- NANOG - lists.nanog.org

Re: Stealth Blocking
by dlr＠bungi.com 25 May '01

25 May '01

[In the message entitled "Re: Stealth Blocking" on May 24, 10:23, "Eric A. Hall" writes:] > > Dave Rand wrote: > > > I'm not sure how effective rate limiting will be. Many spammers send > > one copy of the spam to an open relay, but use many (2 to 50) > > recipients. > > Rate-shapers would also work on the relays. The idea is that if ISPs would > implement a default rate-limit (let's say 4kb/s) that it wouldn't > interfere with normal use. It would interfere with spam distribution > because it would slow down the big runs dramatically. > > The negative side effect is that it cripples people who use email as a > file transfer protocol. > Ok, let's have a look. Last week, I got one spam ("get a free motorola pager") which came through 168 different open relays, bound for 4428 different recipients at bungi.com. There were 791 different connections to deliver all the spam, which meant that each time the spammer used an open relay, they delivered 5 copies of the message to my system (more or less). As was typical, they used 16 different grid.net dialups (all from ipls). Here's the dialup ports they used. Injection point IPs involved (potential source): IP Address Count Status In-addr 63.52.247.163 75 On DUL pool-63.52.247.163.ipls.grid.net 63.52.247.230 16 On DUL pool-63.52.247.230.ipls.grid.net 63.52.247.249 51 On DUL pool-63.52.247.249.ipls.grid.net 63.52.247.255 173 On DUL pool-63.52.247.255.ipls.grid.net 63.52.248.26 1 On DUL pool-63.52.248.26.ipls.grid.net 63.52.248.100 14 On DUL pool-63.52.248.100.ipls.grid.net 63.52.248.153 3 On DUL pool-63.52.248.153.ipls.grid.net 63.52.248.167 156 On DUL pool-63.52.248.167.ipls.grid.net 63.52.248.182 44 On DUL pool-63.52.248.182.ipls.grid.net 63.52.248.186 45 On DUL pool-63.52.248.186.ipls.grid.net 63.52.248.214 123 On DUL pool-63.52.248.214.ipls.grid.net 63.52.248.239 3 On DUL pool-63.52.248.239.ipls.grid.net 63.52.248.251 24 On DUL pool-63.52.248.251.ipls.grid.net 63.52.249.16 3 On DUL pool-63.52.249.16.ipls.grid.net 63.52.249.59 435 On DUL pool-63.52.249.59.ipls.grid.net 63.52.249.67 14 On DUL pool-63.52.249.67.ipls.grid.net The spam was 4K bytes, including header. That's 32K bits. Assuming that the open relays were really, really fast, that means that it would take about 2 hours to send all 4428 spams. If he had used 10 recipients per relay, it would have been 1 hour. 20 recipients would be 30 minutes. Without the rate limiting, assuming a 20 Kbps connection speed, it would have taken about 21 minutes to send the 4428 spams. Either way, rate limiting isn't very effective. Even rate limiting at 1Kbps only makes it 8 hours to send 4428 spams, or just over an hour a day (since these spams were delivered over a week time period). And they were using 4 to 8 dialups at a time. Even at 1Kbps, that's 50,000 to 100,000 spams per day, at 5 recipients per mail. If we go to 20, or 50, the numbers get very large, very quickly, even at 1 Kbps. That's why I think that port 25 blocking is the only way. That, and closing open relays, of course. --

4 3

Splitting a block of Class C's
by Albert Meyer 25 May '01

25 May '01

One of my ISP clients is leaving, and the person who was assigning IP's when they became our client chose to give them class C's scattered throughout our block. These are Sprint IP's which are assigned to us with our Sprint circuit. Our former client is getting a Sprint T1 and asking Sprint to route these class C's to them rather than us, and they tell me that Sprint appears willing. They don't have an AS, but they're getting another local ISP to advertise the IP's for them. I normally wouldn't agree to participate in such a mess, but we're shutting off the Sprint circuit in a couple of months, and I can't see making them re-IP hundreds of domains under the circumstances. Has anyone done something like this? I'm wondering how much it will increase the CPU load on my router. I'm already running at 20% average, and if it gets much over that I start dropping ICMP packets. I know enough BGP to stop advertising the appropriate class C's, but I'm not sure that this won't cause problems that I haven't considered. Will anyone refuse to accept advertisements which send adjacent /24's to different places? Is this an officially "broken" setup, or is it just ugly?

4 3

Re: Splitting a block of Class C's
by Albert Meyer 25 May '01

25 May '01

At 07:39 PM 5/24/01 -0500, Andy wrote: >It really depends on what you *want* to do. If the /24's you have assigned >to them are non-contiguous then they will want to renumber anyway so they >can advertise an aggregate. If you want to help them out, tell them to go >ahead and advertise the /24's out of your aggregate. Some providers have >stricter filtering, but generally will be reachable through other >providers, so connectivity isn't a big deal. Sprint should be advertising >an aggregate of your IP space which will bring all traffic to their >network. Once it reaches Sprint's network, the more specific routes your >customer is advertising will go to them and the rest will come to you. I >can't see that this would add any additional load to your router. > >andy It may not be that simple. I guess I should have mentioned that I don't route anything through Sprint. The only reason I've kept the Sprint circuit is to avoid re-IP-ing. Sprint isn't reliable enough to carry customer traffic. I do advertise the Sprint route, but I add a couple of hops to make sure the traffic goes through my "real" circuit.

