April 2004 - NANOG - lists.nanog.org

RE: Spam with no purpose?
by Michel Py 06 Apr '04

06 Apr '04

>> Michel Py wrote: >> 1. Reduce the efficiency of Bayesian-like filters: Trouble >> with this kind of email is that they are a) of sufficient >> length b) contain only "real" words c) contain none of the >> words regularly used by spammers such as the v. word. > Paul Jakma wrote: > Good bayesian filters do not score on single words alone, > they also score on "phrases" (ie multiple words). Random > strings of words will result in neutral scores (presuming > those words are also used in non-spam), while the phrases > will be slightly higher. Re-used gibberish (ie apparently > random) strings of words will result in "phrases" from > that gibberish having high scores. Indeed; notice I did write "Bayesian-like" and not "Bayesian" and never mentioned anything about good ones or not-as-good ones. > Also, a good bayesian filter should prune its database > regularly of phrases (including one word phrases) that > have not had their score updated recently, further > reducing "pollution" by random words and phrases. > noise is just noise. the spam specific stuff will > still be statistically significant, hopefully. I understand this too. However, I think the point you are missing here is the difference between "what could be done" and "what people have". The fact of the matter is that spam messages including a bunch of random dictionary words have had and still have a much higher penetration rate than messages that don't feature it. The proof is in the pudding. And as I said earlier, expect the "bunch of dictionary words" to mutate into a more sophisticated animal that includes correct grammar. What you and I do or could do (on a small scale) in terms of spam filtering is largely irrelevant. If spammers were smart they would not send us (collectively) spam to begin with, as the only thing it achieves is to get us pissed and implement more filtering. In the end, the only thing that matters is not what we could do about filtering neither how much spam _we_ get, but how many spams joe-six-pack gets per day. WRT this, although it is true that we have made tremendous progress in terms of filtering, it is equally true that the spammers have made tremendous progress in defeating our counter-measures, resulting in end-users getting unprecedented and still increasing amounts of spam. The measuring metric here is _not_ that we successfully filter 90% or 95% or 99.99% of spam; this is meaningless. The meaningful metric is: how many spams does joe-six-pack get a day. There is no difference between a) joe-six-pack getting 50 spams a day and us canceling 450 a day and b) joe-six-pack getting 50 spams a day and us canceling 9950 a day. Actually, there might be one: the spammers laughing their bottoms off thinking that filtering 9950 spams per day per user costs us 100 times more than it takes them to send 10000 spams per user per day. Michel.

3 2

RE: Spam with no purpose?
by Michel Py 06 Apr '04

06 Apr '04

>> Michel Py wrote: >> ... And as I said earlier, expect the "bunch of >> dictionary words" to mutate into a more >> sophisticated animal that includes correct grammar. > Tony Hain wrote: > So the useful content of lists like this one would be > filtered. Maybe this is really just a ploy by the tech > writers of the world for full-employment... ;) Or a ploy by some software vendor to force everyone to use a spell and grammar checker :-) Note that I'm not saying it's good, simply that I see it coming. > Todd Vierling wrote: > This has already happened; there is some well known spam that > consists of HTML "content" or an image-based ad, with snippets > of recent AP newswire stories in the plaintext body section. Indeed, and between AP newswire, good random generators and quotations borrowed from the zillion pages of text available on the web, it's going to take a really, really smart software to make the difference between spam and real email. Michel.

