Subject: Re: Mailman attack in progress

From: [email-masked]
Date: Sun, 13 Aug 2017 23:12:26 -0400 (EDT)

Kaplah!

On Sun, 13 Aug 2017, Glen wrote:

> A brief update on our Mailman attack.
>
> After analyzing the attack pattern, I've added a new long-term measure
> into Mailman that is preventing these botnet subscription attempts
> from being honored (whilst still allowing humans to subscribe).
>
> I then turned my attention to Cloudflare.   After some experimentation
> (and manual-reading!) I discovered that - with a little custom
> crafting - one can actually use Cloudflare to mitigate this type of
> attack quite nicely.  I inserted some custom rules that have all but
> halted the incoming flood completely.
>
> So Mailman subscription service is back online (for humans only!) and
> we appear to be back to normal.
>
> Thank you for your patience during this interruption.
>
> Glen
> --
> Glen Barney
> IT Director
> AMS (IETF Secretariat)
>
>

---

From: Stewart Bryant <[email-masked]>
Date: Mon, 14 Aug 2017 07:46:17 +0100

Do we know why we are being attacked?

-Stewart

Sent from my iPad

---

From: "Andrew G. Malis" <[email-masked]>
Date: Mon, 14 Aug 2017 07:44:19 -0400

Stewart,

I suspect that any organization working on hardening the Internet’s (and
its protocols) security would be an attractive target for such attacks.

Cheers,
Andy

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 14 Aug 2017 10:09:47 -0400

> its protocols) security would be an attractive target for such attacks.

​When ​I started working on spam when the crisis hit, one of the mail
admins told me that I was getting 1/3 of the email sent to VeriSign which
had 2000-3000 employees at the time.

Of course, it wasn't long before the rest of the organization caught up. It
is possible this is IETF only or it might just be someone is hammering
every monarch mailing list front end.

---

From: Derek Atkins <[email-masked]>
Date: Mon, 14 Aug 2017 11:41:12 -0400

Glen,

> from being honored (whilst still allowing humans to subscribe).

When you have time, could you elaborate on what long-term countermeasure
you put into place?  Enquiring minds want to know.

> Thank you for your patience during this interruption.

Thank you for your tireless efforts!

> Glen

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Glen <[email-masked]>
Date: Mon, 14 Aug 2017 09:25:04 -0700

> you put into place?  Enquiring minds want to know.

Good morning everyone (adjusted for your local timezone as appropriate)...

I've had several requests of this type this morning.

The attack against Mailman was sophisticated.  It spoke not only to a
good understanding of Mailman, but also, possibly, to a good
understanding of what we have done to block attacks in the past.  It
was automated, yes, and widely distributed... but it was well adapted
to the current state of Mailman today.  The attack pattern suggests to
me that the primary goal was not so much flooding a few (obviously
fake) target addresses with email, but, rather, forcing email
providers to block the IETF (and any other impacted users) to prevent
the flood of mail we were generating as a result of the attack.

Although to my great disappointment I don't have the luxury of
participating in the IETF as a contributor, I do take the IETF's
mission very seriously.  I've learned in my years of associating with
many of you that the IETF faces strong opposition from individuals,
groups and governments who do *not* want global communications and
connectivity to work... and that the IETF takes its ability to reach
out to - and include - individuals around the world who want to
participate - very seriously.  As a result, I personally consider this
attack to be both directed, and serious.

I know that everyone is interested in what I found and what I did, and
I get that.. I would be too!.  On the other hand, *I* (and my small
team) are the ones who get woken up at 3 in the morning local time
(inevitably!) to deal with these types of things.  And I have no
illusions that the botnet authors and users are going to just "go
away" - as with the spammers, it's a constant battle of "us vs
them"... and I really don't feel like enabling their childishness
anymore.

So, needless to say, I am hesitant to just openly describe attack
countermeasures on a public list.  :-)   I'm sorry for that - I truly
am - because as I said *I* would want to know, too.   Although in this
case it's not a big deal, just a tweak or two, but adjustments that,
were they published, would be much easier for the bot authors to
"adjust for".  For all of these reasons, I'm not comfortable just
unilaterally exposing the IETF's defenses here... and I hope that you
will all understand this.  I am preparing a summary report to the TMC
outlining what was done, and I need to leave it to them to determine
if - and how best - to present the information to interested persons.

Thanks for your support as we deal with the ongoing threats to the IETF.

Glen
--
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: "Patrik Fältström" <[email-masked]>
Date: Mon, 14 Aug 2017 22:54:48 +0200

> if - and how best - to present the information to interested persons.

I think this is a very wise decision. Thanks for this.

> Thanks for your support as we deal with the ongoing threats to the IETF.

Thank YOU for your hard work supporting us.

   Patrik

---

From: Michael Richardson <[email-masked]>
Date: Wed, 16 Aug 2017 16:03:01 -0400

> am - because as I said *I* would want to know, too.   Although in this

Sad, but reasonable.
Perhaps the IAOC would like to organize a by-invitation-only meeting
at which the details might be related, and work to design and/or standardize
counter-measures might be discussed.

    > if - and how best - to present the information to interested persons.

"TMC" <- I have a cache miss on this.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Russ Housley <[email-masked]>
Date: Wed, 16 Aug 2017 16:05:46 -0400

> "TMC" <- I have a cache miss on this.

The TMC is the Technology Management Committee of the IAOC.
See https://iaoc.ietf.org/committees.html#TMC

Russ