Subject: [Asrg] Spam is a security problem

From: Brad Spencer <[email-masked]>
Date: Sat, 15 Mar 2003 06:14:04 -0600

Most spam, that is.  There's the small amount of direct spam and the huge 
amount of abuse spam.

That spam is a security problem has been long recognized: the efforts years 
ago to get all open relays secured were security-based anti-spam 
measures.  They didn't work, spammers still seek and find open relays.  Now 
they also do the same with open proxies.

May I suggest that the problem in this approach is the single-minded way in 
which a solution is attempted?  That single-minded way is to secure 
systems.  That works for those systems but it does not solve the overall 
problem: spammers can so easily find open relays that having almost every 
system secure does not effectively impact spam or spammers.

If simply securing doesn't work there seem to me to be at least two 
options: give up on trying to combat this kind of abuse or take measures to 
end this kind of abuse.

Effectively, the decision has been to give up.  That's the wrong decision, 
of course. It is necessary to take measures to end this kind of abuse.

Let's start with a basic fact: it is incredibly easy to detect the abuse 
spammers commit when they seek open relays.  Most operators of email 
systems can look in their logs and see entries that show a relay attempt 
was rejected. Spammers do relay tests every day, the tests that hit secured 
mail servers get logged.

You should realize that spammers do not just test mail servers.  If you 
think about it the concept of "just test mail servers" is bogus - how could 
someone identify only the mail servers?  Instead, spammers test IPs or 
ranges of IPs.  Those with secure mail servers may have unassigned IP 
numbers and a spare, older system available.  That is all you need to 
detect relay test messages.

Here's a recent relay test message:

Date: Sat, 15 Mar 2003 08:55:05 -1000
From: [email-masked]
Subject: Hopefully this works...
To: <Undisclosed Recipients>

05004905104605304605105204604905105305811211211205105204504905105304510311904805
20460971161041011101150460970990991011151150460970991100461031140580490550540500

With the undisclosed recipients:

[email-masked]
[email-masked]

I know automatically that this is the work of a spammer.  Looking at the 
registrations sincasino.com and videospoker.com quickly conform that 
likelihood.

The question is: how do I use this information to end the spam-sending abuse?

As a single user/operator I'm somewhat constrained.  I can track down the 
spammer's location and try to get the account terminated.  For some tests I 
can try to get the target ISP (for instance, yahoo.com.UK for another 
recent test) to act in some way to thwart the spammer.  I'd prefer those 
ISPs to simply divert messages addressed to spammer dropboxes to a 
non-working address but I think most simply terminate the account.  This 
causes the spammer only the difficulty of setting up another dropbox 
address - hardly likely to stop anything.  Recently I trapped tests from a 
Cox IP and to a Cox email address. Cox was smart enough to realize what I 
told them and terminated the account, then terminated the next account I 
reported.

Even this slow, one-at-a-time effort has results.

Another option is to go further - to deliver the relay test and screw the 
spammer a different way.  Back in mid-February I delivered a test to 
[email-masked].  After that I received a mini-deluge of relay spam, about 
200 99-recipient messages/day, ending yesterday.  None of that spam got 
delivered.  This morning there's a fresh test from [email-masked] in the 
queue - I have no plans to deliver that one (and already its a little late 
to do so: I'd think spammers would be suspicious of late arrivals.  I 
realize I'm giving the average spammer too much credit, and this guy must 
be below average: he puts "meet Russian women" subjects on his MMF spam.)

Others do this same thing.  An operator elsewhere in the world, using his 
massive 120 MHz Pentium with 64 Mb, stopped spam to 281 million recipients 
in his first year of operation.  All he does is deliver relay tests and 
stop spam (which he does archive to CDR.)  He makes no complaints to ISPs 
or anyone.  In Germany there's a site with somewhat more power and 
bandwidth available - they've stopped spam to well over 220 million 
recipients so far this year.

At home I do this same thing on my Windows system.  Note this 
well.  Windows typically does not run an MTA, port 25 is not in use.  It is 
possible to run a program designed to interfere with the spammers and that 
program is available: http://jackpot.uk.net/

After years of effort to secure all open relays there are still enough open 
relays that spammers actively seek them.  securing them all isn't a viable 
option, didn't work, can't work.  I favor a different approach that does 
work and can work: dilute the pool of true open relays with so many false 
ones that the spammers can't find the true ones.  That's absolutely 
simple.  While this is being ramped up the operators of fake relays who 
know how can take the information they glean from their false relays and 
use it to persuade ISPs to take action against the spammers.

