Subject: [Asrg] 0.General - News Article - NYT Reports Porn Spam Hijacking Network

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 11 Jul 2003 12:30:07 -0400

Just came across this SlashDot story 
(http://slashdot.org/articles/03/07/11/133232.shtml) referencing a New 
Times article (http://www.nytimes.com/2003/07/11/technology/11HACK.htm(l) 
that discusses how thousands of computers were hijacked and used for 
sending porn spam. This story is also available at News.com 
(http://news.com.com/2100-12_3-1024967.html). Some quotes:

--------snip----------
More than 1,000 unsuspecting Internet users around the world have recently 
had their computers hijacked by hackers who computer security experts say 
are using them for pornographic Web sites.

The hijacked computers, which are chosen by the hackers apparently because 
they have high-speed connections to the Internet, are secretly loaded with 
software that makes them send explicit Web pages advertising pornographic 
sites and offer to sign visitors up as customers

The hackers operating the ring direct traffic to each hijacked computer in 
their network for a few minutes at a time, quickly rotating through a large 
number. Some are also used to send spam e-mail messages to boost traffic to 
the sites.

By hiding behind a ring of machines, the senders can cloak their identity 
while helping to solve one of the biggest problems for purveyors of 
pornography and spam: getting shut down by Internet service providers who 
receive complaints about the raunchy material.

The computer ring is the latest in an evolution of attacks that allow 
creators of spam and illicit computer schemes to use other people's 
computers as accomplices. For several years, senders of spam have relied 
upon a vestigial element of the Internet mail infrastructure known as "open 
relay" to use Internet servers as conduits for their spam.

As network administrators have gradually shut down the open relay networks, 
spam senders have used viruses to plant similar capabilities on home and 
business computers.
--------snip----------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 11 Jul 2003 12:46:21 -0400

> are using them for pornographic Web sites.

  In addition, the number of bounces I've received about "a virus was
detected in your message to FOO" has increased significantly in the
past week or so.

> sites and offer to sign visitors up as customers

  And how, exactly, can the recipient tell this spam from messages
sent out by mobile users who similarly make direct connections?
There's the content, but content filters have their own issues.

  Unless the propogation of these malware programs is quenched, I
think this incident can be taken as the start of the end for mobile
users of naked, unauthenticated, unverifiable SMTP.  There are other
methods by which they can send email, and those methods will help
protect against this kind of spam attack, at least.

  While spammers can adapt and change their methods, I think that
other than willingly cooperating spam houses, this method of co-opting
thousands of random computers is probably the simplest and most
effective way of sending spam.

  Alan DeKok.

---

From: Raymond S Brand <[email-masked]>
Date: Fri, 11 Jul 2003 14:05:57 -0400

Alan DeKok wrote:
...
> effective way of sending spam.

This is the specific problem that DRIP addresses. See

	http://ietf.org/internet-drafts/draft-brand-drip-00.txt

Raymond S Brand

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 11 Jul 2003 14:16:49 -0400

> 	http://ietf.org/internet-drafts/draft-brand-drip-00.txt

  Without commenting on the rest of it:

------
3.1 Designation Record Template

The template for the DNS records is:

      ${IPS}.${IPV}.relays._email_.${DOMAIN}.   IN   ${TYPE}   ${IP}

   With:

   ${IPS}
      The textual representation of the IP address.
------

  that would be better with it as the *reverse* of the address.  This
allows DNS administrators to better deal with address ranges.  At
which point, it's very similar to:

  http://ietf.org/internet-drafts/draft-fecyk-dsprotocol-03.txt

  In addition, it suffers from the same DNS related problems as RMX,
and draft-fecyk-dsprotocol-03.txt.  This isn't to say it's broken,
it's just imperfect.

  Alan DeKok.

---

From: Raymond S Brand <[email-masked]>
Date: Fri, 11 Jul 2003 15:41:22 -0400

Alan DeKok wrote:
...
> which point, it's very similar to:

The representation was chosen to NOT allow trivial wildcarding to large
ranges since, otherwise, the malware authors would wildcard the entire
IP address space. And an observation, even large mail sites have a finite
number of MTAs and those MTAs already have several individual DNS records.

> and draft-fecyk-dsprotocol-03.txt.  This isn't to say it's broken,

Unlike DMP, RMX, and SPF, DRIP uses the domain name from the HELO/EHLO
SMTP command, the others use the domain name from the envelope FROM
address.

DMP, RMX, and SPF all require envelope rewriting, DRIP does not.

Raymond S Brand

---

From: Barry Shein <[email-masked]>
Date: Fri, 11 Jul 2003 17:44:05 -0400

Well, there ya go, the NY Times is technologically ahead of ASRG in
recognizing what the real source of the spam problem is.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 11 Jul 2003 18:26:45 -0400

>recognizing what the real source of the spam problem is.

