Auto-Responders Should be Illegal

A few years back it made sense. If your email gateway scanned incoming messages and determined one to have a virus it seemed like it was the courteous thing to do to just quickly send a reply to the Sender and let them know that the message was infected and what it was infected with. Why not?

But, such auto-responding to infected emails at this point should be illegal. Companies and entities that still auto-repond to virus infected messages should be fined for the bandwidth they are wasting and for contributing to the problem rather than helping it.

All network and security administrators should know by now that MOST new viruses contain the ability to spoof the From or Sender of the email message and that there is virtually NO chance of the auto-response getting to the actual virus originator.

This latest Sobig virus has had double or triple the impact it should have because misguided administrators haven't turned off auto-responders. Until or unless they can find another way to respond- looking at the packet headers for some other information besides the Sender or From information which is so easily forged.

It is a little exasparating and soemone should mandate that auto-responders are simply not allowed anymore or something.

Yep,

The number of users here who phoned and said "I have a virus alert for this e-mail that I ddn't even send"

A lot of the auto responding is comeing form email antivirus solutions. Those should know which virus spoofs headers in the sig for the virus, I think this one lands on the AV companies for haveing stupid autoresponders...common guys put some brains in them.

Totally Agree!!

Tony: Thanks for the reminder.......

My domains typically receive 10-20 infected mails per day so it hasn't been a big deal..... Last night alone I received over 300.......

The autoresponder to the sender is being switched off right now.

Thanks again.

People are stupid.
A group of people is a group of idiots.

How can we prevent this from happening?
Teach home end users *nix.
Teach home end users that updates are there for a reason.
Teach home end users common sense.

Okay, maybe the last thought to teach common sense is too much to ask for, but would it be that hard for people to just stop being completely ignorant? Computer common sense is not too much to ask for. If you know absolutely nothing about computers, than learn before you use them. You don't go buy an ak-47 and start hunting sea gulls with it without first learning how to hunt, what to hunt, where to hunt, and that you are using too big of a gun to legally do anything.

It's not even funny any more when you hear things such as the DMV was taken down by a worm that exploits a hole patched over a month ago. If people are that ignorant of computers, than stay off of them until you learn; and don't administerate them either. I really wonder who is the ******* admin, and what his excuse is in MaryLand, that he hasn't updated any of the computers in over a month, didn't have a firewall up, at least a good one, and was still using windows boxes for an important government service.

Entropy: Gimme a break with your "*nix is better than Windows" flame.....

NEWSFLASH: The OS is only as good as the Admin...... Period!!!!!!!!

I just received this from a sysadmin that we provide Internet Access, email, web hosting and Security for:-

Quote:

---

I just wanted to say thanks for whatever you have done to protect us from the email viruses. I have people paying me to come to their homes and clean their machines, between the worm and the email viruses – it is truly crazy !!

I have many IT friends who are doing major disaster recovery on their networks with some users getting hit over 1000 times a day.

I know you have a ‘thankless’ job – so I just wanted to say “THANKS”!

Penny

---

This is a 650 user, Windows only network that has remained untouched by "evil hands" for the seven years it has been publicly available and has had only three minor virus outbreaks in 10 years usually caused by no patch/sig being available by the time we received it........ That's a very acceptable record with all those dumb users..........

Frankly- if all of the home users started using *NIx you would start seeing viruses and worms that exploit *Nix.

Malicious code is written for the most target rich environment. There is CERTAINLY no shortage of flaws and vulnerabilities in *Nix machines. If a good percentage of the home user market adopted *Nix they would be easy targets for a worm or virus just like they are now.

I agree with Tiger Shark- its not the OS, its the competency of the admin. I also agree though that users should not be operating computers on the Internet without SOME level of education about how to do so safely. We don't let people operate vehicles on the highway without learning to do so safely and we shouldn't just let any Joe Blow jump on the Internet with his unpatched and unprotected system- Windows or *Nix.