There are operational considerations I haven't discussed.  Many critics 
assert that all the spammers need do is include a dedicated test address 
every so often in the addresses they spam and use non-delivery to that 
address as evidence of a false open relay.  Sure, they can.  Right now they 
don't - there's so few false open relays that many spammers don't recognize 
the possibility.  With Jackpot it has to be trivially easy for a spammer to 
identify a probable Jackpot-IP and treat it just like a secure IP.

The basic idea is sound, and some very effective fake open relays are 
simply standard MTAs, reconfigured.  Those aren't going to be easily 
identified.  More to the point is that this entire means of combatting 
spammers and this entire opportunity to do so are both almost completely 
ignored.  The idea has further extension.  An ISP with a customer who is 
sending out large numbers of relay tests should be easily able to identify 
that customer strictly by the pattern of his outgoing traffic.  A large ISP 
cannot monitor the entire stream of its packets but surely it can monitor 
substreams.  It could monitor all the traffic form each /24, for 
instance.  this isn't full-time monitoring, just sampling.  You don't catch 
every spammer who does relay tests that way but you catch many, and that's 
the point.

Similarly, an ISP that is the target for such tests can identify the source 
of such tests by monitoring incoming traffic. Once the source IP is known a 
complaint can be sent to the ISP of the source, for action.  Telesp.br 
could do this to good effect, as an example.

Everything I've written concerns open relays.  Exactly the same approach 
can be taken against open proxy abuse (which is really where telesp.br 
needs to concentrate effort.)

Currently the practice is to wait until the spam hits the destination ISP 
(or the recipient) before action.  All the difficulty with filters stems 
from this delay.  If spam is attacked at the relay/proxy level no filter is 
needed: the spammer does the filtering for you: he sends only spam by the 
abuse pathways.

What I advocate isn't hard.  For several years I ran a combined server/fake 
open relay.  At the relay level it is not hard to separate spam from valid 
email - the spam is relay mail that doesn't originate at a valid source for 
you to relay.)  It's far simpler to run a fake open relay (or fake open 
proxy) with no legitimate email function.  You know that it has no email 
function, the spammer doesn't.  To him it can look exactly like a system 
run by a clueless operator who doesn't know enough to secure his 
relay.  That is exactly how you want it to look, of course.  The better you 
fake the clueless operator the better you make the fake indistinguishable 
from the true open relay.

I won't give a long description but this fake open relay, run by Michael 
Tokarev in Moscow, successfully deceived one of the most blatant of the 
spammers, Alan Ralsky:

http://www.corpit.ru/cgi-bin/h0n5yp0t

The fake relay is now stopped (as you can tell from the dates), only the 
web page remains.  In operation this was quite easy to use: send the URL to 
the ISP implicated by the IPs that were spam sources.  The ISP could use 
this information to terminate the spammers throwaway account and then do a 
refresh.  When the spammers next throwaway IP appeared, terminate 
that.  Ralsky got thrown off 3 ISPs in one weekend that way.  That was a 
100 MHz 486 DX4.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 15 Mar 2003 11:08:13 -0500

At 6:14 AM -0600 3/15/03, Brad Spencer wrote:
>Others do this same thing.  An operator elsewhere in the world, 
>using his massive 120 MHz Pentium with 64 Mb, stopped spam to 281 
>million recipients in his first year of operation.  All he does is 
>deliver relay

You make some good points about the root problems with relay spams, 
however I think there are a couple problems with your solutions.

Most people do not have the time to run around setting up fake relay 
traps.  In addition, speaking as someone who currently bounces a 
message every two seconds, not all of us can take the risk of 
increasing our bounce volume.  Finally, I don't think you can get 
enough people running fake relays to make even a dent in spam.  281 
million recipients in one year is really very few in the big picture. 
AOL bounces one billion pieces of spam every day.

