- NANOG - lists.nanog.org

RE: Lazy network operators
by daryl＠introspect.net 14 Apr '04

14 Apr '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Michael.Dillon(a)radianz.com > Sent: Wednesday, April 14, 2004 5:18 AM > To: nanog(a)merit.edu > Subject: Re: Lazy network operators > [...] > A tier 1 provider in the SMTP mesh does not have to > be the same thing as a tier 1 provider in the > physical mesh. See the structure of the NNTP mesh > over the years for examples. I fully expect to see > specialized email peering providers arise who will > have SMTP peering arrangements with the large email > site like AOL, Yahoo, Hotmail etc. and who then arrange > peering with large numbers of smaller sites who either > cannot find SMTP peering locally or who want to > be assured of alternate SMTP routes in the event > their main peer cannot reach all destinations. Michael, I picked your message simply as a representative of this viewpoint. But can you ro someone who shares this idea please explain to me how this model accounts for compromised hosts sending their spam through the default MTA or using the default MTA setting son the host? After all of this trouble to get such a system in place, it's going to take the spammers 1/100th of the effort the operation community has put in to thwart the system. But maybe I'm wrong. I'd love to be wrong on this one. Daryl G. Jurbala BMPC Network Operations Tel (NY): +1 917 477 0468 x235 Tel (MI): +1 616 608 0004 x235 Tel (UK): +44 208 792 6813 x235 Fax: +1 215 862 9880 INOC-DBA: 26412*DGJ PGP Key: http://www.introspect.net/pgp

2 1

Re: Lazy network operators
by Miquel van Smoorenburg 14 Apr '04

14 Apr '04

In article <cistron.407D01BB.90708(a)he.iki.fi>, Petri Helenius <pete(a)he.iki.fi> wrote: >Miquel van Smoorenburg wrote: > >>That was solved 6 years ago. You let them use port 587 instead of 25. >>http://www.faqs.org/rfcs/rfc2476.html > >How many MUAs default to port 587? The one I use daily does. >How many even know about 587 and give >it as an option other than fill-in-the-blank? Setting up authenticated SMTP in most MUAs is an order of a magnitude more complicated than changing port 25 to 587 anyway. >...back to the computer literacy requirement again... >How many support calls you get by requiring 587 instead of 25? I don't know, but we get a lot of support calls about spam and viruses, so if we can cut back on those .. But the subject is still spot-on: not moving customers to port 587 for mail submission because it would be "too hard" is laziness on the part of the ISP. Mike.

1 0

RE: Lazy network operators
by Michel Py 14 Apr '04

14 Apr '04

> John Curran wrote: > If we can fix this by changing default behavior to make such > machines less useful to hackers, while still allowing anyone > who wants to originate to do so at will via configuration, > what is the harm? Besides architectural purity (which still bears weight) the problem is that configuration costs money. I have my own SMTP server at home because I'm not happy with my ISP's smarthost. That same ISP can't reverse-lookup my static IP to return a PTR that has my domain name in it, explain me how they will build a filter that un-filters port 25 for my IP and does not for the next one. Michel.

2 1

Re: Lazy network operators
by Eric Brunner-Williams 14 Apr '04

14 Apr '04

> the only people who benefit from the current pricing model are registrars. > if domains cost $300 a year we'd have less than 1% of the number we have now, > but the ones we have would actually get used. i have never received mail > from a domain ending in .biz that was not spam, for example. while i worked for neustar when they were proposing .biz and .us, i didn't know what a bunch of idiots and crooks the management are. they do run lnp and you can look for spam on your tone too courtesy of the lnp dip operator. the current pricing model is $6 to vgrs and its successor in interest, afilias, plus two dimes to icann, and the rest to registrars. some have put their price point down to sub-dollar. the interesting tidbit from the gmail launch was the $2/gb/yr costing that google published. the recurring cost to the db operator for store of what is a sheet of paper is well under $6/yr/sheet. with fewer than 10^^8 total registrations, and five registrars with most of the total volumn, most registrars must have fewer than 10^^6 registrants and make a business unit (meet ongoing icann fees and per-registry fees), etc. the price point for .coop domains is higher, i've yet to get spam from any. there are other ways than pricing to drive down the number of domains and drive up the use of the remaining domains. until recently to get a domain in .cn one actually had to touch paper in the prc and meet some sanity check for allowed use. eric

