On Wed, 24 Sep 2003, Leo Bicknell wrote:

In a message written on Wed, Sep 24, 2003 at 11:28:39AM -0500, Justin Shore wrote:

...

So, my question for NANOG is how does one go about attracting the attention of law enforcement when your network is under attack? How does the target of such an attack get a large network provider who's customers are part of the attack to pay attention? Is media attention the only way to pressure a response from either group? These DDoS attacks have received some attention in mainstream media:

People will pay attention as soon as there is money in black lists. ISP's are businesses. If losing the customer is cheaper than helping them far too many will choose to lose the customer. Many black lists don't pay the ISP at all, indeed they are offered as free services for the good of the community. As a result they get the response that any freeloader would, none.

RBLs Sounds like a great application for P2P. /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ Patrick Greenwell Asking the wrong questions is the leading cause of wrong answers \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/

On Wed, 24 Sep 2003 andrew2@one.net wrote:

Perhaps, but it also seems like moving an RBL onto a P2P network would making poisoning the RBL far too easy...

nope. updates will be crypto signed, thus poisoned updates will be dropped instantaneously.

On Wed, 24 Sep 2003, Justin Shore wrote:

On Wed, 24 Sep 2003 andrew2@one.net wrote:

...

Perhaps, but it also seems like moving an RBL onto a P2P network would making poisoning the RBL far too easy...

That's what I was getting ready to suggest. As it stands now we have at least somewhat of an assurance that the zone we're working with isn't tainted.

Web of trust, yada yada. Still distributed, still resiliant. And/Or, encrypt the zones/updates. Admittedly this is all off-the-cuff and I haven't given it much thought(scalability and performance issues immediately come to mind,) but it might be an interesting enough problem to sit down and research/think about at some point. It certainly would be interesting to find some more "substantially non-infringing" uses for P2P. /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ Patrick Greenwell Asking the wrong questions is the leading cause of wrong answers \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/

I realize that this is seriously off the wall. There is a pretty secure P2P system (Groove) that was developed by Ray Ozzie. Focus is on security on the wire, on the box, everywhere with serious authentication - Diffie-Hellman exchanges and all the right security toys. Admittedly when I run it at home the lights in the neighborhood dim. I am wondering, though if there might be a way to use its kind of services for some behind the scenes secure discovery - removing the hackability of most of the P2P systems. No I don't know how it scales, what it's throughput and licensing limitations are.. I just heard P2P and immediately went outside the box. Chris My vcard is attached.

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Vadim Antonov Sent: Wednesday, September 24, 2003 3:05 PM To: andrew2@one.net Cc: nanog@merit.edu Subject: RE: Another DNS blacklist is taken down

...

...

RBLs Sounds like a great application for P2P.

Perhaps, but it also seems like moving an RBL onto a P2P network would making poisoning the RBL far too easy...

Andrew

USENET, PGP-signed files, 20 lines in perl.

--vadim

Total: 308

Erps, I told my script to mis-count: Total: 284 --- david raistrick drais@atlasta.net http://www.expita.com/nomime.html

On Wed, 24 Sep 2003, Stephen L Johnson wrote:

Please forgive my ignorance, but what is a "joe-job"?

I dug up some links for you. http://www.spamfaq.net/terminology.shtml#joe_job http://www.techtv.com/news/culture/story/0,24195,3415219,00.html http://catb.org/~esr/jargon/html/J/joe-job.html http://www.everything2.com/index.pl?node=Joe%20Job (might be down?) Basically it's of spoofing the source of spam so as to appear to come from an innocent person. I've been on the receiving end of it a couple of times. Basically the innocent person gets flooded with bounces from poorly written MTAs and anti-spam scripts. Think email-based virus bounces. You didn't send the virus; you aren't even infected. However some machine somewhere is infected and spoofed your address as source of the infected email. You of course end up with the bounce and blame from uneducated people for being infected (which again you are not). Hope that helps Justin

On Wed, 24 Sep 2003 Valdis.Kletnieks@vt.edu wrote:

On Wed, 24 Sep 2003 13:10:43 CDT, Stephen L Johnson <stephen.johnson@mail.state.ar.us> said:

...

Please forgive my ignorance, but what is a "joe-job"?

http://searchsecurity.techtarget.com/gDefinition/0,294236,sid14_gci917469,00...

