Subject: Re: [Asrg] Software bashing [mostly OT, but on at the end]

From: Franck Martin <[email-masked]>
Date: Sat, 24 Jan 2009 08:55:12 +1200 (FJT)

for the second link, this is grey listing, so nothing new here

To be noted I see now that infected machines will send several times the same message to the same email.

So I think the spammers are now fighting greylisting, and greylisting is becoming less and less effective.

I kind of like the idea of OS fingerprinting, anyone has a working filter?

----- Original Message -----
From: "John Johnson" <[email-masked]>
To: "Anti-Spam Research Group - IRTF" <[email-masked]>
Sent: Saturday, 24 January, 2009 8:19:34 AM (GMT+1200) Auto-Detected
Subject: Re: [Asrg] Software bashing [mostly OT, but on at the end]

Franck Martin wrote:
> This seems an interesting thread and an interesting way of fighting spam.
>
> Can we get more info and stats on the correlation of spam and fingerprinting of the OS?
>
> We are a research group after all.
>
> Now what happens to all the small businesses that use MS-Exchange to send email?
>   

Please take a look at the following paper - it appears it would impact
MS-Exchange less than you would imagine.

http://www.sans.org/reading_room/whitepapers/email/zombie_profiling_with_smtp_greylisting_33008

for a working sendmail specific milter example, I found this interesting:

http://www.elandsys.com/scam/

_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: "John Johnson" <[email-masked]>
Date: Fri, 23 Jan 2009 15:15:12 -0600

Franck Martin wrote:
> I cannot get to the first link
>   
   My apologies, sent attachment off-list.
    
> To be noted I see now that infected machines will send several times the same message to the same email.
  That's one of the points in the paper - an infected bot will attempt
to send From: many different
   addresses without retrying the initial  To: target. It'll happy
provide many domains that it's
   from.
> So I think the spammers are now fighting greylisting, and greylisting is becoming less and less effective.

  It would appear that OS fingerprinting WITH greylisting is an
effective tool to research. It may be
  one of those short term bandaids, but worthy of looking at.

---

From: Rich Kulawiec <[email-masked]>
Date: Sat, 24 Jan 2009 07:38:07 -0500

On Sat, Jan 24, 2009 at 08:55:12AM +1200, Franck Martin wrote:
> To be noted I see now that infected machines will send several times
> the same message to the same email.  So I think the spammers are now
> fighting greylisting, and greylisting is becoming less and less effective.

Somewhat, but not entirely.  One thing that greylisting still does is buy
time for various DNSBLs and RHSBLs to note abuse and create an entry.
Granted, this is a roll of the dice, but if the greylisting period is
sufficiently long (which is probably appropriate for some classes of
hosts) then it sometimes works.  (And when it doesn't?  It may result
in a FN.)

> I kind of like the idea of OS fingerprinting, anyone has a working filter?

The one I provided a link to:

	http://use.perl.org/~merlyn/journal/17094

is an example.  You'll need a packet filter (like pf) that has the capability
in order to use it, or something similar.

---Rsk

---

From: John Levine <[email-masked]>
Date: 24 Jan 2009 17:41:32 -0000

>is becoming less and less effective.

I looked at my greylist logs for the past month.  It shows 4911
previously unseen IPs that retried, and 51,348 that didn't.  I'd say
that a technique that turns away 91% of the mail it touches is still
pretty effective.

The month before that the numbers were 4707 and 41,487, for about 90%,
so in the short term at least, it's pretty consistent.  I have data
back to May, could crunch it if people wanted.

R's,
John

---

From: Franck Martin <[email-masked]>
Date: Sun, 25 Jan 2009 09:13:15 +1200 (FJT)

Yes it is still pretty much effective, but should we wait for it to become less effective, or think of a better scheme or simply improve it?

----- Original Message -----
From: "John Levine" <[email-masked]>
To: [email-masked]
Sent: Sunday, 25 January, 2009 5:41:32 AM (GMT+1200) Auto-Detected
Subject: Re: [Asrg] greylisting, was Software bashing

R's,
John

---

From: John Levine <[email-masked]>
Date: 24 Jan 2009 22:23:10 -0000

> Yes it is still pretty much effective, but should we wait for it to
> become less effective, or think of a better scheme or simply improve
> it?

In 2005 when I wrote my CEAS paper, 16% of greylisted IPs retried.
Now it's about 10%, which means that if anything, it works better than
ever.

Given that we don't have infinite resources, I see little reason to
spend more time on greylisting.

R's,
John

---

From: Rich Kulawiec <[email-masked]>
Date: Sat, 24 Jan 2009 17:34:48 -0500

> spend more time on greylisting.

I concur with John on this.  The one refinement I have fiddled with
is the use of greylisting behavior to slowly classify connecting systems
as known-friendly, known-hostile, and can't-tell, with different levels
of service provided to each.  But I'm not at all sure that the payoff
for all this work compensates for the effort.

---Rsk