Subject: Re: [Asrg] News Article - FTC targeting open relays

From: Steve Atkins <[email-masked]>
Date: Fri, 16 May 2003 09:17:08 -0700

On Fri, May 16, 2003 at 08:02:41AM -0700, Hallam-Baker, Phillip wrote:
> I just thought I would clear up a statement that appeared in the confessions
> article.
> 
> This said that the spam sender was sending his spam first through an open
> proxy and then through an open relay. As if he was somehow routing the
> message through the open proxy. It sounded to me that the journalist had
> just got confused. 

That sounds right to me. Most open proxies will happily proxy port 25,
and not bother logging where they got the connection from. They're either
used directly, through an open relay or through a local smarthost.

> The way I am hearing open proxy used it is to indicate web form mail. Is
> anyone seeing it used in any other way?

I've not seen them used in that way for spam at all.

Cheers,
  Steve
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 16 May 2003 08:02:41 -0700

Phill

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 17 May 2003 07:48:07 -0600 (MDT)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> ...

As Steve Atkins said, "open proxy" does not refer to the abuse of
"web forms." See http://www.google.com/search?q=%22open+proxy%22+spam
or http://www.google.com/search?q=%22open+proxy%22+spam+pc including
http://www.ftc.gov/bcp/conline/pubs/buspubs/openrelay.htm and
http://news.zdnet.co.uk/story/0,,t269-s2122679,00.html

"Formail" is the common tag for the abuse of "web forms," "CGI scripts,"
or programs intended to collect comments via web pages.  The comments
are collected with an ordinary HTTP form and then mailed to the owner
of the web page by the script or program.  "Fromail" comes from the
name of a popular and badly designed and written implementation of
the idea that lets a savvy web user tell the script to send the comments
to an arbitrary mail address.

In spam circles, the phrase "open proxy" refers to a SOCKS, HTTP, or
other TCP "proxy" or form of ALG or application level gateway, by
analogy to "open SMTP relay" or "open relay."  Such proxies accept
TCP connections from clients, and then based on some chatter, open a
second TCP connection to a second TCP server.  After opening the second
connection, the proxy translucently gateways bits between the client
and the second server.  Depending of the protocol being "proxied" or
of the second TCP server, the proxy must modify some of the bits.
For example, IP addresses in FTP commands must be changed.  Ten years
ago, SOCKS proxies (see RFC 1928) became popular for allowing hosts
inside a firewall on corporate networks to reach hosts outside on the
Internet.  The proxy software usually runs on a firewall or other
system visible to both the Internet and its clients.

When the proxy is properly implemented and configured, the proxy honors
requests from only authorized clients.  Authorization is commonly
determined by the IP address of the client, but can involve passwords
and so forth.  When the proxy answers arbitrary clients, it is "open."

Many SOCKS proxies are not properly implemented and configured.  Worse,
there is some sort of freeware proxy for PCs that is reportedly
configured by default as an open proxy.  The provider of this software
has refused to change the defaults.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg