Subject: spam on old lists - was [89attendees] Fw: new important message (fwd)

From: [email-masked]
Date: Fri, 15 Apr 2016 13:11:39 -0400 (EDT)

Can we have a process where we disallow posting by _everyone_ on the
attendees lists of previous IETF meetings? I think after 4 months there
is no valid reason for allowing to post on those old lists anymore.

Paul

---------- Forwarded message ----------
Date: Wed, 13 Apr 2016 09:15:12
From: [email-masked]
To: 89attendees <[email-masked]>,
     Alexandru Petrescu <[email-masked]>,
     Antoin Verschuren <[email-masked]>,
     Arran Cudbard-Bell <[email-masked]>,
     Dave Cottlehuber <[email-masked]>
Subject: [89attendees] Fw: new important message

[ spam deleted]

_______________________________________________
89attendees mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/89attendees

---

From: Dick Franks <[email-masked]>
Date: Fri, 15 Apr 2016 18:22:01 +0100

> is no valid reason for allowing to post on those old lists anymore.

Is there any valid reason for the list to exist after 4 months?

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 15 Apr 2016 19:27:10 +0200

I think the problem is bigger than that.

I’ve not checked those specific emails headers, but some time ago, I noticed that subscribers of IETF using DNS-BL black listed email servers were allowed to post.

This means that if a spammer is subscribed, or an actual subscriber infected with a virus/bot/whatever, he is able to send all kind of rubbish to the list.

As a consequence of that, because my email server is configured to reject messages that have an IP in any header which is DNS-BL, then my email address was unsubscribed.

I exchanged a few email with AMS and IAOC, and suggested that we MUST reject any sender that is black listed. NEVER got a response back from the IAOC, despite having been told that they will take care of that.

Again: I really think we must reject emails coming from DNS-BL black listed servers.

Is up to each postmaster to make sure that the IP addresses of his/her servers are not listed in DNS-BL and his network free of malware that can create problems to others.

May be some day, someone at the IAOC can take care of this … instead of ignoring our complains.

Regards,
Jordi

-----Mensaje original-----
De: ietf <[email-masked]> en nombre de <[email-masked]>
Responder a: <[email-masked]>
Fecha: viernes, 15 de abril de 2016, 19:11
Para: <[email-masked]>
Asunto: spam on old lists - was [89attendees] Fw: new important message (fwd)

>[ spam deleted]_______________________________________________
>89attendees mailing list
>[email-masked]

---

From: John Leslie <[email-masked]>
Date: Fri, 15 Apr 2016 13:53:36 -0400

> Again: I really think we must reject emails coming from DNS-BL

   In a word, No.

   I'm in a spamhaus blacklist right now (working on it!!!), and spamhaus
refuses to say why. These things happen!

   If we were seeing a higher volume of spam get through, I'd agree to
instituting a moderation-like process; but we're not, and I dislike
make-work for moderators.

   Perhaps somebody would like to work on a captca?

> Is up to each postmaster to make sure that the IP addresses of his/her
> servers are not listed in DNS-BL and his network free of malware that
> can create problems to others.

   Indeed, we try!

   But very few blacklist maintainers offer actually useful information
to help us do this.

   We _could_ in principle work up protocols to replace zero-maintenance
blacklists as "the solution" to spam. I tried, the last time the topic
was hot; but totally failed to get anything that wasn't trivial to bypass.

> May be some day, someone at the IAOC can take care of this ??? instead
> of ignoring our complains.

   How much are you contributing to the funding of that additional work?

--
John Leslie <[email-masked]>

---

From: David Morris <[email-masked]>
Date: Fri, 15 Apr 2016 11:25:16 -0700 (PDT)

Having fought with DNSBL providers, I think the BLACK part of the name is
appropriate ... as in BLACK HOLE re. any hope of rational resolution. My
ISP at the time incorrectly categorized my static IP block as dynamic and
it proved impossible to get past that issue with the BL provider. It
happened at the time that it would be convenient to change ISPs and I did.
Then my email started using a hosted spam filter and my effective IPs were
kept clean by someone else. During the time I was wrangling with the BL, I
had a bounce from one ISP, but their message was complete enough
documenting their whitelist process that I think it took about 5 minutes
to fix.

