Wham! Bam! No More Spam?

newsguy 0 Tallied Votes 551 Views Share

What a difference a day makes. In the 12 hours following the take down of McColo Corp, a web hosting service that stands accused of being responsible for enabling as much as 75 percent of the world's email spam, the volume of said junk mail recorded by specialists at MessageLabs dropped to eight times less than average.

The bad news is that levels started to rise again after that, an almost inevitable consequence of the free market economy that exists within the criminal underground. Knock one player off the top of the tree and others rise up to replace it. This happens all the time.

Matt Sergeant, Senior Anti-Spam Technologist at MessageLabs, still thinks that attacking a spam kingpin can have a dramatic effect. He told me that "First with Atrivo and now the demise of McColo is a testament to how community action is absolutely vital in the fight against spam."

In this case that community action came courtesy of the Washington Post which investigated McColo for four months prior to the outfit having connectivity pulled by two US-based ISPs as a result of its findings.

Hopefully this will, at the very least, come as a wake up call to ISPs and web hosts alike that they are under scrutiny from all angles. That allowing customers to get away with herding botnets is not acceptable and action will be taken. Peering companies cannot simply pretend that what customers do is nothing to do with them. Now that the Internet community has woken up to the problem, and establishment outlets such as major newspapers are taking an interest, perhaps the authorities will start taking things a little more seriously as well.

Of course, it will not destroy the spam problem, not when all a big spam outfit needs is sent to make a profit. It might make a big dent though, and that has got to be worth fighting for.

Now we just need to do something about those link clicking twits who buy stuff from spam, and unfortunately there are it would appear.

Dani AI

Generated

As notes, taking down a major spam-friendly host can produce a dramatic, short-term drop in junk mail — but it rarely fixes the problem permanently. Real, lasting reduction comes from operational changes across the chain: ISPs and transit providers, hosting operators, mail server admins and end users all need to make spamming more expensive and detection faster. The notes below give practical steps each group can use right now.

  • For ISPs and hosting providers: enforce anti-spoofing (egress filtering / BCP38), require and verify abuse contact procedures, block or throttle outbound SMTP from customer address space (unless using an authenticated relay), log and alert on unusual SMTP volumes, and apply fast suspension policies for confirmed abuse.
  • For network operators and peers: share indicators of compromise (IPs, domains, samples) with upstream/downstream peers and CERTs, and use sinkholing or RPZ when lawfully permitted to disrupt command-and-control and payload distribution.

For small orgs and server admins: lock down who can send on port 25 and force use of your authenticated relay; implement SPF, DKIM and DMARC; use RBLs/greylisting and per-client connection/message rate limits; keep OS and endpoint AV updated and scan for bots. A simple gateway firewall example (adapt IPs to your network, test before applying):

# allow your authorized mail gateway
iptables -I FORWARD -s 10.0.0.5 -p tcp --dport 25 -j ACCEPT
# block other LAN hosts from sending outbound SMTP directly
iptables -A FORWARD -s 10.0.0.0/24 -p tcp --dport 25 -j REJECT

Caveat: tailor rules to your topology and document any changes. Above all, combine takedowns with continuous monitoring, fast abuse handling, customer remediation (patch/clean infected hosts), and cross-industry cooperation — that combination is what turns a temporary win into durable progress.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.