- NANOG - lists.nanog.org

Paging RR.COM regarding ISP mail blockage
by Mike Tindor 30 Dec '03

30 Dec '03

I've been trying to get in contact with RR.COM as well regarding blockage of mail from the netblock of our mail servers. Would an RR security/spam rep please contact me via noc(a)1st.net, abuse(a)1st.net or by phone regarding this issue. I have already mailed removal(a)security.rr.com and received an autoreply yesterday morning but have had no dialog with a human as of yet. Thanks, Mike Tindor FIRST Internet 740-695-2280 x 3070

2 1

Automated Network Abuse Reporting
by Jason Lixfeld 29 Dec '03

29 Dec '03

We're a small company but none the less are inundated with firewall logs reporting numerous attempts to find holes in our network; c'est la vie. Seeing as how we are small, we don't have the resources to go through and send emails off to the abuse departments of each network sourcing the probes. Question is: Has there been development of some sort of intelligent unix land app that can understand Cisco syslog output, find the abuse departments of the sourcing networks and send them off a nice little FYI?

9 9

RE: Cachibility analysis software ?
by Yu Ning 29 Dec '03

29 Dec '03

Abdullah, Thanks. We originally get this suggestion from our vendor (you know this major player's name :-). Then we realized, if not running WCCP between router and cache, then the cache is unable to throw back the request. So a more generic question. Can squid, or any other cache engine support by-pass function ? or "throw" back function when it find the request is not cacheable ? All question under no-WCCP condition. BTW, Is there any cache solution, other than Cisco, or Inktomi, that you think working well under 500~1000M backgroud traffic ? thanks ! Yu >-----Original Message----- >From: Abdullah Hameed Sheikh [mailto:ahameed@singtel.com] >Sent: Monday, December 29, 2003 12:20 PM >To: Yu Ning; Nanog >Subject: RE: Cachibility analysis software ? > > >Use policy routing to force all traffic to go out cache >interface. And the cache interface (via connected servers/ >cache engine) cache the web/ftp content and throw rest of the >traffic back to the router to make independent decision. > >If you are good in squid, and can write some IP layer >programming, you can do it in Linux. > >There is a company named something like Macanaye... They have >a very good implementation... The bad thing is that their >company name is so difficult that I cannot remember the >spelling and Due to such a "troubled" name, a lot of my >referral now using other products. :D > >If you are interested, I really need to dig thru my emails... > >regards >Abdullah > >-----Original Message----- >From: Yu Ning [mailto:yuning@ctnt.com.cn] >Sent: Monday, December 29, 2003 11:46 AM >To: 'Nanog' >Subject: Cachibility analysis software ? > > > >Hi nanog, > >Can anyone tell me is there any tool to analysis if a web site >is cachable ? Or now many content in a given site is cachable ? > >What's more, if router does not support WCCP, how can a cache >work with him ? Any suggestion ? > >thanks ! > >Yu Ning > >______________________________________ > >(Mr.) Yu Ning, Vice Director >Networking & Engineering Dep. >North Telecom BU, China Telecom >Beijing, P.R.China +86-10-66002099 >______________________________________ > >

