the hired guns, and companies like Symantec...

*sniff* *sniff* Do I smell a conspiracy?

I highly doubt a consparicy

[Sycraft-fu]

It's just general lack of competence and understanding with law enforcement. The whole Internet thing is new to them (it's fairly new in general for that matter) and it requires very different tactics, skills and resources than normal investigations. Thereofre it is taking time for the law enforcement agencies to change and grow.

Also it isn't really clear what is and is not important on the Internet, crime wise or even what should be a crime. I mean some things are pretty clear, like pedophiles luring litt

Re:I highly doubt a consparicy

[swb]

Unfortunately, I think we have 10-20 more years before we start to see really efficient policing of the Internet. Laws and law enforcement agencies need to be changed and they need time to learn how to efficiently handle electronic crime

What I think we'll end up with is one of two things:

(1) The internet largely hobbled by draconian rules, regulations and laws and left unusable except for EDI among large corporations. Think of "national security", "public morality" and "piracy" as the reasons here.

(2) The "internet" still exists, but most people connect through "super ISPs" that filter, process and protect their users. Unlike AOL, they actually will be responsible for protecting PCs connected to their networks.

Great News!

[Anonymous Coward]

This is great news!

Now we're once step closer to linking spam to al Qaeda. These viruses are terrorist actions, and are more demonstrably more dangerous even than Iraq's nukes!

Once we somehow link spammers to September 11, we can invade them (or maybe just throw them in jail where the other inmates can do the "invading").

Re:Great News!

[pchown]

Have a look at the Terrorism Act 2000 [hmso.gov.uk] (the latest UK anti-terrorist legislation). It's getting close... If the DoS attack can be said to be for the purposes of intimidating supporters of anti-spam legislation, they are probably caught.

By section 56 [hmso.gov.uk], someone directing an organisation carrying out such a DoS attack is liable to life imprisonment.

How to make the services more spamproof

[Ed Avis]

So how about using Bitkeeper or Freenet or Gnutella to distribute spam blacklists and other information?

Re:How to make the services more spamproof

[ArsonPanda]

I'd rather have a centralized db in this case. Case in point: You called me a n00b in a CS game, so I just throw your IP(&|)Domain onto Gnutella, all of a sudden you can't email anyone. Seems problem prone.

Re:How to make the services more spamproof

[pjrc]

It is critical for anti-spam blocklists to operate in real time. The lists are not "distributed" like software, movies or other media. The blocklist must be queried, and those queries must operate close to real-time. This is essential so that updates to the list can stop a spam run while it is still in progress. Also, operating in real-time is important to support removal from the list (and potential legal problems associated with being unable to remove someone promptly).

Re:How to make the services more spamproof

[pjrc]

The best ones allow you to make a zone transfer for yourself. This could be used with a P2P delivery method to distribute a DNSbl. Maybe it could have a push instead of a pull stream.

Quoting from the MAPS RBL website [mail-abuse.org], with some emphasis added:

In transfer mode, you copy the entire MAPS RBLSM to some host of yours, using a network protocol such as DNS or BGP which allows you to be updated instantly whenever changes (and most importantly, deletions) occur. Because of the risk of damage to parties who are l

A good thing really

[Ezza]

Anything that brings "spam" and "viruses" closer together in the public eye is bad for spammers in the long run.

And fortunately for the rest of us (or unfortunately depending on your point of view), this type of behaviour just makes spammers more of a target for legislation and law enforcement.

Spammers and the future of E-Mail

[jlemmerer]

First they spam us and now they do even infect us with viruses... when will it ever stop?
I don't really get it, while spam is increasingly annoying (altough i use a highly customized spam assassin filter i still get about 10 unwanted mails) writing viruses is plainly illegal. But what's the reason for DDoS'ing these sites? The only way to fight the spam is to use mail filters. if people want one they have to customize it themselves to make it actually work.

If the spam keeps increasing as fast as it has in the past few years, the future of mail will be dark... here is my vision: (behold!) you will have a "buddy" list of friendy or coworkers similar to instant messaging services such as ICQ and MSN Messenger and only mails from "thrustworthy" origin gets actually forwarded to you mailbox. not so cool, isn't it? but imho its the only way not to have to delete several dozens of spam a day. (and what annoys me most -> i sometimes accidentially delete mails from friends because they are hidden underneath masses of spam.)

yours
johannes

Re:Spammers and the future of E-Mail

[rusty0101]

The service the sites being DDoSed are offering is a list of well known IP address ranges, and domain names that are Well Known, because they have been found to either have customers who are known spammers, or have done nothing to prevent customers from being inadvertant spammers (open proxies and the like.)

