- NANOG - lists.nanog.org

workaround published for BIND8 and delegation-only
by Paul Vixie 25 Sep '03

25 Sep '03

so far, the BIND8 code itself has been resistant to this feature, but... see the current http://www.isc.org/products/BIND/delegation-only.html page.

1 0

Re: williams spamhaus blacklist
by Dr. Jeffrey Race 25 Sep '03

25 Sep '03

On Wed, 24 Sep 2003 20:01:48 -0400, Leo Bicknell wrote: >Blocking wcg's corporate mail servers is not the solution. It is the ONLY solution that works, as shown many times including the case just posted to this list about Sprint. >Sure, it may get >someone's attention at wcg, but it may also harm a lot of "innocent" >communications, sales talking to clients, other wiltel customers >requesting support, heck, the secretary ordering lunch to be >delivered. These people are also victims of bad corporate management and they should complain to their managers, not to their fellow victims. > >There are laws against spam. If you have evidence, sue in civil >court, or get a DA to go for it in criminal court. There are no presently enforceable laws for this kind of corporate abuse. The only thing that works is hitting the malafactors directly. Regarding BLs: no one forces anyone to use them. They are used because recipients don't want to get trash. Those with a quiet moment who want to see a novel, amusing and detailed ventilation of this issue may take a look at <http://www.camblab.com/nugget/spam_03.pdf> (some details dated) and <http://www.camblab.com/misc/univ_std.txt> (work in progress) I'd welcome any comments. Jeffrey Race

1 0

RE: what to do about joe-jobs?
by badkarma2＠canada.com 25 Sep '03

25 Sep '03

>Speaking of joe-jobs, what's the "proper" proceedure for >dealing with such? The company I work for is currently >undergoing an admitedly minor joe-job. (about 300 or so >bounces that I've seen since mid last week or so.) > >Any suggestions for dealing with this? What domains are you seeing the joe-jobs from? We see alot of joe jobbing attacks from the large webmail providers eg. yahoo.com, hotmail.com, aol.com, netscape.net, etc. A promising response that we've been following is Sender Permitted From http://spf.pobox.com . It's basically a reverse RBL. The owner of a domain identifies ip's that are allowed to send mail for that domain in a TXT DNS record. The rest are tagged with a wildcard deny or probably softdeny initially. If yahoo.com, hotmail.com etc alone just added the DNS records, we'd all be able to identify joe-jobbers of these domains. It won't help their own spam situation but it'd help our massive attacks of spoofed email. Spammers seem to use these big providers since blocking all of hotmail.com or yahoo.com is tough for other providers.

1 0

RE: williams spamhaus blacklist
by McBurnett, Jim 24 Sep '03

24 Sep '03

this is not without precedent.. Anyone from Cable and Wireless listening? If I remember correctly, Cable and Wireless was blocked last year or earlier this year by a similiar ploy. And I also seem to remember them making major complaints over on the SPAM-L list.. Later, J > -----Original Message----- > From: Leo Bicknell [mailto:bicknell@ufp.org] > Sent: Wednesday, September 24, 2003 6:30 PM > To: nanog(a)merit.edu > Subject: Re: williams spamhaus blacklist > > > In a message written on Wed, Sep 24, 2003 at 05:14:04PM > -0400, alex(a)pilosoft.com wrote: > > The moment they started blacklisting IPs that never sent spam. (AKA > > williams corporate mail servers). > > For those who care: > > http://www.spamhaus.org/sbl/sbl.lasso?query=SBL10731 > > I quote: > > ] WilTel Communications Group's Corporate Mail Relays > ] Continued hosting of Eddy Marin spam gang and others have > caused this > ] listing. Previous warnings and spam reports had no effect. > > So, they have decided since WilTil has one (alleged?) spammer > customer none of wiltel should be allowed to send or receive e-mail > anymore. > > The complete list of Williams issues is at: > > http://www.spamhaus.org/sbl/listings.lasso?isp=wcg > > As per usual, no amount of collateral damage is deemed unacceptable. > > -- > Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 > PGP keys at http://www.ufp.org/~bicknell/ > Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org >

1 0

manure distribution
by Petri Helenius 24 Sep '03

24 Sep '03

To put some semi-new information of the looping spam discussion; Here is a breakdown of the junk that took the priviledge of not arriving to my inbox but taking a detour to the spam/virus trap in the last few weeks: | count| Country| asnumber | asdescription | | 156 | IT | 3269 | TELECOM ITALIA | | 129 | US | 3561 | Cable & Wireless | | 89 | NL | 8737 | Planet Technologies BV | | 74 | UK | 2856 | BTnet UK Regional network | | 62 | UK | 5089 | NTL Group Limited | | 53 | US | 3356 | Level 3 Communications | | 53 | FR | 3215 | France Telecom Transpac | | 38 | BE | 5432 | SKYNETBE-AS | | 33 | UK | 5462 | Telewest Broadband | The suggestion I would make that if you are considering applying filters to block large geographical areas, here is a handy list to start from the top: 1/2 :-) |count| country| | 1813 | US | | 362 | CA | | 275 | IT | | 224 | UK | | 181 | NL | | 171 | CN | | 145 | AU | | 83 | JP | | 81 | FR | | 79 | BR | | 63 | KR | Pete

