Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Some Anti-Spam Vendors Blocking and Slowing Gmail

Posted by ScuttleMonkey on Mon Apr 07, 2008 04:02 PM
from the need-something-more-dire-than-can-spam dept.
Businesses Google The Internet IT
fiorenza writes "Google's Gmail (and corporate mail) are being throttled and sometimes blocked by some anti-spam services, including MessageLabs and Antigen. Ars Technica reports that the blocking is a result of the Google CAPTCHA crack, which has allowed a deluge of spam from Gmail's clusters. Most users won't get blocked mail, but Ars confirmed with MessageLabs that Gmail delivery delays are to be expected."
+ -
story

Related Stories

[+] IT: Yahoo CAPTCHA Hacked 252 comments
Hell Yeah! reminds us of a 2-week-old development that somehow escaped notice here. A team of Russian hackers has found a way to decipher a Yahoo CAPTCHA, thought to be one of the most difficult, with 35% accuracy. The Russian group's notice, posted by one "John Wane," is dated January 16. This site hosts a rapidshare link to what looks to be demonstration software for Windows, and quotes the Russian researchers: "It's not necessary to achieve high degree of accuracy when designing automated recognition software. The accuracy of 15% is enough when attacker is able to run 100,000 tries per day, taking into the consideration the price of not automated recognition — one cent per one CAPTCHA."
[+] IT: Gmail CAPTCHA Cracked 317 comments
I Don't Believe in Imaginary Property writes "Websense is reporting that Gmail's CAPTCHA has been broken, and that bots are beginning to sign up with a one in five success rate. More interestingly, they have a lot of technical details about how the botnet members coordinate with two different computers during the process. They believe that the second host is either trying to learn to crack the CAPTCHA or that it's a quality check of some sort. Curiously, the bots pretend to read the help information while breaking the CAPTCHA, probably to prevent Google from giving them a timeout message."
Submission: Some anti-spam vendors blocking and slowing Gmail by fiorenza (996081)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Some Anti-Spam Vendors Blocking and Slowing Gmail 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Gmail and others blocking legit domains, so hey (Score:4, Insightful)

    by gnuman99 (746007) on Monday April 07 2008, @04:10PM (#22993542)
    There were number of times where my emails are silently deleted from Hotmail or even gmail, so hey. Welcome to the world of screwed up SMTP protocol. And all thanks to spammers.

    Today email is less reliable message delivery medium than regular mail which is quite sad considering all transactions in SMTP were considered to be, well, transactions. An acceptance of email by destination means it is delivered, not going to /dev/null. Want to filter spam? Reply with 5xx codes instead - not accept with 2xx and then bin it (unless mailing list headers found in mail, there you can drop spam)

    • Re:Gmail and others blocking legit domains, so hey (Score:5, Interesting)

      by imemyself (757318) on Monday April 07 2008, @04:23PM (#22993684)
      I definitely agree with you, if a mail server accepts my mail with a 200 code, then the mail *should* be delivered. Even if its put in someone's spam folder, the message should get there. That's one of my pet peeves. That being said, from my experiences when setting up my mail server, Gmail was probably one of the best about not blocking legit mail (I've had an SPF record since the beginning though). I had lots of problems with Hotmail, and I think my mail was usually marked as spam by Yahoo until I enabled DKIM signing. With SPF records and DKIM, I don't think I have any major problems (though my mail server handles a pitifully small amount of mail, so its not like we're going to get marked as a bulk sender).

      • Re:Gmail and others blocking legit domains, so hey (Score:5, Insightful)

        by BagOBones (574735) on Monday April 07 2008, @04:45PM (#22993910)
        Really? Do you have any idea the resources this would take for some organizations?

        Based on stats from my frontend SPAM filters 80 - 90% of ALL mail receive in a day is SPAM.

        On my reports some individual users are targeted with between 1500 and 2000 SPAM messages a day. There storage quotas would probably be exceeded over night from SPAM alone.

        I would need to increase my storage capacity immensely if I allowed every spam message to get to the users Junk folder. Not to mention the extra bandwidth of allowing all those mail delivery connections to complete OR to send NDRs to forged senders that are going to bounce back at my system and cause even more load.

