- Test - lists.nanog.org

Drive-by spam hits wireless LANs
by blitz 11 Sep '02

11 Sep '02

> > >And you think the terresterial sources are hard to shut down.... >Drive-by spam hits wireless LANs > >By Graeme Wearden >Special to CNET News.com >September 6, 2002, 10:14 AM PT >http://news.com.com/2100-1033-956911.html > >LONDON--The proliferation of insecure corporate wireless networks is >fueling the growth of drive-by spamming, a security expert warned on >Thursday.

11 19

OT: National Moment of Silence
by Al Rowland 11 Sep '02

11 Sep '02

Doug, The only drop in 'traffic' I've ever noticed was in my former life in the military. Retreat policy on base was that traffic pulled to the side of the road and the driver got out, faced the music and rendered the appropriate salute through the end of the anthem. Since this occurred at a regularly scheduled time one indication of its approach was a noticeable drop in traffic preceding retreat. Sad commentary on our allegiance at the time. Best regards, _________________________ Alan Rowland -----Original Message----- From: Doug Hughes [mailto:doug@Eng.Auburn.EDU] Sent: Wednesday, September 11, 2002 11:39 AM To: Al Rowland Cc: nanog(a)merit.edu Subject: RE: National Moment of Silence On Mon, 9 Sep 2002, Al Rowland wrote: > > I would think there might be a few folk streaming live feeds during > this period. Might even result in a higher traffic load leading up to > and through the relevant period. Some traffic may also be queued and > continue to flow unless SAs worldwide do a bunch of scripting to > suspend all processes during this period. > A live feed of a national moment of silence consuming traffic. Does anybody but me find this amusingly ironic? :) (I know it's the stuff pre and post silence that the live feeds would be interested in, but still!)

1 0

Re: Drive-by spam hits wireless LANs
by Steven M. Bellovin 11 Sep '02

11 Sep '02

One thing I've noticed that may be an anti-spam measure: STN, the ISP that servers Marriott hotels (among others) seems to have a "transparent" proxy intercepting outbound traffic to port 25. Not sure why they'd do that except to deter check-in spammers. They *don't* do anything with traffic to port 80, as best I can tell. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

1 0

Re: Drive-by spam hits wireless LANs
by Michael.Dillon＠radianz.com 11 Sep '02

11 Sep '02

>I agree, but people said that the spammers wouldn't be able to >deal with BGP route advertisement but there was cases of spammers >injecting routes sending out spam then removing those routes. Wlan is >easy. Spammers come from every walk of life including the various technical professions. Otherwise where would all the spamming software and web-scraping software come from!? Just because someone is a technical expert in BGP routing doesn't mean that they will use their skills the way that many NANOG attendees would like them to. Even in the early days of spam, the green-card spammers hired a technical person to set up servers and write spamming scripts. And let's now forget the uber-hackers who create the scripts used so effectively by script-kiddies. And let's not forget, these spammer geeks learn the knowledge from the same places as everyone else, including the NANOG mailing list. I reckon there is a 99.95% probability that there is at least one NANOG subscriber who is a currently an active spammer geek. So if WLANs were relatively safe yesterday, they won't be safe from now on. Of course, if spammers are reduced to driving around major cities in vans generating 802.11b radio traffic, it might be a lot easier to catch them... --Michael Dillon

1 0

National Moment of Silence
by Hank Nussbacher 11 Sep '02

11 Sep '02

Is anyone planning on measuring backbone loads during the National Moment of Silence at 8:46 a.m. Eastern Standard Time on 9/11? -Hank

6 5

Just another day on the Internet
by Sean Donelan 11 Sep '02

11 Sep '02

"Experts predicted that Wednesday is likely to be just another day on the Internet, and if anything a quiet day for cybercriminals." http://story.news.yahoo.com/news?tmpl=story&ncid=581&e=7&cid=581&u=/nm/2002… What is a "normal" day on the Internet? http://www.caida.org/outreach/papers/2001/BackScatter/ Measured 12,000 attacks over a three week period, or 570 attacks a day. http://www.fcc.gov/Bureaus/Engineering_Technology/Filings/Network_Outage/ There is a significant outage on average every 2-3 days.