-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Spencer <[email-masked]>
Date: Sat, 15 Mar 2003 11:10:41 -0600

At 11:08 AM 3/15/2003 -0500, you wrote:
>>massive 120 MHz Pentium with 64 Mb, stopped spam to 281 million 
>>recipients in his first year of operation.  All he does is deliver relay
>
>traps.  In addition, speaking as someone who currently bounces a message 
>every two seconds, not all of us can take the risk of increasing our 
>bounce volume.  Finally, I don't think you can get enough people running 
>fake relays to make even a dent in spam.  281 million recipients in one 
>year is really very few in the big picture. AOL bounces one billion pieces 
>of spam every day.

It's an action for those who have the time and inclination and are willing 
to do it. More importantly the message is that most spam is a security 
problem - I'm attempting to get the people who can act effectively against 
it as a security problem to do so.  If I trap a relay test from within the 
Verizon space then it is almost certainly true that the IP traffic from 
that IP has a pattern that could only be sending relay tests.  If they'd 
sample their traffic they could themselves find the spammers sending 
tests.  This guy: washdc3-ar10-4-60-219-149.washdc3.dsl-verizon.net, to be 
specific.  He tested again a little over 3 hours ago.

The Moscow relay spam honeypot was shut down partly for reasons such as you 
describe, although more basic: the bandwidth used cost real money.

I've argued this for two years.  It's a neglected area in the fight against 
spam, you don't have to know anything to uses the technique, it attacks the 
spammers (although it is a passive technique) where they are vulnerable. 
People talk about elaborate changes to SMTP or the replacement of SMTP - 
those would take much more effort than what I describe.

Do also note that what I do myself, regularly, is accept relay 
messages.  That's much lower in volume (or should be) since in principle 
all you trap is a dozen or so relay tests per day, maximum.  I did deliver 
one relay test in February - that brought spam until yesterday.  At home I 
trap spam from an obnoxious Chinese-language spammer who doesn't wait for 
tests to be delivered - he sends relay spam on the basis of the test being 
accepted.

I delivered another test recently - that one was one sent by an ex-spammer 
who sells open relay lists to spammers.  The spammers apparently send their 
own tests to check out the relays on the list - I've gotten tests from 
sources I'd not seen before.

I'm aware of the billion pieces AOL bounces/day.  That's after the relay 
level - many spammers still send multiple-recipient spam.  What I trapped 
recently (the MMF spam with the "meet Russian women" subjects) comes as 
99-recipient spam.  I suppose the spammer thinks that protects him against 
some law that criminalizes sending to 100 or more recipients.  The 
Chines-language spam has 10 recipients.  At the relay level you trap fewer 
messages to get the same effect AOL does by partially trapping at the 
destination level.  Twenty thousand recipients/day is about 200 spam 
messages/day.  I recognize I'm trapping only a tiny percentage of his total 
output.  This is a dirt-simple technique but to be effective it requires 
many participants.

There have to be enough people willing to do this - most of the spam comes 
through systems that are abused.  Those people are "willing" - they don't 
suffer enough discomfort to do anything about the abuse with any sense  of 
urgency.  The load on the fake relay is much lower, since the spam comes in 
only, never is delivered.

It's as easy for millions of people as downloading Jackpot, downloading a 
JVM (if there's not already one installed), and starting the program.  They 
don't have to enable relay, they don't have to understand what the program 
does.  If they're on a network segment the spammers test (and that's 
probably everything but dialup segments, and I'll bet even those get hit) 
they will trap a relay test. Just that is enough to make a difference, if 
done by enough people.  That will deliver the message to the spammers that 
their abuse will no longer be ignored and allowed to 
continue.  Continue?  It has grown considerably under the policy of neglect.

He he he: Cox IS doing something about relay testers, and the Cox relay 
tester just tested me again (@10:19 & 10:26.)  That will be my next email 
message.

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 15 Mar 2003 15:09:02 -0500

At 11:10 AM -0600 3/15/03, Brad Spencer wrote:
>spam.  I suppose the spammer thinks that protects him against some 
>law that criminalizes sending to 100 or more recipients.  The 
>Chines-language spam has

No, it protects him from people who restrict the number of recipients 
and block the email if it exceeds the number.

>He he he: Cox IS doing something about relay testers, and the Cox 
>relay tester just tested me again (@10:19 & 10:26.)  That will be my 
>next email message.

Yes, I've had good success reporting formmail exploits as well.  You 
can automatically report the testing IP.  Determining whether it was 
a test or a real spam message isn't going to be as safe 
automatically, but if you do it manually then you can also nail them 
at the recipient address.

