Cyber Spam and High Speed Internet

Stories on cable’s high-speed data service lately have fallen into two categories. On the one hand is DOCSIS 3.0, which has emerged from the drawing board and now has found its way into press releases, such as Singapore-based StarHub’s announcement in June that it is working with Motorola on a 3.0 upgrade that should enable broadband download speeds of up to 50-100 Mbps. On the other hand is data’s tremendous revenue power. To take one not-so-random example, last April Comcast announced the addition of 414,000 data customers and a 32.5 percent increase in data revenue over the previous quarter. (Comcast’s next earnings conference call is scheduled for August 2.) There are nonetheless other stories to tell, as Internet providers of all stripes face ongoing cyber challenges and continue to work with vendors toward optimizing their data networks and improving their customer’s overall experience. Beware the zombies San Antonio-based PerfTech Inc., for instance, has found a way for Internet providers to shed themselves from the plague of zombies. While hideous zombies shuffle about after their hapless victims in the hokey horror movies genre, PerfTech clamps down on zombie computers that spit out chunks of spam without affecting the rest of an Internet providers’ e-mail customer base. In late April (and a good month before the Federal Trade Commission launched its "Operation Spam Zombies") PerfTech applied its device —the product is called Abuse Sentry— to Cisco Systems’ routers on five points of presence that Wide Open West serves in its Illinois, Michigan and Ohio markets. "Ever day they (WOW) were getting at least 400 abuse complaints coming in," said Jonathan Schmidt, one of the founders of PerfTech and the company’s vice president of new business development. "After a weekend, they had close to 2,000 and it took a high level of support staff to resolves these. It was very expensive and Wide Open Networks was getting threats of blacklisting from AOL and others." Beyond port 25 Schmidt said one of PerfTech’s devices, which can connects to the router using standard router protocol and while the router is still in operation, can serve up to an OC-92 Cisco router. The routers pass packets to the PerfTech device without looking at the content of the e-mails. For the first month, Abuse Sentry analyzed the information from the subscribers to see which computers were sending spam. The analysis of WOW’s network showed that 90 percent to 95 percent of the outbound e-mails that consisted of spam were being perpetrated by only 1 percent of WOW’s 200,000 data subs. Most of the offending spammers were unwitting hosts to spam zombie viruses that used their computers to spread spam. One quick solution to offing zombie computers that send spam is for Internet providers to close the SMTP port, or port 25, to all but their own servers, which all of the e- mails would then be required to pass through. In this scenario, if the Internet provider doesn’t turn off port 25 to its commercial accounts as well they can become infected. Schmidt said Abuse Sentry can solve the problem without "draconian" measures such as turning off port 25. Once the data on subscribers was gathered. Abuse Sentry started blocking the outbound e-mail traffic of any spamming subscriber. At the same time, it delivers a message to the subscribers’ browser that alerts them to the problem and sends them a link to Trend Micro’s Web site so they can remove the zombie virus. "The goal was to automate the process and keep them (subscribers) from calling support," Schmidt said. "The bulletin is a subscriber-friendly communication that comes up like an extra tool bar in the browser without disturbing the contents of the page. "Wide Open Networks has also used the bulletin for Amber alerts in Ohio. Over 90 percent of the subscribers read the bulletin within two days, 38 percent clicked through for more information and no one complained on the user forum." Like a good ISP neighbor Abuse Sentry blocks access to port 25 at the same time it sends out the bulletin. Once the offending computer is virus free, an e-mail notice is sent to subscribers letting them know that their e-mail service has been restored. "Two of Wide Open Network’s support staff were able to go on to bigger and better things once the complaints when down from 400 a day to single digits," Schmidt said. "The one support person that is left is called the ‘Maytag man’ by his fellow employees and only does spam complaints part time. Another benefit is that Wide Open Networks doesn’t have to worry about being blacklisted, and now it’s a good-neighbor ISP because spam is no longer coming out of its systems." – Mike Robuck