        • Re:Gmail and others blocking legit domains, so hey (Score:4, Insightful)

          by freedumb2000 (966222) on Monday April 07 2008, @05:09PM (#22994116)
          True, and it is really not necessary to pass all mail. In my experience weeding out mal-configured mail servers (i use postfix rules and greylisting) takes care of over 90% of spam. The rest gets caught by an RBL or tagged by spamassassin and sent to the users spam folder. Things may change any day though depending on future strtegies by spam senders, but at the moment it works quite nicely.
        • OK, then use DNS/IP blacklists have your mail server's not accept the mail and report a 500-something error to the SMTP client that's trying to send it. That would block a substantial amount of the spam. Then the rest could be put in the user's spam folders based on content filtering, which can be very unreliable. I just noticed a legitimate message that spam assassin marked as an 8.1 (I've tuned it to put it in my spam folder at 3.3). If need be, the spam folder could be deleted every week. There's no
        • Most of the spam mail is identical, and goes to multiple accounts. if you have millions of users, then you can save space by making messages with identical md5 sums all take only one slot of disk storage space.

          then you run into the problem that not all e-mails produce unique md5 sums (something only an e-mail provider with millions and billions of test cases would ever notice...) and well the occasional bit of mail gets lost because it produced an identical md5 some by chance as a spam message.

            • Re:Gmail and others blocking legit domains, so hey (Score:5, Informative)

              by gnuman99 (746007) on Monday April 07 2008, @10:58PM (#22996530)
              Here's what happens. On SMTP level. << is for what server sends. Rest is what is sent to server.

              << This is your great SMTP server. Yo!
              << 220 super.server.net ESMTP
              HELO srv.my_super_subnet.server.net
              << 250 srv.my_super_subnet.server.net
              MAIL FROM: <handle@server.net>
              << 250 2.1.0 Ok
              RCPT TO: <handle2@server.net>
              << 250 2.1.5 Ok
              DATA
              << End data with <CR><LF>.<CR><LF>
              Subject: Yo
              From: Bob Superman <handle@server.net>
              To: My Buddy <handle2@server.net>

              Want some viagra?

              .
              << 554 5.7.1 Rejected, id=sdsada - SPAM
              QUIT
              << 221 2.0.0 Bye

              See?? No backscatter. The pre-queue filter runs *before* the message is accepted after the . is on the new line indicated end of message.

              What happens now is they get,

              << 250 2.6.0 Ok, id=fsffs FROM blah Ok: queued as foo

              or similar response. Then the filter runs and junks the mail! *That* runs email. I send out email, and it get junked. It gets delivered 50% of the time because some wise guy runs some new magic filter - no spam gets through, and 50% real messages get binned. Then people that should get mail complain that they never get mail (and not just from me).

              If you reply to message from a post queue filter you get backscatter. This is wrong way of doing things. If you reject mail in pre-queue, there is NO backscatter.

              The *only* reason to run after queue and drop silently is for mail marked as Bulk, like mailing list software marks mail as Bulk precedence. Any other mail should be treated as a *no* mail lost priority. Otherwise we may just abandon SMTP altogether.

      • Re: (Score:3, Informative)

        by Spazmania (174582)
        if a mail server accepts my mail with a 200 code, then the mail *should* be delivered.

        That's not actually the rule. The rule is: if a mail server accepts my mail with a 200 code, then the mail should be delivered *OR* a non-deliverable message should be constructed and returned to the envelope from address.

        When you actually follow that rule, it's quite amazing how many folks get bent out of shape by the undeliverables returned when someone forges their address, even though they haven't bothered to use SPF t

    • Re:Gmail and others blocking legit domains, so hey (Score:4, Interesting)

      by gnuman99 (746007) on Monday April 07 2008, @04:26PM (#22993708)
      Just to add something, the problem with 5xx replies is filter is *before* queue so some mail may be delayed and servers need to be contacted a few times before they get a delivery slot. For example, say gmail can filter 1 million messages at a time. That means 1 million open connections. So, if you are connection 1,000,040 you get 4xx response - temporary failure due to no available resources. So try again later.

