Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Spam Security The Internet Your Rights Online

Spammer DDoS-By-Virus On spamhaus.org 568

McDutchie writes "Steve Linford of Spamhaus announced in a press release that the latest Wintel virus, W32/Mimail-E, was created by spammers for the specific purpose of DDoS'ing Spamhaus, Spamcop, and SPEWS. It's becoming more and more clear that the spambags are the ones behind the recent mess with the Windows viruses. They must really be getting desperate."
This discussion has been archived. No new comments can be posted.

Spammer DDoS-By-Virus On spamhaus.org

Comments Filter:
  • Spam is dying (Score:5, Insightful)

    by GotAnMP3 ( 721156 ) on Monday November 03, 2003 @03:51AM (#7376204)
    Seriously, I've been getting less spam lately thanks to filters. Sure, it's not gone entirely, but it's a lot less of a hassle than it used to be. I sure hope this is a sign of things to come... If they're this desperate to stop anti-spammers, they gotta be in their throws of death.
    • They're annoying (Score:2, Insightful)

      by 0x0d0a ( 568518 )
      Filters, yes. Spamassassin, yes. Antispam registries (think SPEWS), no.

      Lists of IPs for "antispam" purposes, drive me bananas. I normally run an MTA on my machine, and don't see any reason to relay mail (slower notification of problems, have to remember to change the relay whenever moving from network to network, etc), and there are groups like the DUL that just block swaths of IPs from sending email.

      I hate getting spam too, but not as much as I get screwed over by stupid antispam "fixes".

      I'm all for
      • Re:They're annoying (Score:5, Interesting)

        by phaze3000 ( 204500 ) on Monday November 03, 2003 @04:10AM (#7376274) Homepage

        Except, of course, that part of SpamAssassin's checks are to use the 'antispam registries' you are complaining about.

        Quite frankly, with the current volumes of spam it is impractical to try and run a mailserver for more than a few thousand users without some form of blocklist or having extremely deep pockets. The problem with SpamAssasin is that it actually increases the load on ones mail servers - a variety of checks have to be run on every single mail. By contrast, using a blocklist means that spam can be rejected before the DATA stage, reducing the load on the server, and the bandwidth consumed by spam.

        • Except, of course, that part of SpamAssassin's checks are to use the 'antispam registries' you are complaining about.

          Sure...but I don't use those. :-)
        • by Joel Rowbottom ( 89350 ) on Monday November 03, 2003 @05:21AM (#7376423) Homepage
          Seriously, if you want to reject stuff at SMTP time rather than accepting it then processing it, try using sa-exim (a freshmeat search will turn it up) - it fits into exim [exim.org] and rejects as soon as it's worked out it's spam - mid-DATA if need be.
          • by dodobh ( 65811 ) on Monday November 03, 2003 @02:16PM (#7379642) Homepage
            You either interrupt transmission before the data phase, or after the data phase has been terminated by . (RFC 2821 mandates that data cannot be interrupted).
            Interruption during the data phase will be considered as a network problem and the mail will be resent, for upto five days. Lots of bandwidth wasted.
            Stopping before the data implies that only the helo/ehlo, mail from: and rcpt to: have been sent. Stopping after data but before the quit just implies that your server will not deal with the bounce. It does nothing to save your inbound bandwidth.
        • Re:They're annoying (Score:3, Interesting)

          by 0x0d0a ( 568518 )
          Quite frankly, with the current volumes of spam it is impractical to try and run a mailserver for more than a few thousand users without some form of blocklist or having extremely deep pockets. The problem with SpamAssasin is that it actually increases the load on ones mail servers - a variety of checks have to be run on every single mail. By contrast, using a blocklist means that spam can be rejected before the DATA stage, reducing the load on the server, and the bandwidth consumed by spam.

          I'd rather jus
      • Re:They're annoying (Score:5, Informative)

        by Analysis Paralysis ( 175834 ) on Monday November 03, 2003 @04:22AM (#7376306)
        Spamassassin, yes. Antispam registries (think SPEWS), no.

        Hate to rain on your parade here, but SpamAssassin does use blocklists by default (as described in the FAQ [taint.org]). It is the existence of such blocklists that has forced certain major ISPs to stop writing "pink contracts" to known spammers and they are the only anti-spam measure that reduces the cost that ISPs have to bear in terms of mail-server storage and excess bandwidth that spam causes. Rest assured that the spam epidemic would be far worse without DNSBLs and the cost of Internet access far higher.

        Whitelists may work for some people, but others may need to keep their inboxes open (e.g. vendor support).

        • by 0x0d0a ( 568518 )
          Hate to rain on your parade here

          You aren't. No need to worry.

          but SpamAssassin does use blocklists by default (as described in the FAQ). It is the existence of such blocklists that has forced certain major ISPs to stop writing "pink contracts" to known spammers and they are the only anti-spam measure that reduces the cost that ISPs have to bear in terms of mail-server storage and excess bandwidth that spam causes. Rest assured that the spam epidemic would be far worse without DNSBLs and the cost of Int
      • by gowen ( 141411 )
        I normally run an MTA on my machine, and don't see any reason to relay mail ... Free Email Everywhere Just Doesn't Work.
        Ahh, I see. Everyone in the world must jump through the painful, non-functioning hoops of whitelisting, just because you don't want the minor inconvenience of relaying.

        Thats really grown up of you.... People like you should be forced to use carrier pigeons.
        • by 0x0d0a ( 568518 )
          Ahh, I see. Everyone in the world must jump through the painful, non-functioning hoops of whitelisting, just because you don't want the minor inconvenience of relaying.

          No. If IP lists really were an effective solution to spam, then you wouldn't hear a peep out of me.

