- Test - lists.nanog.org

Re: Anti-spam System Idea
by Joe St Sauver 16 Feb '04

16 Feb '04

Lawrence Baldwin noted: #Personally, I think the better approach to fighting proxy spam is to #identify the spammers that are *upstream* from the proxies and then get one #or more of them thrown in jail, not for spamming, but for violating federal #or state computer intrusion laws. Spammers are currently using open proxies #because they are free and anonomous, until you make them non-anonomous AND #costly (jail) there's nothing will stop them. I believe this analysis is precisely correct. #This is not as hard as it sounds...if you are an ISP you have hijacked #proxies on your network. The RBLs can tell you which IPs are hijacked #proxies, all you need do is capture Netflow data and examine the upstream #IPs pummeling the hijacked proxy on it's SOCKS and/or HTTP proxy port. ... or the non-standard proxy zombie port de jour. (Depending on how long the box has been spewing, you may also notice scans/probes from good guys attempting to determine what's up with the behavior being observed from that host, but that's easy enough to spot and ignore when you do the traffic analysis). #The #results of such analysis is extremely enlightening...these spammers have NOT #moved off-shore, they are NOT using multiple levels of proxy chaining and #obfuscation, they are spamming DIRECTLY from their web hosting and corporate #offices in North America, and as is often the case, South Florida. ... and from Texas and California and New York, among others. And if you start looking at end-to-end performance and operational issues, it is easy to understand why spammers have NOT moved overseas when shovelling traffic through proxy spam zombies: -- If connecting from overseas, they have trans-pacific latencies and potential packet loss issues (with the reduced throughput that implies), and they can get that comparatively crumby throughput via expensive connections which are potentially subject to governmental interference, with any required systems work being a "remote hands" operation (with inconvenient time zone-related and potential language-related issues). Besides, some people may even block all traffic at their border from those overseas providers... or -- they can get very low latencies from multiple redundantly-connected geographically diverse colo providers here in the US at comparative rock bottom prices and with easy physical access to their systems... that is, they can do this as long as people DON'T bother doing as Lawrence suggests. If you DO start looking at inbound netflow data associated with compromised hosts, things become pretty clear, pretty darn quickly. And if you tie in AOL scomps or other abuse reports, it becomes pretty trivial to even tell *which* spammer is abusing your compromised hosts from domestic colo providers -- you then know WHO, WHAT, WHEN, WHERE, WHY and HOW people are abusing that host. Frost, apply candles, present to law enforcement for processing and attention (or blackhole/filter the colo block at your border, if you're the impatient type or are skeptical about getting law enforcement involved). To tell you the truth, I've been quite surprised that major broadband providers with tens of thousands of compromised customer hosts haven't done that already. Regards, Joe St Sauver (joe(a)oregon.uoregon.edu) University of Oregon Computing Center

1 0

Re: Anti-spam System Idea
by Michael.Dillon＠radianz.com 16 Feb '04

16 Feb '04

>To me, the approach you advocate is something like saying "do away with any centralized >law enforcement, force everyone to carry guns, and if anyone suspects that someone >else is committing a crime, they are obliged to shoot them." I believe that blocking >spam at its source is far easier than blocking it at every possible destination. The >less parties involved in blocking the spam, the higher the probability that the spam >will be successfully blocked. To do this you need to form a police force and a judiciary. Neither are possible in the absence of an organized society. The first step is for some of the larger senders/receivers of email to sit down around a table and form an email services consortium that can set "best current practice" standards and police those standards. This is something that network operators can do. --Michael Dillon

1 0

Re: Identifying IP address types
by Michael.Dillon＠radianz.com 16 Feb '04

16 Feb '04

>1.0.168.192.in-addr.arpa in ptr some1.example.net > in hinfo Dynamic Dialup >2.0.168.192.in-addr.arpa in ptr some2.example.net > in hinfo Static xDSL And why shouldn't an ISP be allowed to sell dialup or XDSL services to someone who runs their own SMTP server? Let's not start mucking around with the ISP's business model here. IN HINFO "No SMTP" If the ISP's customer does have an SMTP server, all they need to do is talk to their supplier and get this changed to IN HINFO "SMTP OK" Of course, I have to add the obligatory plug for LDAP here since this is the kind of thing LDAP was made for. I know that the early DNS was envisioned to support all of these different needs but over time DNS was simplified and focused on doing one job well while people who needed a more general purpose directory migrated to using LDAP. Also, just because some (or all) ISPs publish a directory of SMTP capable IP addresses doesn't mean that third parties cannot continue to publish their own directories as well. And if these 3rd party directories lost the pejorative naming (blacklist, block lists) then perhaps more people would volunteer useful attributes to be published in them. --Michael Dillon