      This is not a problem, really. You can wait a few days until you can deliver the message as long as it is *delivered* eventually. /dev/nulling spam while accepting it with 2xx code is like burning unopened envelope at post office because it was typed instead of handwritten indicating possible spam.

      Pre-queue filter with only 1 unique IP connection at a time to mail server. Problem solved.

      Huge email servers get reasonably constant and predictable amount of mail per day and per hour and even per minute. They can plan pre-queue filtering with some margin for any spikes. And if there is a huge bomb and your mail doesn't get there for 7 days and your server gives up, hey, at least you get a "Could not deliver the message because destination was not available". Much better than "err, never got any mail from you" from the destination party.

    • Today email is less reliable message delivery medium than regular mail
      Depends on where you receive your regular mail and how you do email. I've has less than 10% of my emails not get where they were going, and if you take out the former company domain that was spamming people, it's 0%. Where I live now, there's a good 30% chance that my mail won't get to me.

  • Crack down (Score:3, Insightful)

    by Midnight Thunder (17205) on Monday April 07 2008, @04:10PM (#22993544) Homepage Journal
    I am not sure what Google can do to crack down on this abuse, but they really need to. Have there been any improvement to their Captcha system since it was compromised? Are they closing down suspect accounts?
    • What they need to do is have a process for detecting when an account is spamming.

      Now, you and I would just say "when an account is sending 10,000 messages a day" and that would be correct for about 99.9% of the cases.

      I'd also recommend Google "seeding" the spammers databases with "spamtraps" (not tied to Gmail or Google in any way). If an account sends email to a spamtrap, that account is frozen.

      And so forth.

      • Re:They will, eventually, be cracked again. (Score:5, Insightful)

        by timeOday (582209) on Monday April 07 2008, @05:41PM (#22994402)

        What they need to do is have a process for detecting when an account is spamming. Now, you and I would just say "when an account is sending 10,000 messages a day" and that would be correct for about 99.9% of the cases.
        No, that's the whole point of defeating captcha. Instead of sending 10,000 messages from 1 account, send 10 messages each from 1000 accounts.

      • Re:They will, eventually, be cracked again. (Score:4, Interesting)

        by kesuki (321456) on Monday April 07 2008, @05:46PM (#22994456) Journal
        welcome to spamtrap@donotreply.com (just kidding, but donotreply.com gets a lot of interesting e-mail, I just wondered what they'd do if they started getting 'spamtrap' addressed mail)

        well, making special spamtrap e-mail addresses and putting them in the clear on usenet, message boards, or even on social networking sites owned by google, and making sure the content is boring drivel no one would e-mail that person about. well, i mean how could you decide how to make boring drivel that would still put their address out on sites? 'first post' messages?

        wouldn't someone notice that google got 'first post' every time on 123 consecutive front page articles? wouldn't they? though and e-mail them a congratulation and get spam busted?

        i mean i know i can post boring irrelevant information, but i can't guarantee that if an e-mail is tied to that identity that someone won't e-mail me....

        so spam traps are harder to implement than one would think, unless they're in 'hidden' code. EG: you go to a website, the e-mail is in the html, but never shows on the page... and if you do that, then they might make a scanner that nullifies those addresses... once the realize what's happening.
    • Maybe they could try filtering their outgoing messages? Just a thought.

    • Re:Crack down (Score:5, Interesting)

      by Thelasko (1196535) on Monday April 07 2008, @04:47PM (#22993930) Journal
      I think the safest thing they can do right now is return to their invitation only registration in an effort to close the breach. Then they have to start deleting spam accounts quickly before the spammers adapt to inviting themselves. If they are lucky they will be able to delete spam accounts faster than they multiply.

  • Google wins (Score:5, Insightful)

    by mfh (56) on Monday April 07 2008, @04:11PM (#22993562) Journal
    The missing part of this story really is that Google`s Gmail client has very effective anti-spam filtering. I can see why companies who earn their keep protecting typical client-side email systems, would want to make Gmail obsolete or ineffective. Spammers might use Gmail as a tool to spam, but with good filtering it really doesn`t cost that much compared to the loss of time spent weeding out ham from spam.
    • ...to be safe from spammers using Google Mail... people should just -get- Google Mail themselves?

      I don't know whether to just blink or to think that you discovered a Google strategy here; getting even more people over to Google Mail because there's less spam there; nevermind the fact that a portion of that spam is sent from their own servers(!) I suppose there wouldn't be a heck of a lot of incentive to do something about the spam accounts, then.

      =====

      Or maybe you're saying that Google should apply their sp
  • Our company uses Messagelabs. Just tried a quick message from my Gmail account. Almost immediately received the message. No delay for my account, at any rate.
    • Same here - mail between my Gmail account and my work account, which gets Messagelabs spam/malware filtering, works fine in both directions. Sounds like a badly-sourced story to me...

  • Gmail should go back to their old scheme, where you had to have a cell phone to receive your password, and you could only have one gmail account per phone. That would slow the spammers down.

    If you don't have a phone, you're probably not a good candidate for an advertiser-supported service anyway.

    • What? I've never seen an ad in my gmail when i use my phone.

      Of course, the phone runs Windows Mobile so I don't use the gmail program, I just have it check IMAP every 10 mins, but who's counting?
    • Expect to see a technological solution, this isn't a company full of middle managers or people who are used to losing technical battles.

      If I were a betting man I'd say Google will either A) release a new authentication/authorization scheme for creating new accounts, or B) they'll evolve their current system to be resistant to delivering false negatives on bot provided responses.

      Because honestly, isn't this just graphical/visual acuity based Turing test that needs to be treated as "passed" by the industry? The reasoning being: the equivalent of Alicebot now exists for the graphical world, so the test needs to be re-engineered to test another (currently) unpassed Turing style evaluation.

      Based on that realization: the whole reason capcha's are stupid is that if you keep the existing design but try and make it "harder" to break, the designer of the Bot need only account for that change and not an entire redesign.

      All this sounds like a great technical challenge: think up a new Turing test... When in reality those posting go back to invite only are absolutely right but it's likely we won't see that come out of Google.
    • Gmail should go back to their old scheme, where you had to have a cell phone to receive your password... If you don't have a phone, you're probably not a good candidate for an advertiser-supported service anyway.

      Since when does cell phone == phone? Tons of people don't have cell phones, and most of them are consumers of various goods just like people who do have cell phones. It's amazing how the 'net culture makes it easy to write off huge swaths of the population just because they don't have or want the latest gadgets.

  • Don't blame the spammers (Score:3, Insightful)

    by kitsunewarlock (971818) on Monday April 07 2008, @05:48PM (#22994492) Journal
    Blame the companies that allowed the idiots who buy from spammers to get internet in the first place. I know: everyone makes mistakes. At 2 AM, even I've clicked on a banner once or twice to find something (although I can never recall joining a site due to advertisement via mass mailing).

    But, sadly, statistics still prove that if you try to hit 1,000,000 people without any true risk of getting caught, your bound to hit a sucker eventually. There's one born every minute, after all. Not to use colloquial phrases as my source, of course.

    Personally I'm disheartened that American spam has lowered so. It makes it much harder to track down the parent company and call them and ask them why they sent you their e-mail in the first place...
    • With the current state of the world economy, no one will be willing to pay for something that they get used for free.

    • Re:It's ok though... (Score:5, Insightful)

      by TheMeuge (645043) on Monday April 07 2008, @04:09PM (#22993526) Homepage
      Umm... I have used a number of commercial email systems (in-house for major companies and institutions) and none of them could provide a service that was even remotely close to what Gmail does for free.

      • Re:It's ok though... (Score:4, Funny)

        by teknopurge (199509) on Monday April 07 2008, @04:13PM (#22993588) Homepage
        Then you haven't used Exchange, etc.

        Exchange trumps Gmail easily. No Contest.

