- Test - lists.nanog.org

RE: abusereporting (was Re: Monumentous task of making a list)
by Stephen Gill 09 Feb '04

09 Feb '04

Hi Mikael, Aside from the standardization issue, some of the problems with reports as they stand are that they can be routed to the wrong people, there is no clear way of verifying the authenticity of the data, and the sheer number of reports can inundate a given abuse helpdesk such that they are tempted not to take any action at all. Having a standardized report format is a great idea. In our experience information needs to come from a trusted source or people are less likely to act on the information provided. We've also found it helpful to submit the reports to the ASN maintainers (ISPs) using real-time BGP routing table information to determine who is responsible for a given netblock rather than relying on archaic whois data. The reports are also rolled up into concise summaries where possible so as not to inundate AS maintainers with unnecessary data. If you'd like to quickly determine who is routing a given IP address, you can send your queries to the CYMRU whois server. More information about it can be found here: http://www.cymru.com/BGP/whois.html Members of NSP-SEC receive reports on a weekly or ad-hoc basis summarizing what others are seeing emanating from their networks. The reports are in turn processed by many, such that ISPs can alert their own customers and downstreams of potential problems. A summary of what types of reports are submitted can be found here: http://www.nanog.org/mtg-0310/pdf/cymru.pdf We agree that having a timestamp is crucial to problem resolution, most preferably in GMT. We accompany all IP numbers with an ASN which is used to route the report to the appropriate network boundary. All reports receive a context quantifying and providing a scope around the data. Cheers, Steve, for Team Cymru. -- Date: Sun, 8 Feb 2004 10:43:11 +0100 (CET) From: Mikael Abrahamsson <swmike(a)swm.pp.se> Subject: abusereporting (was Re: Monumentous task of making a list) On Sun, 8 Feb 2004, Suresh Ramasubramanian wrote: > The problem with trojans etc is that there so damn many of them, so the > less time spent actually tracking down the user who was on IP X at time > Y, the better it is for the ISP's staffers who handle complaints about > these. I have asked about this before. Wouldnt it be very nice if there was a standardized way to report IP-number and timestamp and type of complaint? I've seen something produced by some workgroup (RIPE?) but that was a huge document about XML and it seemed non-trivial to implement. I was more into the idea of having basically email headers like: X-ABUSEREPORT-IP: <ip> X-ABUSEREPORT-DATE: <unix timestamp> X-ABUSEREPORT-TYPE: <spam|abuse|ddos|other> This should make it trivial for most automated tools to append this (spambouncer etc) and make it much easier for the abuse system to do a user lookup before presenting the abuse email to the handler, even providing the user email address so the handler can take action. - -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 1

Stopping open proxies and open relays
by Adi Linden 09 Feb '04

09 Feb '04

I am looking for ideas to stop the spam created by compromised Windows PC's. This is not about the various worms and viruses replicating but these boxes acting as open relays or open proxies. There are valid reasons not to run antivirus software, coupled with clueless users, this results in machines that SPAM again just a few hours after having been cleaned. Adi

10 12

Re: P2P open source blocking project
by Michael.Dillon＠radianz.com 09 Feb '04

09 Feb '04

>> For those you want to kill the various p2p programs..there is a >> promising project at the following address: >I'd like to further reduce the functionality of my internet transport >because why? In order to spur the development of more sophisticated P2P protocols and encourage users to switch over to using them. The net *IS* an ecosystem, after all. Read up on eigentrust and "emergent behavior" and "complex adaptive systems". The current crop of popular P2P networks are quite crude and deserve to be killed off in favor of more robust models. --Michael Dillon

1 0

Re: Dumb users spread viruses
by Paul Vixie 09 Feb '04

09 Feb '04

> Uneducated users should live with the slowness. It's protecting the rest of > the world from their blissful ignorance. if it protected them or anybody else i'd say you were right, but since it's a pattern matcher it always takes 2 to 24 hours for a new pattern file to be developed and distributed after a new worm is released. why even bother? > The average Windows user CANNOT BE TRUSTED TO DO THE RIGHT THING because > they are blindly trusting the (1) operating system's security, and (2) > non-malicious intent of the things they view or download. > > This is established fact, with oodles of hard-earned stats to back it up. once you add a particular operating system to the equation i can't disagree (mostly due to lack of facts i've actually gathered or checked personally.) however, in the situation you describe, the fault is still with the OS, not with the end user. as i said before, if we (the creators and distributors of the products and services these users depend on) can't make them safe, then the fault is with us, not with the people using them. it's as if not knowing how the fuel injectors work on my car could make it blow up on the freeway. we'd blame the manufacturer, not the driver, right?

