Spam over Tor

[Mike Cardwell]

Michael Holstein wrote:

>> What exactly is happening? Somebody is using your Tor exit node to
>> access a website (yahoo mail) and using that to send spam? And this is
>> being traced back to you by the spam being traced back to Yahoo, and
>> Yahoo checking their webmail logs and finding your exit node's IP?
> 
> Look at a Yahoo! mail's headers .. the IP of the submitter (by HTTP from 
> ...) is in there.
> 
> I don't see how this is any different than the "pwned" calls (eg: "hey 
> dood .. somebody flamed my blog from yer server!") .. people have been 
> using free porno (or whatever) to get folks to answer Yahoo/Hotmail 
> catchpas for a while now .. and then using those accounts to send spam 
> until Yahoo/Hotmail/etc figures it out and they move on to the next 
> account.

People can already block tor exit nodes connecting to their SMTP servers 
with ease. Blocking tor exit nodes that connected to yahoo to send email 
is only slightly more difficult, because of the received header that you 
mentioned. If spam ever became a problem on Tor, which I doubt, it would 
be easy for email admins to protect themselves from it. If yahoo ever 
see it as a problem, they can block it themselves.

> Actually blocking Yahoo mail without causing other problems would 
> require a fair amount of work, but could be done by proxying outbound 
> traffic and filtering the specific bits of the URL that allow composing 
> an email.

imo, that's a bad idea. If you're not willing to allow people to access 
a service via Tor, reject it in your policy. Don't allow it in your 
policy and then cripple access to it.

Mike