Subject: RE: [Asrg] Whitelisting on Message-ID (Was Turing Test ...) honyp ot plug

From: "Sauer, Damon" <[email-masked]>
Date: Mon, 7 Apr 2003 08:50:09 -0400

<snip>
The problem iwth that is that, well, spammers aren't dumb. I was 
suprised at how quickly the spammer found my open relay. <snip>

 Did you happen to change or add a DNS record?
 Here is a very interesting experiment for you... Add an IP to DNS and have
it mail enabled. I saw this happen first hand as I was bringing a whole load
of new equipment online. The *moment* I added the a new record to DNS,
spammers and spam researchers were hammering my boxes.
 I believe they watch every addition to DNS. It was amazing to watch these
spammers come online and try to hammer systems that were not even in
production yet. They actually did me a favor, I didn't have to run any
mail-storms at these new servers... They were already getting plenty. *sigh*

Regards,
Damon Sauer

*****
"The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential, proprietary, and/or
privileged material. Any review, retransmission, dissemination or other use
of, or taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and delete the material from all
computers."
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 7 Apr 2003 08:31:00 -0600 (MDT)

> From: "Sauer, Damon" <[email-masked]>

> ...
> it mail enabled. 

What do you mean by "add an IP to DNS and have it mail enabled"? 
I assume you mean create an A RR for a new third level domain name,
set a new SMTP server to listening on the IP address in the new A RR,
and possibly create an MX RR for the name.

>                  I saw this happen first hand as I was bringing a whole load
> production yet.  ...

How do you figure that spammers are able to do that?  Don't the
gTLD namesevers for .com, .net, and .org contain several GBytes of
data?  Wouldn't keeping track of the A and MX RRs in only the third
level of .com, .net, and .org require keeping and watching for
changes in TBytes of data?  How many spammers have the bandwidth
or servers to do such things?

How were you able to reject the obvious and far more plausible
alternative explanations?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 7 Apr 2003 07:30:22 -0700

>  Did you happen to change or add a DNS record?

nope. It was around for a while, just not enabled for mail.

> production yet.

You should talk to the folks who do Intrusion detection. Between the 
spammers and the root kiddies, it's brutal out there. Here at home, I 
run two firewalls -- I use a software firewall on my server to DMZ it 
from the full net, and a hardware firewall to protect the rest of my 
home LAN from both the net AND the server, just in case. One of these 
days, I'll upgrade the DMZ to a hardware firewall, too.

---

From: Brad Spencer <[email-masked]>
Date: Mon, 07 Apr 2003 09:45:23 -0500

At 08:50 AM 4/7/2003 -0400, you wrote:
>The *moment* I added the a new record to DNS,

Looks like an idea that could be the basis of an experiment.

In addition you seem to be verifying that a new honeypot would be instantly 
effective at whatever you want that honeypot to do (trap tests, trap tests, 
deliver tests & trap spam, whatever.)  Leave your bedroom window slightly 
open and the same night a burglar climbs through - how hard is it to have a 
cop waiting?  Spammer behavior screams out for simple anti-spammer 
measures.  They need to be made very afraid of touching a new 
system.  They've had the advantage way too long - they should not be able 
to do relay (and proxy) tests for free.  Forget trapping spam - the real 
issue is that they're doing tests with no punishment (no painful results.)

---

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 7 Apr 2003 08:38:03 -0700

afraid of what?

rules require cooperation or policemen. What's your policeman here?

(given that this issue is a much smaller and less devastating issue 
than that of the root kiddies that own machines before the install 
process is finished, and given how little progress has been made at 
slowing that down, I don't see how the anti-spam world is going to make 
better progress here than the entire security world has...)

On Monday, April 7, 2003, at 07:45  AM, Brad Spencer wrote:

> Spammer behavior screams out for simple anti-spammer measures.  They 
> need to be made very afraid of touching a new system.  They've had the 
> advantage way too long - they should not be able to do relay (and 
> proxy) tests for free.  Forget trapping spam - the real issue is that 
> they're doing tests with no punishment (no painful results.)

---

From: Brad Spencer <[email-masked]>
Date: Mon, 07 Apr 2003 11:15:30 -0500

>afraid of what?

Getting whacked.  Wasting a spam run.  Getting exposed.

>rules require cooperation or policemen. What's your policeman here?

Right now the policeman is the spammer's ISP - give the ISP evidence of 
abuse by the spammer and the ISP just about has to act.  The honeypot 
operators tell the ISPs of the abuse - the ISPs act.

Later the ISPs could largely skip the honeypot step.  My honeypot was used 
as the SMTP test IP for hundreds to thousands of open proxy tests in the 
telesp.br domain.  How hard is it for telesp.br to see the connections made 
from all over their space, all to port 25 of the same IP in Wisconsin?  How 
hard is it for telesp.br to see the proxy connections to all their IPs, all 
(probably) from the same IP elsewhere?  Even if from a group of IPs the 
pattern should scream out.  If the ISP bothers to look.  They don't have to 
watch the traffic to their entire space: they could do subspaces, one at a 
time.

The advantage of using honeypots may be that the operator of the honeypot 
IP has an inherent right to monitor traffic to that IP, to examine it.  If 
the operator sees abuse traffic he has a right to report that abuse to the 
appropriate ISP, who can then use that evidence to enforce its own 
TOS.  The ISP may hve no right to actually examine traffic (look at 
packets) absent evidence of abuse.  I suspect the ISP has the right to 
watch for patterns of traffic that are characteristic of abuse and to 
follow through on those (contact the sender, ask for the right of examining 
packets.  Even if he refuses the sender knows he is not getting away with 
it completely undetected.)

>(given that this issue is a much smaller and less devastating issue than 
>that of the root kiddies that own machines before the install process is 
>finished, and given how little progress has been made at slowing that 
>down, I don't see how the anti-spam world is going to make better progress 
>here than the entire security world has...)

Partly the key is that the abuse is so small and is always the same.  It 
takes no particular skill to intercept port 25 traffic to an IP that should 
have no port 25 traffic.  Same for 1080, etc.  It's defensive script-kiddy 
tactics.  It can be less skilled than script-kiddy tactics: download this, 
run this.  Bang! You are a honeypot operator.  Jackpot can report to a 
central server - configure Jackpot to run that way and a whole flock of 
honeypots can be run by people that only vaguely understand they are 
helping fight spam.

As to the security world, they seem to emphasize making a system immune to 
being rooted (as opposed to making those that try to root systems feel 
pain.)  Causing pain here is a much harder task, real honeypots (and 
honeynets) are useful there but in this problem they are dealing at least 
some with hackers who are crafting their solutions as they go, who are 
finding new vulnerabilities.  Even there I'd guess that ISPs could be more 
creative in detecting attempts, particularly from script kiddies: if 
there's a new exploit for a vulnerability on port xyz then watching traffic 
to port xyz should reveal anyone who is scanning through a space looking 
for a vulnerable port.  Do ISPs do that or do they just run around warning 
people to secure port xyz (if even that)?  It's no surprise that there's 
little progress.

---

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 7 Apr 2003 09:33:25 -0700

On Monday, April 7, 2003, at 09:15  AM, Brad Spencer wrote:

> Right now the policeman is the spammer's ISP - give the ISP evidence 
> of abuse by the spammer and the ISP just about has to act.  The 
> honeypot operators tell the ISPs of the abuse - the ISPs act.

If that were true, would the blackhole sites that exist today exist? 
why couldn't the blackhole sites simply report this to the ISP and 
expect the ISP to act? If this were true, any time we found an open 
relay, we could report it to an ISP and it'd be blocked at the ISPs 
firewall, right?

except it doesn't happen. So how does adding honeypots to the system 
make the ISP react to the data?