If your spam assasin were configured to use one of the black hole lists that they provide, to either mark messages as potential spam, in addition to the filters you have customized, you may get a better

Re:Spammers and the future of E-Mail

[SenseiLeNoir]

BLATANT Conspiracy theory, I know, but with the current situation (SCO, MS, etc) who knows.

- Current Virii spread most effectively via MS email products.

- Said products COULD have been "fixed" a long time ago.

- Features that SHOULD have been incorporated into Oulook (prevent external IMG in HTML email, selective Scripting disable, etc) are implemented by other vendors = profit for said vedors.

- MSN hotmail = spam magnet. Solution = MSN 8 = profit.

- more Virii & Spam = more attraction towards centralised email & buddy listing; Largest of which = MSN.

- moving towards a Microsoft "internet"??????

hmmmmmmmm

Re:Spammers and the future of E-Mail

[26199]

I already use whitelisting... and it works wonderfully, with a couple of tweaks:

• It traps for keywords that indicate probably-valid emails, and passes them
• It traps for keywords that indicate likely spam, and rejects if not fully whitelisted
• I have my uni's domain whitelisted, and a few others
• All spam goes in the 'junk' folder and is checked when I can be bothered

What I've found is that I don't mind spam when I'm expecting it... what's annoying about spam is when you think 'hey, I've got mail!' and it

unfortunately untouchable

[grosa]

it goes without saying that this is pretty sleazy, but unless they are idiots, whoever wrote this is probably sitting somewhere overseas. so, unfortunately we can bitch all we want about it being illegal, because noone is going to do anything about it.

time to continue using spamassasin. it works pretty much 100% for me. it's not really the most ideal solution (the ideal solution being saving the bandwith used by spam by not allowing delivery), but it does same the man-time in trashing spam.

Re:unfortunately untouchable

[JaredOfEuropa]

whoever wrote this is probably sitting somewhere overseas. so, unfortunately we can bitch all we want about it being illegal, because noone is going to do anything about it.

The reason no one is going to do anything about this is not the fact that these people are overseas, but the fact that local law enforcement is not doing anything.

These cyber-crimes should be addressed in the same way as any other (international crime). Your national law enforcement officers should track down the country of residence of the culprit and/or send out an international search warrant. Contrary to popular belief, 'overseas' isn't some backwards region whose citizens have barely discovered the abacus. In many countries, writing or distributing virii is a crime, as is executing DDOS attacks. Which is good, because it means law enforcement in those countries will generally assist in bringing these criminals to justice.

If you want to complain about nothing happening, complain to your local cybercops.

Re:unfortunately untouchable

[Mr Guy]

Besides, compared to the bleeding hearts in our justice system, "overseas" is often where you WANT to see them persecuted. Lets all just take a moment to pray they are in Singapore...

This may actually be good

[Kevinb]

These sites should turn their evidence over to the FBI. There's now good reason to go after the handful of individuals responsible for most spam.

Re:This may actually be good

[Indy1]

you really think the FBI (aka Fascist Bureau of Instigation) would lift a damn finger? They certainly didnt when osirusoft got taken all the way out. The FBI only cares about Thoughtcrime and crimes against major campaign donors. Anyone else simply doesnt matter. We're on our own here, and we're gonna have to fix this problem ourselves.

Re:This may actually be good

[Eggplant62]

you really think the FBI (aka Fascist Bureau of Instigation) would lift a damn finger? They certainly didnt when osirusoft got taken all the way out. The FBI only cares about Thoughtcrime and crimes against major campaign donors. Anyone else simply doesnt matter. We're on our own here, and we're gonna have to fix this problem ourselves.

Y'all need to have a talk with Ron Guilmette, owner/operator of monkeys.com. Ron was running a very extensive network of proxy honeypots and using it to collate and publish data about various ISP's harboring proxy-abusing spammers. His data proved essential in identifying the outfits responsible for the virus-related abuse that we're seeing now. Ron also ran the proxies.monkeys.com blocklist, which was terribly good at filitering spam for me and many others.

Back at tail end of August, beginning of September, he was knocked off the net when monkeys.com came under dDoS attacks, most notably from machines known to be infected by viruses, all harboring open proxy software installed by the virus. He called the local police, who had to be coerced, he says, to come out and take a report. The FBI wasn't even interested enough to come out and take a look at his data. If you cannot prove a minimum of $5k worth of damages, you're shit out of luck.

