- Test - lists.nanog.org

Re: The Geography of Spam
by sgorman1＠gmu.edu 02 Mar '04

02 Mar '04

I should add that I meant to say it matches the fact we gets lots of spam from hijacked machines - not the 30% number. We have just been looking at a few machines, but would love to see or hear about anyone who has bigger datasets to work with. ----- Original Message ----- From: Brian Bruns <bruns(a)2mbit.com> Date: Tuesday, March 2, 2004 11:23 am Subject: Re: The Geography of Spam > > On Tuesday, March 02, 2004 11:11 AM [EST], sgorman1(a)gmu.edu > <sgorman1(a)gmu.edu>wrote: > > > Thought folks might find this blurb from Sophos on the geography > of Spam > > interesting. 30% of Spam, they report, comes from hijacked > PC's. Matches > > pretty close to what we see across our network - i.e. all sorts > of stuff > > from swbell.net > > > > o U.S. Routes More Spam than World Combined, Study Shows > > > > Paris -- Intentionally or not, the U.S. routes more spam e-mail > traffic> than the rest of the world combined, according to a new > study by > > anti-virus firm Sophos. The study concludes that most of the > unsolicited> junk e-mails originate in Russia and then passes > through hacked computers > > in the U.S. "More than 30% of the world's spam is sent from these > > compromised computers, underlining the need for a coordinated > approach to > > spam and viruses," said Charles Cousins, Sophos' Asia managing > director . > > The U.S. accounts for a whopping 56% of the global spam pie, > followed by > > Canada with 6.8%. Europe did not fair very well in the report > either, with > > the Netherlands (5th), Germany (7th), France (8th), the U.K. > (9th) and > > Spain (12th) all making the list. > > http://www.sophos.com/spaminfo/articles/dirtydozen.html > > I guess I can say, that I can somewhat agree with what they are > saying, but > the percentage seems to be a bit lower then what I would have > said. With the > recent round of viruses that seem to be designed to help spammers > hijack end > user machines, I'd say the percentage is more towards 45-50%. > Sometimes its > very hard to tell the difference between an open proxy, and a > drone running an > open proxy (take the AHBL's proxy list, which is over 410,000 > proxies listed, > and our infected/hijacked machine count comes nowhere near that). > > Part of the reason why alot of the spam comes from outside of the > US is > because US spammers need to hide their actual locations in order > to avoid > getting snared by CAN-SPAM and similar. This is why Ralsky bases > his spamming > campaigns out of China, where the laws are more relaxed in terms > of this > stuff, and is less likely to get yanked off of his net connection. > This is > also why spammers have 'fronts'. :-) > > > -- > Brian Bruns > The Summit Open Source Development Group > Open Solutions For A Closed World / Anti-Spam Resources > http://www.sosdg.org > > The Abusive Hosts Blocking List > http://www.ahbl.org > >

1 0

Need Comcast contact
by Brian Bruns 02 Mar '04

02 Mar '04

Anyone happen to know of a contact for Comcast's mail server administrators? I need to discuss an issue with them about their mail servers mailbombing my systems from a joe job. Thanks. -- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org The Abusive Hosts Blocking List http://www.ahbl.org

2 1

Netvision.net.il contact
by cw 02 Mar '04

02 Mar '04

Hi there folks We are having pretty significant issues with person using both Netvision ADSL and what would appear to be a netblock assigned to an Israeli newspaper by Netvision. I saw an old email from someone at Netvision in the NANOG archives so I am hoping that he, or someone else there still reads the list. Does anyone have any experiences of dealing with Netvision with regards to issues with their users? I know there is a website somewhere with known NOC contacts but I can't remember it and don't have it bookmarked. Thanks, Colin.

2 2

Possibly yet another MS mail worm
by Todd Vierling 02 Mar '04

02 Mar '04

This one may be a variant of the recent worms. It's spreading by way of zipfile attachments. I don't have more info yet, but my $orkplace has just been hit by it and it's unknown to McAfee and Symantec at this time. It's not W32.Netsky, as best I can tell, because of the attachment filename: this one uses things like accabaacc.zip that are new to me. I don't have more info on it at this time, but will try to snare a sample in transit if it hits my home system. Just a heads-up, -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com>

15 20

RE: Dns help.
by McBurnett, Jim 02 Mar '04

02 Mar '04

Ejay, I found a great link some time ago: www.dnsstuff.com http://www.dnsstuff.com/pages/expert.htm This one has an option to do a lookup to any public DNS server... Pick some of the random Internation DNS servers and try it out.. It helped me out awhile back when an old DNS hoster still had us in their named.conf...... Later, Jim ---From Ejay--- Hi all. nanog(signal,noise++) I have a customer that is reporting intermittent reachability issues to Stormpay.com, and need a off-network perspective on dns. The end-user reports not being able to resolve the domain, but it's been okay everywhere I looked. Most of the complaints have been international, but there are a couple of charter and EarthLink addresses mixed in. Last dns change was 2 almost weeks ago, so I don't suspect a propagation issue. It should resolve to 207.65.19.39. Thanks, Ejay. (Who now owes two rounds at the next <400mi from Nashville after-nanog-bar-huddle)

