- NANOG - lists.nanog.org

VeriSign SMTP reject server updated
by Matt Larson 25 Sep '03

25 Sep '03

Folks, One piece of feedback we received multiple times after the addition of the wildcard A record to the .com/.net zones concerned snubby, our SMTP mail rejection server. This server was designed to be the most modest of SMTP implementations and supported only the most common sequence of SMTP commands. In response to this feedback, we have deployed an alternate SMTP implementation using Postfix that should address many of the concerns we've heard. Like snubby, this server rejects any mail sent to it (by returning 550 in response to any number of RCPT TO commands). We would like to state for the record that the only purpose of this server is to reject mail immediately to avoid its remaining in MTA queues throughout the Internet. We are specifically not retaining, nor do we have any intention to retain, any email addresses from these SMTP transactions. In fact, to achieve sufficient performance, all logging has been disabled. We are interested in feedback on the best way within the SMTP protocol to definitively reject mail at these servers. One alternate option we are considering is rejecting the SMTP transaction by returning a 554 response code as described in Section 3.1 of RFC 2821. Our concern is if this response effectively causes most SMTP servers to bounce the message, which is the desired reaction. We are researching common SMTP servers' handling of this response code; at least one popular server appears to requeue mail after receiving 554. Another option is remaining with the more standard SMTP sequence (returning 250 in response to HELO/EHLO), but then returning 550 in response to MAIL FROM as well as RCPT TO. I would welcome feedback on these options sent to me privately or the list; I will summarize the former. Matt -- Matt Larson <mlarson(a)verisign.com> VeriSign Naming and Directory Services

29 36

RE: Re[2]: williams spamhaus blacklist
by netadm 25 Sep '03

25 Sep '03

>> That describes the escalation procedure of SPEWS, but is not at all >> accurate for the SBL, we do not expand listings sideways into >> customer space or block whole ISPs [*]. >> Mr. Linford's Spamhaus has recently blocked our entire ISP because of 2 entities on our network we are working to terminate (it is a bit more complicated than simply pulling the plug). In addition, we have recently requested removal of listings once we have terminated the customer in question, but received no response. We can vouch for the fact that www.spamhaus.org blocks far more than just sources of UCE. In our case, it is our entire network. -----Original Message----- From: Steve Linford [mailto:linford@spamhaus.org] Sent: Thursday, September 25, 2003 8:22 AM To: Hank Nussbacher; nanog(a)merit.edu Subject: Re[2]: williams spamhaus blacklist At 12:50 +0200 (GMT) 25/9/03, Hank Nussbacher wrote: > AS3339 has a zero tolerance for spamming. With just one spam > complaint we block the IP in question. We have a downstream customer > that has many cybercafes in Africa that generate http and smtp spam > and we block each complaint within 48 hours. > > None the less, here is a recent email extract I received from > someone: > > "Hank, I am not a Spamhaus.org representative in any shape or form. > I do not claim to speak for Spamhaus.org in any capacity. The > University of xxxxxx is, however, a customer (i.e. as of this > morning, we block e-mails from IP addresses listed on Spamhaus SBL). > > I am just guessing what might happen if the problem is not sorted > out. > > I am sure you already know that the standard escalation procedure for > many blocklists is first to block the single offending IP address, > then the immediate smallest block that it is contained in according > to WHOIS, then the entire block of the ISP, and if that fails to stop > the spam, then the corporate MXes of the upstream ISP may be > blocklisted." That describes the escalation procedure of SPEWS, but is not at all accurate for the SBL, we do not expand listings sideways into customer space or block whole ISPs [*]. > Basically, we are being told if we don't drop the customer, our > corporate MXes will be blocked. I would not call this an "extreme > case", but it would appear that overzealous anti-spammers are perhaps > going a bit overboard. Luckily he claimed up-front to not be speaking for Spamhaus. I can sympathize with the level of frustration of someone being bombarded in spam, however we do not run escalations for single spammers (unless the problem is chronic, but even then we'd always contact the ISP and exhaust all other avenues). [*] Although we do not list whole U.S. or European ISPs, that's not strictly true for other areas of the net the "offshore" spammers have gravitated to. We are currently leaning on China heavily and are at this moment blocking large parts of Chinanet Shanghai (online.sh.cn) ADSL netblocks, as it's the worst of the China spam problems with 120 separate SBL listings all of US-based spammers (all the usual make-penis-fast crowd) hosted mainly on Shanghai ADSL lines. Spammers like Alan Ralsky these days pump everything out via SoBig-opened proxies with everything hosted in China, all run from Detroit using VPN. The Chinese are now understanding this but it's taken some time. That escalation should resolve itself 'any moment now' too as they say they're starting the process of tracking down and kicking off the hoard of pests they've acquired these last months. -- Steve Linford The Spamhaus Project http://www.spamhaus.org

