Subject: RE: [Asrg] Sendmail CEO Backs Yahoo DK and MS CID

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 1 Mar 2004 16:33:01 -0800

> The communication issues is one area where common standards 
> would help 
> and this is why we are looking into such standards for abuse 
> reporting 
> including multiple ways to communicate and lookup such data.

The reporting issues need not be spam related

DDoS is a big enough issue here to justify a notification mechanism.
If there is a hijacked machine on the net then the ISP resonsible needs
to know ASAP.

> I agree. The question is what kind of value proposition can we give 
> them? Simply blocking them might be a crude weapon.

	"A machine on your network may be causing grief in my network,
		please fix"
	"You are being impersonated by spam from this address"

Value to notifier	
	* May cause attack to stop
	* Can hold source accountable

Value to receiver
	* Public interest
	* Avoid more intrusive contact attempts
	* Reduce value of capturing machines on the receiver's network
	* Deter attacks
	* Shut down attacks faster
	* Reduce liabilities

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 01 Mar 2004 19:44:04 -0500

Hallam-Baker, Phillip wrote:
>>would help and this is why we are looking into such standards for abuse 
>>reporting including multiple ways to communicate and lookup such data.
> 

I agree. We gave a subgroup setup for this 
(http://asrg.sp.am/subgroups/abuse_reports.shtml) and soliciting 
volunteers. However, we haven't gotten much response so far, which makes 
me think that people might not as interested in this kind of stuff as we 
think they would be.

Yakov

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 1 Mar 2004 21:12:20 -0500 (EST)

>	"You are being impersonated by spam from this address"

Thanks but no thanks, until you have a way to limit the number of
notifications I get to the log10 of the number of spams sent out.

Feel free to tell the network-owner of the spamming machine about it,
that's who can take action to stop the spam (and the notifications).

Seth

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 02 Mar 2004 14:24:21 -0500

> DDoS is a big enough issue here to justify a notification mechanism.

  If anyone who disagrees, please post the IP of their main MTA on
this list.  I'll point the MX for my "death by spam" domain to it.

  The best-case scenario is then that you block port 25 or shut the
machine down.  But your routers will still be dealing with ~100 TCP
SYN's a second to port 25 from 10's of 1000's of IP's.

  If that's not a DDoS, I don't know what is.

> If there is a hijacked machine on the net then the ISP resonsible needs

  Or, everyone else needs to know, so that they can block the machine
if the ISP won't.

  Alan DeKok.