Why it won't happen

[swb]

• The government is too busy busting bong makers [usdoj.gov] and other "terrorists" destabilizing the American Way of Life.
• Big business has done a great job of undermining all aspects of government regulation of business activity -- it took outright criminal theft at Tyco, Worldcom and Enron before the government cared. Microsoft is allowed to run an illegal monopoly with no penality. Fraud, churn and deception at almost every investment bank and mutual fund. The examples go on, but the basic idea is that the government is unwilling to go after massive corporate fraud unless there's a PR risk to the President.
• More insidious I think is the level of "responsible" corporate complicity in spam. There was a great article in Sunday's Minneapolis Star Tribune about the level of involvement by businesses one would assume have too much at stake to get involved in spam; they don't spam directly, but they're more than willing to deal in email info, which ultimately leads them to deal with spammers. Equifax, Experion and so on are willing participants in linking email with credit information and other personal data. Anyway, these people are "Platinum Club" members of the Republican political machine. Exposing them to news articles about spam and black-hat activities, even with a degree or two of seperation, is a major political problem for the Republicans. Republicans also depend heavily on the "car dealer" economic-level entrepenuer, the local bigshots who bankroll house seats. This socioeconomic group more than likely has a lot of involvement in the direct marketing game, and they can't be pissed off, either.
• There's also some "legitimate" ideological rationalization. The Republicans are staunch allies of anything associated with corporate free speech. Any limitation on what or how a corporation can send its message runs into a whole gauntlent of Republican ideaologues who insist on the corporation's "right" to free speech in all realms, including the commercial.

The basic problem is that the DOJ is a political institution. It's not a neutral enforcement institution seeking to punish lawbreakers. Who and how it decides to punish people are political decisions, deeply influenced by the political needs and goals of the administration. Spam and spammers have too many growing ties to people important to the Republican administration and its pro-corporate, pro-business financial backers. A real crackdown on spam would have shockwaves that would hurt them financially and politically, and with the election only a 366 days away, you can bet that pissing these guys off is something they don't want.

Fighting the Spam

[Matrix2110]

I have found a useful friend with Mailwasher, For those of you that thought the war was lost, check out this beauty.

No direct links, Look it up for yourself.

Re:Fighting the Spam

[Pop69]

I've had a lot of luck spam killing with Popfile from http://popfile.sourceforge.net/ Works very well once the initial training is done and is handy for basic mail classification as well.

Here's the article

[l0wland]

Looks like the site is getting /.-ed. So in case it's down, here's the article:

Spammers Release Virus to Attack Spamhaus.org

A new virus released by spammers on Saturday 1st November is infecting computers worldwide, and this time the purpose of the virus is to attack www.Spamhaus.org. The W32.Mimail.D virus is the latest in a string of viruses, each one released by spammers for the purpose of creating a vast worldwide zombie network of spam-sending machines and building an attack network consisting of hundreds of thousands of virus-infected zombie machines with which the spammers then attack anti-spam organizations.

W32.Mimail.D is designed to infect computers worldwide causing them to each begin making overwhelming amounts of bogus requests to Spamhaus.org's web server, www.spamhaus.org, and also attacks the web servers of www.spamcop.net and www.spews.org.

Spamhaus began coming under massive distributed Denial of Service (dDoS) attacks in July 2003, soon after the release of the SoBig.E virus and the Fizzer virus (W32.HLLW.Fizzer). In June Spamhaus stated that spammers had now moved from simple spamming through open proxies to actually manufacturing and sending out viruses to create a network of spam proxies, infecting hundreds of thousands of mainly home-user machines on broadband (ADSL) lines.

Fizzer (W32.Fizzer-A) in particular is a very wide-spread worm which spreads by emailing itself to contacts in Microsoft Outlook and Windows address books. The purpose of Fizzer is to install a minature web server and a DoS attack tool, specifically for attacking anti-spam organizations. In August and September 4 anti-spam systems were forced into closure under overwhelming dDoS attacks that hit them for weeks at a time.

Spamhaus itself was subjected to the same intense dDoS attacks for 3 months but survived thanks to its large distributed network capable of absorbing the attacks. Still, expecting more attacks, and with still no intervention by Law Enforcement, in mid September we moved the Spamhaus web site behind an anti-dDoS device known as iSecure supplied by Melior CyberWarefare Defence (www.ddos.com) and can therefore now withstand the waves of dDoS attacks.

Spammers getting framed?

[Wrathie]

I dont think anyone can be that stupid... Uhh.... hmm. Nevermind.

Poor grandpa

[aardwolf204]

Recently my cable internet service was suspended. Upon calling tech support I was transfered to the fraud and abuse department, you can imagine the look on my face. The techie told me that my access had been suspended because a computer on my network was infected with the welchia worm. The techie was kind enough to even provide me with the MAC address of the offending machine. I was suprised because my mixed network of 10, linux and windows machines, is kept up to date with the latest security patches. After checking all 10 machines I found that none of them had the mac address supplied by the techie. Upon further investigation of my DHCP logs I found that my WiFi network, SSID free_as_in_beer had its first visitor. I left it open because I believe in free access and wanted to see if anyone interesting would enter the network. Unfortunatly the mysterious computer was not logged in so I could not send a net send message to it, and it seems that the person would connect infrequently. I asked my neighbors and couldnt find the individual so I was forced to employ WEP enchrption. Now I've got chalkings outside my apartment just incase someone with any bit of knowledge wants a free ride, but my point, yes I actually had one, thanks for reading was that I feel bad for grandpa and grandma with their 2000 model compaq connected directly to the cable modem for emailing the grandkids. I was fortunate enough to convince the ISP that my network had been secured and I was granted access again, they on the other hand have few options. Then again this is a good thing for repair guys that make house calls, but between gator (or whatever its called now) and all the other crap out there I think they're busy enough.

