- Test - lists.nanog.org

Re: here are some postfix patterns i found useful today
by Paul Vixie 04 Feb '04

04 Feb '04

several of you thanked me privately for the earlier post on this thread, and in the time since then i have been inundated with even more variations of antivirus messages, so i'm posting an update. the bad news is, you have to use body checks as well as header checks. the good news is, i don't think the antivirus companies are going to start swizzling their headers and bodies in order to bypass these checks. about half of them include commercial advertising in their warnings, but that doesn't make them spammers (does it?) the stronger these viruses become, the more antivirus warnings i receive. to that end, i've made rejecting this chatter at the smtp level a priority. (otherwise i'd end up blackholing them at the ip source level, which would cause subsequent false positives on the non-antivirus mail they send out.) > what you do is, install postfix 2.0 or later, set header_checks to some > filename (in your main.cf), header_checks = regexp:/var/local/sa/postfix/headfilt.regex body_checks = regexp:/var/local/sa/postfix/bodyfilt.regex > and in that file, you put the following: bodyfilt.regex: /^Sorry Dangerous Attachment has been Removed/ REJECT body4 / is removed from here because it contains a virus$/ REJECT body5 /^WARNING: This e-mail has been altered by MIMEDefang/ REJECT body6 headfilt.regex: /^Subject:.*ALERTE \- Vous avez envoye un mail avec virus/ REJECT av /^Subject:.*ALERTE\: un virus a / REJECT av /^Subject:.*ALERT\! Virus found in your mail/ REJECT av /^Subject:.*Anti-Virus Notification/ REJECT av /^Subject:.*AntiVir ALERT/ REJECT av /^Subject:.*Anti\-Virus Notification/ REJECT av /^Subject:.*Antigen Notification/ REJECT av /^Subject:.*Antigen found VIRUS/ REJECT av /^Subject:.*Antivirus stopped your message/ REJECT av /^Subject:.*BANNED FILENAME/ REJECT av /^Subject:.*Disallowed attachment type found/ REJECT av /^Subject:.*Email Quarantined Due to Virus/ REJECT av /^Subject:.*Failed to clean virus file/ REJECT av /^Subject:.*File blocked - ScanMail for Lotus/ REJECT av /^Subject:.*Inflex scan report \[\d+\]/ REJECT av /^Subject:.*InterScan NT Alert/ REJECT av /^Subject:.*MMS Notification/ REJECT av /^Subject:.*MailSure Virus Alert/ REJECT av /^Subject:.*Message deleted/ REJECT av /^Subject:.*NAV detected a virus/ REJECT av /^Subject:.*Norton Anti.* detected/ REJECT av /^Subject:.*Ochrona antywirusowa/ REJECT av /^Subject:.*RAV AntiVirus scan/ REJECT av /^Subject:.*RECIPIENT \! Virus Notify \!/ REJECT av /^Subject:.*Report to Sender/ REJECT av /^Subject:.*Returned due to virus\; was\:/ REJECT av /^Subject:.*SAV detected a violation in a / REJECT av /^Subject:.*SENDER \! Virus Notify \!/ REJECT av /^Subject:.*ScanMail Message\: To Sender\, virus found / REJECT av /^Subject:.*Symantec AntiVirus/ REJECT av /^Subject:.*This message contains unsolicited data/ REJECT av /^Subject:.*VIRUS .* IN MAIL FROM YOU/ REJECT av /^Subject:.*VIRUS .*IN YOUR MAIL/ REJECT av /^Subject:.*VIRUS NO SEU EMAIL/ REJECT av /^Subject:.*Virus Alert/ REJECT av /^Subject:.*Virus Check Alert/ REJECT av /^Subject:.*Virus Detected by Network Assoc/ REJECT av /^Subject:.*Virus Notification from Redstone/ REJECT av /^Subject:.*Virus Notification\:/ REJECT av /^Subject:.*Virus Quarantine Notification/ REJECT av /^Subject:.*Virus Warning/ REJECT av /^Subject:.*Virus found in / REJECT av /^Subject:.*Virus in Ihrer Nachricht/ REJECT av /^Subject:.*Virus in\:/ REJECT av /^Subject:.*Votre message contient un virus/ REJECT av /^Subject:.*Warning\: E-mail viruses detected/ REJECT av /^Subject:.*WorldSecure Server notification/ REJECT av /^Subject:.*\[SmartFilter\] Virus Alert / REJECT av /^Subject:.*\[Virus detected\]/ REJECT av /^Subject:.*\{VIRUS\?\}/ REJECT av /^Subject:.*message .* contains a virus/ REJECT av /^Subject:.*virus found in sent message/ REJECT av /^Subject:.*virus trouve dans le message envoye/ REJECT av /^Subject:.*virus trovato in un messaggio inviato / REJECT av and as before, i cannot recommend the following article highly enough: > see also <http://www.attrition.org/security/rant/av-spammers.html>.