1 0

Re: Lazy network operators
by Eric Brunner-Williams 14 Apr '04

14 Apr '04

> The spammers are already creating throw-away domains ... <registrar-hat=on> yup. i've been watching today's crop-o-spam. its pretty consistent, within 48 hours of a buy the domain shows up in a body of a spam, and the buy is for just one year. my business customers almost always throw 10 year buys at me. my intra-registrar proposal is that we make these point at someplace novel, and make domain name persistency shorter than a year on the value-flow side of spam models.

2 1

RE: Lazy network operators
by Michel Py 14 Apr '04

14 Apr '04

> Steven M. Bellovin wrote: > The spammers are already creating throw-away domains; Indeed, a little stockpile has never hurt anybody; by registering them now they'll even have some that have been registered for 11 months when they use them in March 2005. There already are RHSBLs lookup shops that attempt to block these as well. > they'd do the same with mail sender authorizations. True; although they will not suppress spam mail sender authorization schemes do have two advantages: a) they will curb some (from the dumber spammers that still send their crud on behalf of joe12345(a)bigeye_isp.com) and b) they will seriously reduce phishing schemes on behalf of ebay.com or mybank.com. Michel.

1 0

Cr/Hackers Strike Advanced Computing Networks
by Sean Donelan 13 Apr '04

13 Apr '04

This was covered in the Washington Post, but the real information is on Stanford's web site. http://securecomputing.stanford.edu/alerts/multiple-unix-6apr2004.html

1 0

RE: Lazy network operators
by Eric Krichbaum 13 Apr '04

13 Apr '04

We do that here, and I agree it should be a standard practice from the dialup/broadband/etc. provider standpoint. Aren't some of the newer malware/viri using the SMTP setting out of the email client to send through now to get around that anyway? It really shouldn't matter though. I'd rather be: a.) blocking the port 25 traffic and b.) virus scanning the outbound mail, than dealing with the thousands of "Your user tried to hack my system. I'm calling the FBI on you." messages. Eric -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of John Curran Sent: Tuesday, April 13, 2004 3:53 PM To: Stephen J. Wilcox Cc: nanog(a)merit.edu Subject: Re: Lazy network operators At 8:39 PM +0100 4/13/04, Stephen J. Wilcox wrote: >Most of the spam I'm seeing comes directly from end user hosts that >have either an open proxy on them or some kind of malware with its own >SMTP engine designed to send out junk.. in this model the only port 25 >traffic is that from the end host coming outwards, I believe you're >suggestion is to filter port 25 towards hosts. > >Even blocking the outbound 25 traffic (eg pushing it via the ISP SMTP >relay) will not stop the emails. It is possible to extend this and >implement some sort of statistical sanity checking on the mail being >relayed (eg alarm/deny mail once it exceeds X/minute/host) which is potentially a workable solution. Steve, I'm very much suggesting blocking outward to the Internet port 25 traffic, except from configured mail relays for that end-user site. Those hosts which have MSTP malware are stopped cold as a result. /John

1 0

Dialin access in USA, off list
by frank＠try-us.de 13 Apr '04

13 Apr '04

Hello nanog, our company is looking for dialin web-access on a call by call basis in North-America (USA, Mexico, Canada)via ISDN or analog modem. Please contact me off list and thank you for your assistence -- Best regards, Frank Kuempel mailto:frank@try-us.de If it's there and you can see it - it's REAL If it's there and you can't see it - it's TRANSPARENT If it's not there and you can see it - it's VIRTUAL If it's not there and you can't see it - it's GONE

1 0

Computer room A/C
by Christopher J. Wolff 13 Apr '04

13 Apr '04

Hello, If anyone can recommend a dealer of surplus computer room/industrial AC equipment please have them mail me offlist. Thank you very much for your assistance. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

1 0