Spamhaus, URIBL, SURBL under DDOS attack

This has been ongoing for a couple of days now. Spamhaus and two other major blocking list providers have been under a distributed denial-of-service (DDOS) attack. Steve Linford of Spamhaus believes that the source of the attack is the same people who executed the attack against Blue Security last year which effectively destroyed their Blue Frog anti-spam project.

Spamhaus has implemented anti-DDOS countermeasures and is weathering the storm. Uribl has closed up shop, redirecting their IP address to 127.0.0.1 until things blow over. (One wag has suggested that they redirect to 255.255.255.255 in order to get the attention of the ISPs hosting the zombies. Bit of network geek humor there.)

More information can be found in Linford's announcement on usenet news.

National Spam News

I haven't done a news roundup in quite a while, and I have a lot of catching up to do. Are you sitting comfortably? Good, let us begin.

Good article in Slashdot today, bemoaning the fact that the latest Ameritrade leak has gotten no attention from the mainstream press. California law requires them to notify their California customers of a potential security breach. Have they done so? Were customer account ids and passwords also leaked? Ameritrade isn't saying. So far, all they've said is that they take these things seriously. The article suggests some security techniques that Ameritrade should implement to track the source of the leak.

There have been a lot of "greeting card" spams lately. I'll bet you've gotten some yourself. Remember: if the subject line doesn't identify who the card is from, then it's spam. Anyway, Trend Micro reports that these spams are also carrying malware as part of the payload.

Robert Soloway isn't the only one with legal problems this week. TG Daily and other sources report that Microsoft has filed suit against three John Does for sending pump-n-dump spam through their Hotmail service.

The BBC reports that internet service provider Tiscali is now caught up in a serious battle with their spammers. Spam coming from Tiscali has become serious enough that many other ISPs are refusing email from Tiscali, which is seriously impacting their customers. Tiscali has long been plagued with 419 scammers, which they managed to bring under control about 6-8 months ago. It now seems that another house-cleaning has begun.

There is some speculation that Tiscali's problems might be caused by spambots inside their network. See my recent article on this subject.

Ben Edelman reports that spyware is still stealing referal fees. As usual, his claims come with a detailed and in-depth analysis.

The Seattle Times reports that Nigerian 419 scammers are now inviting suckers to get puppies out of the country instead of money. Some people have paid more than $1500 to adopt a valuable dog from Nigeria.

More on Spamhaus ZEN

Yesterday I wrote about how Al Iverson had observed zero false positives from using the Spamhaus ZEN blocking list. I also noted that the sample set was too small (~2300 emails) to definitively give Spamhaus the Zero False Positives Seal of Approval.

Today, numbers provided by the Dutch ISP XS4All were brought to my attention.

In a nutshell, before ZEN, XS4All was using a combination of SBL + XBL + dynablock.njabl.org (ZEN is simply a combination of the SBL, the XBL and the PBL). With this combination, they were blocking about 4 million messages a day, out of 8 million examined. Their abuse@ address receives complaints about false positives about once every two weeks. Assuming that only one false positive in a thousand actually generates a complaint, that's a false positive rate of .00089%. Not too shabby.

(Of course, the one-complaint-in-a-thousand number is plucked straight from the air; I have no idea if anybody has ever done a study to find the actual number, but I think it's a reasonably conservative guess.)

The full article (in Dutch) can be found at Vincent Schönau's blog at XS4All.

Spamhaus ZEN: 80% blocking rate, zero false positives

As reported yesterday in Al Iverson's SpamResource web page:

Iverson was becoming overwhelmed by the spam sent to his abuse address. For obvious reasons, it's a very bad idea to filter an abuse-reporting address because legitimate abuse reports are too easily mistaken for spam.

As an experiment, Iverson applied the the Spamhaus ZEN blocking list to his incoming abuse mail — to tag rather than block.

(Spamhaus ZEN is a merger of the three blocking lists maintained by Spamhaus, and thus should be the most aggressive of them all.)

Iverson's results: out of over 2200 spams received in February so far, nearly 80% would have been blocked by Spamhaus, and there were zero, none, nada false positives.

This is encouraging news for administrators who worry if it's safe to use a blocking list. More testing is required though before it's safe to give Spamhaus the Zero False Positives Seal of Approval. At the very least, we need to see results from a variety of different users, and we need to see the results applied to a corpus of many more than 2200 messages.