ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

What does the spam ISP shutdown really mean?

By | November 19, 2008, 4:49pm PST

Summary: It has been over a week since the takedown of an ISP responsible for directing a large portion of Internet’s spam. While many groups immediately hailed a massive drop in spam, the true story was more nuanced. Everyone, save the spammers, hates spam, and this story has generated quite a bit of interest throughout the [...]

It has been over a week since the takedown of an ISP responsible for directing a large portion of Internet’s spam. While many groups immediately hailed a massive drop in spam, the true story was more nuanced.

Everyone, save the spammers, hates spam, and this story has generated quite a bit of interest throughout the media as a result. There are two misconceptions that do need to be clarified. The ISP did not directly send out somewhere north of one half of all spam on the Internet, but merely coordinated systems that sent the spam. If it sent out that much mail, it would be one of the largest traffic sources on the planet, and would have gone under from the bandwidth bills long ago. The ISP was responsible for directing systems to perform half of all spam sending attempts on the Internet, and was not responsible for half of all spam delivered to the inbox. ISPs that had strong content filters and multiple layers of IP blacklists saw a minimal change in the amount of spam delivered to their customer’s inbox. The spam sent by this ISP was just not getting past the people who invested in good anti-spam protection.

I do think that the ISP shutdown is a landmark event as people will be emboldened to take down additional institutional supporters of spam when they see that removing hard infrastructure actually does have an effect. I hope it emboldens them to take what I believe is the next necessary step in the offensive war on spam: the financial infrastructure. If you truly want to hurt the spammers, find a way of freeing the world of the credit card processors that process the spammers’ transactions. This may possibly raise the financial cost for certain kinds of spam to make it unprofitable and remove it from the net.

One can only hope.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Adam J. O'Donnell, Ph.D. is an R&D engineer who has focused on computer security since 2000.

Disclosure

Adam O'Donnell

Adam J. O’Donnell currently works for Cloudmark, a messaging security company whose clients include the majority of the Tier 1 customer-facing service providers as well as mobile carriers and social networks. He serves on the advisory committee for the SOURCE Security Conference, as well as several conference technical program committees. Many of his close friends work in the security industry, and he will disclose those relationships as he deems it necessary.

Biography

Adam O'Donnell

Adam J. O'Donnell, Ph.D. is an R&D engineer who has focused on computer security since 2000. He currently is the Director of Emerging Technologies at Cloudmark, a messaging security company located in San Francisco.

Adam early on mastered the art of writing in complete sentences, using both hands and one foot. Later, he learned to do so with each individually. After fourteen years of apprenticeship in the mist-covered hills of central Nepal, Dr. O'Donnell emerged an unparalleled digital warrior and in desperate need of a anti-fungal wash.

Approaching both life and enterprise security with the verve of a particular capuchin, he is respected the world over as an observer of all he sees. Adam's dry blade of analysis will sever the hard candy shell surrounding most technical security concepts, and significantly goo-ify the remaining so as to be consumable in small bites with sufficiently large servings of digestive aids. Just what the doctor ordered.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
7
Comments

Join the conversation!

Just In

RE: What does the spam ISP shutdown really mean?
birumut Updated - 5th May 2011
Great!!! thanks for sharing this information to us!
seslisohbet seslichat
0 Votes
+ -
Spam Volume
greg@... 19th Nov 2008
We use a Barracuda spam filter for our clients "As A service" and since that ISP went down.. our average amount of spam went down from around 120,000 messages a day to our client base to 80,000. It was a significant drop to us. It also decreased the amount of bandwidth used for that box by 25-30%, and a week later, we're still in great shape.
0 Votes
+ -
Tracking the money path should be easy, but ...
terry flores Updated - 19th Nov 2008
Almost everyone has conspired to make it as difficult as possible, including VISA and Mastercard, the banks, and even the law enforcement agencies.

It is absurdly easy to fix this problem:
- spam email shows up in an agent's inbox
- he links to the illicit website, with govt credit card
- he contacts processor for a trace of transaction
- If merchant account is onshore, subpoena and freeze account
- if offshore, processor holds transaction for a period of time until local law enforcement is engaged to shut down the operation.

The whole process could be done in hours, and give almost immediate protection to the people who were spammed. The beauty of electronic money is that it is all traced down to the last penny.

BUT, there are a lot of vested interests involved, because the processor and the merchant banks take BIG cuts of the transactions. Nor do they want to deal with the administrative tasks of monitoring and freezing accounts, and cooperating with LEA. So they bribe regulators to let them off the hook. Simple.
0 Votes
+ -
Re: Tracking the money path ...
KeithDick 20th Nov 2008
There is an important step apparently missing from your recipe: Getting a legal judgement from a court that the transaction in question actually is illegal.

Perhaps you have in mind that convicting the spammer somehow is done before targeting him in the first step of your recipe. Maybe that would work, but I'm not sure I see how it would work.

Without having a court involved, I can't see how your recipe can be legally acceptable.

Too bad. It would be tempting to employ a bit of vigilante justice against the spammers, but I think we don't really want to take that path.
0 Votes
+ -
It takes about a week after shutdown
kokuryu 20th Nov 2008
Between the two spam sites that were recently shut down, instead of receiving nearly 10k emails a day AFTER the spam filters are applied, I now receive UNDER 200 emails a day AFTER the spam filters are applied. I am still receiving a few auto-generated spam messages from some other networks, but our overall traffic has dropped from millions of messages a day to just around a thousand a day. THAT is significant. Now we just need to find this third major spam house out there and destroy that one, and emails will be usable again because there will be zero spam. It is very nice right now with the current reduction.

Oh, but what I was saying is, it takes about a week after one of the spam houses is shut down before it's effects are seen.
0 Votes
+ -
Hate to say it...
hasta la Vista, bah-bie 20th Nov 2008
...but they'll only move elsewhere... There's too much money in spam for everybody to rest on their laurels.

I applaud them shutting this thing down, but it is only but one battle in the ongoing spam war
0 Votes
+ -
I was receiving about 100 SPAM emails in Russian each day. My ISP SPAM program was catching them and putting them in a junk folder.

All have stopped....

By the way, I don't read or speak Russian.
0 Votes
+ -
RE: What does the spam ISP shutdown really mean?
birumut Updated - 5th May 2011
Great!!! thanks for sharing this information to us!
seslisohbet seslichat

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix