Reply to topic  [ 13 posts ] 
Trend Micro recommends blocking port 25 to kill botnets 
Author Message
Legend

Joined: Sun Apr 26, 2009 12:30 pm
Posts: 45931
Location: Belfast
Reply with quote
http://www.pcadvisor.co.uk/news/index.c ... d=3210590&

I'll have to have a read at this later, but if there's little hassle to the end user and no/tolerable invasion of privacy (or whatever way you wanna look at it), this should be considered by the sound of it...

_________________
Plain English advice on everything money, purchase and service related:

http://www.moneysavingexpert.com/


Wed Jan 20, 2010 1:41 pm
Profile
What's a life?
User avatar

Joined: Fri Apr 24, 2009 10:21 am
Posts: 12700
Location: The Right Side of the Pennines (metaphorically & geographically)
Reply with quote
Quote:
Two simple techniques could be used to strangle botnets, a security expert has claimed. First, block email port 25 by default.
Wouldn't that stop Thunderbird, Outlook Express etc from sending emails?
Quote:
Second, tell users when they are spewing spam from compromised PCs.
+1

EDIT

Quote:
Port 25 is useful if you happen to be connecting to a remote email server, but would not apply to the vast majority of an ISP's own users who connect to mail servers on internal ports, and would not be affected by such blocking.
Never mind.

_________________
pcernie wrote:
'I'm going to snort this off your arse - for the benefit of government statistics, of course.'


Wed Jan 20, 2010 3:46 pm
Profile WWW
Occasionally has a life
User avatar

Joined: Mon Apr 27, 2009 6:20 pm
Posts: 446
Location: ~/
Reply with quote
My company has a white list of hosts that can send email and Mcafee is configured to block any attempts to send email. Both are pretty sensible things to do. Only problem is when they turn the blocking on by mistake on the server that sends texts via an email gateway. :roll:

_________________
I was nickholway on the old boards.


Wed Jan 20, 2010 9:36 pm
Profile WWW
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:26 pm
Posts: 17040
Reply with quote
l3v1ck wrote:
Quote:
Two simple techniques could be used to strangle botnets, a security expert has claimed. First, block email port 25 by default.
Wouldn't that stop Thunderbird, Outlook Express etc from sending emails?

Quite some time ago the mail routing RFC's were changed such that only MTA's (servers, basically) should be talking to each other on port 25. MSAs (like email clients) should be using port 587. Or I think 465 - one of those may be unencrypted and one encrypted.

Of course they won't stop botnets, because a lot of bots are smart enough to know this and try both ports. But hey, nobody said they knew what they were doing *shrug*. If you really want to stop spam, you actually have to take more extreme measures - only allow submission from authenticated hosts and only pass properly digitally signed email would be a start.

Jon


Wed Jan 20, 2010 9:57 pm
Profile
I haven't seen my friends in so long
User avatar

Joined: Thu Apr 23, 2009 6:58 pm
Posts: 8767
Location: behind the sofa
Reply with quote
jonbwfc wrote:
only allow submission from authenticated hosts and only pass properly digitally signed email would be a start.

Authenticated hosts, yes. Signed? Not so sure about that.

The most annoying thing right now is that so many MX and SPF records are incorrect. And I mean people like banks and other well known businesses. FFS, it's just a few lines of text - get it right!

At the moment, no one should ever use a spam filter because you simply can't trust them not to eat a financially time-critical email from some big important organisation with incorrectly set up public records.

It makes me very angry. This problem should have gone away in 2006.

Grrr.

http://tools.ietf.org/html/rfc4408

_________________
jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly."

When you're feeling too silly for x404, youRwired.net


Wed Jan 20, 2010 10:45 pm
Profile WWW
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:26 pm
Posts: 17040
Reply with quote
JJW009 wrote:
jonbwfc wrote:
only allow submission from authenticated hosts and only pass properly digitally signed email would be a start.

Authenticated hosts, yes. Signed? Not so sure about that.

It's the only way you're going to stop it entirely. Phising mails etc rely on being able to spoof identity. Until you can effectively rely on email being sent by the people who have claimed to send it, you're stuffed. Plus it would stop delivery failure back-scatter.

Jon


Thu Jan 21, 2010 1:15 pm
Profile
What's a life?
User avatar

Joined: Thu Apr 23, 2009 6:27 pm
Posts: 12251
Reply with quote
JJW009 wrote:
jonbwfc wrote:
At the moment, no one should ever use a spam filter because you simply can't trust them not to eat a financially time-critical email from some big important organisation with incorrectly set up public records.


So you are advocating manually sifting through thousands of crap emails every day to find the few that are actually meaningful?