4 3

he.net or other ipv6 tunnelbroker service?
by Suresh Ramasubramanian 06 Apr '04

06 Apr '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi This has been facing periodic downtime for a day or two at a time quite a few times over the past few months. Probably related to http://ipv6.he.net/forum/read.php?f=1&i=717&t=717 where Mike Tindle of he.net described a situation where they were facing capacity issues on their router, setting up CEF ... and another situation where there are so many tunnels, it's not fitting into nvram on the tunnelbroker router but was being loaded off / written to a pcmcia disk. Right now current downtime has been about two or three days. http://ipv6.he.net/forum/read.php?f=1&i=787&t=787 I know, it is a free service and I really shouldn't be bitching. I'd consider upgrading to a paid tunnel, but their paid service offers only v6 colo at their facility and leased lines (T1 all the way to OC48). My personal colo is at another facility nearby (Sherman Oaks CA) and all I need is a simple v6 tunnel. Anybody else around nearby who offers a tunnelbroker (I think the only other free one on the same continent is Viagenie / freenet6, in Canada, which gives you 6bone IPs) srs - -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) iD8DBQFAcL1/RB4r9e3t77kRAhWAAKDAH+WXOapP3oKMB9HMyijxFG8bFACg6uim q72yIY4BlTuKQCqI2vGyjO4= =hp59 -----END PGP SIGNATURE-----

2 2

RE: Mailserver requirements
by kwallace＠pcconnection.com 05 Apr '04

05 Apr '04

Hi Arnold- Whether or not you will accept mail from an address without a (matching?) reverse record is usually an option on your mailserver software. In terms of outbound mail, AOL, for example will no longer accept mail unless the reverse is present. Some providers insist that it match, which makes things a little dicey if your mail server is handling multiple domains. I've gotten around that by wasting an ip address for each domain, and setting up the reverse records accordingly. Also, lots of folks are now verifying the validity of the sender to try to prevent spoofing the mailfrom. (although the spammers only have to spoof a valid email address to get around that) -Keith -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] Sent: Monday, April 05, 2004 5:03 PM To: NANOG Subject: Mailserver requirements Today I run across a MTA which refused to accept mail because it could not detect an MX record for the reverse mapping of the IP address of the server which tried to deliver mail. Is this correct? Or: if A is the IP Address of server trying to deliver mail, does mx(reverse(A)) have to exist? -- Arnold

1 0

Re: Mailserver requirements
by Roman Volf 05 Apr '04

05 Apr '04

He isn't saying it needs a reverse address. He's saying that the reverse address needs an MX record. Roman Volf Keystreams Internet Solutions volfman(a)keystreams.com Mike Walter wrote: >Arnold, > I am surprised you don't have problems sending to AOL as well. >They don't accept email from servers that do not have reverse addresses. >I don't accept email from severs without reverse addressing. > >Mike Walter, MCP >3z.net a PCD Company ><http://www.3z.net> >"When Success is the Only Solution t h i n K 3z.net" > > >-----Original Message----- >From: Arnold Nipper [mailto:arnold@nipper.de] >Sent: Monday, April 05, 2004 5:03 PM >To: NANOG >Subject: Mailserver requirements > > > >Today I run across a MTA which refused to accept mail because it could >not detect an MX record for the reverse mapping of the IP address of the >server which tried to deliver mail. Is this correct? > >Or: if A is the IP Address of server trying to deliver mail, does >mx(reverse(A)) have to exist? > > > >-- Arnold > > > -- Roman Volf Keystreams Internet Solutions volfman(a)keystreams.com

1 0

NANOG 31 Meeting Information
by Carol Wadsworth 05 Apr '04

05 Apr '04

Registration is now open for NANOG 31, May 23-25, 2004, in San Francisco. The meeting will be hosted by CNET Networks. For additional meeting information, please see: http://www.nanog.org/ See you there!

1 0

RE: IANA IPv4 allocations and bogon update: 85/8, 86/8, 87/8, 88/8
by Michel Py 04 Apr '04

04 Apr '04

> Rob Thomas wrote: > The numerous Team Cymru bogon projects have been updated as of 01 APR > 2004 to reflect the following IANA allocation made on 01 APR 2004: > 85/8 Apr 04 RIPE NCC > 86/8 Apr 04 RIPE NCC > 87/8 Apr 04 RIPE NCC > 88/8 Apr 04 RIPE NCC And the amount of time it took me to update my bogon filters is.... Zero. Zip. Because I use Team Cymru's bogon route servers :-) Michel.

