- NANOG - lists.nanog.org

Re: Drive-by spam hits wireless LANs
by Steven M. Bellovin 11 Sep '02

11 Sep '02

One thing I've noticed that may be an anti-spam measure: STN, the ISP that servers Marriott hotels (among others) seems to have a "transparent" proxy intercepting outbound traffic to port 25. Not sure why they'd do that except to deter check-in spammers. They *don't* do anything with traffic to port 80, as best I can tell. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

1 0

Re: Drive-by spam hits wireless LANs
by Michael.Dillon＠radianz.com 11 Sep '02

11 Sep '02

>I agree, but people said that the spammers wouldn't be able to >deal with BGP route advertisement but there was cases of spammers >injecting routes sending out spam then removing those routes. Wlan is >easy. Spammers come from every walk of life including the various technical professions. Otherwise where would all the spamming software and web-scraping software come from!? Just because someone is a technical expert in BGP routing doesn't mean that they will use their skills the way that many NANOG attendees would like them to. Even in the early days of spam, the green-card spammers hired a technical person to set up servers and write spamming scripts. And let's now forget the uber-hackers who create the scripts used so effectively by script-kiddies. And let's not forget, these spammer geeks learn the knowledge from the same places as everyone else, including the NANOG mailing list. I reckon there is a 99.95% probability that there is at least one NANOG subscriber who is a currently an active spammer geek. So if WLANs were relatively safe yesterday, they won't be safe from now on. Of course, if spammers are reduced to driving around major cities in vans generating 802.11b radio traffic, it might be a lot easier to catch them... --Michael Dillon

1 0

National Moment of Silence
by Hank Nussbacher 11 Sep '02

11 Sep '02

Is anyone planning on measuring backbone loads during the National Moment of Silence at 8:46 a.m. Eastern Standard Time on 9/11? -Hank

6 5

Just another day on the Internet
by Sean Donelan 11 Sep '02

11 Sep '02

"Experts predicted that Wednesday is likely to be just another day on the Internet, and if anything a quiet day for cybercriminals." http://story.news.yahoo.com/news?tmpl=story&ncid=581&e=7&cid=581&u=/nm/2002… What is a "normal" day on the Internet? http://www.caida.org/outreach/papers/2001/BackScatter/ Measured 12,000 attacks over a three week period, or 570 attacks a day. http://www.fcc.gov/Bureaus/Engineering_Technology/Filings/Network_Outage/ There is a significant outage on average every 2-3 days.

1 0

network stats
by Ian A Finlay 11 Sep '02

11 Sep '02

A while back, I posted a question to this list: http://www.merit.edu/mail.archives/nanog/2002-01/msg00009.html So, I've still been on the lookout for traffic graphs. I know that many times the mrtg graphs can be misleading and downright wrong at many times, but I still think it's neat to be able to see how much traffic is flowing across various links. But, it would be even better to know what the aggregate flow of traffic across the Internet was at any given time. I know it seems impossible to calculate such a measurement... For example, if one looks at exchange point stats, like linx.net, you can see that at any given moment in time, that facility is exchanging ~15 Gb/s. Could one add all of the aggregates of the exchange points together? Would it even make sense to do so? Is CAIDA working on some way to measure aggregate traffic flow on the Internet? Something like the following (except that it would be representative of the entire Internet, not just Abilene) would be really neat. http://monon.uits.iupui.edu/abilene/total/total-bits.html I have done quite a bit of googling, but have not been able to find any relevant information. Regards, Ian

1 0

Re: How do you stop outgoing spam?
by alex＠yuriev.com 10 Sep '02

10 Sep '02

> and bypassing firewalls is an excellent way to get into BIG trouble with > whomever is running the firewall. It is irrelevant how ignorant that > person might be about the traffic which passes through their firewall. > I'm sure if they were only slightly less ignorant they'd run a strict > HTTP gateway on port 80 of their firewall and then you'd be stuck > wrappging everything up to look like proper HTTP in order to bypass > their firewall. It is better that you learn to negotiate the access you > need than to have to resort to using covert channels which could get you > busted. Steno is a great thing, so it wont get anyone busted. Alex