2 1

African porn dialers, civil war and networks
by Eric Kuhnke 29 Dec '03

29 Dec '03

Forwarded from the Risks digest (www.risks.org) ================================================ Date: Sun, 21 Dec 2003 19:37:31 +0000 From: "Patrick O'Beirne" <mail2(a)sysmod.com> Subject: GuineTel seeks ways of clamping down on scam fraud By Brian King, Balancing Act's News Update 188 (21 Dec 2003) http://www.balancingact-africa.com Phantom Calls In 2003, Terri Lockwood of Indianapolis, Indiana received a phone bill with hefty charges for calls to Guinea-Bissau, a West African country she had never heard of, and much less had reason to call. When she disputed the charges, the American operator AT&T told her that the calls were genuine, and that she or someone in her house must have called, or accessed an adult entertainment site on the Internet. The intruder was a program that had slipped unnoticed onto the family computer, and reconfigured the connection to dial a number in Guinea-Bissau (code 245). The number, however, does not officially exist. The national operator, the regulatory body, and the International Telecommunications Union all agree that the number dialed from Terri Lockwood¹s computer is not programmed within the territory of Guinea-Bissau. Communications infrastructure of the country, furthermore, could not conceivably support the graphic-intensive content production and broadcast of many adult entertainment sites. For the last few years the national operator Guine Telecom has been concerned with repairing basic telephony infrastructure damaged in a devastating civil war. At the beginning of this year Guine Telecom had no new cables to repair its network, no wires to install phones for clients, and approximately 50,000 people on waiting lists. This is not a company receiving revenue from a brisk adult entertainment business, legitimate or not, apparently conducted in its name. The History In 1989 the Government of Guinea-Bissau cemented a strategic partnership with Marconi (now part of the Portugal Telecom group) All international traffic to and from Guinea-Bissau would run through Marconi in Portugal. Marconi was also given the right to open and maintain bank accounts abroad in the name of Guine Telecom. Critics of the company say that management of the company became increasingly chaotic and untransparent. Around 1996 Portugal Telecom managers set up a bank of computers at the earth station to receive pornographic calls from abroad. The calls were received at Guine Telecom and were immediately transmitted back without entering the national network. The practice reportedly generated significant new traffic to Guinea-Bissau, and the added revenue funded new investments in infrastructure. On June 7, 1998 a failed coup d¹etat tipped the country into civil war; key infrastructure (such as the earth station) was destroyed and in the midst of it the bank of audiotext (read 'phone sex') computers. After their departure in 1998 Portugal Telecom began withholding settlement payments for international calls terminating in Guinea-Bissau, and has continued to do so. A journalist from the major Spanish newspaper El País confirmed a so-called ³epidemic² of calls to Guinea-Bissau from Spain, appearing on the bills of people who had no relationship with the country. In all these instances the Spanish operator Telefonica responded that the calls were genuine. Around the same time, a dissatisfied Spanish pornography consumer actually called Guine Telecom to complain about the service. Technical Director Malam Fati was alerted, and so discovered for himself the existence of a number of web pages advertising live pornographic video. The pages appear to be designed to target particular countries; all are linked to a home page at www.sexhotel.com. The pages offer 'free' access to live pornographic video without requiring credit card information. Interested viewers need only to call a number on the screen (dialing instructions from each country are included), to receive a password. These access numbers bear the (245) international code, but the regional codes are not assigned within the territory of Guinea-Bissau. For the rest of this story, go to: http://www.balancingact-africa.com Patrick O'Beirne, Systems Modelling Ltd., Gorey, Co. Wexford, Ireland. +353 55 22294

2 1

RE: Stopping ip range scans
by william＠elan.net 29 Dec '03

29 Dec '03

On Mon, 29 Dec 2003, Abdullah Hameed Sheikh wrote: > There are two types of network: Enterprise and Service Provider. I kind of have both types. I call them unmanaged and managed. For certain ip blocks (always larger then /24) all traffic is passing through linux firewall with multiple vlans & ethernet ports to be able to accomodate multiple customers at the same time. I'd like to at least stop this scan for everything behind the firewall. Would be best if I stop it for entire network too, but that is just a wish and I did not see any easy way to do it using cisco configuration and modifying access lists every minute is probably not too interesting (here I again get reminded of the cooperative bgp filtering draft I worked on for bogons with Michael, Rob & Joren, see http://arneill-py.sacramento.ca.us/draft-py-idr-redisfilter-01.txt I'll have to wait until its part of OS to try something for scan prevention...). > The job of the service provider is very simple. Just provide plain > Internet connectivity. The above is true if you're very "plain" network provider. Some of us do more then just simple internet connectivity services... > if the traffic is detined to an IP which is > in my network, it is considered legitimate traffic. ) The problem is these are random scans, the traffic is going to ips that are not used and never were. They're clearly a random sequential scans. > But it can block your legitimate traffic as well. I've thought about it and the way I see it - if somebody is scanning me, its not a legitimate traffic to me and big potential security risk. So if same ip hits within fraction of a sec 2 or 3 sequential ip addresses on some monitoring device, it seems ok for me if its blocked for next 10 minutes (but not permanently). I don't think any legitimate traffic would be lost in this case. (Note: definition of "legitimate" varies from network to network and from one person to another). -- William Leibzon Elan Networks william(a)elan.net