1 0

Re: in case nobody else noticed it, there was a mail worm released today
by Roger Marquis 04 Feb '04

04 Feb '04

Scott Francis <darkuncle(a)darkuncle.net> wrote: > I've been wondering lately, after about 10 years of email worms spreading in > exactly the same manner with every incarnation ... why do you think people > haven't learned not to open unexpected attachments yet? Blaming it on end users is one way to look at the problem, but not a way that will result in a solution. You should be wondering, after 10+ years of virus laden MS operating systems, why they haven't fixed this stuff. Similar vulnerabilities in Unix, Mac, and other OS were fixed long ago. They're not patched in Windows because MS doesn't have to. MS doesn't write secure code because they are a monopoly and maintain that status by introducing subtle OS bugs that plague competitive third party applications. They don't publish an API for many of their system calls so nobody can write secure code other than MS themselves. They also run as much of their own software as possible in priviliged mode for performance (to avoid context switching). You'll never seen any real security from this type of business model. > (Note: I really do not want this to degenerate into another rant against > vendor M; Sorry for not sharing your disinterest in the actual reasons we continue to see these viruses and trojans infecting MS and, for all intents and purposes, only MS operating systems. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

10 18

[OT] need att.net postmaster contact
by Omar 04 Feb '04

04 Feb '04

Hi, I have a mailing list host which runs into occasional issues with att.net/worlnet.att.net. Their abuse address has been responsive in lifting listings in their block list, but I've not been able to get anyone to respond about a more permanent solution, like setting up a feedback loop and whitelisting our netblocks. Can anyone contact me or direct me to a manager/director in the postmaster group (off-list, of course)? Thanks much, Omar Thameen

1 0

CULPRIT - poor connectivity to new b.root-servers.net
by bill 04 Feb '04

04 Feb '04

upstream routing for the new and old prefixes for b.root-servers.net is asymetric. inbound is generally weighted to arrive through Level3, while the outbound is generally weighted to depart through verio. due to exceptional work from Level3 and Los Nettos, they were able to identify that Verio filters using "golden" prefixes... "I believe I have found the culprit. I think that Verio was filtering the b root traffic out because it was not a blessed source address." and "I have a strange feeling that Verio (the return path for 209.244/14 according to Walt, and probably for lots of other blocks) is filtering source addresses" Verio was asked to update its "blessed" or "golden" prefix list so that packets from "B" would reach thier intended destinations. Third party reports indicate that this "correction" has been applied within Verio. I would appreciate private replies on the efficacy of this ACL modification. --bill

3 2

RE: Road Runner refusing us, others?
by Michel Py 04 Feb '04

04 Feb '04

Looks like your IP 24.92.226.159 is listed at block.blars.org http://www.blars.org/errors/block.html -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mark Jeftovic Sent: Wednesday, February 04, 2004 6:49 AM To: nanog(a)merit.edu Subject: Road Runner refusing us, others? Road Runner is refusing our email forwarders again, according to one of customers they are also refusing yahoo as well, maybe a few others. Anyone else? Can somebody from RoadRunner contact us off list? > > Final-Recipient: rfc822; > Action: failed > Status: 5.0.0 > Diagnostic-Code: X-Postfix; host nymx-1.nyroc.rr.com[24.92.226.159] > said: 550 > 5.7.1 Mail Refused - 216.220.40 - See > http://security.rr.com/mail_blocks.htm#security - 20040203 >

1 0

Re: Road Runner refusing us, others?
by Brent_OKeeffe＠asc.aon.com 04 Feb '04

04 Feb '04

I just sent an email from a Yahoo account to me roadrunner account. Worked fine. Brent Mark Jeftovic <markjr(a)easydns.com> Sent by: owner-nanog(a)merit.edu 02/04/2004 09:48 AM To: nanog(a)merit.edu cc: Subject: Road Runner refusing us, others? Road Runner is refusing our email forwarders again, according to one of customers they are also refusing yahoo as well, maybe a few others. Anyone else? Can somebody from RoadRunner contact us off list? > > Final-Recipient: rfc822; > Action: failed > Status: 5.0.0 > Diagnostic-Code: X-Postfix; host nymx-1.nyroc.rr.com[24.92.226.159] > said: 550 > 5.7.1 Mail Refused - 216.220.40 - See > http://security.rr.com/mail_blocks.htm#security - 20040203 >

