Subject: Re: draft-schlitt-spf-classic-01.txt

From: Dean Anderson <[email-masked]>
Date: Tue, 7 Jun 2005 21:59:45 -0400 (EDT)

Alan, I think you misrember. And looking at www.striker.ottawa.on.ca just
now, I see you've been subject to reverse ping floods as well.  The
reverse attacks you describe are most telling. These happen when people
send pings with your IP address as the ICMP source IP address. That's why
you get people calling up and saying "your machine is attacking me". They
just see the source IP address in the ICMP packets.  But in fact, those
packets originate from the botnet machines. The same ones attacking your
SMTP port. Thats what botnets do.

Your "spam" problem was first reported in January 2002:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++
Date: Wed, 30 Jan 2002 10:53:15 +0000 (UTC)
From: Miquel van Smoorenburg <[email-masked]>
Reply-To: [email-masked]
To: [email-masked], [email-masked]
Subject: Re: Private email to me

    [ The following text is in the "iso8859-15" character set. ]
    [ Your display is set for the "ISO-8859-1" character set.  ]
    [ Some characters may be displayed incorrectly. ]

In article <[email-masked]>,
 <[email-masked]> wrote:
>  I am no longer accepting private email to my 'striker.ottawa.on.ca'
>domain.  For reasons why, see:
>
>  http://www.striker.ottawa.on.ca/
>
>  The domain is on *all* of the spam lists from what I can tell, and
>is receiving 400K+ spam emails a day.  Even dropping the connection
>after the "RCTP TO", and not accepting the message body, it's still
>too much.  The spam is using 10Mbytes per HOUR of bandwidth, which I
>can't afford.
[...]
+++++++++++++++++++++++++++++++++++++++++++++++++++++++

This early exchange was significant:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++
> So, Alan: Who have you annoyed?

  Lots of people, I think.  I've had the domain since 1996, or so.
I've always been vocal and opinionated.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++

See http://www.striker.ottawa.on.ca/

Other messages of the time noted that back then this IP was hosted with
Ottawa Carleton Unix Corp (AS26227). I see its currently with UUnet. 

BTW, A medium sized ISP with perhaps 20,000 users receives about 400,000
messages per day (spam and ham). Probably should have a T3 or OC3 for that
kind of volume. 

A medium sized colo center would host several hundred such domains as
striker.ottawa.on.ca. A virtual host center would probably have several
dozen to perhaps a hundred+ domains on a single machine.  Plainly, neither
a colo nor virtual host datacenter going to be able to handle 400K PER
DAY, PER obscure DOMAIN.

It is simply not credible to say that 400K messages per day is normal for
an obscure (no offense) one-person domain: Its an attack. There are other
ICMP-based attacks on your your personal domain as well. In other messages
you describe hundreds or perhaps thousands of hosts doing this. You aren't
the first person to experience such attacks. You're just the first person
to claim (rather obstinately) that they aren't one (or a few users 
with a botnet) as this quote of shows:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++
  And the IP address of *my* machine has changed, along with all of
it's upstream providers.

  The issue *is* really that there are lots of different spammers
attacking me.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++

While you _insist_ that spammers are just routinely spamming you with an
aggregate 400K messages per day, there is no credible reason to think
that. Instead, you are tangling with a botnet.  See
http://grc.com/dos/grcdos.htm for an interesting read on botnet attacks.
And yes, they do "spam"/"mailbomb" you.

There are successful strategies for dealing with botnet attacks. GRC is
one interesting way, reporting abuse is another. Reporting abuse
eventually causes them bots, and that causes them to risk getting caught,
and causes them to lose resources (in the form of bots).  Your way, of
trying to pursue anti-spam techniques isn't one of the successful
strategies.

There is no help for you in SPF.  If you get 400K messages per second
without SPF, you will still get 400K with SPF. As you pointed out in 
November, 2002:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++
  The bandwidth number I quoted in my previous email worked out to
~2-5 gigabytes a month, for:

EHLO . . . 
MAIL FROM: spammer
RCTP TO: [email-masked]
<hangup>

  If the messages had been delivered, the total data transferred would
go up by a factor of 10-100 times.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++

SPF isn't going to reduce that. Banning spam isn't even going to reduce
that: It isn't commercial spammers doing this. In fact, __nothing__ other
than tracking down the botnets will reduce that.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 08 Jun 2005 13:14:21 -0400

Dean Anderson <[email-masked]> wrote:
> now, I see you've been subject to reverse ping floods as well.

  Not surprisingly, you're missing a key point of information.  This
leads you to erroneous conclusions.

  FYI: At one point, I added FW rules to the box so that port 25 was
open for 5 of my closest friends, and would send ICMP Port
unreachables to everyone else.  While this may not have been the best
thing to do, it caught many idiots.