          However, IP listing is an extremely poor solution to the problem. It takes an approach that is simply not tenable in the security world -- attempting to secure *everyone else's system* rather than your own (you have a list of evil servers,
        • Re:They're annoying (Score:3, Interesting)

          by mjh ( 57755 )

          Everyone in the world must jump through the painful, non-functioning hoops of whitelisting...

          Just out of curiosity, what about whitelisting do you think is non-functional? I've been using a program that, among other things, is an automated whitelist management program. It's called TMDA [tmda.net] and it works fantastically. There are other similar programs.

          I'm just curious as to why you think whitelisting is non-functional.

      • Re:They're annoying (Score:5, Interesting)

        by Nogami_Saeko ( 466595 ) on Monday November 03, 2003 @05:44AM (#7376474)
        Spamassassin is great for ISPs and other companies that need rule-based spam checkers that are sort of "generic".

        For personal filtering, nothing beats a good bayesian filter. I use POPFile myself and it's approaching 99% accuracy and I _LOVE_ it.

        Spam very, very rarely makes it past, and if it does, it's the generic "check out this site" type message with no other information. Even spammers trying this technique aren't having much success as I'm seeing less and less of it (maybe 1 or 2 message a month make it past the filters).

        The next step in anti-spam evolution will be spam-scanning software that automatically follows links back to webpages and looks for "spammy" content and tags the message as spam in the email system.

        For those out there that havn't tried a bayesian form of filtering yet, give POPFile a try: (http://popfile.sourceforge.net/). Just be sure to read the instructions.
        • Spamassassin has Baysian filtering, in addition to the extensive ruleset it uses.

          It can also optionally "autolearn", where decisions about what is spam based on existing knowledge can be used to provide automatic learning input for the Baysian system for future emails.
    • Re:Spam is dying (Score:5, Insightful)

      by kfg ( 145172 ) on Monday November 03, 2003 @04:48AM (#7376366)
      Seriously, I've been getting less spam lately thanks to filters.

      Getting less spam lately or seeing less spam?

      The distinction is critical.

      KFG
    • Re:Spam is dying (Score:5, Interesting)

      by Eggplant62 ( 120514 ) on Monday November 03, 2003 @07:18AM (#7376698)
      Seriously, I've been getting less spam lately thanks to filters. Sure, it's not gone entirely, but it's a lot less of a hassle than it used to be. I sure hope this is a sign of things to come... If they're this desperate to stop anti-spammers, they gotta be in their throws of death.


      No, I cannot concur here. In the last two weeks, I've noticed that the reject rate on my filters has gone up by a surprising amount. I use a custom access table, backed up by several RBL lookups done by postfix, with SpamAssassin on the backend to catch anything that does make it through the initial gauntlet.

      Looking back through my logs, I've only got three weeks saved, but here's the breakdown of rejects for each week:

      Week ending Oct 18 - 122
      Week ending Oct 25 - 250
      Week ending Nov 1 - 214
      0400 Yesterday through now - 37

      Note that I'm seeing hits on addresses that have never existed here, i.e. webaster@$mydomain (yes, the spelling mistake in webaster is theirs, not mine), spammers_lie@$mydomain (non-deliverable, harvested from my usenet posts), mers_lie@$mydomain (trying to remove the obfuscation I might have put in), and now I'm seeing the idiots try to get their crap through by using a non-existent address, john@$mydomain, as the "mail from:" value to attempt to get their crap through.

      Yes, they've become so desperate that criminal methods aren't below them. All the filtering that's being done has lowered their response rates to where it's no longer as profitable as it used to be. Of course, the mindset of these idiots is that they'll just crank out the spam all that much harder, in all that much more quantity, in order to get the rates back up to something manageable. Of course, it's beyond them to think that if people are no longer interested in their pitches, they might check employment opportunities at the local McDonald's, as that might be more a more lucrative situation for them.
  • End of the line: (Score:5, Insightful)

    by eliza_effect ( 715148 ) on Monday November 03, 2003 @03:51AM (#7376205)
    Ironically, the spammers who try to "get tough" in this way will probably end up putting themselves out of business. They've only survived this long because of relative obscurity, but once these extra-malicious spammers are caught, there won't be much in the way of goodwill for the other, questionably legal ones. Good riddance.
  • DDoS (Score:5, Funny)

    by Anonymous Coward on Monday November 03, 2003 @03:51AM (#7376207)
    I wonder if this will be quickly followed by a press release on being slashdotted..? The world's friendliest DDoS attack..

    Chris, taffie down under..
  • by Anonymous Coward
    Spammers have been DOSing internet email for years. Now they're simply adding their attacks to another protocol. Think about it.
  • by jollis ( 691129 ) on Monday November 03, 2003 @03:53AM (#7376213)
    I like this NANAE post [google.com] by Steve Linford much better. Especially the last paragraph.
  • by _LFTL_ ( 409654 ) on Monday November 03, 2003 @03:53AM (#7376216)
    W32/Mimail-E, was created by spammers for the specific purpose of DDoS'ing Spamhaus, Spamcop, and SPEWS.

    And in phase two of the attacks spammers craftily create stories containing links to the target spam lists and post them on slashdot. LFTL
  • Computer Crime (Score:5, Insightful)

    by silentbozo ( 542534 ) on Monday November 03, 2003 @03:56AM (#7376225) Journal
    I've said it before, the feds should stop looking for super-uber-mega crackers. The biggest, most expensive, and most damaging ONGOING computer crime is spam. They're not idiots, and they're not harmless nuisances. They're quite capable, and have hired on many technically proficient guns to do their dirty work, cracking systems, running hordes of zombies, and trying to find exploits in every commercial and non-commercial system so they can send out ever more spam.