2 1

Re: Stealth Blocking
by Richard A. Steenbergen 25 May '01

25 May '01

On Thu, May 24, 2001 at 05:47:41PM -0400, Mitch Halmu wrote: > > "Our users hated it - particularly those using MS Outlook" > > No need to describe what happens when your clients hate your service... Can't be any worse then what happens when you don't have any services that aren't blackholed. Can we find a new list for this now? :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Re: Stealth Blocking
by dlr＠bungi.com 25 May '01

25 May '01

[In the message entitled "Re: Stealth Blocking" on May 24, 9:46, "Eric A. Hall" writes:] > > Returning to operational traffic: > > > One thing that I think *will* help, particularly in the short term, is > > port 25 blocking of dialup ports. It's my personal opinion that this > > will have the greatest impact on spammers who abuse open relays. I've > > watched this happen over the last few months, as various large networks > > have secured their dialup ports. It's impressive. > > TCP rate-limiting on outbound traffic to *:25 would also be extremely > effective, particularly on unclassified customer traffic, and without the > heavy-handed nature of denying all dial-up traffic. Rate-limiting doesn't > interfere with low-volume legitimate mail, but it really cramps spam. > I'm not sure how effective rate limiting will be. Many spammers send one copy of the spam to an open relay, but use many (2 to 50) recipients. I'm unaware of a product that could limit (say) based on the number of connections from a given dialup port. Also, based on several providers information, one dialup account is being used by several, or many, spammer's machines at the same time, so even a per-IP port limit wouldn't have as much effect as you might think. One other way to do this might be to do port 25 blocking on new customers, but allow customers to get unblocked on request after they have been around a while... Isn't that the approach that AT&T used, to great success? It's also interesting to note that at least one dialup reseller actively markets to spammers, and attempts to negotiate unblocked dialups with the various providers. --

3 2

Re: Stealth Blocking
by dlr＠bungi.com 24 May '01

24 May '01

[In the message entitled "Re: Stealth Blocking" on May 24, 14:05, Mitch Halmu writes:] > > On Thu, 24 May 2001, Dave Rand wrote: > > > The MAPS RSS(sm) is a list of open relays *which have been abused*. These > > are sites which have been reported to MAPS as open relays, and have spam > > samples. Once the spam has been verified, a test is performed to verify > > that the site is, indeed, an open relay. If a sample message is accepted, > > and then returned by the site as a relay, the host is listed. Removal from > > the RSS requires that the host no longer relays. Automated probes are never > > done - a human must request the test, and spam must be available. Because > > of the very large number of hosts listed (around 100,000 as I write this), > > it's generally used in DNS mode only. It's pretty easy to get a host which > > is an open relay that has transmitted spam onto the list. Between 100 and > > 1,500 hosts per day are added, and hundreds per day are taken off (as soon > > as they let MAPS know that the relay has been closed). > > Very interesting statistics. It gives you a clear picture of the magnitude > of the squeeze. Now I understand why such heavy hammer was needed at the > helm full-time. Supposing that 100,000 server owners plus those forcibly > 're-educated' get together and do something about it, like scream, or jump > of a 12 inch stool, or donate $10 each, would they be able to shake Dave > off his high horse? How about if they also rally their users that were > suddenly cut off? The vast majority of the open relays that are left are on systems that are unmanned. Another is on systems that "aren't running a mail server" (the classic case is "that is my DNS server, not my mail server! Why is it on the RSS?" - of course, they didn't realize that they had, in fact, left the mail server enabled). No need to shake me off a horse - just close the open mail server. It's a few minutes of work, in most cases, and a few hours in some. Yes, there are some "hard cases" that take much longer to close for various reasons, but it is 2001, not 1997. There's been plenty of time for people to close their mail servers. And note, again, that these hosts are on the RSS. A BGP feed of the RSS is not practical, so only hosts that choose to run the DNS version of RSS on their mail servers will have their mail affected. > > The collateral damage in blocking 100,000 hosts is simply unacceptable. > Especially because there are only a few hundred die-hard professional > spammers that need to be rooted out, and the problem diminishes, or at > least becomes manageable in another way. As an ISP, I have yet to see > a list of black sheep compiled consisting of individuals, spam companies, > or credit cards used to defraud that should not be subscribed. Banks > share such information, why can't ISPs? It would be wonderful if we could. And I do agree that there are relatively few hard-core spammers. And we are rooting them out, one by one, and forcing them into a smaller, and smaller number of ISPs that still permit anonymous sign-up, or unrestricted port 25 access from their dialup ports. The latest kick is to break into machines, and install spamware on them. That's a great sign that the spammers have well and truely crossed the line into already illegal ground. It can also be argued that the collateral damage from *not* blocking spam is unacceptable. But *no one* is forcing you to use any blocking methods. If you don't want to, don't. If you want to, go ahead. Your wires: your rules. Your equipment: your rules. If you choose not to accept mail from people with two wives, that's your choice to make. If you want to accept traffic only from even-numbered IP addresses, that's also your choice. The RSS simply gives you a method to choose from. "These host have be abused in the past, and we have verified them as still open. The traffic you get from here might be spam.". Some people reject it, some mark it. Others don't. What's the problem? > > No matter how noble the cause, the methods are wrong. In all the debate, > it was perhaps lost that no viable technological solution to roaming, > meaning one that is happily accepted by the end user, exists yet. And > please don't mention SMTP Auth, it's not perfected yet. > Many large ISPs are quite happily using pop-before-smtp, and other secondary authentication schemes. Other ISPs are using various other methods to ensure that only their customers get to relay through their mail server. If you have a better method for ferreting out spam, please let us know. If you think you can find a way to stop known spammers (when court orders, fines, ANI blocking, and the like have failed), I'm all ears. Until a better method comes along, I'll continue to make the RSS available. It's my earnest desire that the count of hosts in the RSS reach zero. It's my earnest desire that the count of hosts in the RBL reach zero. Help achiving this goal, by eliminating spam, is appreciated. --

