---

BY DANTE FUOCO

In print | Published February 5, 2009

In an effort to ensure that e-mail providers and internet service providers won’t refuse mail sent from the network, the college has been working this past week to block spam from infected student computers acting as mail-servers.

Though mail would be blocked on some computers, ITS director Gayle Barton said in an e-mail sent to the entire campus that regular student e-mail shouldn’t be affected since the college would only block spam from computers acting as mail servers, which is not typical. A mail-server serves as the buffer for mail at the college — mail coming to and coming from the network must first go through it before it can be delivered or sent.

The e-mail said that “several dozen student computers” have been involved in some sort of spamming in the past month. And the fear throughout the school is that if there is too much spam coming from college computers, corporations, ISPs and external e-mail providers such as Gmail, AOL and Yahoo, will “blacklist,” or refuse, mail from the Swarthmore network.

“More than half of all spam volume worldwide originates from hacked or infected PCs,” the e-mail said. “Our efforts to reduce spam originating from the Swarthmore network won’t significantly impact worldwide volumes but they will eliminate unnecessary network traffic for our users and reduce the risk of being blacklisted.”

So far the college’s efforts to stop spam have been successful.

Information Security Analyst Nick Hannon said on Monday morning there weren’t any infected computers. Tuesday morning there was only one machine on the list, which Hannon later said was most likely due to a minor configuration error that has been fixed.

“What we blocked isn’t expected to be a 100 percent effective solution, but should reduce what we’re seeing,” he said in an e-mail. “The results so far are consistent with our expectations.”

Hannon said that the college has tried to be more proactive about spam prevention since this past summer, when major ISPs and external mail carriers blacklisted the swarthmore.edu site after spammers hacked college e-mail accounts.

“The campus kind of had a scare over the summer,” Hannon said. “It kind of raised our attention.”

Until the school explains to e-mail providers that the accounts sending spam are rogue accounts, it is impossible to send and receive e-mail, which is why it was fortunate that students weren’t here when it happened over the summer, Hannon said.

“So many people depend on their e-mail,” he said. “We’re trying to avoid that situation from happening again.”

Hannon added that this is “really frustrating” not only because the school has to work with external mail carriers to get the college removed from their blacklists, but also because companies and corporations have their own blacklists which the college may not even be aware of.

A computer running as a mail-server sends excessive amounts of spam, often equal to the volume of mail the campus sends in a day, Hannon said. Systems Administrator Jason Rotunno said that spammers aim to run mail-servers on personal computers because they can both access mail and avoid detection from the main mail-server. Even though Rotunno monitors the college’s mail-server to ensure “mail queues aren’t creeping up in volume,” he wouldn’t be able to detect spamming from a personal computer because it would have its own server, separate from the college’s. “We don’t see our queue increasing in size,” Rotunno said. “It’s a way to try to avoid [the system].”

Hannon said that the college discovered this most recent problem when it was looking at Swarthmore addresses. “We were seeing machines popping up [as mail-servers],” he said, which then led to the college blocking them from acting as mail-servers and, as a result, sending spam.

Despite the e-mail, Hannon said that there didn’t seem to be any confusion or concern from the student body.

“The main thing I wanted to be understood was that it wasn’t going to impact them,” Hannon said.

Something that has recently impacted students, however, is connection to the network. “We have been receiving more calls than normal regarding computers in the remediation zone this past week, and a good portion of the ones that I have seen in office are missing a piece of the Virus Scan software,” Restech Coordinator Seth Frisbie-Fulton said in an e-mail. He also noted that some computers may be in remediation by error.

Frisbie-Fulton explained that a computer is “automatically moved into remediation if it doesn’t have part of the required software.” He said, however, that while students go through a certain registration process to connect their computers to their network, ITS may also use this “registration system to disable the Internet access of students when we think their computer may be infected or hacked — usually when we detect an unusual amount of spam mail or hacker queries to our servers from their computer.”

If students are having trouble with wireless or wired connections, Frisbie-Fulton said that he’d urge them to take them to the Restech help desk in Beardsley.

---

« RETURN TO NEWS

« PREV ARTICLE | NEXT ARTICLE »