We block a lot of these types of messages at our internet firewalls. We also block all outbound NDRs. Which in some cases makes it difficult to know that things were not delivered, but we noticed that spammers were sending targetted messages into our environment to try and verify mail lists. Blocking NDRs pretty much effectively blocks this from occuring. We only block outbound NDRs. Another really annoying thing about emails is hosts that restricts mailboxes from receiving new items and are not smart enough to only send the NDR once. I have seen cases where a full mailbox has caused mail storms between companies.

tonybradley,

I totally agreee with you man,,,,,,

"We don't let people operate vehicles on the highway without learning to do so safely and we shouldn't just let any Joe Blow jump on the Internet with his unpatched and unprotected system- Windows or *Nix."

I think some people are definitely lacking in the common sense department, particularly those who have a home computer to use but aren't enthusiasts. Most people I know laugh at me because I'm regularly scanning my pc for viruses, updating my definitions and setting up my firewall etc. But quite a telling statistic - only 3 of my friends have either a pc or a laptop, and of those 3 people none of them have any antivirus/firewall software. 2 of them now have the lovsan virus and are complaining about how they can't get on the net.

You can lead a horse to water.....

I don't really think that drivers license vs. computer license is really a good analogy. Letting somebody drive a vehicle without knowing how to can be a direct cause of death to that person or others. Somebody being stupid about computers at most causes a headache to network administrators. If anybody can 100% link a death to a computer virus, I'll change my stance.

I think that linking acceptance of the analogy to death is an extreme position.

It doesn't need to be death per se. I suppose that if someone drives through a red light there is a high likelihood someone could die, but the analogy works still in my opinion.

People think that they can use their computer on the Internet just like they turn on their TV, VCR or microwave. They have no knowledge of what vulnerabilities await them or how their actions affect others.

Just like I don't want some moron to turn left on a red light and cause an accident that shuts down traffic in all 4 directions making my trip take 4 hours instead of 4 minutes- I also don't want some moron to be allowed on the Internet with an unpatched system that partakes in some denial-of-service that makes my web surfing take 4 hours instead of 4 milliseconds.

If someone wants to be ignorant of common courtesy and safety while driving up and down their driveway that is their prerogative. Likewise, if someone wants to be ignorant of common courtesy and safety while playing on their standalone PC in their basement that is their prerogative. But, once you take your car on the road or your PC on the Internet you are sharing with millions of other people who are impacted by your ignorance. At that point it is no longer aceptable for you to claim ignorance. Learn how to do it right or don't get on the Internet.

It is exceptionally selfish and irresponsible to remain ignorant and impact hundreds, thousands or even millions of other users because you couldn't be bothered to take the time to secure and protect your system first.

Just my $.02

People should be force to take and pass computer class before buying a computer! I totally agree with tonybradley. Car and Computer are related... If you don't know how to drive a car, you're dangerous to other people’s life... If you don't know how to keep your PC secure, you're dangerous to other people’s personal data and more.

Regulation is NEED! Ok... I'm WAY to extremis here but something need to be do!

Quote:

---

If anybody can 100% link a death to a computer virus, I'll change my stance.

---

you could take this to an exteme - if a computer virus managed to infect say a power system and caused a wide spread outage it could infact kill people who depend upon life support machines etc to live. Now I know what people will counter wife "Hospitals have back-up generaters to deal with such things" yes most do but what about those people recieving in home care? The vast majority of them will not have any kind of back-up electricity system and if the main power grid failed they could very possibly die! Not as likly as someone gettin knocked over etc on the roads but as I said this is taking it to the extreme.

v_Ln

It's all very well and good saying that auto-responders should be illegal (and I happen to agree that some action should be taken to at the very least limit their use), but how on earth do you enforce it? Apart from barring all emails from networks that use autoresponders until they change their attitudes (e.g. by adding them to one of the blackhole spam lists), such a proposal is unenforceable.

As with most things on the internet, it's down to individual administrators to comply, and there's not a lot we can do to force them to disable auto-responders, just as there's not much we can do to stop sick people hosting child porn (sure, the police do try and crack down on paedophiles, especially in the UK, but there's no way to outlaw such sites globally, otherwise very few of them would exist).

