Email Blacklisting

I agree nihil .... it's easy to lose sight of who the real criminals are. Someone who forgets to lock their car door may be careless and unwise, but the person who comes along and steals the car has committed the offence.

It's the same attitude you see with road accidents, ie "that dangerous single carriageway A1". Well, it's not the road that causes the accidents it's the drivers on it and while you can do your best to improve the road, at the end of the day the accountability is with the road user. If a road isn't safe then you drive at a sensible speed and you don't overtake or get too close to the car in front. You set off in plenty of time so you don't get frustrated if you're stuck behind a wagon limited to 40 mph.

Sorry, this thread's now gone off at yet another tangent! :D

Actually, I'n not sure this thread has gone off track... Some hard issues have risen from this that are pertenant to the current anti-spam stage. My original message addresses one facet. However the underlting theme has emerged quite strongly: Who are the real victims?

Who do we go after?

1. Corporations or for that matter any business, large or small should obviouly know what they are doing.

2. Any spam friendly ISP. Lets be honest, there are simply too damned many of these out there that are there just for a quick buck.

3. Any business telling consumers they are not at risk and they don't need an antivirus/spam package.

4. Any business that does not respond quickly to customer complaints about spam/viruses.

I'm sure there are others... But this is a good start.

It is very true that there are no internation laws governing spam, bust just about every country on the planet has some sort of law for its citizens. There is also the final line of the Internet - IANA. They have the authority and power to shutdown a block of IP addresses and take out any ISP/Business that allows illegal activity.

Given the context of this thread, who are the real victims? Wheather by RBL, Country blacklists, methods that may exist now or to come, the real victims are the very people we are trying to protect, the basic uneducated computer user.

This now brings us to the crux of the issue: How do we put an end to the spambots, phishing scams, and the like?

Official Fact: The world's largest spam infested country is The United States of America, which also has the weakest antispam laws in the world. This fact is based upon tabulations of IP addresses listed by origin from RBLs, ISPs, various antispam companies and end users reporting spam.

We can't change the world, but we should at least be able to fix our own backyard!

Quote:

---

Originally Posted by frpeter

We can't change the world, but we should at least be able to fix our own backyard!

---

Well said!

Quote:

---

Originally Posted by frpeter

1. Corporations or for that matter any business, large or small should obviouly know what they are doing.

2. Any spam friendly ISP. Lets be honest, there are simply too damned many of these out there that are there just for a quick buck.

3. Any business telling consumers they are not at risk and they don't need an antivirus/spam package.

4. Any business that does not respond quickly to customer complaints about spam/viruses.

I'm sure there are others... But this is a good start.

---

To #1 you should add "Institutions" such as schools, colleges, healthcare and non-profits. These are the weakest link, as their funding encourages them not to invest in the right quantity and quality of staff.

My suggestion for these is they should form groupings and employ a central IT security consultancy. In this country we have "Regional Health Authorities" and "Local Education Authorities" which would be a convenient administrative grouping that is already set up.

Small businesses could possibly use their trade associations or local Chamber of Commerce? Maybe even local government could provide it as a service.

My thinking is that by consolidating funding you would reduce individual cost burdens, and finance a much more professional and effective operation?

#2 I cannot really comment on this one as we don't have that many ISPs over here. I do believe that ISPs should accept more responsibility for internet security rather than their "Pontius Pilate" attitude of washing their hands of it.

#3 I find this one difficult, as there are those who would argue that these products are always one step behind. I would make it a legal requirement that any retail sale of a PC should include a government approved "security manual" which would advise the end user on security matters and "safe computing".

#4 I am not sure what you mean by this? I know for a fact that most home users have never even heard of a spoofed IP address or know how to read an e-mail header :D They certainly should not respond to the spam e-mail, as that merely confirms them as a target.

I feel that this is a Federal government duty. Like determine who will benefit if the spam offer is taken up, and go after them. Even to the extent of using the IRS.................... a thorough tax audit generally gets the message across............ and I very much doubt if the scum involved have filed returns that would bear close scrutiny :cool:

Just a few thoughts :)

Quote:

---

Originally Posted by nihil

#4 I am not sure what you mean by this? I know for a fact that most home users have never even heard of a spoofed IP address or know how to read an e-mail header :D They certainly should not respond to the spam e-mail, as that merely confirms them as a target.

---

Perhaps this is best described with an example. I had a flood of spam hit my server Sunday night. When I filed a complaint at the proper abuse address, I got a message back that the abuse addresses doesn't exist. This qualifies as a non-responsive business. I have also received errors back that my complaint was spam and (one of my favorites for stupidity) the abuse address doesn't handle abuse complaints.

As far as I am aware you run a Whois? and it will tell you the ISP to whom you report the abuse.

If you get the sort of responses you are getting, these should be from the ISP not their customer, which is what I understood you to mean by "business" Sorry if I misread you, but I thought you had that covered in #2 which I understood to cover rogue ISPs.

Surely this brings another "usual suspect" into the equation.......... the Domain Registrars, who issue the address blocks to the ISPs?

A possible solution here is for some sort of regular testing of the abuse addresses? If the response is as you have described then the address block should be banned.

If the Domain Registrars will not accept this responsibility then their authority to assign address blocks should be rescinded.

IANA are not doing their job properly, are they? and we seem to have identified two more "Pontius Pilates" :cool:

BTW, I agree that this thread has become a lot more interesting since its scope has broadened.

:)

Trouble is, a whois will sometimes only give you a block of dynamic addresses. It doesn't always even pinpoint the country - my own location comes up as the US, which isn't correct.

Quote:

---

BTW, I agree that this thread has become a lot more interesting since its scope has broadened.

---

Good :) I was a bit worried about leading it off topic!

Moira,

Please take a look at this site: http://www.dnsstuff.com in the middle column there is an option to get IP information.

The trouble with a lot of IP geographic locators is that they are frequently based on data that is now very obsolete. The one on the front page of AO is based on data that hasn't been maintained for three years or so :)

The problem is that IP address blocks keep getting reallocated so the location tables need to be maintained on a very regular basis. I believe, however that there are subscription services that are pretty accurate (say 95%).

I don't think that the Whois? giving you a block of dynamic IP addresses is a particular problem. It should give you the report abuse contact, and they will naturally require evidence that contains time and date information?

The real question to me, is whether they actually do anything about it?

frpeter seems to be encountering situations where the Whois? abuse data is incorrect, suggesting a dubious registration.

nihil no, from personal experience they don't do anything about abuse reports.

A whois on myself:

Location: United States [City: Reston, Virginia]

Just a bit out :)

Hi Moira,

Let me make a wild guess..................your ISP is AOL?

They have a rather strange architecture, and yes, you may appear to be in the USA, I believe that Whois? shows you their headquarters or something. ;)

They can trace back with the right information though.

:)