Subject: [testlist] Alleged spam complaint / RT Ticket 10775

From: Glen <[email-masked]>
Date: Wed, 24 Sep 2008 16:41:18 -0700

All -

We got the following ticket, which was sent to the IETF discussion list:

> Wed Sep 24 16:25:42 2008  	 [email-masked] - Ticket created  	 	 [Reply] [Comment]
> Subject: 	IETF mail-lists outbound server being exploited
> Date: 	Wed, 24 Sep 2008 16:25:19 -0700
> To: 	[email-masked]
> From: 	Douglas Otis <[email-masked]>
> Download (untitled) [text/plain 580b]
> There is a growing stream of spam being emitted from 64.170.98.32.
> This appears to be the outbound server for IETF mailing-lists. Some
> of the spam has had headers added that indicate the message was
> originally received from an open relay or an IP address on several
> block-lists (with much of it encoded unicode). The messages
> identified as spam have included the original message content. This
> is creating a problem where receiving messages from the IETF is less
> reliable.
> Postmaster@ has been copied. Redacted examples are available upon
> request.
> -Doug

I don't know who "Doug" is, mail-abuse.org appears to redirect to
mail-abuse.com, which has a statement saying they were bought out by
Trend Micro, no example mail was provided, and I see no evidence that
we're being exploited whatsoever.  At this stage, I consider this mail
message to be frivolous.

As everyone knows, because it has been the subject of much discussion
and argument in the past, we run very aggressive anti-spam measures on
the IETF servers, and ALL AMS servers.  Those measures are still in
place, and still working.

If anyone wishes to comment or ask questions, or has further information
about please feel free to contact me directly.

Thanks,
Glen
_______________________________________________
Testlist mailing list
[email-masked]
https://mail.ietf.org/mailman/listinfo/testlist

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 25 Sep 2008 14:44:41 +1200

Doug is a genuine IETF participant who's been using that
email address since 2005 at least. I think you can write
to him privately asking for the evidence.

  Brian

---

From: Glen <[email-masked]>
Date: Wed, 24 Sep 2008 20:54:13 -0700

> to him privately asking for the evidence.

Brian -

Thank you so much for that clarification.  I have done as you suggest, and
this is the message I sent him.  (I sent it from my GMAIL account to ensure
he receives it, since he is blocking all email from us right now - he won't
see any list or other mail from us at that account! - so I'm just pasting
the message in here for everyone's reference.

Thanks for identifying and vouching for him.  That makes my job MUCH easier! :-)

Warm regards,
Glen

>> is creating a problem where receiving messages from the IETF is less         

Mr. Otis:

My name is Glen Barney, and I am the IT Director for AMS, the 
company providing secretariat and system management services
to the IETF.  I am emailing you from GMail, because you are 
clearly unable to receive email from the IETF.

I am unaware of a growing stream of spam emanating from the
IETF servers.  The IETF mail servers are not open relays, they
are closed, secure, properly-registered servers running aggressive
anti-spam measures specified by the IETF leadership and 
implemented by us.  The only outbound mail from the systems
is in the form of mailing list mail, to which individuals subscribe,
or in the form of preset messages sent in response to web actions..
The ultimate arbiter of which messages are sent through to a
list is the list owner/administrator, typically the working group
chair.  The IETF has determined that they do NOT want any
blacklist services such as mail-abuse.org to be used on the servers;
therefore, we do not check any RBL-style services in the
processing of email, and the presence of IP addresses that
your particular RBL may consider significant does not mean that
a message will automatically be refused by the IETF.

With those facts in mind, if you have messages you wish to 
have us review, we will be happy to do so.  Please direct them 
to my attention, and not to the entire IETF discussion list.  My 
direct email address is [email-masked], and I suggest you
copy this address, [email-masked], to ensure that I
receive the email, since my corporate spam filters are
extremely aggressive. 

As for receiving mail, I see that someone has listed us in
mail-abuse.org.  However, a scan of the mail queue shows that,
of all the recipients of all of the email processed through the
IETF servers each day, yours is the only address using or
being blocked by mail-abuse.org at this time.  Since your
email address suggests you are employed by this firm, we 
refer you to your IT department and suggest you ask them
to whitelist this server so that you can receive mail.  Alternatively,
free email accounts such as GMail might provide a clearer
path through which to receive mail.

I hope this information answers your questions and resolves
your concerns.  In the future, you are always welcome to 
email me directly, and all of our contact information is also
available online at http://www.ietf.org/secretariat/ . Please let
me know if you have further concerns.

Glen Barney
IT Director
Association Management Solutions

---

From: Marshall Eubanks <[email-masked]>
Date: Thu, 25 Sep 2008 08:24:12 -0400

Glen;

Did you see the email I sent to action about the same issue ?

I am getting spam from IETF servers, and it doesn't appear to be  
either through-list or
backscatter traffic. It might be, but it doesn't appear to be.

My ticket is [rt.amsl.com #10769]

Marshall

---

From: James M Galvin <[email-masked]>
Date: Thu, 25 Sep 2008 09:55:53 -0400

Marshall,

I looked at your ticket.  The message is really passing through the 
IETF servers at AMS to Henrik's tools machine and being distributed 
from there.  I suspect there is an issue here.

Glen and Henrik will have to look at the configuration.  I don't know 
if things are the same as they were during the transition, but there 
was an access control issue back then.

Your message was destined to ops-chairs.  All the "chairs" aliases are 
expanded on the tools machine.  It used to be that the IETF servers 
just forwarded all those messages to the tools server.

Previously I would have said that the problem is there is no spam 
filtering in that path.  I don't know if that's still the case.  If 
there isn't, then that's the problem.  Alternatively, perhaps the spam 
filtering needs some tweaking.

In any case, I'm sure Glen and Henrik can track down what's happening.

Jim

-- On September 25, 2008 8:24:12 AM -0400 Marshall Eubanks 
<[email-masked]> wrote regarding Re: [testlist] Alleged spam 
complaint / RT Ticket 10775 --

> >> is creating a problem where receiving messages from the IETF is
> >> less reliable.
> > Trend Micro, no example mail was provided, and I see no evidence
> > that we're being exploited whatsoever.  At this stage, I consider
> > this mail message to be frivolous.
> >
> > As everyone knows, because it has been the subject of much
> > discussion and argument in the past, we run very aggressive
> > anti-spam measures on the IETF servers, and ALL AMS servers.  Those
> > measures are still in place, and still working.
> >

---

From: Russ Housley <[email-masked]>
Date: Thu, 25 Sep 2008 10:23:33 -0400

Doug is an active IETF participant.  Please ask him for an example message.

Russ