Subject: [Asrg] IPv6 and the SPAM problem

From: Jeff Silverman <[email-masked]>
Date: Sat, 15 Jan 2005 21:20:40 -0800

This may come under the category of "dumb questions" but I haven't seen 
the answer in any Google search I've tried so I guess I will ask the humans.

Does the wide spread adoption of IPv6 help solve the SPAM problem in any 
way?  I am learning about IPv6 because software under development at my 
work place uses IPv6 and IPv4.  IPv6 is supposed to have security 
features built in to it.   My thinking is that IPv6 ought to make it 
easier to identify the true sender of a mail message, or at least the 
originating MTA.  On the other hand, since SMTP has to work over both 
IPv4 and IPv6, maybe that ability doesn't buy us anything.  A Bad Guy 
can simply continue to use IPv4 for as long as his or her ISP will them 
get away with it.   But what happens after the ISPs require IPv6?  Will 
we ever get to the point where IPv6 is required?

I asked my ISP about their transition plans - the tier one person said 
IPv WHAT? the tier two person said talk to the tier 3 person and the 
tier 3 person said that they will transition when their customers demand 
it.  But none of their customers demand it because it isn't offered.  
Outside of north America, I am told that IPv6 is more common - how can I 
test that?

Sorry if these questions sound naive.

Jeff

-- 
Jeff Silverman
924 20th AVE E
Seattle, WA, 98112
[email-masked]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Sun, 16 Jan 2005 01:19:02 -0500 (EST)

> Does the wide spread adoption of IPv6 help solve the SPAM problem in
> any way?

What's the SPAM problem?  I wasn't aware Hormel had any problem with
it.  If you mean its confusion with spam (a confusion I've seen a lot),
no, I don't think IPv6 will help significantly.  [If this paragraph
confuses you, hint: SPAM is a trademark.]

For the moment, IPv6 helps with spam a little, in that v6 connectivity
is rare enough that if you get mail over v6 it is significantly less
likely (exactly how much less likely will, I'm sure, vary) to be spam
than mail over v4.  (This is at least in part because most of the
zombie army machines have no v6 connectivity.)

As v6 gains wider adoption, of course, this advantage will fade.

> On the other hand, since SMTP has to work over both IPv4 and IPv6,

SMTP has to work over both v4 and v6 in that changes to SMTP that break
either one are essentially nonstarters.

On the other hand SMTP does not have to work over both v4 and v6 in the
sense that there is nothing requiring a dual-stack mailserver to accept
port 25 connections over both protocols

> Outside of north America, I am told that IPv6 is more common - how
> can I test that?

Ask people who've been there? :-)

I spent six months in Norway, working for Universitetet i Tromsø, in
Norway.  The University arranged a netlink for me - and it was v6-only.
(I got a rather sharp lesson in how many of my networking tools were
not v6-ready!)  Yes, I would say v6 is rather more common outside North
America.  In North America, I would expect to get stuck behind a NAT
box instead.  (I would much rather have the v6 netlink.  But then, I
rather loathe NAT.)

My North American upstream *still* doesn't have their own v6 space;
they're using a chunk of 6bone space.  (This matters to me both because
it means slow performance and more points of failure and because it
means no reverse DNS for my v6 addresses.)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: John Levine <[email-masked]>
Date: 16 Jan 2005 06:37:31 -0000

>way?

No.  Despite occasional rumors to the contrary, we don't have any
trouble figuring out what IPv4 address each message comes from now,
but knowing the addresses is only a small part of dealing with spam.

>IPv WHAT?

That's my answer, too.  Whatever problem IPv6 is supposed to solve
isn't anywhere near bad enough for us to make it worth dealing with
the hassle of upgrading everything to IPv6, and particularly for
backbone routers, the hassle and costs are substantial.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: Devdas Bhagat <[email-masked]>
Date: Sun, 16 Jan 2005 12:15:31 +0530

> features built in to it.   My thinking is that IPv6 ought to make it 

IPv6 has specific features built it which are currently available in
IPv4 as VPNs. This, however, adds nothing to preventing/migitating the 
application level attack that spam is.

> originating MTA.  On the other hand, since SMTP has to work over both 

The originating SMTP sending host is easily identified (TCP is
stateful). However, for many organisations, blocking on layer 3 or layer
4 is simply not acceptable. That lack of acceptability leads deep into
filtering territory and a large proportion of the costs associated with
spam.

In short, IPv6 adoption will do nothing to stop worms, viruses, spam and
other application layer attacks.