    Get to work on eliminating spammers and much of our current crop of computer-related woes will just GO AWAY. The only people who would hate for this to happen are the spammers, the hired guns, and companies like Symantec...
    • Get to work on eliminating spammers and much of our current crop of computer-related woes will just GO AWAY. The only people who would hate for this to happen are the spammers, the hired guns, and companies like Symantec...

      *sniff* *sniff* Do I smell a conspiracy?
      • It's just general lack of competence and understanding with law enforcement. The whole Internet thing is new to them (it's fairly new in general for that matter) and it requires very different tactics, skills and resources than normal investigations. Thereofre it is taking time for the law enforcement agencies to change and grow.

        Also it isn't really clear what is and is not important on the Internet, crime wise or even what should be a crime. I mean some things are pretty clear, like pedophiles luring litt
        • by swb ( 14022 ) on Monday November 03, 2003 @07:01AM (#7376654)
          Unfortunately, I think we have 10-20 more years before we start to see really efficient policing of the Internet. Laws and law enforcement agencies need to be changed and they need time to learn how to efficiently handle electronic crime

          What I think we'll end up with is one of two things:

          (1) The internet largely hobbled by draconian rules, regulations and laws and left unusable except for EDI among large corporations. Think of "national security", "public morality" and "piracy" as the reasons here.

          (2) The "internet" still exists, but most people connect through "super ISPs" that filter, process and protect their users. Unlike AOL, they actually will be responsible for protecting PCs connected to their networks.

  • Great News! (Score:5, Funny)

    by Anonymous Coward on Monday November 03, 2003 @03:58AM (#7376235)
    This is great news!

    Now we're once step closer to linking spam to al Qaeda. These viruses are terrorist actions, and are more demonstrably more dangerous even than Iraq's nukes!

    Once we somehow link spammers to September 11, we can invade them (or maybe just throw them in jail where the other inmates can do the "invading").
    • Re:Great News! (Score:5, Interesting)

      by pchown ( 90777 ) on Monday November 03, 2003 @06:58AM (#7376648)
      Have a look at the Terrorism Act 2000 [hmso.gov.uk] (the latest UK anti-terrorist legislation). It's getting close... If the DoS attack can be said to be for the purposes of intimidating supporters of anti-spam legislation, they are probably caught.

      By section 56 [hmso.gov.uk], someone directing an organisation carrying out such a DoS attack is liable to life imprisonment.
  • by Ed Avis ( 5917 ) <ed@membled.com> on Monday November 03, 2003 @03:59AM (#7376238) Homepage
    So how about using Bitkeeper or Freenet or Gnutella to distribute spam blacklists and other information?
    • by ArsonPanda ( 647069 ) on Monday November 03, 2003 @04:19AM (#7376296)
      I'd rather have a centralized db in this case. Case in point: You called me a n00b in a CS game, so I just throw your IP(&|)Domain onto Gnutella, all of a sudden you can't email anyone. Seems problem prone.
    • by pjrc ( 134994 ) <paul@pjrc.com> on Monday November 03, 2003 @05:07AM (#7376395) Homepage Journal
      It is critical for anti-spam blocklists to operate in real time. The lists are not "distributed" like software, movies or other media. The blocklist must be queried, and those queries must operate close to real-time. This is essential so that updates to the list can stop a spam run while it is still in progress. Also, operating in real-time is important to support removal from the list (and potential legal problems associated with being unable to remove someone promptly).
  • by Ezza ( 413609 ) on Monday November 03, 2003 @04:00AM (#7376243)
    Anything that brings "spam" and "viruses" closer together in the public eye is bad for spammers in the long run.

    And fortunately for the rest of us (or unfortunately depending on your point of view), this type of behaviour just makes spammers more of a target for legislation and law enforcement.
  • by jlemmerer ( 242376 ) <xcom123NO@SPAMyahoo.com> on Monday November 03, 2003 @04:01AM (#7376250) Homepage
    First they spam us and now they do even infect us with viruses... when will it ever stop?
    I don't really get it, while spam is increasingly annoying (altough i use a highly customized spam assassin filter i still get about 10 unwanted mails) writing viruses is plainly illegal. But what's the reason for DDoS'ing these sites? The only way to fight the spam is to use mail filters. if people want one they have to customize it themselves to make it actually work.

    If the spam keeps increasing as fast as it has in the past few years, the future of mail will be dark... here is my vision: (behold!) you will have a "buddy" list of friendy or coworkers similar to instant messaging services such as ICQ and MSN Messenger and only mails from "thrustworthy" origin gets actually forwarded to you mailbox. not so cool, isn't it? but imho its the only way not to have to delete several dozens of spam a day. (and what annoys me most -> i sometimes accidentially delete mails from friends because they are hidden underneath masses of spam.)

    yours
    johannes
    • The service the sites being DDoSed are offering is a list of well known IP address ranges, and domain names that are Well Known, because they have been found to either have customers who are known spammers, or have done nothing to prevent customers from being inadvertant spammers (open proxies and the like.)

      If your spam assasin were configured to use one of the black hole lists that they provide, to either mark messages as potential spam, in addition to the filters you have customized, you may get a better
    • by SenseiLeNoir ( 699164 ) on Monday November 03, 2003 @04:30AM (#7376329)
      BLATANT Conspiracy theory, I know, but with the current situation (SCO, MS, etc) who knows.

      - Current Virii spread most effectively via MS email products.

      - Said products COULD have been "fixed" a long time ago.

      - Features that SHOULD have been incorporated into Oulook (prevent external IMG in HTML email, selective Scripting disable, etc) are implemented by other vendors = profit for said vedors.

      - MSN hotmail = spam magnet. Solution = MSN 8 = profit.

      - more Virii & Spam = more attraction towards centralised email & buddy listing; Largest of which = MSN.