4 3

NANOG list reverse DNS handling
by Iljitsch van Beijnum 03 Apr '04

03 Apr '04

A couple of days ago I moved my mail server, and inadvertently mistyped its name in the reverse DNS. After this, I noticed a message wasn't making it to the list. Investigation showed: rcpt to: nanog(a)nanog.org 450 Client host rejected: cannot find your hostname [83.149.65.1] info at: http://www.merit.edu/cgi-bin/mn/reversednsinfo Ok, so far so good. But when I visited the URL mentioned in the rejection message, I just got a web form saying "Please enter your e-mail address and select your organization from the list below". Obviously this is meant to do _something_, but it's entirely unclear what and why. After this the page I think should have been referred in the first place comes up: http://www.merit.edu/mn/support/reversedns.html There is also a link to a DNS checking tool. However, this tool is pretty much useless in situations such as the one in which I found myself, as it doesn't answer the real question: what is the TTL for the offending DNS information.

3 2

.mil contact information
by German Martinez 03 Apr '04

03 Apr '04

Hello, Could somebody from any .mil network contact me offline ? Thanks German --- "Discouragement is an enemy of your perseverance. If you don't fight against discouragement you will become pessimistic first, and lukewarm afterwards. Be an optimist" -- St. JoseMaria Escriva (1902 - 1975) Opus Dei's Founder

2 1

RE: Spam with no purpose?
by Michel Py 03 Apr '04

03 Apr '04

> Deepak Jain wrote: > Can someone explain to me (publicly or privately) why someone > would send spam with no product to sell, no position to pitch, > nothing except text designed to get by a spam filter -- without > even HTML to KNOW it got by a spam filter.. Likely two different goals here: 1. Reduce the efficiency of Bayesian-like filters: Trouble with this kind of email is that they are a) of sufficient length b) contain only "real" words c) contain none of the words regularly used by spammers such as the v. word. It's a lose-lose situation for the spam engine: - If this message is marked as spam, it increases the likeliness of false positives, as the message shares different common points with real email in spam-measuring metrics such as length, percentage of real words, etc. - If this message is marked as legit, it reduces the catching abilities of the spam engines as it shares similar patterns with a spam that would be essentially the same text altered to a spam content. You can bet that it won't be long until we see such messages that not only use only dictionary words, but furthermore are constructed with a valid grammar (and still mean nothing). One of the next fronts in spam detection is based on grammatical correctness. What we are looking at is the eternal battle between the shield and the weapon: as soon as someone invents a new shield, someone else develops a new weapon that will pierce it. 2. It might a statistical probe spam: Spammer xyz has a list of 1 million addresses, out of which 500,000 are invalid and bounce. By using a return address that is actually not bogus, the spammer can indirectly measure the efficiency of Bayesian outsmarting strategies. First the spammer send a spam that will be blocked by the majority of spam-detection engines (even the dumber ones) by including correctly spelled well-knows spam words in both subject and text. You know, the stuff that promises to put a foot in your pants that features "always-on" service. Let's say that our spammer gets 150,000 bounces out of this one, the math is simple: out of 500,000 potential bounces they got only 150,000 which means that 350,000 have been blocked by spam engines prior to the non-existing-user bounce. Then, our spammer sends the kind of email you referred to the same list and measures the bounce rate one more time. If this time he gets 450,000 bounces, it means that only 50,000 out of the 500,000 potential bounces have been blocked by spam engines, which in turns mean that the same email slightly alter will reach a large part of its targets. This is a simplified view, as bounce rate alone is not a valid measurement of outsmarting strategies, but correlating two or three of that kind of metric gives a reasonably precise of which spamming techniques still work, and which have become a waste of bandwidth. Michel. When someone dies, it's a tragedy. When millions die, it's a statistic. -- Josef Stalin --

3 2