North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Quarantining infected hosts (Was: FBI tells the public to call their ISP for help)

  • From: Suresh Ramasubramanian
  • Date: Mon Jun 18 10:44:41 2007
  • Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=tnjSjFM7Ggsi1Lrtlyip6Vbu3Yj3CrzhdrcYzBBjIHigrWxGJwm80ytpqGI6IooMhVfvW292ks0dvvxY9QtvMIcA3tcC8QiX9/LMcpTKjLZTWi/ECQXPpUybj3ZQsRgE0a9UEXTK3QXRTRu3Lcx0/W1m7PoOAI6b4vJ7auKFR+Y=
  • Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=fFF4tVtpKw37rK9J6AgZfNz4FxoKeJfOJBVd397PPKLwXoFw3fAmidj/fbxeFyC1mHHJf3wbmk/mpvpFHXIL75Gr0/LpsdXF6wuxy35Q0Rgfo0yZopLoglYW3D3QQwM7nqEXaNyAvgzUd6gHFn99ws7+R7aD1FylrUfeqEeyBAo=

On 6/18/07, Jeroen Massar <[email protected]> wrote: 
Of course, though 25 is (afaik ;) the most abused one that will annoy a
lot of other folks with spam, phishings and virus distribution, though
the latter seems to have come to a near halt from what I see.


Read these and weep, then -
http://darkwing.uoregon.edu/~joe/port25.pdf
http://darkwing.uoregon.edu/~joe/zombies.pdf

As Joe says (and I agree), trying to fix infected hosts on your
network by blocking port 25 is like treating lung cancer with cough
syrup.

srs
--
Suresh Ramasubramanian ([email protected])