      - moving towards a Microsoft "internet"??????

      hmmmmmmmm
    • I already use whitelisting... and it works wonderfully, with a couple of tweaks:

      • It traps for keywords that indicate probably-valid emails, and passes them
      • It traps for keywords that indicate likely spam, and rejects if not fully whitelisted
      • I have my uni's domain whitelisted, and a few others
      • All spam goes in the 'junk' folder and is checked when I can be bothered

      What I've found is that I don't mind spam when I'm expecting it... what's annoying about spam is when you think 'hey, I've got mail!' and it

  • by grosa ( 648390 ) on Monday November 03, 2003 @04:01AM (#7376251)
    it goes without saying that this is pretty sleazy, but unless they are idiots, whoever wrote this is probably sitting somewhere overseas. so, unfortunately we can bitch all we want about it being illegal, because noone is going to do anything about it.

    time to continue using spamassasin. it works pretty much 100% for me. it's not really the most ideal solution (the ideal solution being saving the bandwith used by spam by not allowing delivery), but it does same the man-time in trashing spam.
    • by JaredOfEuropa ( 526365 ) on Monday November 03, 2003 @05:23AM (#7376428) Journal
      whoever wrote this is probably sitting somewhere overseas. so, unfortunately we can bitch all we want about it being illegal, because noone is going to do anything about it.
      The reason no one is going to do anything about this is not the fact that these people are overseas, but the fact that local law enforcement is not doing anything.

      These cyber-crimes should be addressed in the same way as any other (international crime). Your national law enforcement officers should track down the country of residence of the culprit and/or send out an international search warrant. Contrary to popular belief, 'overseas' isn't some backwards region whose citizens have barely discovered the abacus. In many countries, writing or distributing virii is a crime, as is executing DDOS attacks. Which is good, because it means law enforcement in those countries will generally assist in bringing these criminals to justice.

      If you want to complain about nothing happening, complain to your local cybercops.
      • Besides, compared to the bleeding hearts in our justice system, "overseas" is often where you WANT to see them persecuted. Lets all just take a moment to pray they are in Singapore...
  • by Kevinb ( 138146 ) on Monday November 03, 2003 @04:05AM (#7376259) Homepage
    These sites should turn their evidence over to the FBI. There's now good reason to go after the handful of individuals responsible for most spam.
    • you really think the FBI (aka Fascist Bureau of Instigation) would lift a damn finger? They certainly didnt when osirusoft got taken all the way out. The FBI only cares about Thoughtcrime and crimes against major campaign donors. Anyone else simply doesnt matter. We're on our own here, and we're gonna have to fix this problem ourselves.
      • by Eggplant62 ( 120514 ) on Monday November 03, 2003 @07:36AM (#7376749)
        you really think the FBI (aka Fascist Bureau of Instigation) would lift a damn finger? They certainly didnt when osirusoft got taken all the way out. The FBI only cares about Thoughtcrime and crimes against major campaign donors. Anyone else simply doesnt matter. We're on our own here, and we're gonna have to fix this problem ourselves.


        Y'all need to have a talk with Ron Guilmette, owner/operator of monkeys.com. Ron was running a very extensive network of proxy honeypots and using it to collate and publish data about various ISP's harboring proxy-abusing spammers. His data proved essential in identifying the outfits responsible for the virus-related abuse that we're seeing now. Ron also ran the proxies.monkeys.com blocklist, which was terribly good at filitering spam for me and many others.

        Back at tail end of August, beginning of September, he was knocked off the net when monkeys.com came under dDoS attacks, most notably from machines known to be infected by viruses, all harboring open proxy software installed by the virus. He called the local police, who had to be coerced, he says, to come out and take a report. The FBI wasn't even interested enough to come out and take a look at his data. If you cannot prove a minimum of $5k worth of damages, you're shit out of luck.
    • by swb ( 14022 ) on Monday November 03, 2003 @10:41AM (#7377646)
      • The government is too busy busting bong makers [usdoj.gov] and other "terrorists" destabilizing the American Way of Life.
      • Big business has done a great job of undermining all aspects of government regulation of business activity -- it took outright criminal theft at Tyco, Worldcom and Enron before the government cared. Microsoft is allowed to run an illegal monopoly with no penality. Fraud, churn and deception at almost every investment bank and mutual fund. The examples go on, but the basic idea is that the government is unwilling to go after massive corporate fraud unless there's a PR risk to the President.
      • More insidious I think is the level of "responsible" corporate complicity in spam. There was a great article in Sunday's Minneapolis Star Tribune about the level of involvement by businesses one would assume have too much at stake to get involved in spam; they don't spam directly, but they're more than willing to deal in email info, which ultimately leads them to deal with spammers. Equifax, Experion and so on are willing participants in linking email with credit information and other personal data. Anyway, these people are "Platinum Club" members of the Republican political machine. Exposing them to news articles about spam and black-hat activities, even with a degree or two of seperation, is a major political problem for the Republicans. Republicans also depend heavily on the "car dealer" economic-level entrepenuer, the local bigshots who bankroll house seats. This socioeconomic group more than likely has a lot of involvement in the direct marketing game, and they can't be pissed off, either.
      • There's also some "legitimate" ideological rationalization. The Republicans are staunch allies of anything associated with corporate free speech. Any limitation on what or how a corporation can send its message runs into a whole gauntlent of Republican ideaologues who insist on the corporation's "right" to free speech in all realms, including the commercial.

      The basic problem is that the DOJ is a political institution. It's not a neutral enforcement institution seeking to punish lawbreakers. Who and how it decides to punish people are political decisions, deeply influenced by the political needs and goals of the administration. Spam and spammers have too many growing ties to people important to the Republican administration and its pro-corporate, pro-business financial backers. A real crackdown on spam would have shockwaves that would hurt them financially and politically, and with the election only a 366 days away, you can bet that pissing these guys off is something they don't want.
  • I have found a useful friend with Mailwasher, For those of you that thought the war was lost, check out this beauty.