Barry, leaving the sarcasm aside, there are problems with looking at the 
spam problem from this angle. There are specific problems with dealing with 
the security issue which I mentioned in a prior post:
1. It is easier to deal with the problem on the edge of the network than at 
the core. "Fixing" the core can take decades. In the short and medium term 
we would be looking at "edge" solutions. In the long term perhaps a "core" 
solution might work but would require a very long time to implement.
2. This is something that must be dealt on the infrastructure level of the 
Internet - it is a general issue of security akin to other things that 
zombies are used for (DDOS, hosting porn sites, worms, etc.). These are 
issues that must be looked at as an Internet-wide problem not limited to 
spam. Once again, this problem stems from the fact that the Internet as a 
network inherently trusts its users and servers. Unless you will convert 
the Net into a closed system where every single server and user must have 
authorization, it will not solve the problem.

If this is a general "security" problem, than we cannot hope to solve the 
"spam" specifics without solving the general security problem. Thus, it 
might require a new group to be focused specifically on security issues of 
the Net. We are dealing with spam only.

I would also like to make another suggestion. It seems that you and Eric 
Brunner in particular have been advocating this approach. Why don't you two 
get together and write up a document outlining the spam problem from this 
point of view, and providing an evaluation checklist for solutions (also 
see section 3.2 of the "Technical Considerations" document 
(http://www.ietf.org/internet-drafts/draft-crocker-spam-techconsider-02.txt)). 
This can provide a concrete framework and a checklist for the group to 
consider various proposals falling under this angle of things such as 
replacing SMTP, detecting hijacked computers, DRIP, etc.

Another suggestion which I mentioned before would be setting up an "Email 
Standards Project" akin to the "Web Standards Project". Get a group of 
people together and setup a site that will list recommended configurations 
for popular MTAs and MUAs that can protect user' computers from being 
hijacked and reduce spam. Things like shutting off open relaying, disabling 
ActiveX and JavaScript inside mail clients, perhaps disabling HTML email on 
send, etc. can be documented. User education is very important and 
something that can be very useful in the long run.

Yakov

---

From: Barry Shein <[email-masked]>
Date: Fri, 11 Jul 2003 19:44:31 -0400

> 1. It is easier to deal with the problem on the edge of the network than at 

Many very smart people have been trying to "deal" with the problem on
the edge of the network for several years now, but the spam problem
grows worse and worse.

I think the approach you champion above all others is rapidly becoming
akin to "phlogiston" or "epicycle" theories (early scientific theories
intuitively compelling and also championed to the exclusion of others
which later were proven fallacious at the core.)

I think you would do better to simply show your favored approach to
have merit rather than constantly try to beat back others' approach to
the problem.

There's a fine line between trying to maintain order and simply
dragging a group into a non-stop meta-discussion revolving around
ones' own pet theories.

 > the core. "Fixing" the core can take decades. In the short and medium term 

Fixing the edge has already proved fruitless in nearly a decade of
trying.

Given the proven fruitlessness of one approach vs the possibility of
frustration with another approach (whose underpinnings have now
increasingly been shown to have merit) which is preferable?

Well, let a thousand flowers bloom. I personally have no agenda to see
your favored attack on the problem marginalized.

Unfortunately I don't believe that feeling is reciprocal.

 > solution might work but would require a very long time to implement.

Since your approach has thus far produced nothing measurable why is the
(hypothesized) difficulty of a different approach, in your mind, such
a negative?

I think we've already discussed that issue; that an approach might
take years for ubiquitous deployment does not equate the likelihood of
successful results (i.e., significant reduction of spam, that's why
we're here, right?) from early, less pervasive deployment.

Put another way, you assert that ubiquity would be difficult, but you
haven't established why ubiquity is a reasonable pre-condition for
success.

Besides, nearly every approach has this difficulty, it's an easy
criticism to make.

 > authorization, it will not solve the problem.

This is a particular hypothesis about the problem, and dare I say one
driven by a particular agenda.

One might hope that the purpose of a RESEARCH group is to pursue
promising possibilities, perhaps even more than one, rather than have
bridges burned by one individual's off-the-cuff speculations.

 > something that can be very useful in the long run.

I have a better idea.

Why doesn't Yakov form the Topics-Approved-By-Yakov research group and
then you won't have to spend so much time batting away at competing
approaches?

You can perfect that by being the only one in that group! Consider the
possibility for unfettered consensus!

I think when someone expends as much energy as you do trying to
silence others' approaches something is awry.

Particularly when the competing theory is rising so quickly as this
New York Times article, which seems to have set you off on your
latest, lengthy meta-missive, demonstrates.

-- 
        -Barry Shein

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 12 Jul 2003 08:46:32 +0100

> increasingly been shown to have merit) which is preferable?

Barry, perhaps you could remind the group exactly what kind of approach
you're talking about?

--

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sat, 12 Jul 2003 09:41:21 -0400

Yakov,

See my comments to Phillip. Delete the 2nd word.

Eric

---

From: mathew <[email-masked]>
Date: Mon, 14 Jul 2003 21:32:04 -0400

> protect against this kind of spam attack, at least.

They will? How?