2 1

Re: Stealth Blocking
by dlr＠bungi.com 24 May '01

24 May '01

[In the message entitled "Re: Stealth Blocking" on May 24, 17:00, Mitch Halmu writes:] > > On Thu, 24 May 2001, Jason Slagle wrote: > > > Along those lines, let me get this straight. You support someone > > compiling a list of spammers that you won't sell to, but you oppose > > someone compiling a list of people that I choose not to accept mail > > from. That is quite interesting, and somewhat hypocritical. > > Not at all. "People" is the key. The list in question is of servers > used by innocent people. The bad people are someone else's clients. > I don't feel that it's hypocritical to refuse service to an individual > that just cheated a fellow ISP, just like a bank will not issue an > unsecured loan or credit card to someone that cheated another bank. Until you have to fill out the same amount of paperwork (and have the same level of penalties for misrepresentation on that paperwork) to get an account, this can not happen. And it will _never_ happen for $20/mo accounts. Too much overhead. There's a huge difference between a $1000 limit credit card, and a $10/mo ISP account, wouldn't you say? --

1 0

Request for a clue!
by Thomas Gainer 24 May '01

24 May '01

I have heard a whisper about a network equipment evaluation standard called FCATS. I have never heard of it (only NEBS) and I can not find any information on it. All my searches turn up information on the Florida standardized tests but nothing regarding technology evaluation and reporting. Does anyone have a hint I can follow to find information, like maybe what the acronym stands for? Thanks, Thomas

5 4

Re: Stealth Blocking
by dlr＠bungi.com 24 May '01

24 May '01

[In the message entitled "Re: Stealth Blocking" on May 24, 15:12, Mitch Halmu writes:] > > On Thu, 24 May 2001, Dave Rand wrote: > > > That's why I think that port 25 blocking is the only way. That, and > > closing open relays, of course. > > No, that is NOT the only way. We presume that the spammer had 8 dial-up > accounts. Who is this professional spammer, and how come he/she/it can > still find a provider? That is the question. Perhaps also who is the > merchant that ordered the promotion? Many of these spammers are using phished accounts, or credit cards. Or they use stored-value cards, if they are even a little bit legit. And, he likely only needed one account, with 8 machines signing into that one account (most ISP's don't have the ability to restrict multiple logins). Dialup providers make it easy to become a customer. This is good, because Mom & Pop can sign up. This is bad, because a spammer willing to lie can open an account with a minimum of information. Most providers are unwilling to make the sign-up proceedure tougher. > > The identity of such individual or company belongs on a black list. > Yet the spammer is able to subscribe again tomorrow, next week, next > year... and nothing happens to them. That is the point where control > should be exercised. > As mentioned earlier, even with court orders against it, spammers still sign up, and send out spam. They do not operate by the same rules, or even care about potential liability. As an analogy to the real world, I was speaking with the head of a 911 call center recently. It used to be that crooks would go to some trouble to conceal their identity. With the recent rise in the use of crank, there is now *no* attempt to hide. They will steal blank cheques, then go to the bank and forge them in front of tellers, regardless of the cameras, and the ability for the teller to identify them. Spammers might not be doing crank, but *they just don't care* if we id them. --

1 0

Re: Scanning (was Re: Stealth Blocking)
by Paul Vixie 24 May '01

24 May '01

jtk(a)titania.net ("Joseph T. Klein") writes: > What is the effect of scanning the whole operational address space > four times a week? If history is to be our guide, then the principle effect will be to inspire 400 imitators, and the secondary effect will be to inspire a lot of people to complain about it, block it, or both.

2 1