- NANOG - lists.nanog.org

Re: Major E-mail Delivery for FTC DNCR Launch
by Anne P. Mitchell, Esq. 26 Jun '03

26 Jun '03

Oops..2nd time, sorry - had to resub to NANOG and hadn't actually sent the sub to -post. > Except possibly don't use the word "spam", or anything else that is > liable to trip SpamAssassin and friends into giving your messages a > high score (so references to abdominal anatomy and cable tv decoders > are also probably unwise :). > > I'm frequently surprised that more people don't run their (legitimate, > opt-in, whatever) bulk mail through SpamAssassin before they send it > in order to see how spam-like it looks. I'm forever having to pick > itineraries and electronic tickets from airlines out of my spam > folder. Send them to us; we're happy to tell them to use Habeas. :-) (SpamAssassin is a partner, and whitelists mail using our headers, so those itineraries and e-tickets will sail through SpamAssassin, along with about 3 dozen other ISP and spam filter partners :-) Of course, if it's mailing list mail, it *has* to be confirmed opt-in.] Anne

1 0

Country of Origin for Malicious Attacks
by sgorman1＠gmu.edu 26 Jun '03

26 Jun '03

I was wondering if folks had noticed any trends with malicious network attacks predominantly originating from any individual or group of countries. Any observations, comments or help would be greatly appreciated. Thanks, sean

2 1

Lol - I guess we can all just put IPV6 back in the box.
by Drew Weaver 25 Jun '03

25 Jun '03

http://news.com.com/2100-1028_3-1020653.html?tag=fd_top <http://news.com.com/2100-1028_3-1020653.html?tag=fd_top> -Drew

2 1

RE: Major E-mail Delivery for FTC DNCR Launch
by Ejay Hire 25 Jun '03

25 Jun '03

You will want to make sure your email and sending server avoid the appearance of evil, I.e. Forward and reverse records match, valid MX for the sending domain, sent from a real address, not an HTML email, etc. -----Original Message----- From: Andy Dills [mailto:andy@xecu.net] Sent: Wednesday, June 25, 2003 3:17 PM To: Callahan, Richard M, SOLGV Cc: nanog(a)nanog.org Subject: Re: Major E-mail Delivery for FTC DNCR Launch On Wed, 25 Jun 2003, Callahan, Richard M, SOLGV wrote: > > Good Afternoon > and forgive the new guy if I break any rules or conventions. > > I work for AT&T Government Solutions and we are about to launch the Do > Not Call Registry for the Federal Trade Commission. At a high level > this allows consumers to register their phone numbers to keep most > telemarketers from calling their homes. Penalties for calling a > consumer on the list can be $11K per call and enforcement begins in > October. And we thank you for it. If only you could apply this approach to spam... :( > We are launching consumer registrations on Friday. My concern: > > - every registration using the web generates an email which must be > opened to complete the registration process > > We are looking at the potential of MILLIONS OF EMAILS PER DAY beginning > Friday. These will be from the same address and have the same subject > line. > > I am worried about denial of service or blocking by spam filters if > providers are not aware this is coming. > > I am hoping this group is a good medium to get the word out to inform > the community of this impending event. > > At this time I am unable to provide the link or email address, but will > do so on Thursday evening if it is of value. > > Any thoughts? Posting to the news.admin.net-abuse.email newsgroup would definitely be a good idea. The worst bunch to deal with is the SPEWS crew, and that's their only contact method. However, you don't really run too much risk; we provide co-location services for an organization that does large opt-in only mailings (financial services newsletters, catalogs, etc). They get almost NO complaints, which is absolutely amazing considering the amount of mail they send out. The complaints they do get are swiftly met with proof of opt-in, which you guys will obviously have. They haven't had problems with blacklists, and have been in business for several years. If you were to provide evidence of the request in the email that you send out, and considering that this is basically an anti-phone-spam service, I'm willing to wager your complaint rate will be very minimal, especially if the email arrives quickly after the request for processing. Andy --- Andy Dills Xecunet, Inc. www.xecu.net 301-682-9972 ---

1 0

Re: Major E-mail Delivery for FTC DNCR Launch
by Steven M. Bellovin 25 Jun '03

25 Jun '03

In message <729306F70E13DB43AA2D7AA0FAD4715D05441718(a)OCCLUST03EVS1.ugd.att.com> , "Callahan, Richard M, SOLGV" writes: > >Good Afternoon > and forgive the new guy if I break any rules or conventions. > >I work for AT&T Government Solutions and we are about to launch the Do Not Cal >l Registry for the Federal Trade Commission. At a high level this allows cons >umers to register their phone numbers to keep most telemarketers from calling > their homes. Penalties for calling a consumer on the list can be $11K per ca >ll and enforcement begins in October. > >We are launching consumer registrations on Friday. My concern: > > - every registration using the web generates an email which must be opened to > complete the registration process > >We are looking at the potential of MILLIONS OF EMAILS PER DAY beginning Friday >. These will be from the same address and have the same subject line. > >I am worried about denial of service or blocking by spam filters if providers >are not aware this is coming. > >I am hoping this group is a good medium to get the word out to inform the comm >unity of this impending event. > >At this time I am unable to provide the link or email address, but will do so >on Thursday evening if it is of value. > You should definitely contact the postmasters for some of the major consumer ISPs -- they often have their own filtering policies and procedures. AOL's policies have been discussed on this list in the past. Also watch out for Earthlink's challenge/response scheme. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