On Fri, 15 Apr 2016, John Leslie wrote:

> ----------
> This email has been scanned for spam and viruses by Proofpoint Essentials. Visit the following link to report this email as spam:
> https://us1.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=m1w7uTVeX-2q&rid=113885848&report=1
>

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 15 Apr 2016 20:31:10 +0200

A few years ago, I’ve managed to get a customer out of spamhaus, despite having sent a SPAM because a bot, etc. I was able to find all the info about how to proceed in their web site, apply to clean, etc.

Same with other similar DNS-BLs

I think if you’re “clean” you should have not problem, and we can choose which DNS-BL to apply. If we have from the community negative reports about bad-behaviours from any of those DNS-BLs for example.

Regards,
Jordi

---

From: [email-masked]
Date: 15 Apr 2016 18:52:38 -0000

>appropriate ... as in BLACK HOLE re. any hope of rational resolution.

There are hundreds of DNSBL providers, most of whom are incompentent,
but nobody uses their lists so it doesn't matter.  There are a few
that are competent and have very low error rates.  They, not
surprisingly, are the ones everyone uses.  When I say everyone, I mean
it -- every mail system of any size uses them as part of their spam
filtering because they have to. They're awful but less awful than the
alternatives.

In this particular case, filtering by From: address on mailing lists
still works well enough, particularly here where the participants tend
to be technically sophisticated and so are somewhat less likely to get
their accounts p3ned than average users.  So I agree that we might as
well turn off useless old meeting lists, but I don't see any need to
twiddle things beyond that.

R's,
John

>> was hot; but totally failed to get anything that wasn't trivial to bypass.

I don't think that's a failure of imagination, it's in the nature of
systems with malicious participants.  It's not unrelated to the
observation that you wouldn't want to join a club that would have you
as a member.

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Fri, 15 Apr 2016 15:55:53 -0300

Aren´t old XXattendees MLs suspended/default moderated ? i would have
thought so. At least it's what we do with old lacnicXX-attendees

-Carlos

---

From: John Leslie <[email-masked]>
Date: Fri, 15 Apr 2016 14:56:47 -0400

JORDI PALET MARTINEZ <[email-masked]> wrote:
> A few years ago,

   Thank you for stipulating "a few years ago". Spammers have learned
a lot in the last few years.

> I???ve managed to get a customer out of spamhaus, despite having sent
> a SPAM because a bot, etc.

   In this case, there is _no_ evidence of a bot among my users.

> I was able to find all the info about how to proceed in their web
> site, apply to clean, etc.

   When is the last time you tried?

   Spamhaus has become more paranoid; and several features of their
website aren't functioning well right now. (Not to mention their preference
for users blindly enabling all javascript...)

> Same with other similar DNS-BLs

   Actually spamhaus has a better-than-average reputation. It is _not_
the "same" with the average DNSBLs.

> I think if you???re ???clean??? you should have not problem,

   "clean" by whose definition?

   Nowadays, it's not even a publicly-available definition!

> and we can choose which DNS-BL to apply.

   I refuse to feed a flame-war here; except to say we _won't_ reach
a useful rough-consensus without excluding too many contributors (and
probably won't reach rough-consensus at all).

> If we have from the community negative reports about bad-behaviours
> from any of those DNS-BLs for example.

   Again, how much are you contributing to the costs of what you ask?

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 15 Apr 2016 21:45:37 +0200

I’ve cleaned up bad customer records at several DNS-BL last july, and it worked.

I’m not sure to catch your question about the cost: I think the cost of thousands of IETF subscribers time to get SPAM from IETF exploders is much higher that the cost of using DNS-BL to reject posters that have been black listed.

Saludos,
Jordi

---

From: Benson Schliesser <[email-masked]>
Date: Fri, 15 Apr 2016 17:04:24 -0400

[email-masked] wrote:
> still works well enough, 

First, let me say that I agree with the above statement inasmuch as it concerns external blacklists for filtering IETF mailing lists. But I'm not so sure that I agree with it in a broader sense. I'm saying this as the person whose email address is in the From header of the spam email that started this thread.  :(

The spam message in this case did not originate from any client or host under my control. It did not transit via any of my mail relays. It was a forgery - it spoofed my email address in the From header, and unfortunately happened to match it up with a To header addressing an IETF mailing list to which I'm subscribed. 

For whatever it's worth, this has been going on for a while. I've been getting bounces, moderation notices, etc, for people and lists I never even knew existed. I'm not sure how the originating software harvested my email address, how it's controlled, etc, but it does seem to be some kind of distributed malware or botnet that takes advantage of a specific mail client. (I have further speculation about this, but I'll save that for another venue.)

