Subject: [Asrg] Re: Zombie armies...

From: Jim Witte <[email-masked]>
Date: Thu, 13 May 2004 15:09:49 -0500

> Nothing but action by the providers hosting the zombie armies will stop

   What about getting MS to close the holes that allow the 'Zombie 
armies' to be turned into zombies in the first place?  Of course, after 
reading about all the variants of the "CoolWebSearch worm" and the 
various dll and css sheets it puts various places - I think that may be 
hopeless, short of MS just rewriting Windows from the bottom up, with 
security and *user notification* in mind (NOTHING should be able to 
change the default CSS sheet, or put something into my TCP/IP stack 
(Windock LSP)  without my knowledge)

Jim

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Witte <[email-masked]>
Date: Thu, 13 May 2004 15:05:52 -0500

> they're mostly not going to do anything until it costs them more not 
> to act than to act.

   What if one could somehow bring the router manufacturers interested?  
If any spam solution is to really work, it should dramatically decrease 
the amount of Internet traffic flying through the routers, and 
conversely, increase the amount of capacity for legitimate applications 
(whatever those may be - anything but spam..)  If they could make that 
case to ISPs, business, governments (?), and possibly even end-users 
that some combination of legislation and technical change could 
dramatically increase the speed and efficiency of the internet, it 
could have some effect.  What effect, I'm not sure.  But talking about 
the "costs of spam" (other than e-postage, which has been roundly 
criticized here), one very real cost is on infrastructure.

   Of course, it's not clear how much end-ISP users will really care 
about this as long as high-speed DSL in the US is not widely in use 
(last mile is the limiting factor - I'm comparing "high-speed" with 
places like Singapore, where I've heard they have something like 10Mbps 
connections for half the population for prices comparable to dial-up in 
the US).  But businesses and universities (with fat pipes), ISP's (who 
have to run mail servers and deal with all this crap coming off the 
backbone), research institutions (those that aren't using Abilene which 
isn't affected by spam as far as I know) *might* just care about such 
an argument.  Although, the "this will reduce your bandwidth and 
infrastructure costs" argument is possibly contrary to the financial 
interests of the Cisco's of the world.

Jim Witte
[email-masked]
Indiana University CS

---

From: William Leibzon <[email-masked]>
Date: Thu, 13 May 2004 17:40:23 -0700 (PDT)

Router manufacturers benefit from larger amount of traffic on the net - 
the more traffic there is, the more equipment they can seel to ISPs.

If anything, the point about decreasing traffic and unnecessary load 
capacity on the net can be made to ISPs and they do already know that, 
its the question that real protection against zombie is not that simple, 
ISPs would need to have additional equipment that will redirect all
traffic from port 25 to their own relay servers and then they also
have to actually maintain their relay servers as well as put protection
so that one user could not send too many emails (i.e. when computer gets 
infected and becomes a zombie) as well as notification system to let
the users know their computer is a zombie and customer support to at
least give them some simple suggestions on what to do (i.e. dump windows, 
install linux and we'll help you on the way :). In any case, when you 
think about it, you'll realize that ISP steps to deal with zombies is not 
a simple process and can be quite expensive for ISPs. At the same time 
when I asked once on the isp forum how many would be willing to mark their 
dialup and dsl ports as non-mta end-user ports primarily if this would 
help decrease spam - most said they would be happy to do it if this was 
something that is no more complex then reverse dns.

---

From: John Levine <[email-masked]>
Date: 14 May 2004 01:56:52 -0000

>armies' to be turned into zombies in the first place? 

Considering how many people still use Windows 98, and the rate at
which people are still finding horrible bugs in Windows XP and newer
versions, I fear that's not likely in practice.  Too bad.

-- 
John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711
[email-masked], Mayor, http://johnlevine.com, 
Member, Provisional board, Coalition Against Unsolicited Commercial E-mail

---

From: der Mouse <[email-masked]>
Date: Thu, 13 May 2004 23:47:38 -0400 (EDT)

> [...] real protection against zombie is not that simple, ISPs would
> need to have additional equipment that will redirect all traffic from
> port 25 to their own relay servers

No, it would be enough to block port 25 connections except to their
user-submission hosts.  (Many providers do this already.)

They may _prefer_ to redirect attempts to connect elsewhere, but that's
a different issue.

Most of the rest of what you say I agree with, including the basic
point that

> ISP steps to deal with zombies is not a simple process and can be
> quite expensive for ISPs.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B