Microsoft's anti-spam plan

Microsoft's plan to reduce spam by forcing an email sender's machine to solve a puzzle may be defeated by the Internet's army of zombie PCs, say security experts

One of Microsoft's plans to fight the spam epidemic is unlikely to adversely affect spammers or reduce the quantity of spam, according to security experts.

Microsoft's chairman Bill Gates has been calling for the IT industry to work together and eradicate the spam problem. About six months ago he unveiled an initiative called Penny Black, which was a method for reducing a spammer's ability to send large volumes of unsolicited emails using Hotmail and MSN accounts. He suggested making the senders' computer process a complicated mathematical puzzle, which takes approximately 20 seconds, before each message is released. The puzzle's result is attached to the email's header, so that a receiving gateway can recognise emails that have been through the process and allow them to pass.

Security experts welcomed Gates' plan in principal because it made sense to try and throttle back a computer's resources enough to stop it sending out enormous volumes of spam. However, they fear that in practice this approach might be flawed, because most spam is sent from zombie PCs, computers that have been infected by a type of virus or Trojan horse. Infected machine may be owned by an innocent home user but they are controlled by organised criminals over the Internet.

Simon Perry, the vice president of security at Computer Associates, warned that if a consumer's machine was taken over by a Trojan that used Hotmail to send spam, it would cause serious problems.

"If the machine has been taken over by a Trojan, and assuming the Trojan is not using its own SMTP engine, 20 seconds could turn into 200,000 seconds," Perry said.

latr a servey of IT security professionals conducted at the Infosecurity show in London this week revealed that more than 80 percent of people do not think that Bill Gates' pledge to eliminate spam within two years is realistic.

'lets hope'