2 1

RE: First Post! Annoying Debate at Work.
by Christopher Aldridge 01 Mar '04

01 Mar '04

-----Original Message----- From: Patrick W.Gilmore [mailto:patrick@ianai.net] Subject: Re: First Post! Annoying Debate at Work. >Please do not take this the wrong way, but I thought it was useful >input. Perhaps not to you, but maybe to those who think that getting >their MCSA will teach them all they need to know. It seems as though you MAY not be up to date on the MCSA. It stands for "Microsoft Certified Systems Administrator", FYI. To obtain the MCSA certification, I took the following exams: Exam 70-218: Managing a Microsoft Windows 2000 Network Environment Exam 70-215: Installing, Configuring, and Administering Microsoft Windows 2000 Server Exam 70-210: Installing, Configuring, and Administering Microsoft Windows 2000 Professional Exam 70-216: Implementing and Administering a Microsoft Windows 2000 Network Infrastructure One who thinks these exam topics cover (as you say" "all they need to know", should really investigate this certification. >Some of the things you asked were extremely basic. What "things" were these? I can only find one question in my entire email that requests a response which was: "What's your take and why?", which was obviously referencing the previous statement: --------------------------------------------------------- The argument non-persuasively put is as follows: Is a USB Ethernet Adapter a "converter"? Personally, I say "no". My coworkers seem to say "yes". --------------------------------------------------------- What this means my friend, is I wouldn't ever refer to a USB Ethernet Adapter as a "converter". A few co-workers seem to disagree, hence my request for the opinion of the nanog community. >I've never taken >any of the certifications you list, but I thought they would cover the >basics - especially after 3 of them (from 3 different vendors, I >think?) Unfortunately, MS and Cisco certifications do not generally cover the opinions of those who would and wouldn't classify an Ethernet Adapter as falling under the broad "converter" definition. If you feel that an Ethernet Adapter is a "converter", I suggest taking a different approach. >All that said, if you don't at least start asking, you will never find >out. Asking what? I'm not sure what you're talking about here, but I have received great responses from many people here who actually contributed to this discussion. >So I would not take this as an attack on you personally - lots of >people answered took the time to answer your questions, asking not even >a favor in return as payment. The people who responded helpfully to my post, will receive any help and assistance in the future from me as a fellow nanog'er; without the POINTLESS sarcasm and flaming. > I would take it as a note to people with >certifications or going for certifications that a cert != clue. I agree here 100%. However you have also made it very clear that no_cert != clue. >(Did any of those certs have >labs, or just multiple-guess tests?) Google is your friend. http://www.microsoft.com/learning/mcp/mcsa/requirements.asp http://www.cisco.com/en/US/learning/le3/le2/le0/le9/learning_certificati on_type_home.html >P.S. I kinda expected as much from MS, but it's sad that a cisco cert >doesn't mean much any more. :( Notice mostly everyone who provided useful feedback on this agreed with my opinion on this. Common sense has nothing to do with certs. Having both isn't a bad trait however. FYI, thanks for everyone who contributed to this.

4 4

Dns help.
by Ejay Hire 01 Mar '04

01 Mar '04

Hi all. nanog(signal,noise++) I have a customer that is reporting intermittent reachability issues to Stormpay.com, and need a off-network perspective on dns. The end-user reports not being able to resolve the domain, but it's been okay everywhere I looked. Most of the complaints have been international, but there are a couple of charter and EarthLink addresses mixed in. Last dns change was 2 almost weeks ago, so I don't suspect a propagation issue. It should resolve to 207.65.19.39. Thanks, Ejay. (Who now owes two rounds at the next <400mi from Nashville after-nanog-bar-huddle)

1 0

Re: Possibly yet another MS mail worm
by Rubens Kuhl Jr. 01 Mar '04

01 Mar '04

> > I'm not aware of any mail scanner that does this without running an external > > anti-virus or something alike, although is not that intensive to follow the > > zip headers (as they already do with the MIME headers in order to drop > > external attachments). Most scanners can accept an anti-virus plugin and > > them scan inside zip files, but that requires more processing power, more > > queue disk space, more RAM, more administration to update virus patterns, > > and so on. The cost/benefit usually pays off, but more complexity means less > > people will adopt the solution, thus making worm spreading easier. > > your description makes it all sound quite complicated, possibly because > you are passing all the processing down to the end-user's machine. I was talking about central anti-virus processing... although it's easier on administration than updating hundreds or thousands of machines, it establishes a central bottleneck. Doing decompression and extensive pattern matching on a high volume server is not an easy task. > we have anti-virus (clamav) and anti-spam (spamassassin) running at the > server level, and thus save the end-user alot of cycles. Even on low volume servers, this task is not something one would do without some thinking; on high volume, this is achievable but would require a good systems design to cope with the higher latency between mail receive and mail delivery. > clamav will look inside zip files, and automatically updates its signature > database. > > spamassassin uses both global rules and per-user rules to rate incoming email > and reduce the impact of spam. Been there at many installations of MailScanner (http://www.mailscanner.info) > we even run in-line scans of MIME headers during the SMTP process and reject > specific attachments (.exe, .pif, etc) without even bothering the end-user. That kind of filtering is much easier to configure, administer and goes low on resources. Extending this to verify filenames inside zip files would not be difficult to do, and is simple and not intensive enough to lots of people to turn such filters on. Rubens

7 6

RE: First Post! Annoying Debate at Work.
by Christopher Aldridge 01 Mar '04

01 Mar '04

From: Michael.Dillon(a)radianz.com [mailto:Michael.Dillon@radianz.com] Sent: Monday, March 01, 2004 6:04 AM To: nanog(a)merit.edu Subject: Re: First Post! Annoying Debate at Work. >Thanks for your EXCELLENT example of how technical certification >programs are no guarantee of fundamental technical understanding. >P.S. If you don't ask the right questions you will never get the right >answers. Thanks for the useful input!

2 1

Re: First Post! Annoying Debate at Work.
by Michael.Dillon＠radianz.com 01 Mar '04

01 Mar '04

>Network Analyst >CCNA/MCP/MCSA Thanks for your EXCELLENT example of how technical certification programs are no guarantee of fundamental technical understanding. P.S. If you don't ask the right questions you will never get the right answers.

1 0