        Regards,

        • Re: (Score:3, Interesting)

          by flyingfsck (986395)
          and you certainly haven't used Citadel, which trumps Exchange by a wide margin.

        • Re:It's ok though... (Score:5, Funny)

          by CowboyNealOption (1262194) on Monday April 07 2008, @04:34PM (#22993794) Journal
          I have yet to see Exchange work well in any environment over a few dozen people; certainly not without investing large amounts of money on duplicate servers and hardware. Included is my favourite Exchange analogy: If the same method that exchange/outlook uses to store email were used in the real world as a paper filing system: Every document is translated into Greek, and the original is burned. Then they are all glued together into one solid block and stuffed into a magic box with a tiny slot, through which you can talk to a little gnome who somehow gets each message for you as needed. Sometimes the gnome gets confused and it takes hours (sometimes days) for him to sort things out; meanwhile he can't find your documents until he is totally finished becoming unconfused again. As an added bonus the gnome costs several thousand dollars and when he dies every few years you need to buy a new gnome. Oh and if the first box gets (arbitrarily) full you have to buy another special gnomebox, which of course costs $$$

          • Re:It's ok though... (Score:5, Insightful)

            by imemyself (757318) on Monday April 07 2008, @05:03PM (#22994058)
            Wow, if you're having that many problems with Exchange, your sysadmins need to do a better job. Exchange is generally a pretty good mail/groupware server for corporate environments. If you throw an Exchange server together in five minutes, then yeah, you might have some problems, but as long as you think it through beforehand (and like with anything computer related, have a good backup strategy) it should work pretty well unless you have some really unusual requirements.

            • Re: (Score:3, Interesting)

              by kesuki (321456)
              I remember reading a post about one poor hapless admin, who had come across an exchange server that was eating 10 GB of HD space a day, couldn't figure out what was causing the massive use of disk space, his company was in the middle of their most critical time of year, and he had 3 days left before the server crashed again and he'd be out of a job if he lost 12 of so days (since the last backup of that servers files) of e-mail.. it was an old post, and the people who had ideas were ideas the admin had alr

              • What a bunch of incompetents. 12 day old backups for one, and a complete inability to open task manager to discover which process was doing all the disk writes.

                If it was exchange itself, a mail loop was probably the cause. Older Exchange versions didn't totally prevent users from creating ping-pong forwarding rules with certain external mail systems. Again, a few minutes with simple tools like perfmon would have diagnosed the issue.

                Give the same "admins" a Linux box and the same amount of training the

                • Re:It's ok though... (Score:5, Insightful)

                  by imemyself (757318) on Monday April 07 2008, @07:15PM (#22995226)
                  That is *completely* incorrect. In Exchange 2003 prior to SP2, the limit for the mailbox store was 16 GB. In SP2 they upped that limit to 75 GB, which really is probably enough for most of the small organizations that probably just have a single server running Exchange Standard.

                  Here is a document about it, scroll down to the part where it says Licensed Database Size Limit. http://technet.microsoft.com/en-us/library/aa998066.aspx [microsoft.com]

                  In Exchange 2007, Standard Edition can have up to five mailbox stores in each of five storage groups. And there is no limit on size. http://www.msexchange.org/tutorials/Exchange-2007-Store-Related-Changes-Improvements.html [msexchange.org]

                  Its also mentioned on the Microsoft Exchange page on wikipedia.

                  I'm not saying that Exchange is a perfect mailserver for (or worth the cost in) every situation, or denying that Microsoft does some really annoying things, but please try to get your facts straight before you complain about a piece of software.

                  • Re: (Score:3, Insightful)

                    by Anonymous Coward
                    While the 2GB size was erroneous, it is true that 2003 Standard is limited to a single mail store (see the article you linked to; it says as much). So prior to SP2 you were stuck with 16GB total size.