4 4

Re: How do you stop outgoing spam?
by Paul Vixie 10 Sep '02

10 Sep '02

> One of the basic problems with discussions about spam control is that it > focuses entirely on spam. Blocking output SMTP from individual dial-ups > has a serious negative consequence: > > Laptop mobile users cannot use their home SMTP server. in the business, we call this "tough noogies." > At best, they must reconfigure for each venue -- goodbye wireless > hotspot convenience -- and that is IF they know the SMTP server address for > the local access. i've gotten very good mileage out of ssl-smtp, and out of "port forwarding" so that my laptop uses 127.0.0.1:25 for outbound mail, which is actually a (ssh-borne) tunnel to my home smtp server. > In other words, by blocking output SMTP, mobile users are hurt > badly. I know that *I* certainly am. Constantly and serously. yes. let me take this opportunity to thank you for your significant contributions to smtp and of course rfc822. i'm sorry that you have to be hurt now. but the design calls for a polite population, and while that was true of the internet in 1983, it is absolutely not true today. the nonpolite nature of the overall population means that you will have to be hurt and you will have to change how you use mail in order to make the pain stop. there's a slight choice on the pain menu -- you can have (A) an unusable mail system clogged with unwanted traffic such as spam and viruses, or (B) a barely-usable mail system where everything you want to do is less convenient because you have to use ssl-smtp and ssh tunnels. either way you have to be hurt now. and that saddens me, it really does.

1 0

Re: How do you stop outgoing spam?
by Joe St Sauver 10 Sep '02

10 Sep '02

Valdis wrote: #Most spam-fighting efforts on the technical side make the basic assumption #that spam has similar characteristics to a properly designed TCP stack - that #dropped/discarded spam-grams will trigger backoff at the sender. Unfortunately, #discarding a high percentage of the grams will trigger a retransmit multiple #times. Actually, our experience *does* follow the backoff paradigm: if you block a particular source of spam, that rejection *does* seem to trigger "message volume" backoff at the source, with only periodic check probes apparently designed to see if the spam source is really still blocked (and of course it really still is). Now it is true that in many cases the spammer *will* do a set of probes in an effort to see just how broad a given block is (e.g., is it just a /32 that's being blocked? is it my entire netblock? is it a domain based filter? can I slide in via an open SMTP relay or an abusable proxy server?), but at least here at the U of O, we're NOT seeing spammers waste their time attempting delivery of hundreds or thousands of messages per day via hosts that have been identified and filtered. Regards, Joe

3 2

Re: Internet connection secure from surveilance?
by bdragon＠gweep.net 10 Sep '02

10 Sep '02

> Here is my reply to Joe > > Your solution is good. In general, anyone worried about this kind of invasion of privacy > should arrange to run their own root servers. The more the merrier. This is not neccessarily > about having multiple roots with colliding TLDs, but about security from surveillance. A better solution would be to turn off recursion, this _may_ lead to partitioning away from the rest of the internet, just as running a local root may lead to partitioning away. The benefit, of course, is that you don't worry about someone tapping into any sub-domain dns server. Slightly better than that is to disconnect from the network entirely. This will help prevent someone from eavesdropping on other protocols as well. Again, this may lead to partitioning away from the rest of the network.

1 0

Re: How do you stop outgoing spam?
by sal.sabella＠hushmail.com 10 Sep '02

10 Sep '02

Susan, why do your rules not apply to Jane? I realize she's a larger-than-life figure here, but enough is enough. I won my bet with my boss that she would violate AUP at least five (5) times and not get removed from the list. Please read the NANOG FAQ at http://www.nanog.org/aup.html. If there are further hypocrisies on your part, I'll have to ask Brad Knowles for an AOL account to post from. Sal >Please do not post personal messages on the NANOG mailing list, > which >focuses on Internet engineering and operations issues. In my la >st message >to you I pointed to our AUP: > > http://www.nanog.org/aup.html > >If there are further AUP violations on your part, we'll need to > remove >your posting privileges from the list. > >Susan Harris, Ph.D. >Merit Network/Univ. of Mich. > > >On Tue, 10 Sep 2002 sal.sabella(a)hushmail.com wrote: > >> >> >> "Marshall Eubanks" wrote: >> > When I am at a cafe I use a web based encrypted email progr >am, and >> > if I email a large attachment (say a pdf file), then it goe >s http >> > outbound. >> >> When I am at a cafe, I eat, drink, and sometimes converse wit >h others. >> >> > Again, when I go to a cafe in another city, I am generally >there >> > to get some work done >> >> Again, when I go to a cafe in another city, I am generally th >ere to eat, drink, converse, and soak in the local sights. >> >> I might be in Burbank next week on business. We should meet >up then. Think you could get me tickets and a VIP backstage tour at the Tonight Show? I'd like to meet with NBC execs and weigh the pros and cons of multicasting your band's performance in PIM Dense vs. Sparse mode. You're a great musician BTW. Tell Jay I said hi. >> >> Sal Sabella >> >> >> >> >> Get your free encrypted email at https://www.hushmail.com >> > > > Get your free encrypted email at https://www.hushmail.com

1 0