I agree that home users should be more vigilant in updating their systems, but you can't just blame them. A lot of users (particularly here in the UK) are still on dial-up connections - you try downloading the latest Windows 2000 service pack on a 56kb/s modem. Okay, so virus updates may not take quite as long, but with the amount of updates Microsoft releases (and Linux, Unix etc. - MS is not alone in this department), it's not feasible for most users (especially those without internet access) to keep their systems up-to-date. I check windowsupdate.com most weeks, and nearly every time there's a critical patch waiting for me to download, and that's not including any patches to prevent specific viruses (such as MSBlast). Fortunately, I have a broadband connection, so a 20+mb update isn't a problem to download, but for other people it's just not possible.

There's not much, apart from education, that can be done to prevent clueless home users from contracting any virus, particularly those which email themselves to everyone in your address book. The problem is that those security-aware users who do update their systems are the ones who are least likely to execute unknown attachments.

Billy Gates with his nose stuck so far up his future ideals, his coders forget the average joe.. thinks differently..

Quote:

---

Customer: This printer I just purchased won't print..
und3rtak3r: Are the cables connected as per the instructions?
Customer: Yes
und3rtak3r: And the drivers installed from the CD?
Customer: what CD?

---

I won't post my form Antivirus quotes.. but this is the level that we are facing when it comes to a computer systems security.. the same ones who have no problems with forwarding Chain-emails to 20 or more friends...yetch

Cheers

Quote:

---

you try downloading the latest Windows 2000 service pack on a 56kb/s modem

---

Good point. I often forget that. I have had DSL / Cable at home for so long I forget that the majority of home users still use dial-up.

I just ahd to deal with an outbreak of SQLSlammer again. Someone had installed a 3rd-party application which included a vulnerable version of MSDE. The SP2 patch (called "deskfull") for this is 340+ Megabytes. Even broadband users would shy away from applying such an "update" and for dial-up users you may as well tell them that they need to put wings on their computer and make it fly around the living room.

Conversely to my stance that users should be required to get educated (although I still support that stance) there should also be a requirement that if an "update" exceeds a certain size or percentage of the size of the original program, the vendor should have to re-issue the entire program for free on CD's to all customers. When the update is bigger than the program its no longer an update- its a new version.

But- I definitely agree that dial-up 56k (translation = 20k on a good day) connections downloading and applying updates is virtually impossible. The updates need to be less than 1Mb each to keep it feasible.

tb: I agree that vendors should have to issue updates over a certain size to their customers for free (you can get Windows 2000 SP4 on disk, but you pay for this and it's only available in America - where Cable/DSL is much more prevelant than over here in the UK).

With dial-up, 3Kilobytes/sec is an average download rate, if you get above 4KB/s then you're doing well. The problem is than the stated speed (56Kb/s) is in bits, not bytes, so you divide that by 8 to get the speed in bytes, and then half that because you'll never get maximum throughput. The slow speed, especially for updates, is one of my main reasons for switching to broadband.

I've downloaded 300+mb files using broadband (the Neverwinter Nights demo weighed in at nearly 400mb!) but it does take a long time (several hours if I go away and leave my computer downloading) and, as you said, dial up users can forget it (in fact, anything over 6Mb is usually too much for dial-up).

yes rightly said, the email providers have to think about it right now...........

well anyhow educating the end user about the other side of the technology they are using is the only ultimate solution left...but will the end users take such a pain on their behalf????

Some email providers have started providiing virus scanning facilities on clients mailboxes. Probably a good idea cos the average user will be protected a little more than usual with this. of course they charge for this facility but if at least some people take up this it wil help to reduce the infections.

ultimately all users should be protecting themselves but its quite difficult as one of them said of trying to keep updated thru a 56k modem. what with the large number and sizes of updates, virus definitions....... even with advanced users, it wastes a lot of time keeping up to date on all this.

autoresponse should definitely be disabled and i guess most administrators have done that as we have in my office. there are of course a few out there who havent but i guess they just have to educated. it usually takes time for this to flow down to the less informed admins.

one other problem with the updates is that where i am we are understaffed what with all the cost cutting measures they have taken. they expect 1 person to do the job of 3. and still do it at the same level as before. keeping all the systems updated and getting on with your regular work almost means u live in the office.