Latency generator?
by Temkin, David 25 Jun '03

25 Jun '03

Does anyone know of any free, cheap, or potentially rentable latency generators? Ideally I'd like something that just sits between two ethernet devices to induce layer 2/3 latency in traffic, but am open to any options... David Temkin S-I-G 401 City Avenue Bala Cynwyd, PA 19004 http://www.sig.com <http://www.sig.com> IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

6 5

Re: Country of Origin for Malicious Attacks
by sgorman1＠gmu.edu 25 Jun '03

25 Jun '03

Thanks for all the replies. I was not sure how to tackle the origin problem, so I figured I'd leave it wide open. Both origin as seen by the network, prima facia, and orgin as traced through proxies etc. are useful. Please send along either, but maybe a discalimer saying which would be useful. Many thanks, sean ----- Original Message ----- From: "Scott A. McIntyre" <scott(a)xs4all.net> Date: Wednesday, June 25, 2003 12:46 pm Subject: Re: Country of Origin for Malicious Attacks > > > Hi, > > >> : I was wondering if folks had noticed any trends with > malicious network > >> : attacks predominantly originating from any individual or > group of > >> : countries. Any observations, comments or help would be greatly > >> : appreciated. > > As I'm sure will be mentioned a few dozen times by the time this > message > gets to the list, "origin" isn't as simple as where the packets > you see > come from. > > Malicious attacks can and do come from many places, people, > groups, > organizations -- utilizing any number of compromised systems, > trojans, > bots, proxies, truly malicious attacks can often be as difficult > to trace > as a Hollywood movie phone call, routing through a dozen systems > in as many > countries. > > If people replying on this thread mean that they've actually > tracked the > true source of the malicious activity back to > (.it|.cn|.ro|.ru|.fr|...) by > working with network and system administrators then it might be > useful to > point that part out, as well as share how you found responsible > contacts > who verified your investigations and assisted for some of these > (and many > other) countries. > > Scott > > >

1 0

Re: Latency generator?
by Kevin Oberman 25 Jun '03

25 Jun '03

> From: "Temkin, David" <temkin(a)sig.com> > Date: Wed, 25 Jun 2003 12:48:29 -0400 > Sender: owner-nanog(a)merit.edu > > Does anyone know of any free, cheap, or potentially rentable latency > generators? Ideally I'd like something that just sits between two ethernet > devices to induce layer 2/3 latency in traffic, but am open to any > options... dummynet(4)? It's a standard part of FreeBSD and may be in other BSDs. It's very configurable to generate delays, congestion like behavior and such. NAME dummynet - traffic shaper, bandwidth manager and delay emulator DESCRIPTION dummynet is a system facility that permits the control of traffic going through the various network interfaces, by applying bandwidth and queue size limitations, implementing different scheduling and queue management policies, and emulating delays and losses. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0

RE: Country of Origin for Malicious Attacks
by netadm 25 Jun '03

25 Jun '03

Outside of the U.S., I'll nominate France and the Pacific Rim countries. -----Original Message----- From: sgorman1(a)gmu.edu [mailto:sgorman1@gmu.edu] Sent: Wednesday, June 25, 2003 11:58 AM To: nanog(a)merit.edu Subject: Country of Origin for Malicious Attacks I was wondering if folks had noticed any trends with malicious network attacks predominantly originating from any individual or group of countries. Any observations, comments or help would be greatly appreciated. Thanks, sean

4 3

RE: Country of Origin for Malicious Attacks
by McBurnett, Jim 25 Jun '03

25 Jun '03

Sean, of the scans I get and have seen.. 60% APNIC region Most noteably- Taiwan, China, and Korea (north) 20% RIPE Most noteable- Former Soviet Block nations then Scandanavian countries... 20% ARIN/LACNIC This is a rough estimate from the last 3 weeks... I guess you may be after this kind of fact: When I blocked HINET (Taiwan based-- has a single /16 to my knowledge) I cut scans/probes by 20%.... Later, Jim -----Original Message----- From: sgorman1(a)gmu.edu [mailto:sgorman1@gmu.edu] Sent: Wednesday, June 25, 2003 11:58 AM To: nanog(a)merit.edu Subject: Country of Origin for Malicious Attacks I was wondering if folks had noticed any trends with malicious network attacks predominantly originating from any individual or group of countries. Any observations, comments or help would be greatly appreciated. Thanks, sean

1 0