Rate Limiting as an Anti-Spam Tool

Rate Limiting as an Anti-Spam Tool
( Page 1 of 2 )

Opinion: ISPs need to start putting a cap on the number of e-mail messages sent by users—a policy that would leave nearly all users unaffected but would be a powerful deterrent for spammers.The spit is hitting the fan these days over the impending standards for SMTP authentication. Im a big fan of it, but many are arguing against it—some constructively and some not.

One of the main dismissive put-downs against authentication, especially with respect to zombied PCs, is that spammers and worms will simply switch to using the users authenticated ISP account to send spam.

There are a number of reasons why Im not so worried about this. One of them is that ISPs, at least consumer ISPs, will need to begin limiting the number of e-mail messages sent by users. This is one of those policies that will leave 99-something percent of all users unaffected but generate extreme rage among the others.

Hard limits are not a good way to implement changes like this. What is needed is what we call "rate limiting"—limiting the amount of mail users can send over some period of time. When you do this, you implicitly limit the total amount of mail they can send and, as a practical matter, can make high-volume spamming impractical.

Resource Library:

As I noted in a recent column, many ISPs are monitoring the use of port 25, the SMTP port, on their clients connections. They dont talk about specifics, but Im sure ISPs that exercise this route look not just at the volume but at headers and perhaps for evidence that the system is being remotely controlled.

Blocking actual use of the ISP mail servers is another matter. I spoke to a couple of ISPs that do monitor their mail servers looking for abuse. Clearly, there are some things users can do that would block most acceptable usage policies, such as sending viruses or pornography, but it basically seems to me that they are keeping their policies vague.

I think the time has come to be more specific. Set a rate limit for outbound mail for consumer accounts. There are systems available to enforce it. And it would be yet another sign to users whose computers have been taken over that they need to clean them out.

Next Page: Choosing strong passwords.

>>> More Network Security & Hardware Articles          >>> More By Larry Seltzer