  "port unreachable" != "reverse ping flood"

> These happen when people send pings with your IP address as the ICMP
> source IP address. That's why you get people calling up and saying
> "your machine is attacking me".

  Port unreachables are sent when their SMTP server tries to connect
to mine.  The flood of SMTP sessions from compromised boxes leads to
floods of returning "go away" messages from my box.  If they're
idiots, they quickly conclude that I'm attacking them.

  This has happened not once, not twice, but multiple times.  In every
case, I was in contact with the admins of the compromised box, and
once I convinced them to turn off SMTP, the spam delivery attempt
stopped, and therefore the ICMP messages from my box stopped.

  And once they fixed the problem, it didn't re-occur from their site.

> But in fact, those packets originate from the botnet machines.

  In fact, you're wrong.  The packets in question originated from MY
machine.  I know this, you don't.

  Please stop, Dean.  It's embarrassing.

  Alan DeKok.

---

From: Dean Anderson <[email-masked]>
Date: Wed, 8 Jun 2005 16:28:10 -0400 (EDT)

>   "port unreachable" != "reverse ping flood"

You have no basis for concluding that their recieving "ICMP port
unreachable"  means that they actually tried connecting to you.  This 
packet is easily forged.

So there is no reason to think they are trying to send you spam. I did see
that you thought they were, __based on their logs__ (_Their_ logs have no
relevance to your claim)

Plainly, __their logs__ of ICMP unreachables don't mean they sent you
connections. You can't be that stupid. This is obstinancy.

If __they__ were sending you thousands of spam connections, and getting
thousands of port unreachables back, they would first notice the
additional CPU load on their server due to the many processes attempting
to connect to you. They would next notice the equally large number of TCP
SYN packets coming from their server.  Apparently, they didn't find this, 
and so the contacted you.

Now possibly one person would notice Unreachables, and not look to see if
they were sending SYNs.  But you indicated that not just a few, but _MANY_
people made this same "mistake". The law of numbers suggests that many
people would not make such a simple mistake.

Further, To prove your claim, __you__ would need logs indicating that they
actually tried connecting. Where are the SYNs from their server?  But you
have no such specific logs, or don't claim you do in those cases.

Just another demonstration of bad logic and irrationality.

But once again, you are ___still___ getting ___ABUSE___ 

This is not routine spam, as you keep insisting. Anti-spam techniques will
not stop people whose goal is abuse.

Spammers aren't calling you complaining that you should not to send them
ICMP unreachables.  What lunacy 

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Wed, 8 Jun 2005 16:48:54 -0400 (EDT)

> machine.  I know this, you don't.

Lets stick to the facts that were posted in 2002, so that you don't change
the facts as we go along.  If your description of facts in 2002 was
insufficient, then I am fully justified in not believing you, and drawing
conclusions from the facts you presented, regardless of what the actual
god-known truth of the matter is.

You didn't indicate that your machine was sending this traffic on your web
page, in 2002.  You just indicated that they claimed to have received
packets, and that you convinced them to send logs.  That fact that you
would need to convince them to send logs suggests you denied their claims
that you were sending these packets.  Otherwise, why would you want their
logs?

Your logic fails:  Recieving an ICMP port unreachable doesn't imply the
four things you listed:

=================================================================
Even worse, there have been a consistent trickle of complete shithead 
messages from alleged "sysadmins", saying "Your machine is attacking me!" 
When they're convinced to send firewall logs, they send logs which show 
them receiving 1000's of ICMP port unreachable messages. This says a few 
things: 

1. Their firewall is misconfigured. (Blocking ICMP's is wrong.) 
2. They're trying to send me spam, and complaining when they can't. 
3. They don't understand how networks work, or how to set up their 
machines. 
4. Words cannot describe their incompetence. 

In short, if you see your machine getting hammered by ICMP packets from 
this IP, it means you have to fix your system. Don't call me. Don't call 
my ISP. Don't make stupid threats about me trying to "hack" into your 
machines. If you do, then I will call the FBI (or whatever government body 
is intimidating to you), and inform them that you are a criminal hacker. 
They will believe me, not you. 
=================================================================

None of what you claim follows from the fact they got ICMP unreachables.

You'll tell the FBI they are criminal hackers?  The FBI will believe you, 
not them?

		--Dean

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 08 Jun 2005 17:09:11 -0400

Dean Anderson <[email-masked]> wrote:
> unreachable"  means that they actually tried connecting to you.

  As I said, how about watching the packets go out of my box?

> So there is no reason to think they are trying to send you spam.

  Other than the umpteen connections/s to port 25 on my machine.  No,
no reason to think they're trying to send me spam.