    No direct links, Look it up for yourself.

    • Re:Fighting the Spam (Score:2, Informative)

      by Pop69 ( 700500 )
      I've had a lot of luck spam killing with Popfile from http://popfile.sourceforge.net/ Works very well once the initial training is done and is handy for basic mail classification as well.
  • Here's the article (Score:5, Interesting)

    by l0wland ( 463243 ) <l0wlandNO@SPAMyahoo.com> on Monday November 03, 2003 @04:07AM (#7376267) Journal
    Looks like the site is getting /.-ed. So in case it's down, here's the article:

    Spammers Release Virus to Attack Spamhaus.org

    A new virus released by spammers on Saturday 1st November is infecting computers worldwide, and this time the purpose of the virus is to attack www.Spamhaus.org. The W32.Mimail.D virus is the latest in a string of viruses, each one released by spammers for the purpose of creating a vast worldwide zombie network of spam-sending machines and building an attack network consisting of hundreds of thousands of virus-infected zombie machines with which the spammers then attack anti-spam organizations.

    W32.Mimail.D is designed to infect computers worldwide causing them to each begin making overwhelming amounts of bogus requests to Spamhaus.org's web server, www.spamhaus.org, and also attacks the web servers of www.spamcop.net and www.spews.org.

    Spamhaus began coming under massive distributed Denial of Service (dDoS) attacks in July 2003, soon after the release of the SoBig.E virus and the Fizzer virus (W32.HLLW.Fizzer). In June Spamhaus stated that spammers had now moved from simple spamming through open proxies to actually manufacturing and sending out viruses to create a network of spam proxies, infecting hundreds of thousands of mainly home-user machines on broadband (ADSL) lines.

    Fizzer (W32.Fizzer-A) in particular is a very wide-spread worm which spreads by emailing itself to contacts in Microsoft Outlook and Windows address books. The purpose of Fizzer is to install a minature web server and a DoS attack tool, specifically for attacking anti-spam organizations. In August and September 4 anti-spam systems were forced into closure under overwhelming dDoS attacks that hit them for weeks at a time.

    Spamhaus itself was subjected to the same intense dDoS attacks for 3 months but survived thanks to its large distributed network capable of absorbing the attacks. Still, expecting more attacks, and with still no intervention by Law Enforcement, in mid September we moved the Spamhaus web site behind an anti-dDoS device known as iSecure supplied by Melior CyberWarefare Defence (www.ddos.com) and can therefore now withstand the waves of dDoS attacks.

  • I dont think anyone can be that stupid... Uhh.... hmm. Nevermind.
  • Poor grandpa (Score:5, Interesting)

    by aardwolf204 ( 630780 ) on Monday November 03, 2003 @04:11AM (#7376279)
    Recently my cable internet service was suspended. Upon calling tech support I was transfered to the fraud and abuse department, you can imagine the look on my face. The techie told me that my access had been suspended because a computer on my network was infected with the welchia worm. The techie was kind enough to even provide me with the MAC address of the offending machine. I was suprised because my mixed network of 10, linux and windows machines, is kept up to date with the latest security patches. After checking all 10 machines I found that none of them had the mac address supplied by the techie. Upon further investigation of my DHCP logs I found that my WiFi network, SSID free_as_in_beer had its first visitor. I left it open because I believe in free access and wanted to see if anyone interesting would enter the network. Unfortunatly the mysterious computer was not logged in so I could not send a net send message to it, and it seems that the person would connect infrequently. I asked my neighbors and couldnt find the individual so I was forced to employ WEP enchrption. Now I've got chalkings outside my apartment just incase someone with any bit of knowledge wants a free ride, but my point, yes I actually had one, thanks for reading was that I feel bad for grandpa and grandma with their 2000 model compaq connected directly to the cable modem for emailing the grandkids. I was fortunate enough to convince the ISP that my network had been secured and I was granted access again, they on the other hand have few options. Then again this is a good thing for repair guys that make house calls, but between gator (or whatever its called now) and all the other crap out there I think they're busy enough.

    I only wish that I could keep my WiFi up without WEP for my neihgbors or anyone walking by without exposing myself to risk of internet connection termination.

    Have any other slashdotters had similar experiences, or suggestions. Thanks.
    • Sorry for replying for my own post, forgot to add this:

      I found from techtv.com a program for network intrusion detection called Intrusec Expose from www.intrusec.com [intrusec.com]. Its pretty cool software for monitoring your network and can do a lot more than just tell you what computers are connected and altert you when net computers enter the network. It can also scan for services and such.

      No I'm not affiliated with this company and I'm not endorsing this software, I'm actually asking if anyone knows of a free
      • I'm actually asking if anyone knows of a free, OSS or not alternative.

        snort [snort.org] is quite useful on *NIX machines. Quoth FreeBSD's security/snort ports description:

        Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and mu

    • Re:Poor grandpa (Score:5, Interesting)

      by gad_zuki! ( 70830 ) on Monday November 03, 2003 @04:49AM (#7376367)
      >I only wish that I could keep my WiFi up without WEP for my neihgbors or anyone walking by without exposing myself to risk of internet connection termination.

      Print up some business cards with the WEP key. Hand them out to people you trust.

