September 2004 - Test - lists.nanog.org

paging the postmaster from adelphia
by Matt Ghali 23 Sep '04

23 Sep '04

Your mail is bouncing. Your support reps claim that they have no control over blacklisting. Your mail servers say that socrates.berkeley.edu is on a blacklist that it isn't. Please mail me, we've been trying to resolve this for a week. Matt Ghali berkeley.edu mail ops

1 0

Website contact for www.cisco.com
by Temkin, David 23 Sep '04

23 Sep '04

Can someone responsible for either security or operations of www.cisco.com please contact me? We are seeing an issue where you may be blocking one of our source IP addresses from accessing the website. Thanks, -Dave David Temkin S-I-G IMPORTANT: The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

2 1

Re: The worst abuse e-mail ever, sverige.net
by Mike Nice 23 Sep '04

23 Sep '04

> Blocking just hides it. I used to believe in port blocking as the solution > to many user problems but now I have 3 and 4 page ACL's > on my border routers. This does not scale. Yes, I could push this out via > radius to the NAS but again this does not solve the problem. > The solution I am working toward is quickly identifying user infections. >We are almost there. I collect and record > all traffic from the users going to dark space and am almost finished with > the system that will identify who held that > IP at a specific time. It is all in SQL so that is easy. Our system is similar, except we block port 25 completely via RADIUS after we detect an outgoing virus or spam, then notify the customer. This eliminates the ACL's on the border routers. The user can still surf freely to download patches while not causing further damage. Some users just don't want to be bothered and just use webmail to send E-mail and keep the block forever.

3 3

RE: FW: The worst abuse e-mail ever, sverige.net
by Sean Crandall 23 Sep '04

23 Sep '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Mikael Abrahamsson > Sent: Tuesday, September 21, 2004 1:01 PM > > As I said, this is DSL, which to me implies always on. Each DSLAM port > only allows one IP address, this is set statically. The customer has a > static IP address assigned to him/her, which never changes > over time. No > DHCP, nothing dynamic what so ever. If you want to make yourself > unreachable to one of our customers you blacklist their IP > which is always > the same. Simple. We configure our DSL customers the same way you do. Static PVC, Static IP. Each user has a static IP and in 99% of the cases, we do not assign any dynamic IPs. However, I would say that it is safe to say that the majority of the ILECs here in the US provide DSL service where the IP is dynamic. Most of the time, it doesn't change, but it is very possible that the next time that the user logs in (most are also using PPPoE for the connection setup) that the DHCP server might give them another IP. As such, when we have seen our IP blocks get blocked strictly because of the rDNS entry having 'dsl' in it, a simple email to the admins explaining that we are not providing dynamic services has gotten our rDNS entries taken off of the blacklist. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. 6691 Owens Drive Pleasanton, CA 94588 (925) 201-2530 (office) (925) 201-2550 (fax)

19 32

Visualization of Hurrican Ivan Internt Outages
by sgorman1＠gmu.edu 23 Sep '04

23 Sep '04

Thoughts folks might find this bit from John Quarterman's Internet Perils outfit, by way of Martin Dodge, interesting: https://www.internetperils.com/perilwatch/20040914.php Visualizes the impact of the loss of an undersea cable to the Cayman Islands

1 0

RE: FW: The worst abuse e-mail ever, sverige.net
by Miller, Mark 23 Sep '04

23 Sep '04

Most DSL providers that hand out static addressing also have the means to delegate the rDNS. Sounds like it is time to get your own DNS on. - Mark E. Miller "...it said: Install Windows 2000 or better...so I installed FreeBSD..." PGP Key fingerprint = 4E60 8A3C ECE5 3018 474B 1D0F 9C74 6147 85FB F2F4 -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Lars-Johan Liman Sent: Wednesday, September 22, 2004 3:17 AM To: nanog Subject: Re: FW: The worst abuse e-mail ever, sverige.net I cannot agree to the "block port 25" line of action. I am a Unix sysadmin, with 15 years of experience as sendmail and DNS expert. I have a DSL line at home, with static IP, and generic rDNS provided by my ISP. Behind it I have a serious Unix server, configured to roughly the same standard that I use at work. *snip*

2 1

Spyware Equivalent to ISC.Sans.Org?
by David A. Ulevitch 22 Sep '04

22 Sep '04

NANOG, I am trying to get some information on some of the worst spyware offenders currently nailing users. Is there something like isc.sans.org but for tracking spyware infection/spread rates? I'm not looking for specific papers on worm speeds ( ala the warhol worm paper) but a more generic statistics of worst offenders. I am also interested in knowing about any .edu's publishing this sort of information. Thanks for any help. -david ---------------------------------------------------- David A. Ulevitch - Founder, EveryDNS.Net http://david.ulevitch.com -- http://everydns.net ----------------------------------------------------

