Subject: Re: [Asrg] In case anyone thought Barry was exaggerating

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 27 Jun 2003 12:11:25 -0400

At 10:13 PM 6/26/2003 -0400, Barry Shein wrote:

>On June 26, 2003 at 21:04 [email-masked] (Yakov Shafranovich) wrote:
>  > In your opinion, isn't spam considering a specific case of a network 
> abuse
>  > problem? Why is the spam problem any different from lets say a BBS user
>  > dialing in every moment and giving all other BBS users a busy signal. OR
>  > lets say in a shared-Unix system, a user grabbing too much disk space
>  > leaving not much for anyone else.
>
>Scope.
>
>Ringing your phone over and over is annoying as hell.
>
>Ringing every phone in the city over and over is evidence of a massive
>security breach.
>
>Any idiot can ring one (or a few) phones over and over.
>
>But once someone has acquired the technological savvy to ring millions
>of phones and no one can stop them we're in a whole different ball
>park.
>
>Telling people to unhook the bell on their phone (boy I must be old to
>even think of that) doesn't quite address the latter issue.

Then according to you, how is spam different from a DDOS attack were 
thousands of computers start spewing packets? If both problems are similar, 
then perhaps we need to look into what methods are currently in place to 
block DDOS attacks and we can reuse the same methods here for spam.

>  > In both cases,  there were mechanisms in place to catch the wrongdoers 
> and
>  > enforce the rules. The problem with the Internet is as many people have
>  > mentioned, is that it is an open system, written by people no expecting
>  > abuse - by people who trusted each user on the network to do the right
>  > thing. As far as I understand you, what you and Eric Brunner are 
> trying to
>  > bring to everyone's attention, is the need for similar controls on the
>  > Internet so massive network abuse can be detected early and stopped.
>
>I think we need to begin to recognize the problem for what it actually
>is. A massive security breach which no doubt violates many extent laws
>and not just some obnoxious behavior which needs to be curbed by
>smartening things up a little.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 27 Jun 2003 10:37:00 -0400

Yakov Shafranovich wrote:

> I read over the transcripts, unfortunately my current bandwidth is way 
> too small for the videos. Well, Dr. Hancock's stuff is definatly 
> chilling, especially the parts about the new 802.16 wireless standard 
> with over 30 mbps going in the radius of 30 miles. Just think of all 
> zombies and open relays possible to be setup. A lot of the stuff he said 
> seems to support Barry's arguments that viruses, zombies and infected 
> computers are a major source of spam.

A lot of what everyone on that panel said supported that, especially 
Nick and Michael, and my comment (which should be on the transcript).

Machines that open proxy (whether by naive analogx or wormed spamware) 
are responsible for at _least_ 70% of all of our spam.

Some numbers off the spamtrap (numbers are: total over past 7 days, 
%percentage of entire spamtrap):

BOPM                      6611509  35.70
MONKEYPROXY               10091018  54.48
NTauto                    1519398   8.20
NTliar                    13481631  72.79
OBproxies                 2784368  15.03
OSproxy                    396490   2.14
OSsocks                   8478399  45.78

These are effectiveness rates on our spamtrap against various open proxy 
blacklists.  DNSBL users will recognize several of these. NT* are ones 
we build ourself. "NTauto" is a combined "open relay and proxy" 
blacklist which doesn't generally overlap with others (it won't perform 
a test if the IP is blacklisted by anybody else).

"NTliar" is a very specialized blacklist detecting attacks from open 
proxies.  And in case you're wondering about its reliability, in the 
three weeks since NTliar was developed, it hasn't had a _single_ false 
positive.  Ever.

No, sorry, I cannot reveal how NTliar works without a NDA.

If you use DNSBLs, or even if you don't, there's no excuse not to use a 
good open proxy blacklist.

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 1 Jul 2003 20:54:51 +0200

On Mon, Jun 30, 2003 at 05:18:12PM -0400, Barry Shein wrote:
> Ok ok, fair enough, but there is something so low-intensity about
> zombie spambots that it seems to have gone on for months with people
> only noticing the result. That makes it different.

Agreed ;-)

However I notice in my logs (emails to non-existant users) that there
are patterns, where spammers concentrate on one account. I see within
a 30 second timeframe connections from about 10-50 different hosts where
they try to double inject messages to one user.
I have also seen similar behaviour with kinda dictionary spams where
they always have 5-10 hosts in parallel work on a subset of usernames
e.g.    aa*@domain to ae*@domain
	af*@domain to al*@domain
	[ ... ]
and a total of some 100 hosts per day. If the spammer didn't "fine tune"
the process and there are 40-50 hosts in parallel it qualifies for a DDoS,
IMHO.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"