      Control outbound port 25 connections via your firewall. Allow only port 80 from untrusted clients. etc. Its not *that* hard. There are linux distros set to do this using an old 286 if need be. If you want to give it away you will need a robust firewall. Think of it as a digital condom.
  • They are winning (Score:5, Insightful)

    by WindBourne ( 631190 ) on Monday November 03, 2003 @04:14AM (#7376286) Journal
    based on the number of spams that are getting through. It has jumped up again (doubled) in the last 1-2 months.
    The spamers are not desperate. They have simply figured out nice openings and are bulldozing a near infinity lane highway.
  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Monday November 03, 2003 @04:14AM (#7376289)
    Comment removed based on user account deletion
  • by auzy ( 680819 ) on Monday November 03, 2003 @04:19AM (#7376295)
    Well, the guy behind this article is obviously a spammer.. its a really smart idea to slashdot a site which is getting DDOS'ed... Well, I'm wondering what would have been more damage.. the worm or the slashdotting
  • Two part plan (Score:5, Interesting)

    by glassesmonkey ( 684291 ) * on Monday November 03, 2003 @04:20AM (#7376300) Homepage Journal
    Maybe it's a 1-2 punch type approach.
    Step A - release virus to DDoS on blacklist maintainers ...(DNS/blacklist/etc has to be re-routed until virus passes)
    Step B - while blacklists are down, send out massive spam campaign or more virus-type spam
  • by rediguana ( 104664 ) on Monday November 03, 2003 @04:31AM (#7376331)
    I'm being serious here...

    Haven't the authorities shown a propensity for going after malicious software writers, particularly viruses and worms, whilst completely ignoring spam? By writing malicious software, haven't they just attracted a whole lot more attention from law enforcement than they would otherwise have got?

    Good on them I say - I think we could do with more law enforcement attention on these sort of people!

    Of course it doesn't deny the impacts on those being attacked, nor covers the international aspects of spam. But with more countries creating explicit laws to deal with hacking and misuse of computers, the more dodgy spammers might start getting what they deserve - a good ass-pounding in prison!
  • by gad_zuki! ( 70830 ) on Monday November 03, 2003 @04:45AM (#7376356)
    First get a corporate shield, an S-corp can be had for as little as $100 in most states. This will protect your personal assets from a lawsuit.

    Get a bulk mailer and email harvester and sell "Placebon the Herbal Viagra." Get a credit card processing account (or maybe just paypal) from a bank.

    Email a million people.

    Get ~5,000 orders.

    Charge $19.99

    Send them a .40 bottle of vitamin C with a little sticker that says "Placebo you bought from a spammer, dumbass. Cure wait ails ya."

    You profit. They get burned. Everyone wins. For the moral people, think of it as your personal war against scurvy.
  • No good news here (Score:5, Interesting)

    by heironymouscoward ( 683461 ) <heironymouscowar ... m ['hoo' in gap]> on Monday November 03, 2003 @04:55AM (#7376378) Journal
    Anyone who believes that this is the desperate act of a dying species is woefully wrong. Spammers used to be somewhat naive technologically, but the last year or two has seen a consolidation of spammers with virus writers and in essence the battlelines between the "good" and the "bad" users of the Internet have never been so well drawn as now.

    A symptom of all evolving systems, natural or artificial, is that parasites will take advantage of easy opportunities. In nature, this battle has been a fundamental force for evolution and change. I don't see why it should be different in the Internet, which largely behaves like a natural system.

    Here is an analysis of the subject [slashdot.org] by an expert on the matter (oh, it's ME?!). Bottom line: as long as the Internet is built on predictable defined structures (protocols and gateways), it will be heavily parasitized. What we see today is only a warmup. The solution is to find ways of evolving the structures of the Internet faster than the parasites can evolve.

    This problem won't go away through wishful thinking - we need to understand what is actually going on. Heck, this discussion is moot: if my theory is correct, self-modifying defensive systems will happen exactly as the parasites have evolved: because this is what happens in natural systems.

    I just trolled myself. Damn.
    • Re:No good news here (Score:3, Interesting)

      by Reziac ( 43301 )
      [goes off, reads Expert Journal] ;)

      Okay, since parasites also get parasites... how about a parasite that attaches itself to and debilitates spam?

      Seriously, might that be doable/practical?? Obviously there are "vaccination" issues (you can't go invading every user's PC "for their own good") but how would one make such a parasite species-specific, so it would only feed off spammers?

  • by activewire ( 515493 ) on Monday November 03, 2003 @05:02AM (#7376387)
    this virus spreads itself by email a ZIP attachment which contains EXE that must be run, of course its Windows only.

    I would love a way to identify IP address of all idiots who contract this virus, just to be sure my AOL/RoadRunner/Verizon netblock blacklists are complete.
  • Quick to judge (Score:5, Insightful)

    by Jesus IS the Devil ( 317662 ) on Monday November 03, 2003 @05:09AM (#7376399)
    People shouldn't just jump to the conclusion that the perpetrator of this is some commercial spammer. I visit some webmaster forums and many have commplained that some of these sites like SPEWS often go overboard in their blackholing, ending up block innocent bystanders who have a tough time getting out of these blocks.

    I say it could have been the work of some pissed-off admins who were frustrated.
    • Re:Quick to judge (Score:3, Insightful)

      by Indy1 ( 99447 )
      if an admin did this, then he's a complete dumbass that fails to understand the purpose and reason behind spews and the other blacklists. If some spam friendly isp REFUSES to kick their spammers off, like att, c&w, exodus, qwest, cogent, internap, burst, etc etc etc, then they should expect to be heavily blacklisted. And if an admin (btw: i am a network admin myself) is DUMB enough to host with a known spam haus, then he or she shouldnt be surprised when their mail gets bounced with a flurry of 550's.
      • Re:Quick to judge (Score:5, Interesting)

        by melonman ( 608440 ) on Monday November 03, 2003 @05:54AM (#7376498) Journal

        I don't like spam, but I have to admit that the thought of someone seriously inconveniencing SPEWS doesn't upset me too much.

        Our server ended up on their blacklist despite never having sent a spam, because someone else in the 16-bit IP range had. 16 bits, that's up to 65K machines with maybe half a million users...

        Our machine is in a server park. Of course spammers operate from such places. The SPEWS argument that you block thousands of innocent users to get at one guilty one is just plain immoral, and, at least in my case, has the effect of making me opposed to any centralised anti-spam measures, whereas previously I would have been favourable.

        If it ever happens again, I'll buy myself a clean SMTP server, or find another solution, but the one thing I'm never going to do is contact my ISP (who, incidentally, enforces a strict anti-spam policy), because I object on principle to being dictated to by people who treat my company's reputation as 'collateral damage' as part of their quixotic campaign.

        As for the 'change ISP every three weeks' advice, that just isn't a viable option when you have a few dozen domains, many of them interacting with third party mail filtering, Exchange servers etc.

        If SPEWS dropped that one policy of punishing the innocent in an attempt to get at the guilty, it would have my support. Until then, I expect SPEWS to continue to alienate the people who should be on the anti-spam campaign's side.

        • Re:Quick to judge (Score:5, Interesting)

          by Indy1 ( 99447 ) on Monday November 03, 2003 @06:21AM (#7376559)
          more then likely, your hosting service refused to act on spam complaints, and spews kept escalating the listing untill the whole /16 got nuked (would you indulge my curiousity and tell me what /16 your on? I'm willing to bet its a major spam haus). Spews wasnt trying to get that one spammer only, its trying to beat some sense into your hosting service by bitch slapping them. You are collatoral damage.

          Changing isps every 3 weeks isnt viable, but when you pick isps in the first place, do you homework.
          Pick a good one once, and your very unlikely to ever have to worry about Spews. The reason why Spews is a problem for you is because a LOT of mail admins including me use it. Spews itself IS NOT your problem, its your isp thats the problem for refusing to deal with spammers on their network. We collectively have decided that when a major isp refuses to deal with their spam problem, that we'll refuse to deal with them. And your caught in the middle.

          Hypothetically, if Spews ever died, you'd have far worse problems. Why? For example, I HEAVILY firewall off large isps that have major spam problems, you should see my ruleset for blocking. Not counting the geographic bans, its at 944 entries, and each entry drops a /24 at a minimun, with most entries taking out a /16 to /20. And I know i am not the only one doing this.

          Now imagine your isp starts harboring a spam gang (ala Verio or C&W) and blatantly lies and refuses to get rid of the spammers despite all complaints. This quickly gets noticed in NANAE, and mail admins will start dropping that entire hosting service into their deny lists and firewalls. Good luck EVER getting out of 1000's of firewalls and deny lists. At least you can get off Spews if your isp cleans up.

          • Re:Quick to judge (Score:5, Insightful)

            by AKnightCowboy ( 608632 ) on Monday November 03, 2003 @07:50AM (#7376793)
            For example, I HEAVILY firewall off large isps that have major spam problems, you should see my ruleset for blocking. Not counting the geographic bans, its at 944 entries, and each entry drops a /24 at a minimun, with most entries taking out a /16 to /20. And I know i am not the only one doing this.

            Unless you're running the firewall for AOL, Earthlink, MSN, or Yahoo I really doubt Verio or C&W gives a shit if you just fell off the face of the earth completely, much less blocked a couple of their networks. If you did work for such a large company you wouldn't be blacklisting like that for long as you'd lose your job.

        • by frankie ( 91710 ) on Monday November 03, 2003 @09:54AM (#7377388) Journal
          despite never having sent a spam, because someone else in the 16-bit IP range had.
          [...]
          my ISP (who, incidentally, enforces a strict anti-spam policy)

          These two statements are mutually contradictory. But first, a reminder that SPEWS is not Not NOT representative of mainstream anti-spam blocklist providers. Both SpamCop and SpamHaus use narrow targeted blocklists. Furthermore, the real responsibility for your blocked email lies with the recipient postmaster who chose to use the SPEWS list. Their server, their rules. You could call them and ask to be whitelisted.

          According to best evidence, SPEWS always starts with an abuse complaint email and a /32 blocklisting. If further spam arrives at their address(es?) the listing expands to /28, /24, etc, until either the spammers are removed or the entire ISP is listed. In order to reach /16, your ISP must have ignored SPEWS and retained its spammers for a long Long LONG time.

  • by MAFIAA ( 683655 ) on Monday November 03, 2003 @05:15AM (#7376414)
    What beggars belief more is that a corp with the near-infinite resources of Microsoft still gives people a near-perfect vector for virus distribution. I'm sure if any one of us had 40Bn cash and 8 years (is that how old LookOut Express is now?) we could either code or hire programmers to code an email client that wasnt broken.

    Of course.. if they ever mended LookOut the AV guys would go out of business overnight but that's a whole new consipracy theory involving large cash backhanders and deliberately broken coding there... :o)
    • Of course.. if they ever mended LookOut the AV guys would go out of business overnight but that's a whole new consipracy theory involving large cash backhanders and deliberately broken coding there... :o)

      The newest versions of Outlook have been fixed. They no longer auto-run scripts, etc. But it is pretty hard to protect against stupid users who will open .exe's from just about anyone. Though I have heard Outlook can now be configured to just plain reject emails with any sort of script/executable attachm
  • by TheWanderingHermit ( 513872 ) on Monday November 03, 2003 @05:36AM (#7376456)
    If spammers are really behind these virii, and we're able to verify it, then it is probably that even the blind and computer-ignorant gov. offices, like FBI, or whoever, will eventually get the same info others have.

    Whereas before their only offense was spam (which is gradually being outlawed), now they have done something for which people have been indicted and sent to jail for.

    Spammers are evil -- we all know that -- and this just means the gov. (if they're awake) will finally have a tool to put the worst of them in jail once they can prove who's spacking and creating anti-anti-spam virii.
    • If spammers are really behind these virii, and we're able to verify it, then it is probably that even the blind and computer-ignorant gov. offices, like FBI, or whoever, will eventually get the same info others have.