I only wish that I could keep my WiFi up without WEP for my neihgbors or anyone walking by without exposing myself to risk of internet connection termination.

Have any other slashdotters had similar experiences, or suggestions. Thanks.

Intrusion detection software

[aardwolf204]

Sorry for replying for my own post, forgot to add this:

I found from techtv.com a program for network intrusion detection called Intrusec Expose from www.intrusec.com [intrusec.com]. Its pretty cool software for monitoring your network and can do a lot more than just tell you what computers are connected and altert you when net computers enter the network. It can also scan for services and such.

No I'm not affiliated with this company and I'm not endorsing this software, I'm actually asking if anyone knows of a free

Re:Intrusion detection software

[cpghost]

I'm actually asking if anyone knows of a free, OSS or not alternative.

snort [snort.org] is quite useful on *NIX machines. Quoth FreeBSD's security/snort ports description:

Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and mu

Re:Poor grandpa

[gad_zuki!]

>I only wish that I could keep my WiFi up without WEP for my neihgbors or anyone walking by without exposing myself to risk of internet connection termination.

Print up some business cards with the WEP key. Hand them out to people you trust.

Control outbound port 25 connections via your firewall. Allow only port 80 from untrusted clients. etc. Its not *that* hard. There are linux distros set to do this using an old 286 if need be. If you want to give it away you will need a robust firewall. Think of it as a digital condom.

They are winning

[WindBourne]

based on the number of spams that are getting through. It has jumped up again (doubled) in the last 1-2 months.
The spamers are not desperate. They have simply figured out nice openings and are bulldozing a near infinity lane highway.

Comment removed

[account_deleted]

Comment removed based on user account deletion

evil spammers getting it slashdotted...

[auzy]

Well, the guy behind this article is obviously a spammer.. its a really smart idea to slashdot a site which is getting DDOS'ed... Well, I'm wondering what would have been more damage.. the worm or the slashdotting

Two part plan

[glassesmonkey]

Maybe it's a 1-2 punch type approach.
Step A - release virus to DDoS on blacklist maintainers ...(DNS/blacklist/etc has to be re-routed until virus passes)
Step B - while blacklists are down, send out massive spam campaign or more virus-type spam

I'm glad that the spammers did that...

[rediguana]

I'm being serious here...

Haven't the authorities shown a propensity for going after malicious software writers, particularly viruses and worms, whilst completely ignoring spam? By writing malicious software, haven't they just attracted a whole lot more attention from law enforcement than they would otherwise have got?

Good on them I say - I think we could do with more law enforcement attention on these sort of people!

Of course it doesn't deny the impacts on those being attacked, nor covers the international aspects of spam. But with more countries creating explicit laws to deal with hacking and misuse of computers, the more dodgy spammers might start getting what they deserve - a good ass-pounding in prison!

Re:I'm glad that the spammers did that...

[Steve B]

And sorry to say this, but it is IMPOSSIBLE to make "Spam" illegal because no two people can agree on what it is.

Nonsense. No two people agree about the precise boundary between marketing and fraud, and yet the latter is illegal. No two people agree about the maximum safe speed on a given stretch of road, and yet there are speed limits.

The law often boils down to picking some arbitrary boundary in the middle of the gray area and then treating it as the black-and-white frontier.

My evil plan for spam.

[gad_zuki!]

First get a corporate shield, an S-corp can be had for as little as $100 in most states. This will protect your personal assets from a lawsuit.

Get a bulk mailer and email harvester and sell "Placebon the Herbal Viagra." Get a credit card processing account (or maybe just paypal) from a bank.

Email a million people.

Get ~5,000 orders.

Charge $19.99

Send them a .40 bottle of vitamin C with a little sticker that says "Placebo you bought from a spammer, dumbass. Cure wait ails ya."

You profit. They get burned. Everyone wins. For the moral people, think of it as your personal war against scurvy.

No good news here

[heironymouscoward]

Anyone who believes that this is the desperate act of a dying species is woefully wrong. Spammers used to be somewhat naive technologically, but the last year or two has seen a consolidation of spammers with virus writers and in essence the battlelines between the "good" and the "bad" users of the Internet have never been so well drawn as now.

