Subject: RE: [Asrg] "worm spam" and SPF

From: "Vipul Ved Prakash" <[email-masked]>
Date: Sat, 27 Nov 2004 11:28:47 -0800

Nod. This moves the content filtration problem to a different 
place: on the outgoing servers. If the only way to send out spam 
is through drones, then all spammers will move to using drones. 
The conclusion that I draw from this is that content filtration 
techniques used on outbound mail would have to be of the same 
level of sophistication as inbound filtration today. 

cheers,
vipul

-----Original Message-----
From: [email-masked] on behalf of Seth Breidbart
Sent: Fri 11/26/2004 11:15 PM
To: [email-masked]
Subject: Re: [Asrg] "worm spam" and SPF
 
"Vipul Ved Prakash" <[email-masked]> wrote:

[some MIME cruft elided]

> But consider the following scenario: A new worm come out that uses
> infected machine's designated servers to send out mail.  Say these
> mail servers have a SPF or DK record and further they enjoy good =
> reputations on the various reputation services (since they mostly
> send out good mail). The recipient machines do a SPF/DK check, it
> passes, they lookup the reputation, which checks out too, and
> deliver the mail bypassing all content-based filtration
> sub-systems. The recipient systems get infected.  The smarter
> users start reporting the worm to reputation services, who in turn
> punish the senders. After a while the senders reputation drops so
> much that they are unable to send out legit mail.

Therefore, an ISP (or other sender) that wishes to retain a good
reputation will set its outgoing mailservers to check for the latest
worms fairly soon after they're discovered, and throttle mail from any
particular sender so not too many worms get out before they're learned
about.

Seth

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Gadi Evron <[email-masked]>
Date: Sat, 27 Nov 2004 21:45:10 +0200

> level of sophistication as inbound filtration today. 

I don't want to sound like some FUSSP guy, but I still honestly believe 
this can be controlled and pushed to the level we discuss by ISP's 
blocking port 25 on dynamic ranges. All a user has to do is ask for port 
25 to be opened... and besides.. if they are running a server on a 
dynamic range.. Good luck!

Closing port 25 on dynamic ranges would effectively make most mass 
mailers today useless. And thats a fact.

Should port 25 be blocked? AOL and comcast say yes.. many others say no.

	Gadi.

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 27 Nov 2004 21:28:28 +0100

On 2004-11-27 21:45:10 +0200, Gadi Evron wrote:
> blocking port 25 on dynamic ranges.
[...]
> Should port 25 be blocked? AOL and comcast say yes..

If they say so, why don't they do it? I still see a lot of connections
from comcast DSL addresses (and a few from AOL).

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg