Time to check the rate limits on your mail servers

Thu Feb 3 17:16:41 UTC 2005

On Thu, 03 Feb 2005 17:54:28 +0200, Gadi Evron <ge at linuxbox.org> wrote:
> Still, please tell me, how is not blocking un-used or un-necessary ports
> a bad thing? It is a defensive measure much like you'd add barricades
> before an attack.

Agreed.  And depending on your service, there are different ports
worth blocking.  For residential users, I can't see a reason to not
block something like Netbios.  And blocking port 25 effectively
prevents zombies from spamming.  Unfortunately, it also blocks
legitimate users from being able to use SMTP AUTH on a remote server..

> They now evolved, and are using user-credentials and ISP-servers. This
> evolution means that their capabilities are severely decreased, at least
> potentially.

Has this been confirmed?  Does this new worm, in fact, use SMTP AUTH
where necessary?  Will it also check the port that the user's computer
is set to send mail on?  So, for instance, if SMTP AUTH is required,
and the mail submission port is being used rather than standard port
25, will the worm detect all this?

The nice part about SMTP AUTH, though, is that there is at least a
direct link to the user sending the spam.  This means, of course, that
ISP's will need to police their users a little better..  :)

> It means ISP's will have to re-think their strategies, just like AOL
> did. It also means it's once small step to victory for us. We are a long
> way from it, and please - not everybody blocks port 25 so current-day
> worms are more than efficient still.

So I guess users will have to stop clicking that "Save Password"
button...  That is, until the worm records the keystrokes when the
password is entered...  *sigh*

>         Gadi.
> 

-- 
Jason 'XenoPhage' Frisvold
XenoPhage0 at gmail.com