> and so the contacted you.

  I count at least 3 assumptions in that paragraph.

> people made this same "mistake".

  Read the web page.  It's "a steady trickle".  More than one, and
less than 10.

> have no such specific logs, or don't claim you do in those cases.

  I have the data, you don't.  I'm sorry that this upsets you.

> ICMP unreachables.  What lunacy 

  Exactly.  I never claimed that.

  At this point, I have to ask: Are you for real, Dean?

  Alan DeKok.

---

From: Dean Anderson <[email-masked]>
Date: Wed, 8 Jun 2005 23:18:15 -0400 (EDT)

>   As I said, how about watching the packets go out of my box?

1) Having an outbound packet rate, as you describe, doesn't indicate that
they sent you SYN packets. It is possible that your machine is
compromised, and that it really is attacking them.

2) It is possible that you received SYN packeets that weren't from them. 
Forged SYN packets are common type of attack.

3) Merely having an outbound ICMP packet rate doesn't mean that the
packets they got came from your system.

4) It is possible that their system is compromised.

All of these are more likely than your insistence that they are spammers 
asking you not to send them ICMP packets.

With this in mind, lete look again at your claims: (from 
www.striker.ottawa.on.ca)

**1. Their firewall is misconfigured. (Blocking ICMP's is wrong.) 

Blocking __all__ ICMP is probably wrong. There is only one ICMP packet
that shouldn't be blocked, and there is currently an attack which makes it
reasonable to block even that turn. So blocking the ICMP port unreachable
packet type is not wrong. http://www.av8.net/ICMPTypes.txt

**2. They're trying to send me spam, and complaining when they can't. 

This is just irrational.

**3. They don't understand how networks work, or how to set up their 
machines. 

Their machines are probably set up correctly. But if they aren't, you 
haven't shown any reason that they aren't.

**4. Words cannot describe their incompetence. 

The acts you attribute to them are entirely rational and show no
incompetence on _their_ part. 

Competence is the ability to solve common problems in your field of work.
A common problem for an IT professional might have to solve is analyzing
an attack.  What should a competent professional have done in Alan's
situation?  Lets look at what should happen:

Sysadmin calls Alan, and says: "Your system is attacking me"
Alan should say: "What makes you think that?"
Sysadmin says: "I'm getting loads of ICMP messages from your IP."
Alan should say: "What's your IP? I'll take a look"
Sysadmin tells him IP.
Alan grabs packets to and from that IP

[now we have some options, depending on what Alan finds]

Option 1: Alan found packets to/from that IP

  Option 1A: Alan found SYN Packets from their IP and ICMP packets to it
    Alan says: "I'm seeing SYN packets from your IP. Do you see that?"
    Option 1A1: Sysadmin sees it
      Sysadmin says: "Yes. Hmm. That's weird"
      Alan: "OK. Could you block SYNS to my IP until you fix it?"
      Sysadmin: "Sure".
    Option 1A2: Sysadmin doesn't see anything
      Sysadmin says: "No SYN packets here."
      Alan says: "Hmm. Somebody may be forging SYN packets from your IP.
           I'll contact my ISP and see if we can trace it down. In the 
           meantime, I'll block ICMP going to your IP.
      Sysadmin says: "Thanks for taking care of the problem"

  Option 1B: Alan found ICMP but no SYN Packets
    Alan says: "I'm just seeing ICMP packets to your IP. But that's
         strange; I don't see any SYN packets. Hmm. I seem to have 
         a compromise on my box. I'll block ICMP to your IP until
         I get it fixed."
    Sysadmin says: "Thanks for taking care of the problem"

Option 2: Alan didn't find packets to or from that IP 

  Alan says: "I don't see anything to or from your IP. It seems that 
       our IP has been forged in the ICMP packet."
  Sysadmin says: "Ok, thanks. I'll contact our upstreams to trace 
       the traffic. Thanks for you help."

So now we know what should have happened, lets postmotem what happened:

Alan said that no one should contact him because they are reciving ICMP
from his IP.  Alan says on his page that anyone contacting him about this
is incompetent. Alan says they are spammers complaining about his ICMP.
Alan says he convinced some to send him _their_ logs.  Their logs don't 
prove Alan's claims.

Indeed, none of Alan's claims are supportable.

Alan didn't go through any of the steps listed above; He didn't document
them. To demonstrate his own due diligence, he would need to report what
he found.

So, it Alan's competence that's in question. Not the competence of the
people who called him to complain about the ICMP packets apparently coming
from his IP address.

And as already shown, his claims about blocking ICMP are also incorrect.  
Alans failure to understand common practice reflects badly on competence 
as an IT Professional.