I'm not denying that these are good ideas.  And they probably go more 
towards hurting spammers than things like filtering--which the 
spammers never see.  As a tool that aids in driving spammers 
off-shore and to fixed locations, they seem good.  And like most 
things--that makes them a part of a solution, not the solution itself 
(I know, you weren't claming that.)

And that, I think, has been the main lesson of this discussion group. 
Destroying spam is not a matter of applying a magic solution (those 
IBM TV ads come to mind, if you've seen them recently).  It's going 
to be a set of various tools, all aimed at driving spammers into a 
corner where we can hold them off while we apply a bit more 
accountability to the system.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Brad Spencer <[email-masked]>
Date: Sat, 15 Mar 2003 14:43:53 -0600

At 03:09 PM 3/15/2003 -0500, you wrote:

>towards hurting spammers than things like filtering--which the spammers 
>never see.  As a tool that aids in driving spammers off-shore and to fixed 
>locations, they seem good.  And like most things--that makes them a part 
>of a solution, not the solution itself (I know, you weren't claming that.)

All the best results I know of from relay spam honeypots have been offshore 
systems (280 million, 220 million, Moscow.) There is _nowhere_ for the 
spammers to escape, if they use abuse to send their spam.  The better the 
domain is for them in terms of having abusable systems the better it is to 
set up a fake in that domain. Some of us self-nominate ourselves to open 
relay blocklists - many spammers look there to find open relays.  The 
overall goal (for me) is for there to be no reliable list anywhere of open 
relays the spammers can safely abuse.  That would mean that any list would 
be unsafe for them to use, and "unsafe" means riddled with fake 
entries.  Block me, I don't mind - I don't send anything anyway.  I just 
run sinks for relay messages (plus occasionally deliver a relay test to a 
spammer.)

There are very good relay spam honeypots from US systems - those are also 
quite useful.

Fixed locations are the bread-and-butter of blocklists.

Yes - part of the solution.  And don't lose sight of the fact that the 
top-level management of many domains can handle the illicit traffic to 
ports that are abused - the action taken does not have to be at the 
individual IP level.  While it is at the individual level  home operators 
can be significant fighters against spam. Or managers in university 
departments - that's what I was when i started.

I'm still just trapping crud from 210.85.168.26 but others might get better 
stuff.  It would probably different if I delivered the relay tests - I 
captured one from axis.software.powerinternetcr.com [216.25.173.15] on my 
home system today.  Nice rap sheet: http://openrbl.org/ip/216/25/173/15.htm

---

From: [email-masked] (Justin Mason)
Date: Sat, 15 Mar 2003 12:46:51 -0800

> (I know, you weren't claming that.)

What's the benefit in driving them off-shore?  It just seems to be
a problem, to me.  Sure, you can then use a blackholes.us
BL, but that's not a solution -- it just ghettoizes users in those
countries.

--j.

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 15 Mar 2003 16:34:56 -0500

>BL, but that's not a solution -- it just ghettoizes users in those

I'm assuming that some of the drive offshore is to fixed locations. 
However it also helps de-legitimize spam.  "Yes, we need to advertise 
your lumber company, but we can only do it using these servers in 
Latvia."  If the goal is to marginalize spam, that helps.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Scott A Crosby <[email-masked]>
Date: 16 Mar 2003 12:28:49 -0600

On Sat, 15 Mar 2003 06:14:04 -0600, Brad Spencer <[email-masked]> writes:

> After years of effort to secure all open relays there are still enough
> open relays that spammers actively seek them.  securing them all isn't
> a viable option, didn't work, can't work.  I favor a different
> approach that does work and can work: dilute the pool of true open
> relays with so many false ones that the spammers can't find the true
> ones.  That's absolutely simple.  While this is being ramped up the
> operators of fake relays who know how can take the information they
> glean from their false relays and use it to persuade ISPs to take
> action against the spammers.

However, is it effective? What this means is that a slightly greater
percentage of email is denied. However, email sending is as
automatable as it was. If we are in a world where bandwidth costs are
expected to decrease and where CPU costs are expected to decrease,
then even with this, spam becomes more economical, because with the
same resources, they can send more messages, even if an increasing
percentage get rejected.