A symptom of all evolving systems, natural or artificial, is that parasites will take advantage of easy opportunities. In nature, this battle has been a fundamental force for evolution and change. I don't see why it should be different in the Internet, which largely behaves like a natural system.

Here is an analysis of the subject [slashdot.org] by an expert on the matter (oh, it's ME?!). Bottom line: as long as the Internet is built on predictable defined structures (protocols and gateways), it will be heavily parasitized. What we see today is only a warmup. The solution is to find ways of evolving the structures of the Internet faster than the parasites can evolve.

This problem won't go away through wishful thinking - we need to understand what is actually going on. Heck, this discussion is moot: if my theory is correct, self-modifying defensive systems will happen exactly as the parasites have evolved: because this is what happens in natural systems.

I just trolled myself. Damn.

Re:No good news here

[Reziac]

[goes off, reads Expert Journal] ;)

Okay, since parasites also get parasites... how about a parasite that attaches itself to and debilitates spam?

Seriously, might that be doable/practical?? Obviously there are "vaccination" issues (you can't go invading every user's PC "for their own good") but how would one make such a parasite species-specific, so it would only feed off spammers?

No defense against idiots

[activewire]

this virus spreads itself by email a ZIP attachment which contains EXE that must be run, of course its Windows only.

I would love a way to identify IP address of all idiots who contract this virus, just to be sure my AOL/RoadRunner/Verizon netblock blacklists are complete.

Quick to judge

[Jesus IS the Devil]

People shouldn't just jump to the conclusion that the perpetrator of this is some commercial spammer. I visit some webmaster forums and many have commplained that some of these sites like SPEWS often go overboard in their blackholing, ending up block innocent bystanders who have a tough time getting out of these blocks.

I say it could have been the work of some pissed-off admins who were frustrated.

Re:Quick to judge

[Indy1]

if an admin did this, then he's a complete dumbass that fails to understand the purpose and reason behind spews and the other blacklists. If some spam friendly isp REFUSES to kick their spammers off, like att, c&w, exodus, qwest, cogent, internap, burst, etc etc etc, then they should expect to be heavily blacklisted. And if an admin (btw: i am a network admin myself) is DUMB enough to host with a known spam haus, then he or she shouldnt be surprised when their mail gets bounced with a flurry of 550's.

Re:Quick to judge

[melonman]

I don't like spam, but I have to admit that the thought of someone seriously inconveniencing SPEWS doesn't upset me too much.

Our server ended up on their blacklist despite never having sent a spam, because someone else in the 16-bit IP range had. 16 bits, that's up to 65K machines with maybe half a million users...

Our machine is in a server park. Of course spammers operate from such places. The SPEWS argument that you block thousands of innocent users to get at one guilty one is just plain immoral, and, at least in my case, has the effect of making me opposed to any centralised anti-spam measures, whereas previously I would have been favourable.

If it ever happens again, I'll buy myself a clean SMTP server, or find another solution, but the one thing I'm never going to do is contact my ISP (who, incidentally, enforces a strict anti-spam policy), because I object on principle to being dictated to by people who treat my company's reputation as 'collateral damage' as part of their quixotic campaign.

As for the 'change ISP every three weeks' advice, that just isn't a viable option when you have a few dozen domains, many of them interacting with third party mail filtering, Exchange servers etc.

If SPEWS dropped that one policy of punishing the innocent in an attempt to get at the guilty, it would have my support. Until then, I expect SPEWS to continue to alienate the people who should be on the anti-spam campaign's side.

Re:Quick to judge

[Indy1]

more then likely, your hosting service refused to act on spam complaints, and spews kept escalating the listing untill the whole /16 got nuked (would you indulge my curiousity and tell me what /16 your on? I'm willing to bet its a major spam haus). Spews wasnt trying to get that one spammer only, its trying to beat some sense into your hosting service by bitch slapping them. You are collatoral damage.

Changing isps every 3 weeks isnt viable, but when you pick isps in the first place, do you homework.
Pick a good one once, and your very unlikely to ever have to worry about Spews. The reason why Spews is a problem for you is because a LOT of mail admins including me use it. Spews itself IS NOT your problem, its your isp thats the problem for refusing to deal with spammers on their network. We collectively have decided that when a major isp refuses to deal with their spam problem, that we'll refuse to deal with them. And your caught in the middle.

Hypothetically, if Spews ever died, you'd have far worse problems. Why? For example, I HEAVILY firewall off large isps that have major spam problems, you should see my ruleset for blocking. Not counting the geographic bans, its at 944 entries, and each entry drops a /24 at a minimun, with most entries taking out a /16 to /20. And I know i am not the only one doing this.