1 0

network stats
by Ian A Finlay 11 Sep '02

11 Sep '02

A while back, I posted a question to this list: http://www.merit.edu/mail.archives/nanog/2002-01/msg00009.html So, I've still been on the lookout for traffic graphs. I know that many times the mrtg graphs can be misleading and downright wrong at many times, but I still think it's neat to be able to see how much traffic is flowing across various links. But, it would be even better to know what the aggregate flow of traffic across the Internet was at any given time. I know it seems impossible to calculate such a measurement... For example, if one looks at exchange point stats, like linx.net, you can see that at any given moment in time, that facility is exchanging ~15 Gb/s. Could one add all of the aggregates of the exchange points together? Would it even make sense to do so? Is CAIDA working on some way to measure aggregate traffic flow on the Internet? Something like the following (except that it would be representative of the entire Internet, not just Abilene) would be really neat. http://monon.uits.iupui.edu/abilene/total/total-bits.html I have done quite a bit of googling, but have not been able to find any relevant information. Regards, Ian

1 0

Re: How do you stop outgoing spam?
by alex＠yuriev.com 10 Sep '02

10 Sep '02

> and bypassing firewalls is an excellent way to get into BIG trouble with > whomever is running the firewall. It is irrelevant how ignorant that > person might be about the traffic which passes through their firewall. > I'm sure if they were only slightly less ignorant they'd run a strict > HTTP gateway on port 80 of their firewall and then you'd be stuck > wrappging everything up to look like proper HTTP in order to bypass > their firewall. It is better that you learn to negotiate the access you > need than to have to resort to using covert channels which could get you > busted. Steno is a great thing, so it wont get anyone busted. Alex

4 4

Re: How do you stop outgoing spam?
by Paul Vixie 10 Sep '02

10 Sep '02

> One of the basic problems with discussions about spam control is that it > focuses entirely on spam. Blocking output SMTP from individual dial-ups > has a serious negative consequence: > > Laptop mobile users cannot use their home SMTP server. in the business, we call this "tough noogies." > At best, they must reconfigure for each venue -- goodbye wireless > hotspot convenience -- and that is IF they know the SMTP server address for > the local access. i've gotten very good mileage out of ssl-smtp, and out of "port forwarding" so that my laptop uses 127.0.0.1:25 for outbound mail, which is actually a (ssh-borne) tunnel to my home smtp server. > In other words, by blocking output SMTP, mobile users are hurt > badly. I know that *I* certainly am. Constantly and serously. yes. let me take this opportunity to thank you for your significant contributions to smtp and of course rfc822. i'm sorry that you have to be hurt now. but the design calls for a polite population, and while that was true of the internet in 1983, it is absolutely not true today. the nonpolite nature of the overall population means that you will have to be hurt and you will have to change how you use mail in order to make the pain stop. there's a slight choice on the pain menu -- you can have (A) an unusable mail system clogged with unwanted traffic such as spam and viruses, or (B) a barely-usable mail system where everything you want to do is less convenient because you have to use ssl-smtp and ssh tunnels. either way you have to be hurt now. and that saddens me, it really does.

1 0

Re: How do you stop outgoing spam?
by Joe St Sauver 10 Sep '02

10 Sep '02

Valdis wrote: #Most spam-fighting efforts on the technical side make the basic assumption #that spam has similar characteristics to a properly designed TCP stack - that #dropped/discarded spam-grams will trigger backoff at the sender. Unfortunately, #discarding a high percentage of the grams will trigger a retransmit multiple #times. Actually, our experience *does* follow the backoff paradigm: if you block a particular source of spam, that rejection *does* seem to trigger "message volume" backoff at the source, with only periodic check probes apparently designed to see if the spam source is really still blocked (and of course it really still is). Now it is true that in many cases the spammer *will* do a set of probes in an effort to see just how broad a given block is (e.g., is it just a /32 that's being blocked? is it my entire netblock? is it a domain based filter? can I slide in via an open SMTP relay or an abusable proxy server?), but at least here at the U of O, we're NOT seeing spammers waste their time attempting delivery of hundreds or thousands of messages per day via hosts that have been identified and filtered. Regards, Joe

3 2