                    I find it typical that you start mentioning Exchange 2007; pretty much every Microsoft person recommended we upgrade to the newest software when we started having trouble with our Exchange server. Luckily we decided to get off the Microsoft upgrade treadmill; it was a pretty easy sell when we saw how much just

                    • Re:It's ok though... (Score:4, Informative)

                      by jsfetzik (40515) on Tuesday April 08 2008, @08:58AM (#22999656)

                      In Exchange 2003 prior to SP2, the limit for the mailbox store was 16 GB. In SP2 they upped that limit to 75 GB
                      16GB per mailbox should be enough for most users for a few years to come, what is all the fuss about?
                      No 16GB to for the mailbox store, which houses ALL of the mail boxes, IIRC. Thus, the reason for having 10M-20M limits on peoples inbox.

            • Re:It's ok though... (Score:4, Insightful)

              by Bryansix (761547) on Monday April 07 2008, @06:10PM (#22994692) Homepage
              It's funny how a good backup strategy involves NOT using anything from Microsoft to backup exchange. I mean seriously, how long has been exchange been out and Microsoft can't make a backup program that can backup and restore individual mailboxes? WTF! Oh, and I don't want to take the store offline to do it.
          • That *is* funny. Though I have never had this experience with Exchange 2003 at any site I've managed over the past five plus years. In fact, our Exchange 2003 installations have remained rock-solid and stable. These installations range from five people to over 50. Very happy with the performance and stability.

            That is not to say that I have not seen Exchange 2003 tank. It happened recently to a colleague running on Windows 2000 Server. Lost his mail store.

            But there are arguments on both ways of doing t

        • Re:It's ok though... (Score:4, Insightful)

          by Sleepy (4551) on Monday April 07 2008, @07:27PM (#22995292) Homepage
          >Exchange trumps Gmail easily. No Contest.

          As a source for spam, and a plague of server-generated 'automated' notices, Exchange beats EVERYTHING.

          Exchange is fine if you keep it where it belongs: inside a workgroup or protected by a SMTP-protocol filter (which is not running on the same box).

          Recently I had to defend a customer who was the target of a DDOS... 80% of which were "bounces" from Exchange (forged From: undeliverables, permanent Out Of Office, DSNs, Mailbox full emails, etc). Exchange is pathetic in terms of controlling what gets "onto" the server.

          By comparison, Google mail is a VERY good Internet citizen. They may have had Captcha compromised, but they'll plug it up. I'll them over their competition anyday.

    • Re:It's ok though... (Score:4, Funny)

      by anotherone (132088) on Monday April 07 2008, @04:10PM (#22993546)
      Did you seriously just post an unsolicited commercial message in a thread about how unsolicited commercial messages are watering down legitimate communication mediums?

    • Re: (Score:3, Insightful)

      by Stochastism (1040102)

      This is to be expected from free mail providers. If you want quality service, including people that police spammers and watch their systems, then you obviously pay for the higher-quality email service.

      I suspect Yahoo, Hotmail and Gmail between them have more "police" than most other commercial providers put together.

      I don't necessarily believe these free services are inherently low quality. What is true is that they are a massive target for spammers. Spammers get something from these services they don't get by sending mail directly by SMTP: DKIM and SPF authentication from (relatively) high reputation IPs.

      Yes, they all go around blocking each other sometimes, but this is not new. I vaguely remembe

    • This is to be expected from free mail providers. If you want quality service, including people that police spammers and watch their systems, then you obviously pay for the higher-quality email service. Regards,

      What can i say, Google gives me 7 gigs of space for my account, the most popular local ISP gives 100 megs, and this crappy service. Actually gmail is the only email client i've dealt with recently that isn't hell and a half to support. the anti spam service has been near perfect until now as well on all 3 of my accounts. :D

      And saying thats its a budget service is just plain uneducated. its funded (quite generously, I might add) by the discreet, context sensitive ads you will find on the side of the page

    • Re: (Score:3, Interesting)

      by Skapare (16644)

      The IPs doing this shit are the end user addresses for home and office computers that are no different than all the other end users that use Gmail. They could block an IP, but eventually that IP will be used by someone else who is a legitimate and secure Gmail user. They are better off closing accounts that send spam. But Google isn't doing that (based on having seen spam from the very same user I reported to them as a spammer 2 weeks prior). If they do decide to pursue the user of the IP, once they get

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.