2 1

SF Bay Area: Email Administrator Usability Study
by Kristyn Greenwood 22 Sep '04

22 Sep '04

I've been informed that the members of this list would be interested in a usability study being conducting on the activities of Email Administrators. If you are not an email administrator but know of someone who might be interested please feel free to forward this message. I am looking for email administrators in the San Francisco Bay Area and Sacramento to participate in a usability study. We are looking for individuals whose primary role is to administer and maintain their organization's electronic mail system; regardless of the type of email system administered or the tools used. Participants may be system administrators, database administrators, network administrator as long as 50% of their time is spent working on the electronic mail systems. As a thank you for participating in the study, we are providing $20 Starbucks gift certificates to the participant, a $5 Starbucks gift certificate to their manager/VP(s), and a $5 Starbucks gift certificate to the individual who referred them. The purpose of the study is to identify the types of tasks that email administrators typically perform, and the tools that they use. It involves no travel as we would like to visit email administrators at their place of work and observe a typical day. If you are an email administrator who would like to participate, please contact me at the address below and provide a name and phone number where you can be reached. If you know of an email administrator who might be interested, please forward this message to them. Thanks for your assistance, Kristyn Greenwood Principal Usability Engineer kristyn.greenwood(a)oracle.com

1 0

RE: FW: The worst abuse e-mail ever, sverige.net
by Kathryn Kessey 22 Sep '04

22 Sep '04

I don't want to add to this bash-fest, but maybe a little context and a laugh helps... the original posting sounds like utter frustration, something I'm sure a few people are familiar with if you've ever worked for a bunch of sociopathic conartists using their service provider business to steal from people in order to support their prostitution/drug/gambling habit and/or perpetuation of their cult... Like my previous employer. If you work for someone who allows you to subject sales to any sort of screening, like asking "Is your mail server RFC2505 compliant?", luckily you aren't working for clowns who would sell to anyone (and actually say things like "spammers are a great sales channel!"), refer to themselves as "pirates of telecommunications" (seriously), and refuse to support any implementation of known good technical practices if it A) costs > 0.01 or B) inconveniences any spammer (I mean, customer.) And the aftermath of not implementing reasonable technical practices, is of course, all your fault (like all of your superblocks being RBLed for consistently selling service to notorious spammers)... People who treat their engineers with utter disdain and contempt, as if they are just a sinkhole for their sales dollars. Luckily for me, I could just walk away and hand them my two word resignation letter (thats right: FO). Not everyone can, esp during the recession. I'm just posting this because if you have never worked in these conditions, its hard to comprehend the frustration level, I certainly didn't before experiencing it myself. And maybe we should find ways of putting scourge like this out of business. glad to be back from the dark side, working for a real company again... Kathy -----Original Message----- From: John Curran [mailto:jcurran@mail.com] Sent: Wednesday, September 22, 2004 10:37 AM To: Lars-Johan Liman Cc: nanog Subject: Re: FW: The worst abuse e-mail ever, sverige.net At 10:16 AM +0200 9/22/04, Lars-Johan Liman wrote: >I cannot agree to the "block port 25" line of action. You block port 25 until a customer says that they're claim to have setup a responsible mail submission agent and demonstrate the necessary clue density. This can be readily determined by having customer support mail a short form with relevant questions such as "Is your mail server RFC2505 compliant?", "Please list the mechanism used to secure mail submission to your server?", and "Are you prepared to handle SPAM reports for all email originated or relayed?" No problem for someone who knows what they're doing but enough to deter the random end user. /John

1 0

FW: The worst abuse e-mail ever, sverige.net
by Daniel Golding 22 Sep '04

22 Sep '04

On 9/21/04 1:00 PM, "james edwards" <hackerwacker(a)cybermesa.com> wrote: > >> Sheesh. Get over /yourself/. Your network is rude by its very existence, >> if it lets spammers relay crud by way of it. Your own arrogance in >> thinking it's not your problem to fix is astounding. > > I did no say it is not my problem, we have a 10 year history of being > very pro-active for all abuse issues and have a dedicated staff person to > deal with these issues. Slaming my mail admin because a dial up user has a > virus > is rude, period. Our dial up address space is listed, if people choose to > block > mail from that space. > > james > To shift this to a more operational tone... Networks make choices. One choice is to declare their dynamic space and put the duty of ignoring emails from dialups users on the receiving networks. Another choice is to filter port 25. Filtering port 25 has its own costs - some users are offended/bothered by this, since they can't use their own corporate mail servers, in some cases. If a network makes the choice of putting the duty of filtering on the receiving party, they need to accept that this will upset some of those receivers. Today's security environment means that spam-sending viruses are common. The only responsible thing to do is filter port 25, smarthost for your users, and inform them about using the alternate submission port with authenticated SMTP in order to work with enterprise mail servers - or IPSec VPNs, for that matter. This is simply the best practice, at this point in time. Using humans ("dedicated staff person") to stop spam isn't scalable - automated processes are sending this stuff, we need systematic ways to fight it - black/white lists, SPF, port 25 filtering, bayesian filtering and other tools. -- Daniel Golding Network and Telecommunications Strategies Burton Group

7 8