Feeds

Criminal case against ORBZ spam blacklist dropped

Battle Creek holsters legal guns

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

The City of Battle Creek, Michigan, has agreed not to pursue criminal charges against the administrator of spamlisting blacklisting service ORBZ, which led to the withdrawal of the service earlier this week.

The move lets Ian Gulliver, the administrator of ORBZ.org, off the hook for allegedly causing a major slowdown of its mail server in the course of testing for open mail relays, which are often used as a tool by spammers.

According to a statement issued by Battle Creek, the city initially suspected criminal mischief when tests conducted by Gulliver triggered a weakness in the version of Lotus Domino software used by the City. The tests caused a major slowdown of the City's email network for about a day on February 25.

It called the police who served a search warrant on Gulliver, a 20-year-old systems administrator from New York state, who fearful of the consequences of criminal charges, pulled the plug on ORBZ.

Doubtless that helped to convince Battle Creek (the home of Kellogg's) that he had no criminal intent, prompting it to drop charges.

It seems doubtful if the ORBZ blacklist will be restored to operation even though the threat of criminal charges has been lifted. Many Regsiter readers have written to us criticising ORBZ's methodology.

But what about the Lotus Domino security issue?

Last August, Gulliver sent a message to the BugTraq mailing list stating that the ORBZ scanner creates "oddly formed mail envelopes that can cause Lotus Domino to enter a mail routing loop" resulted in the crash of a mail server.

The issue, which we're told was never particularly serious, was fixed with Lotus Domino version R5.0.9 last September. With normal anti-relay configuration in place, the exploit didn't work anyway, Notes administrators have told us.

Apparently Battle Creek failed to update its servers in a timely manner, so it came a cropper in February. It has now fixed the problem, and pledged to review its security policies to learn lessons from its email outage, and prevent a reoccurrence. It said it now recognises that Gulliver "has done us a service", though it has criticisms of his actions.

"We are going to be taking a close look at our policies regarding Lotus security updates and how we can avoid the issue in general," said Michelle Reen, Assistant to the City Manager.

"In turn, however, we have asked him [Gulliver] to reconsider his policy of making unannounced tests on servers. In today's computerised world it is everyone's responsibility to maintain a secure system."

"But, if I can draw the analogy that just because everyone should wear a computerised bullet-proof vest doesn't mean that shooting people to find out who isn't wearing one is the best answer," she added. ®

Related stories

ORBZ shuts up shop, cites criminal charges
ORBS now split into three
ORBS splits into ORBZ and ORBL
Junk mail costs lives

Internet Security Threat Report 2014

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
BIG FAT Lies: Porky Pies about obesity
What really shortens lives? Reading this sort of crap in the papers
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
You think the CLOUD's insecure? It's BETTER than UK.GOV's DATA CENTRES
We don't even know where some of them ARE – Maude
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?