Spam isn't illegal, except in very limited ways in limited 
jurisdictions. And in reality, spam (like porn) is seen as a lucrative 
business by some companies. They've already decided to turn a deaf ear 
to complaints. How does this change that?

> As to the security world, they seem to emphasize making a system 
> immune to being rooted (as opposed to making those that try to root 
> systems feel pain.)

could that be because trying to "cause pain" (as in reporting them to 
ISPs and having the ISP react in some way) doesn't work?

---

From: Brad Spencer <[email-masked]>
Date: Mon, 07 Apr 2003 12:17:30 -0500

At 09:33 AM 4/7/2003 -0700, you wrote:

>If that were true, would the blackhole sites that exist today exist? why 
>couldn't the blackhole sites simply report this to the ISP and expect the 
>ISP to act? If this were true, any time we found an open relay, we could 
>report it to an ISP and it'd be blocked at the ISPs firewall, right?

The blackholes have open relay sites listed or have spam sources 
listed.  Neither, according to you, is an regarded as illegal or as an 
abuse by the ISP.  The honeypot is the abused IP - the spammers is trying 
to steal service form  an open relay and getting reported.  that is 
something the ISP should act on - it is abuse.

I'm comfortable in principle with blocking all open relays - the problems 
come in the details.  Better yet, block spam sources - don't worry why they 
are spam sources.  Again, the problems are in the details.  I'd favor a 
fairly rapid aging off of listed IPs - if they continue to be spam sources 
they'll get listed again real soon.  the detail is the identification of 
spam sources - it's labor intensive for many blocklists so they can't 
afford to have short listing lifetimes (if they wanted.)

>except it doesn't happen. So how does adding honeypots to the system make 
>the ISP react to the data?
>
>Spam isn't illegal, except in very limited ways in limited jurisdictions. 
>And in reality, spam (like porn) is seen as a lucrative business by some 
>companies. They've already decided to turn a deaf ear to complaints. How 
>does this change that?

That's partly my point.  spam may not be illegal (the ISPs can convince 
themselves of this even though spam is illegal in several states) but the 
abuse used to send the spam is illegal.  I get ISPs to act on the basis of 
the abuse, not on the basis that the abuse sends spam.  That may not appeal 
to purists (who want the ISPs to act strictly against spam) but it gets the 
job done.  For me it does happen.  uu.net acted on my information (as far 
as I can tell) way back when they were accused of ignoring 
complaints.  Maybe the complaints are accurate: I send powerful enough 
complaints that they can't be ignored.  Same with Michael Tokarev's Moscow 
honeypot (which had an associated web page.) uu.net had to be told more 
than once but as soon as they _got_ the message there were hits on the web 
page from a great many uu.net IPs, probably corporate ones.  Ultimately 
uu.net acted on the complaints.  They did learn to just do a refresh and 
find for themselves the uu.net IPs that appeared to be sending spam 
to/through the honeypot.   (It's "appeared to be" because Ralsky used an 
asymmetrical routing scheme so that the apparent spam sources were 
throwaway dialup IPs rather than the actual IP of the spam source.  That 
worked for Ralsky while the complaints were based on the spam after it 
reached a user.  It failed when the complaint was from a honeypot that had 
a live log on a web page.  He ran out of throwaway accounts on three 
different ISPs in one weekend.)

>>As to the security world, they seem to emphasize making a system immune 
>>to being rooted (as opposed to making those that try to root systems feel 
>>pain.)
>
>could that be because trying to "cause pain" (as in reporting them to ISPs 
>and having the ISP react in some way) doesn't work?

Sure could. I have no data; this is a topic for a different IETF group.  I 
have sometimes reported suspicious connection attempts to the ISPs and have 
sometimes gotten responses indicating they have acted.  I doubt that the 
regular practice is to report suspicious attempts - most just ignore them, 
I think.  Mostly I ignore them, for that mater.