We need a solution that can continue to work in worlds where
Disk/CPU/bandwidth is becoming ever cheaper. A technique that halves
the effectiveness of spam will be erased in two years. What do they
care if half of the proxies are fake two years from now? The cost per
message that goes through a non-fake proxy will be the same then as
now. At such a small loss, it may not even be worth the effort to
identify the fakes.

Computing and bandwidth is cheap enough that you can't win by forcing
the spammer to burn cycles or bandwidth, unless you can increase those
costs by orders of magnitude. One person's yearly wage of, say,
$40,000 can buy 20 $1400 machines and still spend $1000/month for
bandwidth/colo. Lets see, 4TB/month. Requiring them to hire one
additional employee affects their bottom line more than blocking 10
billion emails.

> spammers and this entire opportunity to do so are both almost
> completely ignored.  The idea has further extension.  An ISP with a
> customer who is sending out large numbers of relay tests should be
> easily able to identify that customer strictly by the pattern of his
> outgoing traffic.  A large ISP cannot monitor the entire stream of its

At least as far as outgoing traffic is concerned, wouldn't a server
doing relay tests closely resemble any popular mailing list server? It
might be identifiable if it gets a huge number of incoming RST's from
port 25.

Scott

---

From: Brad Spencer <[email-masked]>
Date: Sun, 16 Mar 2003 14:03:39 -0600

At 12:28 PM 3/16/2003 -0600, you wrote:
>percentage of email is denied.

Yes, for small numbers of such systems.

The real point is that of considering the abuse aspects of the majority of 
spam and devising ways to combat that abuse.  Spammers don't know anything 
about a particular IP just form the IP - they have to find out in some 
manner anything they do know.  Currently it is close to 100% safe and 
reliable for them to test for open relay (or test for open proxy) and find 
what they seek.  That's abuse, it is accepted and tolerated, spam continues 
to grow as a problem.

I'm no internet expert, this is an IETF working group.  Some focus, some 
goal, some something is needed.  What's currently being done is 
demonstrably inadequate.  The solutions seem to (1) do much more of 
something that is already done and (2) do something new.  The something 
news that I see are elaborate and require (I think) a shift in how email is 
done.  There'd have to be a very long transition period - that needs to be 
well-analyzed in any proposal for a new email protocol, for example.  I've 
already done some analysis (which maybe someone could show to be bogus) by 
characterizing the transition period as very long  I have a great distaste 
for that - I want spam dead now, and if not now then next week, or the 
middle of next month.

More people could use blocklists, with usage concentrated on the blocklists 
that are intended to do what blocklists do - prevent delivery of spam 
(contrasting with SPEWS, if you can't see my intent.)  More people could 
use DCC - it's mostly automatic (there's a whitelisting requirement for 
sites that have mailing list subscribers), it works, it responds quickly, 
it scales.  Then the approach I emphasize: do something at the abuse level, 
before the spam is on its way to the final destination.  The anti-spammers 
have the advantage here if they want to claim it (right now, by ignoring 
the abuse, anti-spammers give the advantage to the 
spammers.)  Anti-spammers far overwhelm spammers in their numbers, 
anti-spammers can be in any IP space.  Practically everyone who reads this 
message should be able to go to the logs of a mail server and observe that 
relay email is being rejected. Most have chosen the  path of blocking such 
abuse and then ignoring it.  The spammers figuratively knock on the door 
and ask to have access, the response is to ignore the knocking and then to 
curse the neighbor who lets the spammers misuse their systems.  That 
approach guarantees that relay spam is sent to systems that will relay 
it.  When it is relayed it then shows up at destinations ISPs to be 
filtered or otherwise rejected or accepted.  Too much is accepted - that's 
the problem.  It would have been easy to stop the spam (like that which 
advertises http://www.quickmailorderbrides.com/?oc=2390 that I'm stopping 
in small quanttties) but most just let it go to the true open 
relays.  There's no real asrg plan - may I suggest looking at what could be 
done about the abuse aspects of relay spam and deciding whether its a 
viable option for significantly helping to defeat spam?  I understand that 
there is direct spam - this approach doesn't touch direct spam. If the 
result of this approach were the forcing of spammers to send direct spam 
from overseas wouldn't that be a giant step forward?  Then there'd be a 
relatively small number of IPs to block - it's a situation tailor-made for 
success by DNSBL.