IPv6 does help in providing an encrypted stream built into the packet
layer itself. Also, some people think that the sheer volume of IP space 
available implies that script kiddies being able to portscan and easily
locate hosts will find their work a lot harder. I think that all that it
implies is that a lot more 0wned hosts will portscan smaller ranges of
IP space, and scans will take slightly longer.

Devdas Bhagat

---

From: Laird Breyer <[email-masked]>
Date: Sun, 16 Jan 2005 16:51:54 +1000

> but knowing the addresses is only a small part of dealing with spam.

My (very limited) understanding is that IPv6 offers a significantly
expanded address space. Such a large address space could in principle be
subdivided in much more complex ways than we have now. For example,
ISPs might be able to subdivide their allotted space in standard ways
according to service and type of customer (assuming such a standard
was developed etc). This might make IPv6 address analysis and
filtering much more powerful (e.g. all residential customers would have
a "residential" flag embedded in their IPv6 address etc).

I don't think IPv6 would help with anything requiring content analysis.

-- 
Laird Breyer.

---

From: James Lick <[email-masked]>
Date: Sun, 16 Jan 2005 15:40:20 +0800

Devdas Bhagat wrote:

>
>Also, some people think that the sheer volume of IP space 
>locate hosts will find their work a lot harder.
>

The flip side to this is that more IP addresses means it will be more 
likely that ISPs will give endusers a range of IP addresses instead of 
just one as they typically do now.  Most people get around this by using 
a broadband router with NAT capability.  This also acts as a fairly 
effective firewall, but most people get one so they can hook up multiple 
computers, not for the added security.  If that requirement is no longer 
present, this could mean more enduser computers directly connected to 
the net with no firewall, and more hosts that can be broken into.

-- 
James Lick -- 黎建溥 -- [email-masked] -- http://jameslick.com/

---

From: Seth Breidbart <[email-masked]>
Date: Sun, 16 Jan 2005 16:43:03 -0500 (EST)

> Does the wide spread adoption of IPv6 help solve the SPAM problem in

Indirectly, a little.

It gets much harder to scan IP space for zombiable machines when that
space is 128 bits wide than when it's 32 bits wide.

Seth

---

From: Seth Breidbart <[email-masked]>
Date: Sun, 16 Jan 2005 16:43:03 -0500 (EST)

Indirectly, a little.

Seth

---

From: Tony Finch <[email-masked]>
Date: Mon, 17 Jan 2005 11:56:59 +0000

>space is 128 bits wide than when it's 32 bits wide.

People who run botnets don't have to scan for zombies. They identify
themselves by joining IRC channels. If anything, the larger address
space of IPv6 will make things worse.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
NORWEGIAN: BASIN IN NORTH, SOUTHERLY OR SOUTHEASTERLY 5 TO 7, VEERING
SOUTHWESTERLY 6 TO GALE 8 FOR A TIME. SHOWERS, BECOMING WINTRY AT TIMES.

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 17 Jan 2005 09:05:46 -0500

-----BEGIN PGP SIGNED MESSAGE-----

Tony Finch wrote:
| Seth Breidbart <[email-masked]> wrote:

|>It gets much harder to scan IP space for zombiable machines when that
|>space is 128 bits wide than when it's 32 bits wide.

| People who run botnets don't have to scan for zombies. They identify
| themselves by joining IRC channels. If anything, the larger address
| space of IPv6 will make things worse.

Zombiable != "Zombied".  Seth should really have said "scan for
[compromisable|insecure|open proxy|open relay et. al.] machines".

Minor nit: these days a lot of zombies self-announce using something
other than IRC on standard ports.  HTTP on port 80.  Etc.

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 17 Jan 2005 10:25:17 -0500 (EST)

Tony Finch <[email-masked]> wrote:
> themselves by joining IRC channels.

That's why I wrote "zombiable machines" and not "zombies".  Once
they're zombies, they report to their controllers.  But when they're
merely vulnerable, somebody has to find them and turn them into
zombies.  Some methods of doing that involve scanning IP space
(remember the studies showing it takes on average under 4 minutes or
so for a new machine to be found and zombied?)

Of course, other methods (email, web pages) don't require scanning, so
the problem isn't solved, just one set of methods of making zombies
becomes much harder.

> If anything, the larger address space of IPv6 will make things
> worse.

Do you mean because each machine will have its own IP address rather
than running through NAT in the typical home installation?  If not, I
don't see how.

Seth