>   I have the data, you don't.  I'm sorry that this upsets you.

You don't make any claim that you gave them your logs. So I don't think
you did. Whether or not you actually have that data is irrelevant. You
didn't use it to make your case to them, and you can't make a rational
case without it.  I don't need to see your data to conclude that your 
argument is unsupported.

I'm not upset to not have your data. You just seem to be stretching the
assertion that nobody can make any conclusions without it. But that's just
wrong.  Deductions can be made, given what you have revealed.

>   Exactly.  I never claimed that.

You did, and you have been: Point 2 on your list:

  2. They're trying to send me spam, and complaining when they can't

Further, you also keep asserting that spammers are routinely spamming you,
and you deny my assertion that you are being abused by people who seek to
annoy you.

My assertion (since 2002) has been that this is an attack. It is not
"spam". It is meant to annoy you.

>   At this point, I have to ask: Are you for real, Dean?

You are the one pursuing an irrational position well beyond the point of 
making a credible claim. It is no longer credible to think that you belive 
what you say.

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 09 Jun 2005 12:30:52 -0400

> 4) It is possible that their system is compromised.

  When I talked with these people, the SYN's & ICMP's all stopped
after they claimed to have fixed their systems.

  This would lead any reasonable person to conclude that their system
was compromised (as I said), that the source and destination of SYN's
& ICMP's was exactly what they appeared to be (as I said), and that no
botnet was involved (as I said).

> [now we have some options, depending on what Alan finds]

  In those options, you leave out the one option I've been telling you
repeatedly is what happened: their machine really was compromised, and
all of the traffic was exactly as it appeared, with no botnets or
forgeries.

> To demonstrate his own due diligence, he would need to report what
> he found.

  I have no responsibility to show my logs to you, or to anyone else
on the planet.

> Whether or not you actually have that data is irrelevant. You
> didn't use it to make your case to them,

  I didn't need to.  They could independently verify for themselves
that their machine was compromised, was sending spam, and that their
machine was sending loads of TCP SYN's to my machine.  They aren't
spammers because they aren't *intending* to send spam, it's a
side-effect of their network misconfiguration.

  I'm surprised that the one realistic interpretation of the events is
the only one you cannot admit might have happened.

  I won't respond to the rest of your comments about competence and
credibility.  The evidence speaks for itself.

  Alan DeKok.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 10 Jun 2005 17:12:56 -0400 (EDT)

It is interesting what you skipped.

I didn't say you needed to show logs, but your coyness with the logs is,
well, interesting. But you do need to describe what happened, and what
steps you took. And you did describe it. However, the description isn't
sufficient to justify any of the conclusions you assert.  None of your 4
assertions hold water.

Whether you _talked_ to a few or not makes no difference. A few might have
been compromised. They all _might_ have been compromised. So what. That a
few are compromised doesn't mean _all_ were compromised.  Each has to be
handled separately.  It is quite reasonable for them to call you.  Yet you
assert it was unreasonable, and proof of their incompetence.  And I
_doubt_ very much that you were pleasant or reasonable with any of them:
You think they are spammers complaining about getting ICMP unreachables.

If you thought they were compromised, there would be no point in asking
them for logs. You would simply ask them to check to see if they are
sending you SYNs. But you didn't do that. No, you asked them to see their
logs: "what? I can't possibly be sending you unreachables. Send me your
logs."  Helpful? Hardly. But you wouldn't want to be helpful to a spammer
complaining about getting unreachables, now, would you? No.

And if several _were_ compromised and attacking the same machine (it would
take more than a few to generate the traffic you describe), it suggests
that they were exploited by a botnet.  When multiple sites are exploited,
and all attack the same host, that's a good sign of a botnet operation. So
your assertions that no botnet was involved is just completely, willfully,
obstinately unsupportable.  Botnet's change tactics once in while. That's
one reason you have to treat case separately. It may send SYNs today, and
forged packets tomorrow.

And there is _still_ no evidence that any of the people that contacted you
had any network misconfiguration.  To the contrary, your assertion that
blocking ICMP Unreachables means network misconfiguration is untrue.

Your railing against them is simply unreasonable and irrational.

But, of course, there is no way that you can be convinced you are wrong.  
Just like Chris Neill and many other ultra-radical extremists: You never
admit wrongness, no matter how overwhelming the evidence. Even when Chris
Neill was FIRED for his abuse and investigated by the FBI as a result,
Neill __still__ didn't think he was wrong.  Evidence of wrongness doesn't
get much more overwhelming than that.

So, there is little point in further discussion: You aren't or willing to
rationally address any issues. That's fine: Think what you want. But I
have to jump in once in a while to debunk such claims.

		--Dean