If the user's copy of Microsoft Outlook is capable of sending e-mail, 
then it doesn't matter if you authenticate or verify before allowing 
SMTP. It doesn't help a bit, any more than it would help to block SMTP.

As long as the machine can be used to send e-mail, and can easily be 
compromised (i.e. is running Windows), it can be used to send spam. If 
necessary the spamming trojan can simply feed its messages to Outlook 
to send via whatever method of authentication and verification the 
user's ISP requires.

mathew

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 15 Jul 2003 08:47:11 -0400

mathew <[email-masked]> wrote:
> > ... this incident can be taken as the start of the end for mobile

  By spreading the load of spam detection & filtering.

> SMTP. 

  Who is the "you" in that sentence?

  a) owner of the domain/MTA the sender is claiming to be from
  b) the final recipient

  If by 'you", you mean "the recipient", then of course authentication
doesn't help, because the recipient *can't* authenticate the sender.
And why is the recipient responsible for authenticating the identity
of all senders?  Does no one think that's a stupid idea?

  If, on the other hand, the roaming sender authenticates to his home
domain, and uses his home MTA for email, then the home domain now has
the opportunity to be a Good Netizen, and filter out the crap before
spewing it onto the net.  This won't happen all of the time, but it
will happen sometimes.

> It doesn't help a bit, any more than it would help to block SMTP.

  Only if you assume that the recipient is the one doing ALL of the
work of spam detection & filtering, and that no one else on the
network does anything.

  Spam filtering on outbound messages is perfectly permissible in many
cases, and legally required in many.  Do you really think that it's
legally acceptable for businesses to allow their employees to send
(whatever illegal content) to each other, or to people outside of the
company?

> compromised (i.e. is running Windows), it can be used to send spam.

  Nonsense.  It can be used to *try* to send spam, but there's no
guarantee that the recipient will be bothered by those attempts, or
even know about them.

  Alan DeKok.

---

From: mathew <[email-masked]>
Date: Tue, 15 Jul 2003 18:07:50 -0400

>   Who is the "you" in that sentence?

The user's ISP.

> spewing it onto the net.  This won't happen all of the time, but it

Filter how, though? How are you going to distinguish between e-mail 
generated by the computer's owner and sent by his e-mail software, and 
e-mail generated by malware and sent by the computer's owner's e-mail 
software?

> (whatever illegal content) to each other, or to people outside of the

So you're proposing that ISPs be required to run something like 
SpamAssassin on all *outgoing* e-mail, and bounce e-mail back at the 
user if it looks like spam?

I see a problem with that--will users accept it, or will they take 
their money elsewhere? I know that when *I* send an e-mail, I expect it 
to be sent--if my ISP bounces it back because they don't like the 
content, it's time for me to find another ISP.

mathew

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 16 Jul 2003 09:27:50 +0100

> user if it looks like spam?

This is a real live issue for providers of (for instance) free webmail
services. I'm familiar with a situation where the admin overhead of
investigating and terminating accounts following abuse allegations is
making this kind of outbound filtering look very attractive. I realise that
free webmail is a special case, but it's clear that the volume limits
imposed by many such providers are a step along this road.

> content, it's time for me to find another ISP.

Most (if not all) ISP have AUP which prohibit the use of their systems for
sending spam. I suspect that if a customer had a lot of trouble with
outbound content filtering it would be because either;
(a) their ISP does filtering badly - in which case you're right, the
customer would walk, or (b) the customer *is* a spammer.

I believe that it is in the long-term interests of ISP to keep spammers off
their networks. The consequences of blacklisting on legitimate customers
can support arguments for outbound filtering.

I don't see how you'd "require" ISP to use this, perhaps you might choose
to whitelist ISP who assert that they do.

--

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 16 Jul 2003 10:26:27 -0400

> e-mail generated by malware and sent by the computer's owner's e-mail 

  There are a number of methods.  Volume is one.  Content filtering is
another.

  i.e. If the recipient can decide a message may be spam based on
content filters, why the heck can't the senders ISP make the same
decision?

  Why can't ISP's run simple QoS style limiters on outbound email?
For each message that looks like real email, bandwidth goes up, and
delay goes down.  For each message that looks like spam, bandwidth
goes down, and delay goes up.  At no point will any email be blocked.
And the delays will usually be done on time scales that are
unnoticable to people.

  There are MANY ways of dealing with suspicious traffic at the
source.  Dropping the traffic whole-sale is just one of them.

  Cost considerations aside (no one makes money off of email, etc..),
I don't understand why it's considered acceptable Netiquette to send
gigabytes of garbage onto the net, knowing full well that most of it
will be thrown away at the other end.  It's ridiculous.

> user if it looks like spam?

  That's *exactly* what I refused to say.

  I'm saying that the ISP's MAY CHOOSE to be polite to the rest of the
net, and (shockingly) may want to be aware of what's going on in their
internal network.

> content, it's time for me to find another ISP.

  If you're a spammer, it's perfectly reasonable for you to get kicked
off of an ISP (at their choice or yours), because allowing you to spam
usually costs them MUCH more money than they get from you.

  Alan DeKok.