2 1

a note to those who would automate their rejection notices
by Paul Vixie 28 Dec '03

28 Dec '03

today AOL thoughtfully supplied the following to postmaster(a)vix.com: Peewee1isme(a)aol.com SMTP error from remote mailer after initial connection: host mailin-02.mx.aol.com [64.12.137.89]: 554-(RLY:B1) The information presently available to AOL indicates this 554-server is generating high volumes of member complaints from AOL's 554-member base. Based on AOL's Unsolicited Bulk E-mail policy at 554-http://www.aol.com/info/bulkemail.html AOL may not accept further 554-e-mail transactions from this server or domain. For more information, 554 please visit http://postmaster.info.aol.com. this was in response to what the e-mail community refers to as a "trivial forgery", whose salient headers were: Return-path: <ediva.clapplz(a)vix.com> Received: from port-212-202-52-233.reverse.qsc.de ([212.202.52.233] helo=1-online-poker-video.com) by mx01.qsc.de with esmtp (Exim 3.35 #1) id 1AQIw9-0000bF-00; Sun, 30 Nov 2003 05:11:58 +0100 Message-ID: <0d7b01c3b6f8$814916c5$da62d340@ifptblb> From: "Ediva Clapp" <ediva.clapplz(a)vix.com> so once again we see, as in the case of the anti-virus rejection notices, that my reward for having my domain name forged in spam that didn't come from here, is to get mail from AOL telling me that they rejected it. so, i'll add this pattern to my own "drop silently" filters along with chaff from symantec's products, network associates' products, and so on. of the foundational principles which made the internet possible and which made it different from alternatives such as OSI, very few remain. one of them was "must scale indefinitely". a simple application of this principle toward anti-virus and anti-spam automated rejection notices is to ignore the envelope and ignore the header and just focus on the peer IP address: To: postmaster(a)[212.202.52.233] would have been a better destination for this. it's standards-compliant, and if the sender isn't an open proxy then they'll be able to get it, and it will not needlessly increase the collateral damage toward the holders of domains that were forged. "don't make me stop this car, kids." ...and to all a good night.

7 6

Re: a note to those who would automate their rejection notices
by Paul Vixie 27 Dec '03

27 Dec '03

> pv> of the foundational principles which made the internet > pv> possible and which made it different from alternatives such as > pv> OSI, very few remain. > > Would SPF <http://spf.pobox.com/> be a bit less destructive than many > other proposals to counter "trivial forgery". No. Nor will Yahoo's recently announced technology make any real difference. Preventing forgery is a way of protecting domain names as "service marks" and also ensuring that your own or your customers' non-spam output isn't snared in a bunch of false-positive trappery. But it won't stop or even slow the rate at which spam is sent or is received. Spammers still lie, but they are no longer as dumb as fence posts, and they can register throw-away domains whose crypto-authenticity is completely valid, even in the presence of wide scale wormspoor-proxy usage. It could be that I'm just especially irritable this year, or it could be that the reinvention frequency of bad ideas really is growing at the same rate as the internet's population. I no longer think that E-mail as we know it will survive. But I would be less irritable about it if the people who keep proposing to "save" it would (a) do their homework, (b) assume that spammers are going to try to adapt, and (c) think about the side effects of the tools they deploy. This is information warfare. "Warfare." You aren't fighting the terrain or the elements or some mindless bacteria. You're fighting other humans, and they are armed, committed, dangerous, and adaptive. In that light, I look at things like Bayesian filters or Vipul's Razor and I wonder, why is the "D" in Vern's DCC (see www.rhyolite.com/dcc) so difficult to predict a need for? (Y'all already know my views on relay-probing without spam-in-hand, but the tie-in here is "how can you fight spam if your principles aren't different from the people you're fighting? where exactly do you think it will end?") Anyway, I hope folks will stop sending automated rejection notices to domains who were not involved, other than by forgery, in the transmission of a virus or spam. In other words, there's relevant operational content in this thread, and when "fighting" spam it would be reasonable to avoid hurting uninvolved third parties. AOL, please listen.

