September 2003 - Test - lists.nanog.org

Re: Verisign Responds
by Michael.Dillon＠radianz.com 25 Sep '03

25 Sep '03

>> you are confused. and in any case this is off-topic. take it to namedroppers, >> but before you do, please read rfc's 1033, 1034, 1035, 2136, 2181, and 2317. >Can someone please tell me how a change to a critical component of the >Internet which has the capacity to cause harm is not an operational issue? He didn't say that. He said that there is a mailing list called "namedroppers" for discussion of DNS protocol changes and related DNS issues. And he also said that if you want to get very far with your proposal the list members would expect you to be familiar with the RFCs which document the existing DNS protocol. And even though he didn't say it, it is true that your proposal is not an operational issue. Now if somebody would actually code this new DNS protocol into a DNS server and a resolver (or some clients) then maybe it would become an operational issue. --Michael Dillon

1 0

Another DNS blacklist is taken down
by Justin Shore 25 Sep '03

25 Sep '03

I thought ya'll might be interested to hear that yet another DNS blacklist has been taken down out of fear of the DDoS attacks that took down Osirusoft, Monkeys.com, and the OpenRBL. Blackholes.compu.net suffered a joe-job earlier this week. Apparently the joe-jobbing was enough to convince some extremely ignorant mail admins that Compu.net is spamming and blocked mail from compu.net. Compu.net has also seen the effects of DDoS attacks on other DNS blacklist maintainers. They've decided that the risk to their actual business is too great and they are pulling the plug on their DNS blacklist before they come under the gun by spammers. http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=3f70e839%2… Ron Guilmette, maintainer of the Monkeys.com blacklists has posted a farewell from Monkeys.com to news.admin.net-abuse.email. Ron cites the total lack of interest in the attacks by both big network providers and law enforcement authorities as the ultimate reason he's pulling the plug. http://groups.google.com/groups?q=%22Now+retired+from+spam+fighting%22&hl=e… It's truely a sad day for spam fighters everywhere. So, my question for NANOG is how does one go about attracting the attention of law enforcement when your network is under attack? How does the target of such an attack get a large network provider who's customers are part of the attack to pay attention? Is media attention the only way to pressure a response from either group? These DDoS attacks have received some attention in mainstream media: http://www.msnbc.com/news/959094.asp?0cv=TB10 http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_b… Apparently it hasn't been enough. Legal remedies take too long and are cost prohibitive (unless you're the DoJ). Subpoenas and civil lawsuits take months if not years. Relief is needed in days if not hours. Justin

16 24

419 with a twist
by Stephen J. Wilcox 24 Sep '03

24 Sep '03

for amusement thought the list might like to see my latest 419 email with not a single african government official in sight. amused us all here anyhow, not seen anything like this before! the netblock is a nameless nigerian ISP inetnum: 81.199.82.0 - 81.199.83.255 netname: CIDR-COMMUNICATION-01 descr: Internet service provider country: NG ---------- Forwarded message ---------- Date: Tue, 23 Sep 2003 23:02:19 +0200 From: "CAPT TONY [LEADER]" <capttony(a)mail9.com> Reply-To: capt_tony2001(a)indiatimes.com Subject: US ARMY Dear Sir/Ma, We are teams of American coalition troops writing from Baghdad Iraq! We are urgently seeking for your willingness to secure the below consignments as shown in the attached photos! The goods were captured here in Baghdad, abandoned in one of the Saddam Hussein's Treasure House. However, the goods consist of Gold Bars, Gold coins and huge amount of fund in the sealed boxes! At this moment, we are intending to ship these goods outside Iraq for reasons of safekeeping on our behalf but due to law and restriction order, we are unable to transport the goods to AMERICA that is the reason why we are soliciting for your interest to assist us in receiving the goods on our behalf preferably in Europe. We are ready to meet to your demand on this basis with our intending 25% of the entire goods either in cash or in value. Therefore, we will appreciate your effort to reach back via email confirming your interest to assist us receive the consignment. As soon as we receive your positive reply, we shall furnish you with further details. Please, note, this issue must be handled with utmost confidentiality as to avoid publicity! Yours truly. Capt. STELLA .A (Team Leader)

2 1

workaround published for BIND8 and delegation-only
by Paul Vixie 24 Sep '03

24 Sep '03

so far, the BIND8 code itself has been resistant to this feature, but... see the current http://www.isc.org/products/BIND/delegation-only.html page.

1 0

Re: williams spamhaus blacklist
by Dr. Jeffrey Race 24 Sep '03

24 Sep '03

On Wed, 24 Sep 2003 20:01:48 -0400, Leo Bicknell wrote: >Blocking wcg's corporate mail servers is not the solution. It is the ONLY solution that works, as shown many times including the case just posted to this list about Sprint. >Sure, it may get >someone's attention at wcg, but it may also harm a lot of "innocent" >communications, sales talking to clients, other wiltel customers >requesting support, heck, the secretary ordering lunch to be >delivered. These people are also victims of bad corporate management and they should complain to their managers, not to their fellow victims. > >There are laws against spam. If you have evidence, sue in civil >court, or get a DA to go for it in criminal court. There are no presently enforceable laws for this kind of corporate abuse. The only thing that works is hitting the malafactors directly. Regarding BLs: no one forces anyone to use them. They are used because recipients don't want to get trash. Those with a quiet moment who want to see a novel, amusing and detailed ventilation of this issue may take a look at <http://www.camblab.com/nugget/spam_03.pdf> (some details dated) and <http://www.camblab.com/misc/univ_std.txt> (work in progress) I'd welcome any comments. Jeffrey Race