>However, email sending is as

And they do.  That same argument apples to most or all current 
techniques.  The goal surely is to drive the cost of sending the spam above 
amount "earned" from the spam.  There's no particular reason to pick what I 
advocate other than the fact that the opportunity is great and that 
opportunity has been overlooked.  It's a cherry-picking situation: almost 
anyone with a Windows system on a permanent network connection can run 
Jackpot and do something against spam.  How many million people would that 
be if you assumed just 1% did it successfully?

>now. At such a small loss, it may not even be worth the effort to

Good.  Now you are in an evaluation discussion but you are doing it (to me) 
backwards.  You are assuming failure and then describing failure in terms 
of an inadequate approach.  I suggest you determine how many fake proxies 
it would take to hurt them badly enough to force them to quit and then 
evaluate how difficult it would be to get that number of fake 
proxies.  Make conservative guesses both ways: assume lots are needed, 
assume difficulty in getting participants.  Can it still be done effectively?

RFC 2505 flatly stated that securing open relays was not a viable way to 
fight spam.  Nonetheless that was the method of choice for years.  Securing 
all open relays has to be around 99% complete for it to have a visible 
effect.  That seems not to have yet happened.

Poisoning the pool of open relays is effective at all levels.  If 10% of 
the pool is fake relays then you'd estimate, I think, that twould give a 
10% effectiveness against relay spam, just on the basis of non-delivered 
spam messages alone.  Any further effect you achieve by identifying spam 
sources or spamvertised URL's is a bonus.  Any extra work you force the 
spammers to do to avoid fake relays is a bonus.

It works now.  I think it deserves further analysis, further amplifcation.

>additional employee affects their bottom line more than blocking 10

The guy spending his entire yearly wage in order to spam would need, I'd 
think, to earn more than that yearly wage to make spamming 
worthwhile.  Earning that wage takes him around 2000 hours/year - that's 
his primary job.  Make spamming hard enough that it takes 2000 hours of 
work to earn $40,000 and any sane spammer would give up - he's putting in 
4000 hours to clear what he already is earning.

>might be identifiable if it gets a huge number of incoming RST's from

I think it would look exactly like a mailing list server, if that server is 
busy 24 hours/day.  That would be some mailing list server.  I don't doubt 
there are such but I couldn't name any.  If the TOS allow packet 
examination then it's a different story - the spam and/or the relay tests 
will stick out.  If you  DCC'd outgoing email then relay tests would be 
personalized for every recipient (because most relay tests have the tested 
IP either encoded or in plain text.)  If you simply look at destination 
IP's and compare that with the target addresses of the email then relay 
tests and relay spam stick out instantly.  Probably other statistical 
measures that avoid actual examination of the contents of outgoing messages 
would also serve to distinguish the valid form the invalid.

Here's some HTTP lines from a spam run I'm capturing - would a legitimate 
mailer ever have such content in its messages?

<a href="http://www.quickmailorderbrides.com/remove/?oc=23900">Le<!--32152112-->t me kn<!--32151146-->ow an<!--321800041767-->d I won't wri<!--321<a href="http://www.quickmailorderbrides.com/?oc=2390">A ni<!--4866462713614-->ce lady wa<!--4866462624478155-->nts to corr<!--4866462455010778--><a href="http://www.quickmailorderbrides.com/remove/?oc=23900">Le<!--4866462752305-->t me kn<!--486646222340-->ow an<!--486646222274-->d I won't w<a href="http://www.quickmailorderbrides.com/?oc=2390">A ni<!--8784534-->ce lady wa<!--8781671-->nts to corr<!--878231134728-->espond with you.<!-<a href="http://www.quickmailorderbrides.com/remove/?oc=23900">Le<!--878566853511-->t me kn<!--87871-->ow an<!--87863245-->d I won't wri<!--878632<a href="http://www.quickmailorderbrides.com/?oc=2390">A ni<!--564863357458778354-->ce lady wa<!--56486335800484-->nts to corr<!--5648633533-->esp<a href="http://www.quickmailorderbrides.com/remove/?oc=23900">Le<!--5648633566--><!-- b hiqzpw khxjmm npjtyl epu-->t me kn<!--564863350710-->ow a
The messages are all to people not in my domain.  How many legitimate 
mailing lists are sent through relays?

r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]
r;[email-masked]

I munged the addresses slightly...