1 0

Re: monkeys.dom UPL being DDOSed to death
by Joe St Sauver 24 Sep '03

24 Sep '03

Hi, #This goes beyond spam and the resources that many mail servers are #using. These attacks are being directed at anti-spam organizations #today. Where will they point tomorrow? Many forms of breaking through #network security require that a system be DOS'd while the crime is being #committed. These machines won't quiet down after the blacklists are shut #down. They will keep attacking hosts. For the US market, this is a #national security issue. These systems will be exploited to cause havoc #among networks of all types and sizes; governmental and commercial. Note that not all DNSBLs are being effectively hit. DNSBLs which run with publicly available zone files are too distributed to be easily taken down, particularly if periodic deltas are distributed via cryptographically signed Usenet messages (or other "push" channels). You can immunize DNSBLs from attack, *provided* that you're willing to publicly distribute the contents of those DNSBLs. And when it comes to dealing with the sources of these attacks, we all know that there are *some* networks where security simply isn't any sort of priority. (For example, make it a practice to routinely see what ISPs consistently show up highly ranked on incident summary sites such as http://www.mynetwatchman.com/ ). Maybe the folks running those networks are overworked and understafffed, maybe they have legal constraints that limit what they can do, maybe their management just don't care as long as they keep getting paid. Who knows? Whatever the reason, no one is willing to depeer them or filter their routes, so they really are free to do absolutely *nothing* about vulnerable hosts or abusive customers. There are absolutely *no* consequences to their security inactivity, and because of that, none of us should be surprised that the problem is becoming a worsening one. Regards, Joe St Sauver (joe(a)oregon.uoregon.edu) University of Oregon Computing Center

13 18

RADB
by Christopher J. Wolff 24 Sep '03

24 Sep '03

Hello, On the RADB site, under features and benefits, the service claims to mirror "more than 30 other IRR databases." My challenge is that I need to list my information with RADB and don't want to go through the hassle of manually submitting every subnet owner and first-born when I can put a RWHOIS server up for ARIN. RADB should just poll my RWHOIS server. Thank you in advance for your advice. Regards, Christopher J. Wolff

2 1

RE: Another DNS blacklist is taken down
by Mark Segal 24 Sep '03

24 Sep '03

I think some RBLs might get better responses from the ISPs when they stop taking "collateral damage gets the abuse department's attention" attitudes.. Some RBLs cause many providers a LOT of headaches, so it is not surprising that when it is their turn to complain, the ISPs will just say: post to abuse.ddos.isp.net and we might get around to fixing it. :). Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Justin Shore [mailto:listuser@numbnuts.net] Sent: September 24, 2003 12:29 PM To: nanog(a)merit.edu Subject: Another DNS blacklist is taken down I thought ya'll might be interested to hear that yet another DNS blacklist has been taken down out of fear of the DDoS attacks that took down Osirusoft, Monkeys.com, and the OpenRBL. Blackholes.compu.net suffered a joe-job earlier this week. Apparently the joe-jobbing was enough to convince some extremely ignorant mail admins that Compu.net is spamming and blocked mail from compu.net. Compu.net has also seen the effects of DDoS attacks on other DNS blacklist maintainers. They've decided that the risk to their actual business is too great and they are pulling the plug on their DNS blacklist before they come under the gun by spammers. http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=3f70e839%24 1%40dimaggio.newszilla.com Ron Guilmette, maintainer of the Monkeys.com blacklists has posted a farewell from Monkeys.com to news.admin.net-abuse.email. Ron cites the total lack of interest in the attacks by both big network providers and law enforcement authorities as the ultimate reason he's pulling the plug. http://groups.google.com/groups?q=%22Now+retired+from+spam+fighting%22&hl=en &lr=&ie=UTF-8&oe=UTF-8&selm=vn1lufn8h6r38%40corp.supernews.com&rnum=4 It's truely a sad day for spam fighters everywhere. So, my question for NANOG is how does one go about attracting the attention of law enforcement when your network is under attack? How does the target of such an attack get a large network provider who's customers are part of the attack to pay attention? Is media attention the only way to pressure a response from either group? These DDoS attacks have received some attention in mainstream media: http://www.msnbc.com/news/959094.asp?0cv=TB10 http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_bl ockers Apparently it hasn't been enough. Legal remedies take too long and are cost prohibitive (unless you're the DoJ). Subpoenas and civil lawsuits take months if not years. Relief is needed in days if not hours. Justin

5 4

Re: Verisign Responds
by Paul Vixie 24 Sep '03

24 Sep '03

> See the NANOG archives for my post reguarding wildcard caching and set > comparison with additional resolver functionality for requesting if the > resolver wishes to receive wildcards or NXDOMAIN. oh... that wasn't a joke, then? there won't be a protocol change of that kind, not in a million years.

4 4

RE: monkeys.dom UPL being DDOSed to death
by sowens＠epik.net 24 Sep '03

24 Sep '03

Provide me a list of requirements and I'll see what I can do about the bandwidth, colo and BGP session. Shane -----Original Message----- From: John Payne [mailto:john@sackheads.org] Sent: Tuesday, September 23, 2003 7:41 PM To: nanog(a)merit.edu Subject: Re: monkeys.dom UPL being DDOSed to death --On Tuesday, September 23, 2003 6:11 PM -0400 Kai Schlichting <kai(a)pac-rim.net> wrote: > - BGP anycast, ideally suited for such forwarding proxies. > Anyone here feeling very adapt with BGP anycast (I don't) for > the purpose of running such a service? This is a solution that > has to be suggested and explained to some of the DNSBL operators. Anyone want to offer hardware, colo, bandwidth and a bgp session for a dnsbl anycast solution?

1 0