In an effort to do something about this (in addition to fruitless attempts at getting help from various abuse@ teams) I've tried to configure DMARC, DKIM, and SPF for my sending domain. Unfortunately the IETF mail servers don't seem to pay attention to this, and spoofed messages still get relayed. Further, because the IETF mailing lists don't perform sender rewriting, legitimate messages were being thrown away by list members' mail servers that do respect SPF. The (hopefully temporary) fix has been to add the IETF mail servers to my domain's SPF record - which results in false negatives instead of false positives. 

If any experts have advice on how to fix this better, please teach me. I'll buy you many drinks, chocolates, or whatever makes you happy! 

Otherwise the only fix that I can imagine is for the IETF to start opportunistically filtering list message submissions based on DMARC, SPF, and DKIM, as well as performing sender rewriting in the list software. Like most things, I imagine the subscribers on this list have opinions about this - and I'd be glad to hear them. 

Thanks,
-Benson

---

From: Dick Franks <[email-masked]>
Date: Fri, 15 Apr 2016 23:22:46 +0100

On 15 April 2016 at 19:52, <[email-masked]> wrote:
[snip]

> twiddle things beyond that.

So what needs to be done to make it happen?

---

From: Jared Mauch <[email-masked]>
Date: Fri, 15 Apr 2016 18:33:30 -0400

> On Apr 15, 2016, at 2:56 PM, John Leslie <[email-masked]> wrote:
> 

I’m reminded of a recent discussion on another list about how to turn off
IPv6 but just for google because the users were infected with malware and
got CAPTCHAs. The abuse in v4 is quiet, but when the hosts moved to dual-stack
and IPv6 capable it became obvious.

The provider blamed google and wanted to know how to disable IPv6 for google 
only.

DNSBL/RBL are a part of life on the internet in the past 20 years.  You don’t
deal with abuse at your own peril, as once you’re the noisiest abuser and added
you generally have a *lot* of work to clean up.

Having worked at places that got corporate mail servers added to DNSBL as a
business response to not terminating people for AUP violations before, this is
hard to explain and deal with.

I likely didn’t see the messages on the old list due to it matching a known
message pattern that is blocked.  I know everyone wants @ietf lists to be
sufficiently promiscuous to have a low barrier to participating, but 
we must perform some basic security operations to block them.

Regarding locking the lists?  I’m all for that after IETF closes
out the venue contract/payments.  It should be a mechanical operation
that coincides.  This way if there is a venue problem or something specific
those at the meeting can discuss, otherwise the general public doesn’t get
spammed with details.

- Jared

---

From: "John R Levine" <[email-masked]>
Date: 15 Apr 2016 19:46:38 -0400

> The spam message in this case did not originate from any client or host under my control. It did not transit via any of my mail relays. It was a forgery - it spoofed my email address in the From he…

Yeah, this is a new trend, crooks harvest address books and then do 
(from,to) pairwise spamming to take advantage of the common trick of 
whitelisting addresses in the recipient's address book.

If you're seeing a lot of forgery, SPF, DKIM, and DMARC will help 
somewhat, but since DMARC famously can't tell the difference between 
forged spam and mailing lists, I wouldn't turn on any DMARC policies. 
History suggests that in a while the bad guys will buy a new spam list and 
your bounces will drop back to normal.  FWIW I've been using my iecc.com 
address since 1993 and my taugh.com address since 2002, both have been 
scraped out the wazoo but with normal filtering both remain quite usable.

> Otherwise the only fix that I can imagine is for the IETF to start 
> opportunistically filtering list message submissions based on DMARC, 
> SPF, and DKIM, as well as performing sender rewriting in the list 
> software. Like most things, I imagine the subscribers on this list have 
> opinions about this - and I'd be glad to hear them.

Given that we've seen only one or two spams of this sort leak through, I'm 
not inclined to do anything about it.  An interesting thing to do would be 
to instrument the mail, do the various DNSBL, SPF, DKIM, and DMARC checks 
on incoming mail and log the results in the message headers.  Then we can 
gather data to tell us what would happen if we used them to filter.

On my smallish system, I use a few conservative DNSBLs to block mail, 
which knocks out about 2/3 of it, then SPF and DKIM as part of the 
spamassassin score.  I check DMARC but don't do anything beyond logging it 
except for a handful of high risk domains like paypal.com where DMARC 
failure almost always means phish.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.