4 3

P2P open source blocking project
by William Warren 09 Feb '04

09 Feb '04

For those you want to kill the various p2p programs..there is a promising project at the following address: http://www.lowth.com/p2pwall/ftwall/ William -- May God Bless you and everything you touch. My "foundation" verse: Isaiah 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD.

2 1

Re: Stopping open proxies and open relays
by Michael.Dillon＠radianz.com 09 Feb '04

09 Feb '04

>Force all SMTP outbound connections from users thru a SMTP proxy. On that >proxy, force users to do SMTP Authentication; I've heard only once of a spam >code that will use the user's configuration info or dispatch e-mail thru >them. Even if they do, you can rate-limit messages/hour, unique mail >to/hour, disable mail service after a threshold, whatever sounds a good >policy to you. This is the most sensible message I've read about SPAM in a long time. And it is even highly relevant to network operators who service end users. Now if only we could come up with something similar for ISP server-to-server mail transfers then we might actually reduce SPAM to a dull roar receding into the distance. --Michael Dillon

1 0

Re: Are SW upgrades needed in MPLS core networks?
by Michael.Dillon＠radianz.com 09 Feb '04

09 Feb '04

>Just to be sure, my point here is not where the effective IPv6 performance >suits one needs or not, but wether a router that can forward <amount> Mpps >of IPv4/MPLS packets can also forward the same amount of IPv6 packets per >second. Wouldn't a network with an MPLS core use 6PE to implement IPv6 rather than routing v6 natively in the core? In that case wouldn't the forwarding performance of native v6 be irrelevant? --Michael Dillon

1 0

Re: question on ptr rr
by Paul Vixie 09 Feb '04

09 Feb '04

>> I've run all my mailers with aggressive PTR checks for about a year, and >> while some of my guests aren't getting all the e-mail that's sent to them, >> it's had no impact on me other than that periodically I have to tell some >> remote postmaster that their PTR's are missing or that they don't match >> the HELO hostname. Invariably they fix it. > ... What do you suggest otherwise-responsible operators like me do, > when after begging SBC for two years, my reverse DNS still isn't > delegated correctly? buy a 1U, put it in a colo center (should cost you about $50/month) and proxy all your outbound mail from there. stop thinking of broadband as anything other than a lastmile protocol between your house and your own piece of the internet core. or send SBC a copy of RFC 2317 every hour via a crontab. might not be very effective but it would sure get you talked about. since you're a customer they can't accuse you of spamming them...

8 8

Re: question on ptr rr
by Paul Vixie 09 Feb '04

09 Feb '04

> >I think the tipping point went by a while ago, and that anyone who wants > >their e-mail to be accepted will make sure their mail relay has a PTR and > >that that this PTR holds the same name used in the SMTP HELO command. > > Of course, not all that long ago AT&T Worldnet got crucified -- on this > list, among other places -- for doing just that. then you should've stood your ground.

1 0

Re: Dumb users spread viruses (here's one!)
by Dr. Jeffrey Race 09 Feb '04

09 Feb '04

On Sun, 8 Feb 2004 21:03:29 +0000 (GMT), E.B. Dreger wrote: >Most of our users are reasonable, however. With a little >explanation about the harm an insecure computer can cause, they >understand and accept the fact that they're not islands. > >Of course, many still get infected with spyware and viruses. At >least they're willing to have their computers repaired... better >than nothing, but still not as good as being proactive. :-/ Datapoint: I just cleaned my 12-year old daughter's personal machine running Windows, connected to our home network and to the world via ADSL. Took half a day. Found 2 viruses, 4 trojans, and 122 registry entries for assorted malware, spyware, adware, etc. Jeffrey Race

1 0