Members of the ISP-Tech list would never do anything illegal, but that doesn't mean they won't talk about what they'd like to do to a spammer's system or their ISP.

[July 31, 2002]

On the ISP-Tech list in July, GP inquired,

"We have been getting a lot more spam lately, and some of it's really nasty stuff. Has anyone thought about sending an organized DoS to the original source and to the spammers' hosters?"

A number of respondents suggested that starting a DoS war with a spammer might not be the best idea:

[TH warned] "Is it illegal? Definitely. Is it morally correct? You're on shaky ground there. Is it advisable? I would not want to get into a DoS war with someone who could very possibly pull up a couple hundred zombies and shut me down."

[JL advised] "Only do it if you have tons of money to burn to pay defense attorneys. While their nasty spam is not necessarily illegal, a DoS attack most definitely is. It may be nice to imagine doing it, but let it go at that."

Others pointed out that there might be more creative ways of taking revenge:

[BK noted] "With all of this going on, I am surprised that someone hasn't come up with a spam scam to con the senders out of their money: wouldn't that be terrible..."

[TH added] "There was a recorded case of a spam company suing someone who supplied them with false addresses to send to: only 20 percent of the addresses they purchased were real. I laughed myself silly when I read it."

DA recommended some more specific ways an ISP can take action:

"Remember that spammers tend to like IP addresses. Change your IP addresses, and leave a spam trap on the unused addresses. I wrote a program that sends OOB (out-of-band) data as fast as it can to any connections, and also bans that address. I get a few hits per day. On some operating systems, the TCP timers won't expire as long as you are getting data, even OOB data. On others, the OOB data will be buffered until the application or system runs out of memory and crashes."

"Also, access list your customer edge connections so that they can only originate traffic with IP addresses assigned to them: this prevents crackers and viruses from using your customers' systems to send traffic with forged IP addresses. If you log this, and analyze the logs, you'll detect virus infections and cracking before they do. Logs are your friend. Log much, and analyze frequently."

— End