Subject: Re: [Asrg] SICS

From: [email-masked]
Date: Thu, 23 Dec 2004 21:54:45 +0000 (GMT)

> I've been hit by 1500 zombie pc's simultaneously pumping the same
exact spam at us.

> How cheap does cheap have to be to deal with an attack like that?

At SOME point, this is more a DDOS attack than a spam issue... although if we go 
after unwanted/untrusted attachments and HTML, we will go a long way towards 
solving the problem (at least for E-mail vectors) of recruiting these zombie 
spambots.

There is clearly NO (local) solution for DDOS attacks, because by the time they 
arrive at your entrance portal the damage has already been done.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Laird Breyer <[email-masked]>
Date: Fri, 24 Dec 2004 13:53:20 +1000

On Dec 23 2004, [email-masked] wrote:
> At SOME point, this is more a DDOS attack than a spam
> issue... although if we go after unwanted/untrusted attachments and
> HTML, we will go a long way towards solving the problem (at least
> for E-mail vectors) of recruiting these zombie spambots.

That's the whole point. Spammers are DDOSing the SMTP servers. We're
discussing ways to protect against such DDOS attacks. But looking at
message contents is useless - by the time your SMTP server gets to see
the message, the resources are committed. 

> There is clearly NO (local) solution for DDOS attacks, because by
> the time they arrive at your entrance portal the damage has already
> been done.

Available information before that point is limited. You can refuse to
accept the connection based on IP address, or you can accept the
connection tentatively and do some cheap lookups. Before the message
DATA arrives, you have three pieces of information: a HELO (or EHLO)
identification string, the MAIL and RCPT strings (There's also VRFY or
EXPN but keep it simple).  Once the DATA command is used, the
connection is no longer cheap, because the data can be arbitrarily
long, and doing any sort of analysis on it will cost unpredictable
resources anyway. So discussing body analysis is irrelevant for this
problem.

-- 
Laird Breyer.

---

From: Barry Shein <[email-masked]>
Date: Fri, 24 Dec 2004 19:17:10 -0500

Without belaboring the specific technical suggestions being made,
which seem to me suffer at the very least from new and ever-changing
definitions of heretofore well-understood terms such as
"scaleability", I don't think finding ways to reduce the cost of
handling the ever-growing crush of spam is progress towards any
solution.

Such suggestions, along with announcements of relevant hardware
advancements (ram disks or whatever) are no doubt interesting from a
practical point of view to system administrators but don't strike me
as progress in the context of this group.

But feel free, I'm just explaining why I'm done with this particular
thread.

It's kinda like dealing with muggings by suggesting ways to make money
faster than muggers can steal it.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Laird Breyer <[email-masked]>
Date: Sat, 25 Dec 2004 10:21:28 +1000

That's a long winded way of saying you'd rather not give out
mail volume statistics on a public forum. A simple refusal would have
saved a lot of unnecessary arguing about unknown unknowns :-)

-- 
Laird Breyer.