1 0

Road Runner refusing us, others?
by Mark Jeftovic 04 Feb '04

04 Feb '04

Road Runner is refusing our email forwarders again, according to one of customers they are also refusing yahoo as well, maybe a few others. Anyone else? Can somebody from RoadRunner contact us off list? > > Final-Recipient: rfc822; > Action: failed > Status: 5.0.0 > Diagnostic-Code: X-Postfix; host nymx-1.nyroc.rr.com[24.92.226.159] > said: 550 > 5.7.1 Mail Refused - 216.220.40 - See > http://security.rr.com/mail_blocks.htm#security - 20040203 >

1 0

Re: Poor connectivity to new b.root-servers.net address?
by sthaug＠nethelp.no 04 Feb '04

04 Feb '04

> the problem seems to be in the level3/cenic/losnettos path. > > juniper -ge- gsr -ge- foundary -ge- foundary -ge- foundary -100m- 7513 > > the IP path is: > > juniper - 7513 > > more as we unearth the problems... What I didn't mention in my original post is that this problem has existed, as far as I can see, since B was moved to a new address. Anyway - it seems things are fixed now. DNS lookup, traceroute and ping work from AS 2116 (source address 193.71.2.2) and AS 3307 (source address 194.19.15.2). There are still timeouts at the router hop before 130.152.181.66, which looks like it should be 67.30.130.66, traceroute'ing from 193.71.2.2 and 194.19.15.2: 13 so-10-0.hsa1.Tustin1.Level3.net (209.244.27.154) 188.092 ms so-9-0.hsa1.Tustin1.Level3.net (209.244.27.174) 188.118 ms 187.955 ms 14 * * * 15 130.152.181.66 (130.152.181.66) 177.112 ms 177.141 ms 177.202 ms and 13 so-11-0.hsa1.Tustin1.Level3.net (209.244.27.162) 188.861 ms 188.604 ms so-8-0.hsa1.Tustin1.Level3.net (209.244.27.166) 188.947 ms 14 * * * 15 130.152.181.66 (130.152.181.66) 187.970 ms 187.573 ms 187.399 ms The missing hop here is visible as 67.30.130.66 coming from 129.241.1.16 (AS 224). I'm not going to worry too much about the traceroute timeouts, even if it would be nice if that could also be fixed. The main point is that DNS lookups are now working as they should. Thanks! Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

antivirus in smtp, good or bad?
by Stephen J. Wilcox 04 Feb '04

04 Feb '04

Hi, When investigating our mail queue it seems we have quite a lot of mails which are stuck in transit... Whats happening is we're accepting the mail as the primary MX for the domain but the user has setup a forwarding to another account at another ISP, they have antivirus service on that other account. So we get the mail, spool it and try to forward it but then we get a "550 Error: Suspected W32/MyDoom@MM virus" after DATA and our server freezes the mail. Surely this is an incorrect way to do this as there will be lots of similar MXs like ours backing this mail up? They should accept the mail and then bounce it? Thoughts? Steve

4 5

Re: Unbelievable Spam.
by Michael.Dillon＠radianz.com 04 Feb '04

04 Feb '04

>> Spam Hosting - from 20$ per mounth. >> Fraud Hosting - from 30$ per mounth. >> Stoln Credit Cards, Fake ID, DL's. >This is known as "Rule #3" on n.a.n-a.e... Spammers are stupid. Stupid!? These spammers are not stupid. There are very few legitimate businesses which can actually turn a profit from spamming. Most of the money to be made is in selling spam related software and services to suckers. The problem is, how do you identify people who are dumb enough to think that spam services are worth paying for? Simple. You send lots of spam which, by definition, only goes to people who know something about the Internet and might be willing to spend money on an Internet-related service. Then you wait for responses which, by definition, are only going to come from grade A suckers. Then you pounce on these hapless marks, rip them off and move on. Spammers are not stupid. They are smart criminal gangs which have not only managed to keep their schemes running for several years in the face of great public animosity, they have also managed to sabotage the efforts that supposedly work against them. A favorite trick is for them to go into a forum like NANAE and support a flawed anti-spam effort because they know that it keeps people from focusing on real solutions. The net effect of all of these flawed technical attacks on spam is that it has filtered out the naive spammers from the spamming community and left spamming in the control of criminal gangs. When will we realize that SPAM is a social problem and it needs a social solution? When will the major email providers sit down around a table and agree to some guidelines for email exchange that make it impossible for rogue users to inject large volumes of email into the system? The existing non-hierarchical email exchange network is not scalable. I hope that everyone on this list can understand what the email exchange overlay network is and recognize that it is subject to similar scaling rules as the underlying IP network. --Michael Dillon

7 6