Subject: RE: [Asrg] SICS

From: "Hannigan, Martin" <[email-masked]>
Date: Tue, 21 Dec 2004 19:37:15 -0500

The ISP's cooperate. Going after the zombies is, for the
most part, an ineffective approach to the situation. Search
and destroy of the controllers is more effective i.e.
1 controller = 100K downed bots. (example)

There's a ton of work going on behind the scenes.

-M<

--
Martin Hannigan                         (c) 617-388-2663
VeriSign, Inc.                          (w) 703-948-7018
Network Engineer IV                       Operations & Infrastructure
[email-masked]

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> william(at)elan.net
> Sent: Tuesday, December 21, 2004 6:52 PM
> To: Barry Shein
> Cc: ASRG list
> Subject: Re: [Asrg] SICS
> 
> 
> 
> It should be ISP's responsibility to help other ISPs and as such most 
> appropriate way to deal with zombies is for ISPs to indicate which of
> their ip blocks are used by broadband end-users and which are 
> real mail
> servers. If majority of ISPs did that, that would effectively cut the
> zombie spam only to be within ISP's own network, which I'm sure they'd
> deal with a lot more promptly (and if they don't its really their
> problem and their users who have to suffer but nobody elses).
> 
> On Tue, 21 Dec 2004, Barry Shein wrote:
> 
> > The idea of complete end-user control is a utopian ideal 
> which died a
> > few years ago when spammers' zombie bots began hitting ISPs by the
> > thousands simultaneously.
> > 
> > At this point there are only two choices, either block at 
> the ingress
> > (e.g., blocking network blocks and similar), or begin 
> charging around
> > $1000/month for e-mail accounts to pay for the bandwidth 
> and hardware
> > necessary to keep up with the unfettered flow (essentially, a
> > dedicated server with a dedicated T1 per mailbox.)
> > 
> > Anyone who says otherwise, notably EFF, is just ignorant.
> > 
> > 
> 
> -- 
> William Leibzon
> Elan Networks
> [email-masked]
> 
> 
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 21 Dec 2004 17:38:25 -0800 (PST)

On Tue, 21 Dec 2004, Hannigan, Martin wrote:
> most part, an ineffective approach to the situation.

I'm not talking about reactive approach - I'm talking about prevention of 
this in the first place. All that is necessary is that ISPs agree to share
in a standard way a list of host they believe to be responsible enough to
freely participate in SMTP transactions on their own. This cuts down list 
of possible zombie targets to very few machines run by users who are 
already likely to have security mechanism that prevents their system from
being taken over.

> Search and destroy of the controllers is more effective i.e.

It is certainly good that this is going on, I've been involved in couple 
of these "search and destroy" missions myself. But this is all work after
the fact when we should be trying to research ways to prevent the occurance
of the problem in the first place. In other words, would you prefer to 
face possiblity of being sick with a smallpox rather then the world 
having choosen to immunize everyone against it some time ago which 
effectively got rid of the problem? 

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Tue, 21 Dec 2004 21:12:33 +0000

> Search and destroy of the controllers is more effective
> i.e.  1 controller = 100K downed bots. (example)

But ... the acquisition cost or re-acquisition cost or rendezvous cost
is zero, and the controller may simply be the current lease holder ...

There are assets that have different temporal properties than the set
of write-side nodes, which frankly, appear to twinkle.

BTW, my research interest is in spam/http (e.g., comment spam on blogs),
not spam/smtp, and in my problem space the write-side is as intractible,
address list, content signature, authentication exchanges, and so on,
so my interest is on the read-side.

Milage varies, but this is research, so I've no idea what I'm doing.

Eric

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Tue, 21 Dec 2004 21:30:35 +0000

> ...

Variola was effectively quarentened until about 1521. It wasn't an issue
in the New World population until infected immigration populations were
introduced from the Old World.

---

From: Barry Shein <[email-masked]>
Date: Tue, 21 Dec 2004 21:19:46 -0500

Yes, but the very assumption that anyone would "take down" a zombie PC
(block, disable, whatever) belies the "end-user control" notion of
spam.

For all I know there's someone out there who wants that zombie to spew
at them, maybe they're doing research or something. And, by EFF's
recommendations, it would be morally repugnant for an ISP to thus
interfere.

So although it might be a slightly different case, it's the same exact
issue.

You just think no one is crazy enough to defend zombie PCs, and I'd
like to think you're correct. But as far as I can tell EFF is that
crazy.

And if that's not what they're trying to say in that white paper then
they should disabuse it and admit that under current conditions the
distinction they make is at best purely academic (i.e., there may
exist at least one instance which fits their profile, but whether it's
representative or even definable remains an open question), and at
worst purely idiotic.

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 21 Dec 2004 19:29:50 -0800 (PST)

> recommendations, it would be morally repugnant for an ISP to thus

Who interfered? If somebody wants to accept spam from zombie pc - they can
go ahead (ok, they may have to tell their ISP that they want to do it or
may have to run their own mail server with different set of policies).
 
> like to think you're correct. But as far as I can tell EFF is that

Well since they "that crazy" to hold a view it as that anybody has the 
right to send then any kind forged and spoofed of email and its their
responsibility to (re)view every one of those emails manually to determine 
if its something they wanted to receive, perhaps we need to run a small 
test campaign of their convictions - how about all the spamtraps instead 
of sending zombie spam to /dev/null instead start forwarding and [re]forged
those email to EFF! :) So anybody knows list of their officers who are good
audience to read about what email traffic originates from zombied machines?

Perhaps even a screensaver could be created to help in this process ... :)
 
-- 
William Leibzon
Elan Networks
[email-masked]

---

From: John Levine <[email-masked]>
Date: 22 Dec 2004 03:35:11 -0000

>like to think you're correct. But as far as I can tell EFF is that

I had lunch with the EFF rep who spoke at the FTC authentication
conference about a month ago.  She told me that she hand sorts 2000
spams a day from her mailbox.  Apparently she thinks this is a
productive use of her time.  Go figure.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com