Message Board

Tracking Harvesters/Spammers

Found a spammer... in the next cubicle over...

Author: L.Perplies (29 Sep 08 11:07am)

So my boss goes on vacation awhile back. Previously he did nothing but complain about his computer, so I decide to help him out while he's gone and fix whatever the problem is. The IT department is fed up with him and his complaining so this'll be a great time to take care of it and not hear his whining.

I start cleaning it out. First off, dude... seriously stop browsing the porn at work. If your that bored then play some browser game or something. Maybe your good at solitaire. Or if you must browse the porn, use a webproxy and disable Javascripting.

But in any case, I clean off about 90% of the stuff and then find out that a worm has created an SMTP engine somewhere and is sending out approximately 150-300 spam emails per minute! I pull the network cord and firewall the SMTP. I eventually get it cleaned out, now I stay late about one night a week just to clean his computer again and make sure we don't do this.

So, if you've gotten a message recently that says something like "Spongebob named in Paris Hilton's paternity lawsuit!" (and, no, I'm not kidding) then I'm sorry.

But the question here is about laws specific to the US.

I know if your computer sends out spam you are liable according to the law. Since his computer was sending spam without his knowledge, is he legally liable?

Do you think if he did end up in a court about this a jury would convict him?

I'm figuring he'd be liable legally, but since it was done without his knowledge they wouldn't prosecute him, but instead try to get the person that created/installed the zombieware in the first place.

Just wanted to get your opinion on the subject. I'm not worried about my boss whatsoever though... might make a good three day weekend. (Kidding!)

Re: Found a spammer... in the next cubicle over...

Author: L.Huston (17 Dec 08 12:21pm)

Great work,!

My next question would be why your IP department is so negligent to not notice that volume of traffic? I use a network traffic tool on my own systems that would have detected that within 2-3 minutes or less. This is part of the problem as most people are unaware THEY are the source of spam. On my personal computer I use Zone-Alarm Pro that has a tool built in that would block any email system based on the volume of emails sent. Its user controlled and can be setup to block at any given rate per minute, or if the CC has more than a given number of recipients. A very effective tool that your IT people could quickly implement.

Re: Found a spammer... in the next cubicle over...

Author: J.Sniderman (4 Mar 10 2:42am)

Wow! So, none of the recipients contacted your company or its upstream provider's abuse@ address??

Either way, I am definitely not a lawyer, but afaik a lot of people download some junk, get their machines infested, and unknowingly send out spam.

At least with home users, many dynamic ranges are already blacklisted in PBL or something similar. Im pretty sure that there is a blacklist for hacked/exploited computers as well, check on spamhaus to see if any of your companies IP's are listed.

Most important: Block connections exiting your companies network on port 25 that originate from anywhere but the corporate email servers, and impliment some kind of filtering of outgoing mail from servers, so that an authorized user cannot spam, on purpose or otherwise.

Also, I wonder what your company's policy on browsing porn from work is? Most places that alone is enough for termination.