Now imagine your isp starts harboring a spam gang (ala Verio or C&W) and blatantly lies and refuses to get rid of the spammers despite all complaints. This quickly gets noticed in NANAE, and mail admins will start dropping that entire hosting service into their deny lists and firewalls. Good luck EVER getting out of 1000's of firewalls and deny lists. At least you can get off Spews if your isp cleans up.

Re:Quick to judge

[AKnightCowboy]

For example, I HEAVILY firewall off large isps that have major spam problems, you should see my ruleset for blocking. Not counting the geographic bans, its at 944 entries, and each entry drops a /24 at a minimun, with most entries taking out a /16 to /20. And I know i am not the only one doing this.

Unless you're running the firewall for AOL, Earthlink, MSN, or Yahoo I really doubt Verio or C&W gives a shit if you just fell off the face of the earth completely, much less blocked a couple of their networks. If you did work for such a large company you wouldn't be blacklisting like that for long as you'd lose your job.

SPEWS is *slow* to judge

[frankie]

despite never having sent a spam, because someone else in the 16-bit IP range had.
[...]
my ISP (who, incidentally, enforces a strict anti-spam policy)

These two statements are mutually contradictory. But first, a reminder that SPEWS is not Not NOT representative of mainstream anti-spam blocklist providers. Both SpamCop and SpamHaus use narrow targeted blocklists. Furthermore, the real responsibility for your blocked email lies with the recipient postmaster who chose to use the SPEWS list. Their server, their rules. You could call them and ask to be whitelisted.

According to best evidence, SPEWS always starts with an abuse complaint email and a /32 blocklisting. If further spam arrives at their address(es?) the listing expands to /28, /24, etc, until either the spammers are removed or the entire ISP is listed. In order to reach /16, your ISP must have ignored SPEWS and retained its spammers for a long Long LONG time.

But they CAN do these viruses ...

[MAFIAA]

What beggars belief more is that a corp with the near-infinite resources of Microsoft still gives people a near-perfect vector for virus distribution. I'm sure if any one of us had 40Bn cash and 8 years (is that how old LookOut Express is now?) we could either code or hire programmers to code an email client that wasnt broken.

Of course.. if they ever mended LookOut the AV guys would go out of business overnight but that's a whole new consipracy theory involving large cash backhanders and deliberately broken coding there... :o)

Re:But they CAN do these viruses ...

[leerpm]

Of course.. if they ever mended LookOut the AV guys would go out of business overnight but that's a whole new consipracy theory involving large cash backhanders and deliberately broken coding there... :o)

The newest versions of Outlook have been fixed. They no longer auto-run scripts, etc. But it is pretty hard to protect against stupid users who will open .exe's from just about anyone. Though I have heard Outlook can now be configured to just plain reject emails with any sort of script/executable attachm

Actually, This Could Be Good

[TheWanderingHermit]

If spammers are really behind these virii, and we're able to verify it, then it is probably that even the blind and computer-ignorant gov. offices, like FBI, or whoever, will eventually get the same info others have.

Whereas before their only offense was spam (which is gradually being outlawed), now they have done something for which people have been indicted and sent to jail for.

Spammers are evil -- we all know that -- and this just means the gov. (if they're awake) will finally have a tool to put the worst of them in jail once they can prove who's spacking and creating anti-anti-spam virii.

Re:Actually, This Could Be Good

[mabu]

If spammers are really behind these virii, and we're able to verify it, then it is probably that even the blind and computer-ignorant gov. offices, like FBI, or whoever, will eventually get the same info others have.

You would think so wouldn't you?

The problem is spammers have been breaking federal laws since the beginning of the Internet. Hijacking a mail relay has never been legal -- it's a felony. Ever heard of anyone getting jail time for a flood ping even though it is illegal?

It's interesting. You

Bayesian filtering

[dido]

I've been using SpamAssassin's Bayesian filtering features to get rid of my spam for good. I've turned off SpamAssassin's use of any of the antispam sites like spamhaus, spews, and spamcop, mainly because some of them have been foolish enough to sweep such a wide net that turning on use of these sites causes SpamAssassin to filter legitimate mail that comes from my own domain! (that's what I get for living in a country whose ccTLD is run by a brain-damaged registrar...) I've been running almost totally on Bayesian filters after having trained them carefully for a month, and have thus far had zero false positives and false negatives. I mainly keep the spam around to further strengthen the training of my filters and for occasional entertainment value. Those Nigerian scams can be really funny sometimes, you know. :)

These blacklists could go away tomorrow and my Bayesian filters will only keep getting better and better at weeding out the spam. In my experience, these antispam sites are actually more part of the problem than the solution, because they filter more mail than they should.