1 0

RE: Anti-spam System Idea
by Michael.Dillon＠radianz.com 16 Feb '04

16 Feb '04

>If these exist then why are we still having problems? Why do we let >customers who have been infected flood the networks with traffic as they do? Someone sent me a message on Friday with a Dykstra quote that sums it all up... It is impossible to sharpen a pencil with a blunt axe. It is equally vain to try to do it with ten blunt axes instead -- E.W Dijkstra, 1930-2002 It simply isn't possible to block spam no matter how many axes we use and how cleverly they are designed. If we would put the same amount of effort into a secure Internet email architecture, then the whole SPAM issue would just fade away. Today, there it is not possible to secure the email system by securing a subset of email servers. SPAM can enter the system at any email server and therefore we have to secure all servers in order to block SPAM. But any particular email server also needs to accept legitimate email from a large and unbounded number of sending servers. So it is a very, very hard problem to either separate SPAM sources from legitimate email sources or to separate SPAM messages from legitimate email messages. However, if the world shifted and the only way to send email was to use a secure authenticated submission protocol to pass the message to an ISP with whom you have a business relationship, then the scale of the problem changes. Now you only have to secure the submission servers and any particular organization can more easily distinguish between the small number of customers and the larger number of non-customers. Of course, this also means that all SMTP servers must also be secured to only accept email from known authenticated sources. This is technically possible if we had the will. However, today few people have the will to attempt to fix this problem because of the phantom SPAM problem. We see the symptoms of the email architecture disease and assume that SPAM is the disease itself rather than merely a symptom of the disease. In the meantime, Internet users are discarding the use of email in favor of instant messaging networks, some of which are more secure than email and have less SPAM. You will note that IM services are rarely offered by an ISP to its customers as part of a service bundle. The net effect of this is that one of the value-added services that smaller ISPs can offer is becoming eroded and replaced by a value-added service that is only offered by the largest ISPs. --Michael Dillon

1 0

Re: Anti-spam System Idea
by Rainer Atkins 16 Feb '04

16 Feb '04

I have a different idea about how spam could be dealt with, which I have yet to see proposed or discussed on Nanog. Everything suggested is always a technical patch trying to deal with the fact that spammers can make a lot of money. And, regardless of the patch you apply, they will find a way around it because the financial incentive is big enough. It seems to me that if a spammer has a network of 10,000 trojaned broadband connected computers at his disposal to send spam, its not much use if no one wants to pay him to do this. So, instead of focusing on the spammer focus on the spamme'rs customer. Place the cost of spam mitigation on them, pass legislation that makes them liable if their product or service is advertised by spam. This should generate some freedom of speech flames. :-) _________________________________________________________________ Choose now from 4 levels of MSN Hotmail Extra Storage - no more account overload! http://click.atdmt.com/AVE/go/onm00200362ave/direct/01/

1 0

power outage in LA?
by matthew zeier 15 Feb '04

15 Feb '04

I just lost an upstream provider and they tell me there's a power outage in LA - anyone have any info on that? -- matthew zeier - "Nothing in life is to be feared. It is only to be understood." - Marie Curie

1 0

Re: Anti-spam System Idea
by W.D.McKinney 15 Feb '04

15 Feb '04

>-----Original Message----- >From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] >Sent: Sunday, February 15, 2004 01:21 AM >To: 'Tim Thorpe' >Cc: nanog(a)merit.edu >Subject: RE: Anti-spam System Idea > > >On Sat, 14 Feb 2004, Tim Thorpe wrote: > >> If these exist then why are we still having problems? > >Because the spammers are creating proxies faster than any of the anti-spam >people can find them. Evidence suggests, at least on the order of 10,000 >new spam proxies are created and used every day by spackers >(spammer/hackers). > >The relative insecurity of windows and ignorance of the average internet >user has created an incredibly target rich environment for the spackers. > >> Why do we let customers who have been infected flood the networks with >> traffic as they do? Should they not also be responsible for the security >> of their computers? Do we not do enough to educate? > >Economics, and convenience outweighing security. We're big, and slow to >change. They're small and mobile. > > The Barracuda Networks Firewall helped us and especially recently. Realize it's an edge solution, but seems about all we can do right. Some of the users still are using other accounts are getting spacked. Dee Alaska Wireless Systems

3 2

RE: Anti-spam System Idea
by Tim Thorpe 14 Feb '04

14 Feb '04

I am trying to find all of the rouge relays out there created by the more recent worms that have spread throughout the internet, and improve the speed at which it is done, instead of say a list that updates daily with SOME of the relay changes, this list would be rebuilt daily from the ground up and made available daily to be grabbed. For current personal SPAM control I use cloudmark's spamnet, I have yet to find anything better, but it does cost a couple bucks a month. > -----Original Message----- > From: Brian Sneddon [mailto:B.Sneddon@metrologic.com] > Sent: Saturday, February 14, 2004 12:45 AM > To: 'Tim Thorpe' > Subject: RE: Anti-spam System Idea > > Hi, Tim. > A couple of the RBL (real-time black hole listing, in case > you're not already familiar with them) providers already do > something like this. SORBS and NJABL stick out in my mind as > examples. Is there something about their method that you're > seeking to improve? > > Also as far as anti-spam software is concerned my personal

2 1

Wireless Pt-Pt in Orlando FL ?
by Ben Crosby 14 Feb '04

14 Feb '04

Hi all, If anyone knows of a company who can provide internet connectivity via fixed wireless in Orlando, please contact me off-list. I'm looking for DS3 or higher. I welcome any experiences anyone may have had with this type of service. Ben.