      You would think so wouldn't you?

      The problem is spammers have been breaking federal laws since the beginning of the Internet. Hijacking a mail relay has never been legal -- it's a felony. Ever heard of anyone getting jail time for a flood ping even though it is illegal?

      It's interesting. You
  • Bayesian filtering (Score:5, Interesting)

    by dido ( 9125 ) <dido AT imperium DOT ph> on Monday November 03, 2003 @05:38AM (#7376458)

    I've been using SpamAssassin's Bayesian filtering features to get rid of my spam for good. I've turned off SpamAssassin's use of any of the antispam sites like spamhaus, spews, and spamcop, mainly because some of them have been foolish enough to sweep such a wide net that turning on use of these sites causes SpamAssassin to filter legitimate mail that comes from my own domain! (that's what I get for living in a country whose ccTLD is run by a brain-damaged registrar...) I've been running almost totally on Bayesian filters after having trained them carefully for a month, and have thus far had zero false positives and false negatives. I mainly keep the spam around to further strengthen the training of my filters and for occasional entertainment value. Those Nigerian scams can be really funny sometimes, you know. :)

    These blacklists could go away tomorrow and my Bayesian filters will only keep getting better and better at weeding out the spam. In my experience, these antispam sites are actually more part of the problem than the solution, because they filter more mail than they should.

    • by Indy1 ( 99447 ) on Monday November 03, 2003 @06:09AM (#7376523)
      and the spammers will continue to waste your network bandwidth and resources. Content based filtering is
      a inperfect solution at best, and one that does NOTHING to discourage the spammers. Only heavy blocking of spam friendly countries and isps seems to do much to discourage more spam.
  • Slashdot will.

    There are few things I can think of more Homer-Simpson-ish than post a slashdot link to certains sites to tell the world they are being DoSed.
  • Spam Prevention (Score:3, Informative)

    by cagle_.25 ( 715952 ) on Monday November 03, 2003 @09:54AM (#7377384) Journal
    This is slightly offtopic, but I've been turning over an anti-spam scheme in my mind for a while. What if ...

    you are required to pay a small escrow fee as part of your ISP service fee, AND

    if someone receives and e-mail from you and deems it as spam, then he clicks the appropriate button, AND

    your escrow fee is charged *once per e-mail* and his is increased by the same amount.

    The balance of the escrow fee would be refundable at any time, but accounts with a balance of 0 would be unable to send e-mails.

    As I think through this, I can see several virtues:
    1. The senders of spam would have to pay per offensive e-mail and would thus have strong incentive to stop.
    2. Senders of legit e-mail would continue to have free or mostly free e-mail.
    3. Those affected by spam would have immediate recourse and receive compensation for their time.
    4. The spirit of the plan seems right: if you are going to waste my time with your spam, then you pay me for it. But if you are a friend, you get my time for free.

    Does anyone see drawbacks to this plan? Perhaps increase in net traffic per e-mail sent, but that would presumably be offset by a substantial decrease in spam.

    • Re:Spam Prevention (Score:3, Insightful)

      by Zed2K ( 313037 )
      "Does anyone see drawbacks to this plan?"

      Basically its the same theory as warning someone in AOL-IM. Their warn level gets high enough they can't send messages until it drops some. The problem is people get into "warning wars". How high can I make a friends warn level to piss him off.

      For spam who is going to be the judge to determine if its spam or not? I consider all the stupid jokes I get from people spam so I should hit them and make them pay for it. What if I piss someone off so they decide to re
  • by Erik Hensema ( 12898 ) on Monday November 03, 2003 @10:36AM (#7377602) Homepage

    But not whitelisting as we know it.

    Think about it: most spam comes from cable and adsl connected machines. dynablock.easynet.nl is trying to block each and every dynamic IP on earth, effectively making it a whitelist of static and therefore blockable IP's.

    One could even take this one step further: blacklist the entire internet and whitelist known mailservers. Getting out of that should be easy, but no so easy that a spammer could do it automatically. And when you're spamming from a whitelisted IP, the IP is blacklisted again for, say, 1 week. Then it can be whitelisted again, but when you're spamming again, then it's blacklisted for a month.

    The hard part of such a whitelist is: where do you start? I think it would be sensible to start out by simply tagging mail originating from blacklisted IP's. Early adopters can then whitelist each and every IP they expect mail from. After a while a sufficiently small amount of mail will be tagged by the blacklist, so it can be used to start blocking with it.

    If we only could convince each and every postmater on earth to use such a system, it could be very, very useful.

    Meanwhile, please use Dynablocker [easynet.nl]. It can really help making h4x0red boxes useless as a spam source.

  • by Moblaster ( 521614 ) on Monday November 03, 2003 @11:58AM (#7378294)
    Spammers spend a tremendous amount of time and energy cracking systems, setting up zombies, getting around barriers of all sorts. The reason why is because they have a financial incentive to do so.

    If security through obscurity is an intellectually bankrupt concept, then the spam industry innovates security knowledge like no other.

    The fact is that spammers not only save work for the script kiddies, they help the NSA, CIA, FBI, KGB... as well as IBM, MSFT, SYMC...

    Think of them as parasites that feed off our collective ignorance, and you'll see what a useful cleansing function they serve in the greater ecosystem.
  • by msimm ( 580077 ) on Monday November 03, 2003 @12:23PM (#7378502) Homepage
    They where a great free email service ('whitelist') similar to the TMDA system [tmda.net].

    I see quite a few posts suggesting that spammers are getting desperate, but brazen seems more appropriate. They are shutting down some of our most effective anti-spam tools and there seems nothing we can do about it. To me that looks more like their winning.

We all live in a state of ambitious poverty. -- Decimus Junius Juvenalis

Working...