Re:Bayesian filtering

[Indy1]

and the spammers will continue to waste your network bandwidth and resources. Content based filtering is
a inperfect solution at best, and one that does NOTHING to discourage the spammers. Only heavy blocking of spam friendly countries and isps seems to do much to discourage more spam.

If the Virus doent kill them...

[Pope Raymond Lama]

Slashdot will.

There are few things I can think of more Homer-Simpson-ish than post a slashdot link to certains sites to tell the world they are being DoSed.

Spam Prevention

[cagle_.25]

This is slightly offtopic, but I've been turning over an anti-spam scheme in my mind for a while. What if ...

you are required to pay a small escrow fee as part of your ISP service fee, AND

if someone receives and e-mail from you and deems it as spam, then he clicks the appropriate button, AND

your escrow fee is charged *once per e-mail* and his is increased by the same amount.

The balance of the escrow fee would be refundable at any time, but accounts with a balance of 0 would be unable to send e-mails.

As I think through this, I can see several virtues:
1. The senders of spam would have to pay per offensive e-mail and would thus have strong incentive to stop.
2. Senders of legit e-mail would continue to have free or mostly free e-mail.
3. Those affected by spam would have immediate recourse and receive compensation for their time.
4. The spirit of the plan seems right: if you are going to waste my time with your spam, then you pay me for it. But if you are a friend, you get my time for free.

Does anyone see drawbacks to this plan? Perhaps increase in net traffic per e-mail sent, but that would presumably be offset by a substantial decrease in spam.

Re:Spam Prevention

[Zed2K]

"Does anyone see drawbacks to this plan?"

Basically its the same theory as warning someone in AOL-IM. Their warn level gets high enough they can't send messages until it drops some. The problem is people get into "warning wars". How high can I make a friends warn level to piss him off.

For spam who is going to be the judge to determine if its spam or not? I consider all the stupid jokes I get from people spam so I should hit them and make them pay for it. What if I piss someone off so they decide to re

Whitelisting may be the only sollution

[Erik Hensema]

But not whitelisting as we know it.

Think about it: most spam comes from cable and adsl connected machines. dynablock.easynet.nl is trying to block each and every dynamic IP on earth, effectively making it a whitelist of static and therefore blockable IP's.

One could even take this one step further: blacklist the entire internet and whitelist known mailservers. Getting out of that should be easy, but no so easy that a spammer could do it automatically. And when you're spamming from a whitelisted IP, the IP is blacklisted again for, say, 1 week. Then it can be whitelisted again, but when you're spamming again, then it's blacklisted for a month.

The hard part of such a whitelist is: where do you start? I think it would be sensible to start out by simply tagging mail originating from blacklisted IP's. Early adopters can then whitelist each and every IP they expect mail from. After a while a sufficiently small amount of mail will be tagged by the blacklist, so it can be used to start blocking with it.

If we only could convince each and every postmater on earth to use such a system, it could be very, very useful.

Meanwhile, please use Dynablocker [easynet.nl]. It can really help making h4x0red boxes useless as a spam source.

SPAM good for (Inter)National (Cyber)Security

[Moblaster]

Spammers spend a tremendous amount of time and energy cracking systems, setting up zombies, getting around barriers of all sorts. The reason why is because they have a financial incentive to do so.

If security through obscurity is an intellectually bankrupt concept, then the spam industry innovates security knowledge like no other.

The fact is that spammers not only save work for the script kiddies, they help the NSA, CIA, FBI, KGB... as well as IBM, MSFT, SYMC...

Think of them as parasites that feed off our collective ignorance, and you'll see what a useful cleansing function they serve in the greater ecosystem.

Bluebottle was DDosed off the net..

[msimm]

They where a great free email service ('whitelist') similar to the TMDA system [tmda.net].

I see quite a few posts suggesting that spammers are getting desperate, but brazen seems more appropriate. They are shutting down some of our most effective anti-spam tools and there seems nothing we can do about it. To me that looks more like their winning.

Re: Desperate like a fox

[Black Parrot]

> > They must really be getting desperate.

> This reminds me of the President claiming the increased rate of attacks in Iraq was a sign of progress.

Whew, I'm so glad to hear we're winning the War on Spam!

Somebody needs to tell my mail service, though.

> Since when does increasing sophistication demonstrate desperation?

When the facts are inconvenient and spin is deemed an acceptable substitute.

Re:Desperate like a fox

[jmv]

Well, it doesn't prove they're desperate, but it shows that spamhaus and others hurts them (otherwise, why attack them).

Re:Could someone please make the argument...

[Analysis Paralysis]

Surely it would be more appropriate to force them to take an overdose of their own viagra? Sorry, v1agra.

Re:Could someone please make the argument...

[pe1rxq]

I am against the death penalty by principle....
I can understand that some people think in the line of an eye for an eye (I don't agree with them, but atleast they have some argument).
Spam leads to irritation, or eaven to lost bandwidth or time and thus to a financial damage. To say that that justifies killing is so stupid it isn't even funny.

