What real effect on spam will this have?

HC-Majick · 2005-03-22, 09:51 AM

http://money.cnn.com/2005/03/22/tech...ex.htm?cnn=yes

SirMoby · 2005-03-22, 12:19 PM

This may not have a large effect any time soon but it could spawn a new branch of technology to help solve a major problem. If IBM sells this technology to a few big players then others may get involved.

The thing that I find confusing is what does it matter if the mail is bounced back or not? If the computer sending the mail isn't accepting incoming mail then it's just a little noise on the line and won't change a thing.

RawAlex · 2005-03-22, 12:37 PM

SirMoby: Even if a server isn't accepting mail back, it still has to handle the REQUESTS for the mail to come back. That means that the level of network traffic BACK to the source of the spam could effectively remove half or more of their available bandwidth (it gets worse if they bounce bounces).

It could get MUCH worse if all of the links inside a spam message are loaded and "checked" be the program for each email sent... most spammers couldn't handle the 22 million page verifications... they would die.

While in the short term network traffic would go up, it would almost certainly make it MUCH more difficult to make money from spam.

As a side note, most of the "hardcore spammers" I have known in the past have moved on to other things, the return on effort in spam isn't what it use to be.

Alex

cd34 · 2005-03-22, 01:15 PM

If the zombie isn't listening for port 25, a connection refused will be granted almost immediately. No performance penalty whatsoever to the machine sending the spam.

If the cable/broadband providers start tarpitting or dropping inbound port 25 connections, your mail server will sit there waiting for an ACK for its SYN, and never get it -- thus, launching a mini-DOS on your own mailserver.

If the user had a firewall, and the provider didn't firewall, then they might see some alerts, but, the ones with the zombies probably aren't running firewall/up-to-date antivirus.

I doubt it will do much except sell product and boost IBM's bottom line for 'fighting' spam.

SirMoby · 2005-03-22, 01:25 PM

Just becasue the spamputer is sending mail does not mean that it has to accept incoming mail. Even if it is they will quickly learn which mail servers send a bunch of stuff back and just turn on some packet filtering and block everything coming back from them. I'm sure even the lowest level spammers have enough knowledge to setup minor protection.

Even if they don't block it so what? IBM wants to send the mail back to the spamputer. They send a request for a TCP connection on port 25 but the spamputer isn't listening on port 25 so nothing happens for 60 seconds and then the IBM computer never establishes a connection. Wow, 1 packet every 60 seconds.

So maybe they're going to send a bunch of UDP packets or something? Even if they end up with 10% of the mail server market, which is very unlikely, then the best they can do is increase junk traffic on the wire by 10%. Since it's junk traffic it requires no processing so it's kind of pointless because it won't slow things down much at all.

Feel free to send a couple of 1,000 emails to my PC because it's not listening to port 25 and it's going to slow you're system down a lot more then mine.

Maybe I'm just missing something but unless the spamputer is listening for email and processing it then how can it slow things down enough to matter?

Head Boy · 2005-03-22, 02:27 PM

I thought spam came via stupid surfers that don't have proper protection. It looks as if IBM are a few years too late with this.

2005-03-22, 09:51 AM	#1
HC-Majick You can now put whatever you want in this space :) Join Date: Oct 2004 Location: Upstate NY Posts: 541	What real effect on spam will this have? http://money.cnn.com/2005/03/22/tech...ex.htm?cnn=yes __________________ Submit Your Freesites:

2005-03-22, 01:15 PM	#4
cd34 a.k.a. Sparky Join Date: Sep 2004 Location: West Palm Beach, FL, USA Posts: 2,396	If the zombie isn't listening for port 25, a connection refused will be granted almost immediately. No performance penalty whatsoever to the machine sending the spam. If the cable/broadband providers start tarpitting or dropping inbound port 25 connections, your mail server will sit there waiting for an ACK for its SYN, and never get it -- thus, launching a mini-DOS on your own mailserver. If the user had a firewall, and the provider didn't firewall, then they might see some alerts, but, the ones with the zombies probably aren't running firewall/up-to-date antivirus. I doubt it will do much except sell product and boost IBM's bottom line for 'fighting' spam. __________________ SnapReplay.com a different way to share photos - iPhone & Android

2005-03-22, 02:27 PM	#6
Head Boy Hello, is this President Clinton? Good! I figured if anyone knew where to get some tang it would be you Join Date: Feb 2005 Location: England Posts: 442	I thought spam came via stupid surfers that don't have proper protection. It looks as if IBM are a few years too late with this. __________________ Adult domain names for sale at Baronets Splinkies have arrived

2005-03-22, 12:19 PM	#2
SirMoby Jim? I heard he's a dirty pornographer. Join Date: Aug 2003 Location: Washington, DC Posts: 2,706	This may not have a large effect any time soon but it could spawn a new branch of technology to help solve a major problem. If IBM sells this technology to a few big players then others may get involved. The thing that I find confusing is what does it matter if the mail is bounced back or not? If the computer sending the mail isn't accepting incoming mail then it's just a little noise on the line and won't change a thing.

2005-03-22, 12:37 PM	#3
RawAlex Took the hint. Join Date: Mar 2003 Posts: 5,597	SirMoby: Even if a server isn't accepting mail back, it still has to handle the REQUESTS for the mail to come back. That means that the level of network traffic BACK to the source of the spam could effectively remove half or more of their available bandwidth (it gets worse if they bounce bounces). It could get MUCH worse if all of the links inside a spam message are loaded and "checked" be the program for each email sent... most spammers couldn't handle the 22 million page verifications... they would die. While in the short term network traffic would go up, it would almost certainly make it MUCH more difficult to make money from spam. As a side note, most of the "hardcore spammers" I have known in the past have moved on to other things, the return on effort in spam isn't what it use to be. Alex

2005-03-22, 01:25 PM	#5
SirMoby Jim? I heard he's a dirty pornographer. Join Date: Aug 2003 Location: Washington, DC Posts: 2,706	Just becasue the spamputer is sending mail does not mean that it has to accept incoming mail. Even if it is they will quickly learn which mail servers send a bunch of stuff back and just turn on some packet filtering and block everything coming back from them. I'm sure even the lowest level spammers have enough knowledge to setup minor protection. Even if they don't block it so what? IBM wants to send the mail back to the spamputer. They send a request for a TCP connection on port 25 but the spamputer isn't listening on port 25 so nothing happens for 60 seconds and then the IBM computer never establishes a connection. Wow, 1 packet every 60 seconds. So maybe they're going to send a bunch of UDP packets or something? Even if they end up with 10% of the mail server market, which is very unlikely, then the best they can do is increase junk traffic on the wire by 10%. Since it's junk traffic it requires no processing so it's kind of pointless because it won't slow things down much at all. Feel free to send a couple of 1,000 emails to my PC because it's not listening to port 25 and it's going to slow you're system down a lot more then mine. Maybe I'm just missing something but unless the spamputer is listening for email and processing it then how can it slow things down enough to matter?