1 1

RE: SMTP relaying policies for Commercial ISP customers...?
by Dan Ellis 13 Feb '04

13 Feb '04

Andy, These are exactly my concerns, and exactly what I feel I'm going to hear from the staff and the customers. I am going to go back and make sure there isn't a "better" solution. Thanks for the input. The issue we have as a dynamic IP broadband provider is that it's a royal pain to shutdown a user - especially in regards to just mail. Lets say we have a spammer and a script detects it. We then have to track him back to the MAC address of the modem, lookup that MAC in the customer DB, shutdown his access and then reset the modem. And at the end, he loses all access, not just mail. With AUTH we can just stop mail access. Yeah, sure we could try to push some access list to the modem itself, blocking mail, but those modems are so flaky to start, it'll never work reliably. Can't just block the IP on the mail server because the user will or could just get a new IP, and then you are blocking a legit user. I'm still not sure if the norm is for providers to let t1+ customers relay. I have multiple OC3's and 12's from AT&T, MCI,... Will they let me relay off their servers without SMTPAUTH? Probably not. As always, comments welcome. -- Daniel Ellis, CTO, PenTeleData (610)826-9293 "The only way to predict the future is to invent it." --Alan Kay > -----Original Message----- > From: Andy Dills [mailto:andy@xecu.net] > Sent: Friday, February 13, 2004 12:35 PM > To: Dan Ellis > Cc: nanog(a)merit.edu > Subject: Re: SMTP relaying policies for Commercial ISP customers...? > > > On Fri, 13 Feb 2004, Dan Ellis wrote: > > > 1) Residential Policy: Enable SMTPAUTH and disallow relaying > > unless the customer has a valid username/password. If you're not paying > > for a mailbox, you don't get to relay outbound. This should not break > > anything except those residential accounts that *should* be commercial > > anyway. > > > > 2) Broadband commercial: This is the difficult one. These are the > > customers that aren't big enough to rightfully run their own mailserver, > > but they are big enough to have roaming users on their networks (coffee > > shops, branch offices, hotels, SOHO....). They expect relaying service > > for either their mailserver or for all their various PC's. At the same > > time, they don't have many, if any mailboxes through the ISP. My > > thought is that they should ONLY be allowed to relay via SMTPAUTH by > > using a residential mailbox login/pass OR they need to purchase a > > commercial relay service (expensive because of the openness of it) for > > their IP space. > > > > 3) T1+ : These customers should not be allowed to relay unless > > they purchase (expensive) relay services for their IP space. Of course, > > they can always use a residential mailbox, but will have to use SMTPAUTH > > for it and will be restrained by the same policies residential mailboxes > > have (low tolerance tarpitting,...). > > While the amount of effort you put into this so far is commendable, I > really think you're barking up the wrong tree. > > At the end of the day, what have you done, besides annoy your customers > and increase the load on your support staff? > > I don't really see what you're suggesting being anything other than a huge > effort, solving the wrong problem. > > For any responsible ISP, the problem is the spam coming into your > mailservers, not leaving. As long as you quickly castrate the people who > do relay spam through you, you're not going to have an egress spam > problem. > > Since you seem to have countless hours to invest in this problem, you'd be > better off writing a log parser to identify WHEN somebody is relaying spam > through you, so you can react. > > Something else I've seen implemented is rate limiting. Keep track of the > number of messages sent by an IP over a variable amount of time and > implement thresholds. > > > I'd love to hear some of the conversations you have with your leased line > customers, when you tell them they have to pay for "(expensive) relay > services" to send mail through your mail server. How many times will they > laugh before hanging up on you? :) > > That's like the IRS trying to charge you for the forms... > > And I'd also like to see the looks on your technical support staff's faces > when you tell them they need to assist your ENTIRE USER BASE in switching > to authenticated SMTP :) > > And then you have to deal with the customers who have MTAs that don't > support authenticated SMTP...and on and on. > > Whenever the solution is more expensive than the problem, you need to go > back to the drawing board. > > Andy > > --- > Andy Dills > Xecunet, Inc. > www.xecu.net > 301-682-9972 > ---

8 8