The point is not what I'm doing, the point is that more thought could be 
given to fighting back against the spammers at the abuse level.  There's 
probably several unexplored ideas - what are they?  (One guy got so tired 
of the relay spam volume that he programmed a very long response packet - 
to cause a buffer overflow in the sending system - to the spamware.  Just 
like that, after one such response,  the flow stopped...)

---

From: Brad Spencer <[email-masked]>
Date: Sun, 16 Mar 2003 18:46:09 -0600

At 01:14 PM 3/16/2003 -0800, Ronald F. Guilmette wrote:

>In message <[email-masked]>, you wrote:
>
> > Anti-spammers far overwhelm spammers in their numbers, ...
>
>What makes you think so?

I guess it depends on how you count them.  If you count the people who JHD 
then I think the anti-spammers outnumber the spammers.  If you count the 
people who don't like spam then they outnumber the spammers.

---

From: Brad Spencer <[email-masked]>
Date: Sun, 16 Mar 2003 19:27:03 -0600

At 03:39 PM 3/16/2003 -0500, Kee Hinckley wrote:
>Okay.  A practical question.
>
>Let's say I extract from my logs a list of IP addresses that are 
>attempting to relay through my server.
>
>1. There is no way I'm going to set up a relay tarpit.  I'm already 
>bouncing one message every two seconds--I can't handle any additional hits 
>on my bandwidth.  It's been doubling every year since '96.

OK.  Do what makes sense for you.  I used to emphasize trapping spam, now I 
concentrate on passively capturing relay tests (although I did deliver some 
to one particular tester just to see what he spams.  Its' a MMF scheme and 
some "MEet Russian Women" crap.)  I also delivered one for someone I'm told 
now sells lists of open relays to spammers.

>2. But I'd be happy to auto-report those relay attempts.  Do you have 
>tools to do that?

No, I don't.

>Are they safe (e.g. no more than N reports about the same IP address in a 
>certain amount of time, consolidate multiple IP reports to the same report 
>address)?  How do I keep from auto-reporting my own users when they forget 
>to authenticate, or when they are using pop-before-smtp and the 
>authentication has timed out?
>
>Keep in mind that there are always border cases.  For instance 
>194.100.84.20 tries to relay through me (always to 
>[email-masked]) a thousand times or more a day.  How do you 
>auto-determine who owns that IP?  The reverse DNS lookup doesn't match.

I favor a conservative approach: if in doubt do whatever is least likely to 
cause any harm.  If you have doubts about a relay attempt then you could 
either not report it or you could tell the ISP you rejected the attempt but 
you don't know the nature of the email you rejected - t could be spam 
related.

It would seem worth your time to try to track down what is going on with 
194.100.84.20  - that's a lot of attempts.

Another option would be a central location that accepts reports of 
attempted relay and correlates them.  Many relay tests now come through 
open proxies, I think some destinations are false and that the tester 
actually relies on the bounces rather than on delivery (the destination is 
a particularly vulgar: 
<http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&selm=Xns93068404FFFF8someuser999nwsupcom%40192.168.1.6>

Cripes - that was 2 months ago.

Keep in mind that this is the ASRG mailing list of the IETF.  It is my 
impression that the goal is to seek effective ways to combat spam, the E in 
the parent group's name makes me think it is to be engineered.  There's 
plenty of opportunity in taking the approach I suggest, I do not suggest 
simply doing what I do.

There could be alternative IETF recommendations: a really good blocklist, 
suitable for even large ISPs (like AOL, although I doubt AOL would ever 
trust any list from outside unless it's use is completely voluntary on the 
part of the user.)

It's my impression that the desire is to move, as opposed to remain 
static.  I'm for that, I put forth my suggestion, I can see it might be 
chosen as the basis for further and wider action.  This is not (I hope) a 
place to have religious wars about which approach is best, it's a place for 
the planning of effective action.

Spam is a strange crime (insofar as it is a crime, and I don't mean to 
trigger discussion on that question.)  In principle every step taken by a 
relay spammer can be fully logged, once it is known where he connects to 
the internet. All the spam that originates on a major ISPs network could be 
monitored, if it is determined to be a crime somewhere and if the proper 
search warrant is issued.  That's an important consideration but the point 
I wish to make is that spammers are able to operate secretly largely 
because people who could watch them don't.  I believe that watching them is 
worth doing, in particular watching their abuse attempts.