How to render botnets ineffective for spam

Posted by

The biggest problem in terms of spam is botnets. Most spam originates from zombie computers and botnets. What can be done to stop it?

The real problem is that spammers don't always want you to do anything with the email they send other than read it. Penny stock trading is a big focus of the spammers these days. They don't require that you do anything but buy the stock the spammer mentions. So the spammer doesn't really care what the message contains, as long as it mentions the name of the penny stock company they want you to buy shares in.

What this means is that if DKIM becomes ubiquitous, then spammers will no longer be able to put an address they control in the "From" address of an email. They're going to have to rely on their zombie's smarthost to send the email, and that means putting the "From" address of whoever owns the zombie computer in the email. The spammer doesn't really care, though, as long as the message contents are there. The same would generally be true if the spammer were trying to sell cheap meds. As long as the link to their website is there, they don't care what the "From" address is.

So what can we do about it? I mentioned a little while ago about Challenge-Response anti-spam. Some people pointed out to me that C-R is rather ineffective at the moment due to the fact that the challenge often ends up going to someone who never even sent the email in the first place -- essentially, the C-R is creating it's own spam! However, with validating email you can be pretty sure that the challenge will actually go to the person who sent the email. They may not have sent the email intentionally (if it was a spam) but they did send it.

Now, the bot could come up with a random user name, but with the same domain, but I don't think this would be common. Besides, most ISPs require you to authenticate your outbound email with a username/password, and that's generally already tied to a specific "From" address.

It's not going to stop botnets, but it should become quite obvious when you've been infected. You'll start getting lots and lots of email challenges to emails you didn't send!

There are lots of issues with challenge-response anti-spam at the moment, but I believe that validating email should remove many of those issues. I might have been a sensationalist in the title of this post, but I really do think that validating email (that is, DKIM) will have a big impact.

blog comments powered by Disqus