Ending Spam Zombies

A spam zombie is a computer that's been taken over by malicious software for the purpose of sending junk email. The software is usually installed via an exploit, or unintentionally by the user.

Zombies are uniquely hard for spam blocker software to track by IP address as they come from nearly every different network on the planet.

Since zombies use ISPs resources without compensation, the service providers have an incentive to shut them down. This is in contrast to other spammers who pay their providers for service. There are many different ISPs that cater to spammers, but none want zombies.

Unlike other spam related issues, the technical solution to zombies is fairly easy.

First, ISPs need to shutdown external access to SMTP (outgoing mail / port 25) except to their own mail server. This generally won't impact end users.

Second, ISPs need to implement a "flow control" mechanism on their own SMTP servers. A reasonable limit might be 60 emails per host / hour. Some users may legitimately need to send more email than this. The limit could be overridden by enabling SMTP authentication. This might pose a minor inconvenience for users, but should only really effect those sending newsletters, etc.

These steps shouldn't require any new anti-spam e-mail software. Existing mail server and router technology should allow for them to be implemented.

It's not quite a perfect solution, but it would radically cut down on the amount of spam sent by zombies. It however would not necessarily reduce the total number of zombie systems. In order to fully eliminate zombie spammers, a large majority of ISPs would all have to implement these practices to block junk e-mail. This unfortunately, seems unlikely.

Back