2 1

Latency between Global Crossing & AT&T
by Steven Schecter 25 Sep '03

25 Sep '03

Has anyone noticed excessively high latency between Global Crossing and AT&T? From what I've gathered, the PNIs between Global Crossing and AT&T are completely maxed out. The word is AT&T will not increase peering capacity with Global Crossing since their in bankruptcy protection. I am certain that this is affecting a large number of both Global Crossing and AT&T customers. I think it's fair to say that both Global Crossing and AT&T are amongst the larger Tier 1 providers out there, it's shameful that they can't come to an agreement on upgrading capacity. bash-2.05a$ traceroute www.att.net traceroute to www.att.net (204.127.166.135), 64 hops max, 40 byte packets [..] 4 0.so-0-2-0.gbr2.nwr.nac.net (209.123.11.234) 1.991 ms 2.254 ms 1.908 ms 5 5.ge-0-0-0.gbr1.nwr.nac.net (209.123.11.221) 2.063 ms 10.506 ms 2.075 ms 6 so-0-2-1.ar1.JFK1.gblx.net (64.211.83.61) 2.576 ms 2.704 ms 4.343 ms 7 pos3-0-2488M.cr2.JFK1.gblx.net (67.17.72.17) 2.564 ms 2.577 ms 2.125 ms 8 pos0-0-2488M.cr2.NYC1.gblx.net (67.17.64.138) 2.681 ms 2.698 ms 2.270 ms 9 so6-0-0-2488M.ar2.NYC1.gblx.net (67.17.64.158) 2.760 ms 2.724 ms 2.748 ms 10 208.51.134.6 (208.51.134.6) 144.483 ms 146.267 ms 143.238 ms 11 tbr1-p011601.n54ny.ip.att.net (12.123.1.122) 148.627 ms 153.665 ms 150.902 ms 12 tbr1-cl1.cgcil.ip.att.net (12.122.10.2) 171.625 ms 175.044 ms 170.965 ms 13 tbr2-p012501.cgcil.ip.att.net (12.122.9.134) 175.628 ms 172.361 ms 174.355 ms 14 tbr2-cl7.sl9mo.ip.att.net (12.122.10.46) 179.093 ms^C regards, /sjs -- Steven J. Schecter :: Just a spoon full of MEDs <sjs(a)nac.net> :: make the routes flow down