_________________
All the best,
Paul
brataccas wrote:
your posts are just combo chains of funny win

I’m on Twitter, tweeting away... My Photos Random Avatar Explanation


Thu Jan 21, 2010 2:59 pm
Profile
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:26 pm
Posts: 17040
Reply with quote
paulzolo wrote:
JJW009 wrote:
jonbwfc wrote:
At the moment, no one should ever use a spam filter because you simply can't trust them not to eat a financially time-critical email from some big important organisation with incorrectly set up public records.


So you are advocating manually sifting through thousands of crap emails every day to find the few that are actually meaningful?

I dunno, since I didn't say that. Someone's quotings gone astray.

Jon


Thu Jan 21, 2010 5:07 pm
Profile
I haven't seen my friends in so long
User avatar

Joined: Thu Apr 23, 2009 6:58 pm
Posts: 8767
Location: behind the sofa
Reply with quote
paulzolo wrote:
So you are advocating manually sifting through thousands of crap emails every day to find the few that are actually meaningful?

It's entirely up to you. If you don't ever expect to receive anything important by email, then I guess it doesn't matter. personally, it really f*cks me off when someone complains about not being informed simply because they didn't check their spam.

I do "spam filter" my snail mail though. I get so much junk through the letterbox I simply don't have time to sort through it, so I chuck it all strait in the recycling bin. After all, no one would ever entrust anything important to the post without sending it signed for. When I tell people "Oh it probably went in the spam", the damned fools look at me like I'm mad :roll:

_________________
jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly."

When you're feeling too silly for x404, youRwired.net


Thu Jan 21, 2010 9:08 pm
Profile WWW
I haven't seen my friends in so long
User avatar

Joined: Thu Jun 18, 2009 5:10 pm
Posts: 5836
Reply with quote
JJW009 wrote:
After all, no one would ever entrust anything important to the post without sending it signed for. When I tell people "Oh it probably went in the spam", the damned fools look at me like I'm mad :roll:

HMRC do.

_________________
Jim

Image


Thu Jan 21, 2010 11:30 pm
Profile
I haven't seen my friends in so long
User avatar

Joined: Thu Apr 23, 2009 6:58 pm
Posts: 8767
Location: behind the sofa
Reply with quote
rustybucket wrote:
HMRC do.

Never heard of them. Whoever they are, the damned fools should get with the 21st century. Seriously, information printed in sticky stuff on mashed up tree delivered by snail mail by a man battling through the snow with a trolley WTF? Totally pointless. Send me text or an email; that way at least there's a chance I might actually receive it :?

Obviously paper is a good fall-back if the lights go out, but I'm really hoping that doesn't happen quite yet.

_________________
jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly."

When you're feeling too silly for x404, youRwired.net


Fri Jan 22, 2010 12:46 am
Profile WWW
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:26 pm
Posts: 17040
Reply with quote
JJW009 wrote:
rustybucket wrote:
HMRC do.

Never heard of them.

They've probably heard of you :lol: .

Her Majesty's Revenue and Customs - basically the UK tax collectors and border police (among other things).


Fri Jan 22, 2010 9:43 am
Profile
I haven't seen my friends in so long
User avatar

Joined: Thu Apr 23, 2009 6:58 pm
Posts: 8767
Location: behind the sofa
Reply with quote
"checks Wiki"

Quote:
The Inland Revenue was, until April 2005, a department of the British Government responsible for the collection of direct taxation, including income tax, national insurance contributions, capital gains tax, inheritance tax, corporation tax, petroleum revenue tax and stamp duty. More recently, the Inland Revenue also administered the Tax Credits schemes [1], whereby monies, such as Working Tax Credit (WTC) and Child Tax Credit (CTC), are paid by the Government into a recipient's bank account or as part of their wages. The Inland Revenue was also responsible for the payment of child benefit.

The Inland Revenue was merged with HM Customs and Excise to form a new department, HM Revenue and Customs, with effect from 18 April 2005. [2] The former Inland Revenue is thus now part of HM Revenue and Customs, but it is still the name by which the tax gathering department of government is commonly known by British people and is often referred to as "the Tax Man".


Oh, right. They probably sent me a letter informing me of the change, but I expect it went in the junk so I didn't get it. They should have emailed me or sent a text if it was important :roll:

_________________
jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly."

When you're feeling too silly for x404, youRwired.net


Fri Jan 22, 2010 6:17 pm
Profile WWW
Display posts from previous:  Sort by  
Reply to topic   [ 13 posts ] 

Who is online

Users browsing this forum: No registered users and 18 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group
Designed by ST Software.