‘Open Relay’ Anti-Spam Tool Loses Effectiveness

E-mail service providers have been using the Open Relay Database tool for years to restrict spam waves. The five-year old tool has, however, ceased operating partly due to its own success.

The database's operators in a farewell note of December 18, 2006 said that the open relay lists were no longer as much effective to prevent spam gushing into networks as they used to be. This is because spammers now use more sophisticated techniques against anti-spam community's improved tactics.

Spammers have since long been exploiting e-mail servers with open relays that accept e-mails from any system to transmit to any other. Such e-mails are therefore classified as junk e-mails.

Service providers took action by using ORDB lists to block e-mail traffic including authentic e-mails that move through open relay servers. This pressurized operators of such relays to allow outbound e-mails of their own customers only.

Mail-server software has been trafficking e-mails with also closed relays making the severity of open relay threats less significant. For spammers use zombie PCs, generally those of home consumers by taking control over them through viruses and other malware, to send out spam mails. ORDB was in common use in the past when open relays were the major medium for spamming operations, said John Levine, co-author of "Fighting Spam for Dummies". Now most spam goes out from virus-controlled zombies. Today there are more ways than there were with open relays.

Levine said lists such as one from Spamhaus that also target zombies have recently been more powerful.

ORDB's number of open relays came down in late 2004 and since then has more or less stagnated at 225,000 servers. ORDB decided to shut down its project instead of expanding it to take in zombies. For that would have meant a lot of effort without increasing resources, according to one of the database's operators, Andreas Plesner Jacobsen.

The decision was taken one year back but nobody took the initiative to execute it, said Jacobsen. He added that currently, such a small percentage of e-mail servers rely totally on ORDB to combat spam, that it wouldn't be a surprise for people to find lot of junk in their mailboxes.

Related article: “Loopholes did not cause online banking thefts”: ICBC

» SPAMfighter News - 1/5/2007