Subject: Re: [Asrg] honey pot plugged

From: "John Fenley" <[email-masked]>
Date: Wed, 09 Apr 2003 13:43:48 -0600

I just want to address 1 thing you said:

>From: Brad Spencer <[email-masked]>
[tons of stuff]
>Pretty soon the spammers run out of IPs to test...
[tons more stuff]

This part of one of your sentences seems to be the basis of your whole Idea.
When the spammers run out of IP addresses to test they will have found every 
real open relay as well.

Kee Hinckley  Wrote:
"I posted an easy way to get around honeypots the other day -- regular 
tests. Easy to do using a small array of captive accounts, hard to catch."
and:
"That's not even an arms race, that's throwing snowballs at a tank."

I agree, this does nothing to solve the real problem:
Why do people send spam, and how do we make them stop SENDING it?
If we answer this question, we win. The contest is over.

John Fenley

_________________________________________________________________
Tired of spam? Get advanced junk mail protection with MSN 8. 
http://join.msn.com/?page=features/junkmail

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: matthew richards <[email-masked]>
Date: Wed, 9 Apr 2003 13:18:33 -0700

>Why do people send spam,

because it costs them next to nothing and a marginal percentage of 
lamers respond to their solicitations.

>and how do we make them stop SENDING it?

we A: take away their incentive (profit)
we B: develop a new system or supplement the current system in such a 
way that it allows email users to effectively and efficiently block, 
filter or bypass spam.
we C: analyze spammer strategy and develop passive or aggressive 
countermeasures.
we D: ________________________

---

From: Brad Spencer <[email-masked]>
Date: Wed, 09 Apr 2003 15:24:04 -0500

At 01:43 PM 4/9/2003 -0600, John Fenley wrote:

>When the spammers run out of IP addresses to test they will have found 
>every real open relay as well.

Yes.  If they'd stand pat and just use the ones they know then honeypots 
would be very powerless, other than honeypots slipped in in place of real 
open relays.  You make an excellent point.  I'd have pushed honeypots more 
strongly earlier if I'd really known the extent of their testing that seeks 
to find new open relays.  Catch 22: to know I need honeypots.  People could 
look at their logs and report tests but they don't, and didn't when I 
asked.  Most people who do say something about tests seen in their logs say 
they are there.

Then Michael Tokarev put up his honeypot and was trapping Ralsky spam 
within a few days, "The Mushroom guy" put up his and was trapping spam at 
an average rate well over 1/2 million recipients/day - the indication was 
that spammers still scan for open relays, at least overseas.  I can't know 
whether the relay tests I capture are scans or are something else - too 
little data.  But there's been over 300 tests on that one system so far 
this year - enough to make it reasonable to suspect the spammers still 
scan.  That system was SMTP dead from mid-November to Jan 3.  Tests showed 
up instantly once SMTP was again running.  I think some must be scans.

See my problem?  There's a persistent East-coast tester and an obnoxious 
West-coast tester (among others), and I can't tell if they are treating me 
special or not, because I have no other data points.

But you're right: if they take their list of known relays and never try to 
add to it the only way to get a honeypot going would be to substitute it 
for a real open relay.  Fun, worthwhile, not likely to be a killer, back 
burner at best.

That's open relay honeypots.  I think they heavily scan for open proxy 
honeypots.  I've never run one but I can see many advantages to the proxy 
honeypot (chief being that nowadays it's the one most likely to be 
contacted directly from the spammers system.)  The thing I push most is the 
idea: go after the abuse done to send spam.  That's where attention would 
be valuable, to my mind.  As an  individual I have little chance to do 
anything like an ISP-level approach,  have little influence to get an 
ISP-level approach going.  ASRG has the chance and the influence, if it is 
determined to be worthwhile.

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 9 Apr 2003 16:49:26 -0400 (EDT)

> determined to be worthwhile.

Can I ask why open proxies are considered to be such a problem? It would
seem, that since no legitimate mail would come from them, they are perfect
candidates for the RBLs. Are they not fairly easy to detect and confirm?
Why wouldn't they be in any list of open relays, since that is one of the
things they do? Does legitimate mail come from them? That seems unlikely
to me. Is the problem that they are short lived? But why would that be a
problem? 

I have a feeling the answer must be obvious, but perhaps there are several
of us here who have missed the obvious.

---

From: Brad Spencer <[email-masked]>
Date: Wed, 09 Apr 2003 15:58:45 -0500

>of us here who have missed the obvious.

A proxy could be on a real mail server.  I squawk a lot about collateral 
damage but even I can tolerate blocking an IP that has an abused open proxy 
but that is how real email could come form a system with an abusable open 
proxy.

One thing about honeypots is that they work against spam, not spam 
sources.  If the honeypot weren't there a DNSBL that listed every open 
relay or open proxy, whichever pertains to the spam in question, would 
block the spam anyway.  For that part of the honeypot function there's no 
real gain.   There are also sites that don't use DNSBLs.  The honeypot 
protects those, if the spam first comes to the honeypot.  That means fewer 
marks see the spam, fewer respond to the spammer, he gets a lower 
return.  That's part of the goal, in the short term.  Long term you want to 
so corrupt the open whatever picture that the spammer can't recognize true 
open whatevers.

Plus you may find other ways to screw with the spammer using the honeypot.

---

From: [email-masked] (Justin Mason)
Date: Wed, 09 Apr 2003 14:48:11 -0700

> to me. Is the problem that they are short lived? But why would that be a

Yes, they are easy enough to detect -- but folks do not take kindly to
open-proxy probes at SMTP connect time, so testing is not always viable.

Also some proxies are getting sophisticated, using unusual ports -- so
a full port-scan may be necessary at times.

--j.

---

From: Brad Spencer <[email-masked]>
Date: Wed, 09 Apr 2003 17:05:13 -0500

>a full port-scan may be necessary at times.

You are, I hope, aware of the Trojan Horse problem:

http://groups.google.com/groups?selm=aqhj96%2429tp%241%40FreeBSD.csie.NCTU.edu.tw&output=gplain

Do any of the "unusual" ports you mention correspond with those listed in 
the posting, if I may ask?

---

From: [email-masked] (Justin Mason)
Date: Wed, 09 Apr 2003 15:30:54 -0700

> the posting, if I may ask?

That's the Jeem trojan, I've heard of that alright.   However, I don't
know for sure what ports might be a good example, since I'm just an avid
user of the DNSBLs in question, not one of the folks writing the testing
tools ;)

There's a good chance that the reason unusual ports are showing up is,
indeed, because of Jeem-infected machines, rather than the traditional
AnalogX style of default-open proxy software.

--j.