4 3

RE: Proposed changes to the AUP.
by Wesley Vaux 25 Sep '03

25 Sep '03

owner-nanog(a)merit.edu is sending me virus infected emails. Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com -----Original Message----- From: Leo Bicknell [mailto:bicknell@ufp.org] Sent: Thursday, September 25, 2003 10:13 AM To: nanog(a)merit.edu Subject: Proposed changes to the AUP. Two recent e-mails made me take a new look at the Nanog AUP, and I'd like to propose several changes to help clarify the policy. Several recent discussions have descended into the weeds. I'll take my share of the blame for my participation. That said, one on-list event, and several off list events have raised some lingering questions about the Nanog AUP and how it is enforced. I believe that there are a couple of changes to the AUP that would help prevent these threads from happening, and those are the issues I want to raise. If you're not familiar, the AUP is at http://www.nanog.org/aup.thml. I suspect many of you have no idea how the Nanog AUP is enforced, so I will go into that first. Moments ago we saw a glimpse on the list. The first attachment to my message (it's not in the archive yet to give you a URL) entitled "srh-jrace" is a copy of an e-mail I believe Susan accidently copied to nanog(a)merit.edu. If you look at the CC list you'll see the intended target was nanog-support(a)merit.edu. To help show that assumption is probably correct, I attach three more messages, first, second, and third. These are three cases, in chronological order, where I have been given similar warnings for AUP violations. For full context, these three messages were part of the following threads: first - http://www.cctec.com/maillists/nanog/historical/0109/threads.html#01538 second - http://www.cctec.com/maillists/nanog/historical/0110/threads.html#00577 (Note, there are at least three other thread roots right under it as some follow ups didn't get attributed correctly.) third - http://www.merit.edu/mail.archives/nanog/threads.html#14454 To be clear, I'm not trying to "appeal my conviction" on any of these, the first thread clearly drifted way off topic, the second I clearly mention the law and politics. The third gives me a bit more trouble, as the reason I posted was to see if anyone could operationally use this new (admittedly legal) tool, but heck, it was about law so I'm ok with being wrong on that one. I show you these as I am unhappy about the method by which these were handled. So, what are my proposals? Simple: 1) Change item 6 on http://www.nanog.org/aup.html to read "prohibited" rather than "discouraged". Discouraged suggests to me general discussion about those topics is bad, but if it has operational significance or general interest on the list it may still be appropriate. However, it appears that there is no clear way to define what would or would not be appropriate, and that the enforcement is more in line with prohibited. Changing that one word should make it much more clear, and remove all doubt. Most likely item #3 should also be prohibited and not discouraged as well. 2) The current AUP states: ] Individuals who violate these guidelines will be contacted personally ] and asked to adhere to the guidelines. If an individual persists ] in violating the guidelines, the convener of NANOG, Merit Network, ] Inc., will take action to filter the offender's messages to the ] list. I have several problems with this: * There is no way for the nanog membership to review that the policy is being applied evenly and fairly. * Where there are ambiguities in the appropriateness of a topic there is no way to know that the moderators are using the same criteria the general membership would use. * It does nothing to educate other mailing list participants as to what is or is not appropriate. This method provides a gentle and constant reminder of the AUP that always provides new and relevant examples. * It does nothing to stop the thread. Several people have received these after others for the same thread -- I think we all have an implicit assumption that if it's allowed to continue by the moderators it must be ok to reply. To that end, I propose the following new method of handling things, which I believe is more in-line with what other mailing lists do: When inappropriate messages are sent to the list the convener will reply both to the list and to the poster pointing out that the topic is in violation of the AUP and should cease. Chronic offenders will be notified personally that their messages may be filtered or that they may be removed from the list as deemed appropriate by the conveners. -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0

Re: williams spamhaus blacklist
by Dr. Jeffrey Race 25 Sep '03

25 Sep '03

On Thu, 25 Sep 2003 08:29:42 +0100, Steve Linford wrote: >for the benefit of those providers on nanag who use our SBL system, >rest assured we will be removing the escalation 'any minute now' as >WCG are now in contact with us and I understand are pulling spammer >plugs. Elegant understatement of basic principle that only hitting the management scum over the head with a mallet will change their behavior. Leo, are you listening? In my judgment rehashing this issue on NANOG is 1000% appropriate because the people on this list are the ones who have to carry the bad news to their masters. Jeffrey Race

2 1

williams spamhaus blacklist
by Len Rose 25 Sep '03

25 Sep '03

gateway.wcg.com (65.77.117.10) is being blacklisted by the spamhaus service. Can someone at Williams Communications get this taken care of? Your mail server is being blocked by everyone who uses spamhaus and it's delaying important mail from your company to one of our customers.

13 17

Re: Verisign Responds
by Michael.Dillon＠radianz.com 25 Sep '03

25 Sep '03

>And the usual US-centric view... >Which congress person does Demon Netherlands, T-dialin, Wanadoo >France, Tiscali etc. go to? In the Netherlands, Germany, France, Italy and other countries people generally know who to go to to raise an issue with their governments. In some cases there is a direct equivalent of "your" elected representative unless the country uses proportional voting. In all cases, the ISP can contact their favorite political party and ask for advice and support in raising a complaint to the U.S. government who indirectly regulate Verisign through the Department of Commerce involvement in ICANN and IANA. It is especially important for ISPs outside the U.S.A. to also issue press releases to go along with their petition for government action because the publicity from the press release will often accomplish more than the petition itself. The goal should be to get your country's government to officially protest the U.S. government's support for Verisign's action in destabilising the Internet. When the number of protests reaches critical mass and are widespread enough, then the Department of Commerce will be forced to act. The failure of the DOC to act before this point forms an indirect support of Verisign's action by the U.S. government. --Michael Dillon