1 0

RE: what to do about joe-jobs?
by badkarma2＠canada.com 24 Sep '03

24 Sep '03

>Speaking of joe-jobs, what's the "proper" proceedure for >dealing with such? The company I work for is currently >undergoing an admitedly minor joe-job. (about 300 or so >bounces that I've seen since mid last week or so.) > >Any suggestions for dealing with this? What domains are you seeing the joe-jobs from? We see alot of joe jobbing attacks from the large webmail providers eg. yahoo.com, hotmail.com, aol.com, netscape.net, etc. A promising response that we've been following is Sender Permitted From http://spf.pobox.com . It's basically a reverse RBL. The owner of a domain identifies ip's that are allowed to send mail for that domain in a TXT DNS record. The rest are tagged with a wildcard deny or probably softdeny initially. If yahoo.com, hotmail.com etc alone just added the DNS records, we'd all be able to identify joe-jobbers of these domains. It won't help their own spam situation but it'd help our massive attacks of spoofed email. Spammers seem to use these big providers since blocking all of hotmail.com or yahoo.com is tough for other providers.

1 0

RE: williams spamhaus blacklist
by McBurnett, Jim 24 Sep '03

24 Sep '03

this is not without precedent.. Anyone from Cable and Wireless listening? If I remember correctly, Cable and Wireless was blocked last year or earlier this year by a similiar ploy. And I also seem to remember them making major complaints over on the SPAM-L list.. Later, J > -----Original Message----- > From: Leo Bicknell [mailto:bicknell@ufp.org] > Sent: Wednesday, September 24, 2003 6:30 PM > To: nanog(a)merit.edu > Subject: Re: williams spamhaus blacklist > > > In a message written on Wed, Sep 24, 2003 at 05:14:04PM > -0400, alex(a)pilosoft.com wrote: > > The moment they started blacklisting IPs that never sent spam. (AKA > > williams corporate mail servers). > > For those who care: > > http://www.spamhaus.org/sbl/sbl.lasso?query=SBL10731 > > I quote: > > ] WilTel Communications Group's Corporate Mail Relays > ] Continued hosting of Eddy Marin spam gang and others have > caused this > ] listing. Previous warnings and spam reports had no effect. > > So, they have decided since WilTil has one (alleged?) spammer > customer none of wiltel should be allowed to send or receive e-mail > anymore. > > The complete list of Williams issues is at: > > http://www.spamhaus.org/sbl/listings.lasso?isp=wcg > > As per usual, no amount of collateral damage is deemed unacceptable. > > -- > Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 > PGP keys at http://www.ufp.org/~bicknell/ > Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org >

1 0

manure distribution
by Petri Helenius 24 Sep '03

24 Sep '03

To put some semi-new information of the looping spam discussion; Here is a breakdown of the junk that took the priviledge of not arriving to my inbox but taking a detour to the spam/virus trap in the last few weeks: | count| Country| asnumber | asdescription | | 156 | IT | 3269 | TELECOM ITALIA | | 129 | US | 3561 | Cable & Wireless | | 89 | NL | 8737 | Planet Technologies BV | | 74 | UK | 2856 | BTnet UK Regional network | | 62 | UK | 5089 | NTL Group Limited | | 53 | US | 3356 | Level 3 Communications | | 53 | FR | 3215 | France Telecom Transpac | | 38 | BE | 5432 | SKYNETBE-AS | | 33 | UK | 5462 | Telewest Broadband | The suggestion I would make that if you are considering applying filters to block large geographical areas, here is a handy list to start from the top: 1/2 :-) |count| country| | 1813 | US | | 362 | CA | | 275 | IT | | 224 | UK | | 181 | NL | | 171 | CN | | 145 | AU | | 83 | JP | | 81 | FR | | 79 | BR | | 63 | KR | Pete

1 0

Re: monkeys.dom UPL being DDOSed to death
by Joe St Sauver 24 Sep '03

24 Sep '03

Hi, #This goes beyond spam and the resources that many mail servers are #using. These attacks are being directed at anti-spam organizations #today. Where will they point tomorrow? Many forms of breaking through #network security require that a system be DOS'd while the crime is being #committed. These machines won't quiet down after the blacklists are shut #down. They will keep attacking hosts. For the US market, this is a #national security issue. These systems will be exploited to cause havoc #among networks of all types and sizes; governmental and commercial. Note that not all DNSBLs are being effectively hit. DNSBLs which run with publicly available zone files are too distributed to be easily taken down, particularly if periodic deltas are distributed via cryptographically signed Usenet messages (or other "push" channels). You can immunize DNSBLs from attack, *provided* that you're willing to publicly distribute the contents of those DNSBLs. And when it comes to dealing with the sources of these attacks, we all know that there are *some* networks where security simply isn't any sort of priority. (For example, make it a practice to routinely see what ISPs consistently show up highly ranked on incident summary sites such as http://www.mynetwatchman.com/ ). Maybe the folks running those networks are overworked and understafffed, maybe they have legal constraints that limit what they can do, maybe their management just don't care as long as they keep getting paid. Who knows? Whatever the reason, no one is willing to depeer them or filter their routes, so they really are free to do absolutely *nothing* about vulnerable hosts or abusive customers. There are absolutely *no* consequences to their security inactivity, and because of that, none of us should be surprised that the problem is becoming a worsening one. Regards, Joe St Sauver (joe(a)oregon.uoregon.edu) University of Oregon Computing Center

13 18

RADB
by Christopher J. Wolff 24 Sep '03

24 Sep '03

Hello, On the RADB site, under features and benefits, the service claims to mirror "more than 30 other IRR databases." My challenge is that I need to list my information with RADB and don't want to go through the hassle of manually submitting every subnet owner and first-born when I can put a RWHOIS server up for ARIN. RADB should just poll my RWHOIS server. Thank you in advance for your advice. Regards, Christopher J. Wolff

2 1