Re: ISP port blocking practice

[Jon Lewis <jlewis () lewis org>]

On Sun, 5 Sep 2010, Claudio Lapidus wrote:

> > If I block port 25 on my network, no spam will originate from it.
> > (probablly) The spammers will move on to a network that doesn't block their
> > crap.  As long as there are such open networks, spam will be rampant.  If,
> > overnight, every network filtered port 25, spam would all but disappear.
> >  But spam would not completely disappear -- it would just be coming from
> > known mailservers :-)  thus enters outbound scanning and the frustrated user
> > complaints from poorly tuned systems...
>
> That won't be probably the case. Here recently we conducted a rather
> comprehensive analysis on dns activity from subscribers, and we've
> found that in IP ranges that already have outgoing 25 blocked we were
> still getting complaints about originating spam. It turned out that
> the bots also know how to send through webmail, so port 25 blocking
> renders ineffective there.

Anti-spam is a never ending arms race.  Originally, the default config 
for most SMTP servers was to relay for anyone.  10 years ago, sending spam 
through open SMTP relays was quite common.   Eventually, the default 
changed, nearly all SMTP relays now restrict access by either client IP or 
password authentication, and the spammers adapted to open proxies.  Today, 
nobody in their right mind sets up an open HTTP proxy, because if they do, 
it'll be found and abused by spammers in no time.  These too have mostly 
been eliminated, so the spammers had to adapt again, this time to botted 
end user systems.

Getting rid of the vast majority of open relays and open proxies didn't 
solve the spam problem, but there'd be more ways to send spam if those 
methods were still generally available.  The idea that doing away with 
open relays and proxies was ineffective, so we may as well not have done 
and should go back to deploying open relays and open proxies it is silly.

With all the different webmail systems, it seems unlikely to me (though I 
definitely wouldn't say impossible) that bots are spamming through your 
webmail (unless you work for gmail, hotmail, etc. and are an attractive 
enough target that it made sense to code a bot to automate utilizing your 
webmail interface).  Bots being used as proxies seems far more likely to 
me for the general case of "bots" spamming through an ISP's webmail.

----------------------------------------------------------------------
 Jon Lewis, MCP :)           |  I route
 Senior Network Engineer     |  therefore you are
 Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________