[anti-abuse-wg] how to detect spambots - SPAMTrusted

On Wednesday 04 March 2009 11.56, Florian Weimer wrote:
> * Frank Gadegast:
> 
> > And the following makes me really crazy:
> > - preventing spambotted PCs from sending spam is SOOO easy
> 
> The detection problem has been solved years ago, agreed.  There are
> multiple, working solutions.
> 
> > YES, its not only "likely", its prooven, spambots scan outlook address
> > books, and if the provider is only big enough (it works here for
> > only 10000 mailboxes) ...
> > ... SPAMBOTS USING YOUR DIAL-IN IPs DO SEND SPAM TO YOUR OWN MAILSERVERS !!!
> 
> And even if that doesn't happen for you due to some strange scenario,
> there are tons of free, external data feeds to which you can subscribe
> which provide you with high-quality data about compromised customer
> PCs.
> 
> > the customer phones up usally 5 minutes later, we can explain
> > and check the situation, he is cleaning his computer and
> > there is one spambotted PC less in the world.
> 
> Cleaning up the PC costs between 100 and 200 EUR.  Someone needs to
> absorb those costs.
The "owner" has to absorb this cost. That's the price they pay
to get infected in the first place. Tha main thing is to isolate
it from Internet and prevent further damage.
> 
> Detection is solved, but response is still an open problem.
Why ? The connection will go blank. Any person at the other end has
to do some fault-finding and will end up with the solution. Any spambot
will not. Problem solved.

> 

-- 
        Peter Håkanson   

        There's never money to do it right, but always money to do it
        again ... and again ... and again ... and again.
        ( Det är billigare att göra rätt. Det är dyrt att laga fel. )