1 0

Re: Verisign Responds
by Michael.Dillon＠radianz.com 25 Sep '03

25 Sep '03

>> you are confused. and in any case this is off-topic. take it to namedroppers, >> but before you do, please read rfc's 1033, 1034, 1035, 2136, 2181, and 2317. >Can someone please tell me how a change to a critical component of the >Internet which has the capacity to cause harm is not an operational issue? He didn't say that. He said that there is a mailing list called "namedroppers" for discussion of DNS protocol changes and related DNS issues. And he also said that if you want to get very far with your proposal the list members would expect you to be familiar with the RFCs which document the existing DNS protocol. And even though he didn't say it, it is true that your proposal is not an operational issue. Now if somebody would actually code this new DNS protocol into a DNS server and a resolver (or some clients) then maybe it would become an operational issue. --Michael Dillon

1 0

Another DNS blacklist is taken down
by Justin Shore 25 Sep '03

25 Sep '03

I thought ya'll might be interested to hear that yet another DNS blacklist has been taken down out of fear of the DDoS attacks that took down Osirusoft, Monkeys.com, and the OpenRBL. Blackholes.compu.net suffered a joe-job earlier this week. Apparently the joe-jobbing was enough to convince some extremely ignorant mail admins that Compu.net is spamming and blocked mail from compu.net. Compu.net has also seen the effects of DDoS attacks on other DNS blacklist maintainers. They've decided that the risk to their actual business is too great and they are pulling the plug on their DNS blacklist before they come under the gun by spammers. http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=3f70e839%2… Ron Guilmette, maintainer of the Monkeys.com blacklists has posted a farewell from Monkeys.com to news.admin.net-abuse.email. Ron cites the total lack of interest in the attacks by both big network providers and law enforcement authorities as the ultimate reason he's pulling the plug. http://groups.google.com/groups?q=%22Now+retired+from+spam+fighting%22&hl=e… It's truely a sad day for spam fighters everywhere. So, my question for NANOG is how does one go about attracting the attention of law enforcement when your network is under attack? How does the target of such an attack get a large network provider who's customers are part of the attack to pay attention? Is media attention the only way to pressure a response from either group? These DDoS attacks have received some attention in mainstream media: http://www.msnbc.com/news/959094.asp?0cv=TB10 http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_b… Apparently it hasn't been enough. Legal remedies take too long and are cost prohibitive (unless you're the DoJ). Subpoenas and civil lawsuits take months if not years. Relief is needed in days if not hours. Justin

16 24

419 with a twist
by Stephen J. Wilcox 25 Sep '03

25 Sep '03

for amusement thought the list might like to see my latest 419 email with not a single african government official in sight. amused us all here anyhow, not seen anything like this before! the netblock is a nameless nigerian ISP inetnum: 81.199.82.0 - 81.199.83.255 netname: CIDR-COMMUNICATION-01 descr: Internet service provider country: NG ---------- Forwarded message ---------- Date: Tue, 23 Sep 2003 23:02:19 +0200 From: "CAPT TONY [LEADER]" <capttony(a)mail9.com> Reply-To: capt_tony2001(a)indiatimes.com Subject: US ARMY Dear Sir/Ma, We are teams of American coalition troops writing from Baghdad Iraq! We are urgently seeking for your willingness to secure the below consignments as shown in the attached photos! The goods were captured here in Baghdad, abandoned in one of the Saddam Hussein's Treasure House. However, the goods consist of Gold Bars, Gold coins and huge amount of fund in the sealed boxes! At this moment, we are intending to ship these goods outside Iraq for reasons of safekeeping on our behalf but due to law and restriction order, we are unable to transport the goods to AMERICA that is the reason why we are soliciting for your interest to assist us in receiving the goods on our behalf preferably in Europe. We are ready to meet to your demand on this basis with our intending 25% of the entire goods either in cash or in value. Therefore, we will appreciate your effort to reach back via email confirming your interest to assist us receive the consignment. As soon as we receive your positive reply, we shall furnish you with further details. Please, note, this issue must be handled with utmost confidentiality as to avoid publicity! Yours truly. Capt. STELLA .A (Team Leader)

2 1