2 1

RE: MS's new antispam idea
by Michel Py 27 Dec '03

27 Dec '03

David, >> Michel Py wrote: >> Besides, the deployment is sketchy: before it can be >> activated, it needs to be deployed at the vast majority >> of servers that send legitimate mail, which means that >> in the interim one still has to accept emails that don't >> use the system, which in turn produces no incentive to >> deploy it in the first place. > David Schwartz wrote: > While I think this scheme is a pretty bad idea, the argument > above is just not correct. Obviously, until this scheme is > widely-deployed, you have to accept email from sources that > won't perform this validation, but that doesn't mean that > there's no benefit to performing the validation or > requesting it. Your point is valid, but along with the benefits of performing the validation even if the deployment has not reached 100% yet comes major drawback: If it can be assumed that Microsoft or eBay will indeed shell out the resources to buy and operate a few rackfulls of 1U low-end servers to distribute the processing load, the same assumption does not apply to smaller entities. I have a relatively small customer (~200 employees) that has a 300,000 person mailing list; they effectively send 300,000 legitimate emails a day. If I stick to the figures proposed yesterday (10 seconds of CPU an email / 8000 a day for one CPU) what does it mean for these guys in the period before 100% deployment: They have to choose between: 1. Do nothing and risk being more filtered than they otherwise would be. 2. Bite the bullet, buy 37 new servers (while they were using one) and develop a mechanism to load share the computation of the puzzle. A large number of these guys won't go for the 37 extra servers. What does it mean for you and me in the decision to deploy or not to deploy such a scheme on our own mail servers: it means that the extended filtering capabilities you described (which are very valid) nevertheless have to be balanced with an increased number of false positives, that very number of false positives being greatly increased by the partial deployment. As of today, the way I see the challenge of spam is not in terms of how much you block, but in terms of the ratio of false positives to undetected spam. Unfortunately, in the interim period this enhanced filtering mechanism you describe would favor two categories: a) the big and/or wealthy (because they can buy the required resources) and b) the spammers (because they steal the resources) at the expense of the smaller organization. :-( Michel.

1 0

MS's new antispam idea
by Stephen J. Wilcox 27 Dec '03

27 Dec '03

http://news.bbc.co.uk/1/hi/technology/3324883.stm Ok so in summary you have to use a bit of CPU to solve a puzzle before it lets you send email. So either this doesnt work because spammers dont actually use their own PCs to send email or we are talking about a whole new mail protocol, either way I'm thinking this isnt going to work and its yet another publicity stunt. Steve

6 6

RE: MS's new antispam idea
by Michel Py 27 Dec '03

27 Dec '03

> Stephen J. Wilcox wrote: > So either this doesnt work because spammers don't > actually use their own PCs to send email Indeed; it doesn't do any good against spammers that control large numbers of zombie machines; they'll just distribute the processing load all over the place. And it would make life miserable for people that send large numbers of legitimate emails. Besides, the deployment is sketchy: before it can be activated, it needs to be deployed at the vast majority of servers that send legitimate mail, which means that in the interim one still has to accept emails that don't use the system, which in turn produces no incentive to deploy it in the first place. Michel.

2 1