This is amusing because we hosted joes.com at that time (and still do) and the other day I heard the term and speculated as to whether it could have come from the attack on joes.com back then. The URL above is accurate. To correct a mistaken impression that the ensuing DOS attack was a result of the bounces, the bounces were easily handled. The email sent out was an example of effective social engineering designed to make the recipients mad enough to attack the perceived sender. Of the over a million angry recipients, some had the technical know how to lash out. Think of it as a smart weapon where the weapon used is borrowed minds engaged by use of a meme. Job jobbing is a layer 9 algorithm (the program is the message people read and what it causes them to do) that is made possible by the ability of a spammer to forge their identity as that of their intended victim. Mike. +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber@he.net http://www.he.net | +-----------------------------------------------------------------------+

On Wed, 24 Sep 2003, Stephen L Johnson wrote:

On Wed, 2003-09-24 at 12:48, David Raistrick wrote:

...

On Wed, 24 Sep 2003, Justin Shore wrote:

<snip>

...

joe-job earlier this week. Apparently the joe-jobbing was enough to convince some extremely ignorant mail admins that Compu.net is spamming and blocked mail from compu.net. Compu.net has also seen the effects of

Speaking of joe-jobs, what's the "proper" proceedure for dealing with such?

Please forgive my ignorance, but what is a "joe-job"?

Hmm probably something that isnt going to happen now that all domains are valid a la verisign Its when spammers take your domain name and use it as their from address, it *used* to get around sender verify in smtp which a lot of smtp servers implement. Basicalyl if you're being joe jobbed you will get the bounce messages from all the email addresses the spammers are sending to that dont exist. The one that they're doing on my own domain which I mentioned on list some months ago is still going strong with many Mbs of bounces per day.. I think its fair to say there is very little you can do as tracking the source is almost impossible.. Steve

At 2:07 PM -0500 9/24/03, Justin Shore wrote:

open proxy. You're screwed if that's the case. However since you have a complete copy of the spam you can still follow the money trail. Spammers have to get their money somehow. The actual spam will give you many places to start. Of course once you have that you still have to convince

With the possible exception of the new California law, I've yet to see any case in which the benefit from nailing a spammer (in terms of damages, or even reduced attacks) comes even close to covering the amount of time it took to find and pursue them. I doubt even the big ISPs recover their cost--their goal seems to be deterrence. However I'd be happy to donate somewhere.com's bogus inbound traffic (we bounced ten million messages last year, definitely looking at more than twenty million this year) to the cause. -- Kee Hinckley http://www.messagefire.com/ Next Generation Spam Defense http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's.

On Wed, 2003-09-24 at 13:10, Stephen L Johnson wrote:

Please forgive my ignorance, but what is a "joe-job"?

Thank for all of the off-line reponses. I was aware of the tactic. But It was the first time I've heard it called a "joe job". (Stephen has learn his one new thing for the day) -- Stephen L Johnson stephen.johnson@mail.state.ar.us Unix Systems Administrator sjohnson@monsters.org Department of Information Systems State of Arkansas 501-682-4339

Each mailserver could keep a cryptographically verified list, the list is distributed via some P2P mechanism, and DoS directed at the 'source' of the service only interrupts updates, and only does so until the source slips an updated copy of the list to a few peers, and then the update spreads. Spam is an economic activity and they won't DoS a source if they know it won't help their situation.

If anyone who attempts to distribute such a list is DoSed to oblivion, people will stop being willing to distribute such a list. Yes, spam is an economic activity, but spammers may engage in long-term planning. You can't keep the list of distributors secret. I'd be very interested in techiques that overcome this problem. I've been looking into tricking existing widely-deployed infrastructures into acting a distributors, but this raises both ethical and technical questions. DS

Thus spake David Schwartz (davids@webmaster.com) [24/09/03 17:39]:

If anyone who attempts to distribute such a list is DoSed to oblivion, people will stop being willing to distribute such a list. Yes, spam is an economic activity, but spammers may engage in long-term planning. You can't keep the list of distributors secret. I'd be very interested in techiques that overcome this problem. I've been looking into tricking existing widely-deployed infrastructures into acting a distributors, but this raises both ethical and technical questions.

P2P has been suggested, and while I make no comments about P2P itself... What about Freenet? It hides the origin of the file(s), it's truly distributed, it's encrypted, it's authenticated, and it will do your dishes. Okay, so it won't actually do your dishes. But it seems to do everything that most other people have suggested. It's incredibly difficult to DoS a Freenet node, and it's incredibly easy to set one up (just requires some hefty CPU).