Jeroen

An eye for an eye, a minute for a minute

[matfa]

An eye for an eye, a minute for a minute;

Well, say spammers send their messages to 2 million recipients, and each spend, on average, 10 seconds reading and deleting said spam. That comes out at 231 days of _completely wasted_ life. Life that can never be given back to whoever lost it.

Even worse, since that's time spent awake, it's more like a year of real time. Say the spammer sends 100 such spams, he would then have _wasted_ an entire lifetime. We can thus, by the "An eye for an eye, a minute for a minute" rule, confiscate the rest of his life!

There's the argument you requested!

cheers,
m

Re:Could someone please make the argument...

[DNS-and-BIND]

It just wouldn't be slashdot without a kneejerk liberal taking everything seriously and issuing a sober, politically correct refutal to someone's offhand comment.

Re:Not really...

[nchip]

Oh, puhhlleeeze:

Read the virus analysis [nai.com] before making untrue claims:

The worm sends a large amount of data to remote servers (port 80 and ICMP). The worm verifies that a connection is active by contacting www.google.com. If successful, an attack is initiated on the following domains:

* spews.org
* spamhaus.org
* spamcop.net
* www.spews.org
* www.spamhaus.org
* www.spamcop.net

Re:I don't see what the problem with spam is

[McDutchie]

If it is useless, I delete it (it takes all of 2 seconds). Whats the problem?

Two hundred thirty-five gazillion times two seconds is the problem.

Re:Legislation and TLD's

[vidarh]

The flaw with this is exactly that it allows easy filtering. Spammers want to reach you regardless of whether you are filtering or not, so would likely not care about *.spm.

And for porn sites: If they are all on *.xxx they will be filtered, but much of that filtering would happen by people apart from their clients themselves. Yes, it would remove children (which I'm sure the porn sites would be very happy about - if you're in a business that require credit card signups and where your primary cost is bandwidth, would you like to have an underage person with no credit card but all the time in the world to download your preview content over and over again and wasting your bandwidth accessing your site?), but it would also remove people surfing from work (you'd be surprised - I've run several networks where all traffic went through a Squid proxy, and the traffic stats were "interesting" considering it came from people working in glass cubicles), from any country that decides to stop the "immoral" porn sites, from any municipality or state with powers to order ISP's to filter, and a wide variety of other situations.

The porn industry would likely hate *.xxx for those reasons: It makes it easy to censor them.

And we should be vary of any attempt to force controversial content to be labelled for exactly that reason.

Another problem is who sets the standards. In some countries kissing publicly is considered obscene. Some countries consider bare womens limbs obscene. Some countries are pretty liberal about underage nudity as long as it's not in a sexual setting (some places parents taking pictures of their children playing naked on the beach would be ok on a page with their holiday pics, but would be considered child porn if they were put on a porn site, for instance)

This is why the .kids proposal was altered to .kids.us - it restricts the above problem to standards within a single country. But in the .kids.us case it's about positive labelling: Label what you explicitly want to allow rather than that which some people will want to restrict, so the problem was smaller to start with.

A .spm would have some of the same problems. As long as the criteria would be made purely based on delivery method and volume I wouldn't be too concerned, but again the question would be in what cases mass distribution could be made outside of .spm, and how to verify that it taken place.

Also, a .spm would need more than just that - a major problem of spam is the cost of handling it for ISPs. Making it harder to reach users, but giving spammers a specifically legal way of delivery, would likely exacerbate that by forcing spammers to massively increase their volume to make up for reduced reach.

Here's how more laws and regulation will stop spam

[mabu]

1. Print out all the new laws and proposed regulations; bind them into a big, thick book.

2. Get some competent network admins (who are obviously nowhere near any government cyber-crime unit) and can easily track down the source of the spam and worms.

3. Go to the perpetrators home or residence.

4. Beat the perpetrator over the head with the book of laws.

The more laws we pass, the heavier the book becomes and the more brain damage it will do. Considering the trend our leaders have in thinking more laws will stop this when the existing laws aren't being enforced, the only reasonable solution is to use the actual laws themselves as some form of blunt instrument.

Re:Mimail-E also DDoS'ing financial sites

[gorbachev]

It's not attacking several financial sites, just Fethard Finance.

The .biz TLD has been regularly used by spammers, who use the zombie networks to host their websites and even DNS servers. I bet fethard.biz is ran by someone, who is sick and tired of getting the .biz domain thorouhgly plonked by blocklists and complained either directly to the criminal spammers or the admins of the .biz TLD and the spammers got a word of that.

Proletariat of the world, unite to kill spammers.
The more painfully and slowly, t