Subject: [Asrg] 2. Improving Blacklists and Reputation Services

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 09 Feb 2004 15:30:17 -0500

I would like to pose a question to the group. The IP address of the 
incoming MTA is the only sure thing that we possess today that cannot be 
easily spoofed (BGP attacks aside). There are numerous blacklist and 
reputation services out there that carry and store information about IP 
addresses. With an LMAP-type proposal like DRIP, this information can 
also be keyed by domain name.

All of this implies that reputation services such as blacklists will 
continue to exist. However, a major problem has been with these services 
is that they provide a binary yes/no answer. Many commercial ISPs would 
like to make the decisions themselves. Filters such as SpamAssasin would 
probably be better off basing data on a larger scale than a simple yes 
or no.

Taking all of this into account, I ask the following:
1. Is it feasible to develop a standard format and protocols for storing 
and quering data from reputation services?
2. Is it feasible for such format to be feature rich providing more data 
than a simple yes/no. Meng Wong of SPF proposed on his list a while back 
something like how many messages sent by MTA, how many were spam, etc., 
akin to what SenderBase does.
3. Can this be supplemented by accrediation formats and protocols?
4. Would any of this improve blacklists?
5. Would all of this reduce spam?

Feel free to forward this message to other lists, and NANAE.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"I ate your Web page. / Forgive me. It was juicy / And tart on my 
tongue." (MIT's 404 Message)
-------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matthew Elvey <[email-masked]>
Date: Mon, 09 Feb 2004 14:27:54 -0800

On 2/9/2004,Yakov Shafranovich sent forth electrons to convey:

> incoming MTA is the only sure thing that we possess today that cannot 
> be easily spoofed (BGP attacks aside). There are numerous blacklist 
> and reputation services out there that carry and store information 
> about IP addresses. With an LMAP-type proposal like DRIP, this 
> information can also be keyed by domain name.
>
> continue to exist. However, a major problem has been with these 
> services is that they provide a binary yes/no answer.

This is incorrect; several BLs already provide a variety of answers.
The reason many BLs provide a binary answer is that the software they 
run on only allows it (and can thereby be less resource-intensive). 1 
bit for all of IPv4 fits in RAM on many machines, especially if 
compressed...
Some that I've posited are:
SpamCop provide its spam/ham ratio.
Someone who used this IP [threatened to | did] sue me.
A spammer who used this IP owes me money. (payola.org)
The admins of this IP tell me they provide a free email service, but do 
their best to police their users.
The admins of this IP tell me they provide a free email service, but do 
their best to police their users.
The admins of this IP tell me they don't spam and agree to pay for any 
that is sent from this IP.

AHBL has 18 response codes listed at
 http://ahbl.org/responsecodes.php

> DDOS attacks on blacklists have shown than reliance on DNS might not 
> be such good idea. Other possibilities like P2P services might be 
> feasible. 

Some BLs have found effective ways to defend themselves, as well.

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 09 Feb 2004 17:34:05 -0500

> On 2/9/2004,Yakov Shafranovich sent forth electrons to convey:
...
> This is incorrect; several BLs already provide a variety of answers.

Would there be a value to creating a standard protocol and format for 
such data?

Yakov
-------

---

From: Matthew Elvey <[email-masked]>
Date: Mon, 09 Feb 2004 16:14:51 -0800

> Would there be a value to creating a standard protocol and format for 

My plate is full, but I think so.  Exact definitions of what an open 
relay, or a dial-up IP, or a spamming IP is differ, but a standard 
protocol and form could still be useful
http://mail-abuse.com/rbl+/ uses a bitwise binary scheme. 
I'd guess Paul Vixie/MAPS set the defacto standard of using 127/8 ips.

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 10 Feb 2004 00:23:01 -0500

> http://mail-abuse.com/rbl+/ uses a bitwise binary scheme. I'd guess Paul 
> Vixie/MAPS set the defacto standard of using 127/8 ips.

There's already a draft for both BCPs and protocols of DNSBLs.  But as 
you say, our plates are full.  Needs a document editor.

---

From: "Walter Dnes" <[email-masked]>
Date: Tue, 10 Feb 2004 01:06:16 -0500

On Mon, Feb 09, 2004 at 03:30:17PM -0500, Yakov Shafranovich wrote

> is that they provide a binary yes/no answer.

  There is no inherent binary limitation of today's de-facto DNSbl
implementations.  DNSbls have have approximately 16 million possible
responses in the 127.0.0.0/8 CIDR.  And furthermore, they can return
multiple records for one query (which is the querying software's
responsibility to handle properly).  Quite a few DNSbls have an
"aggregate zone", which can return multiple multiple values.  An example
is dnsbl.sorbs.net.  Here's a comment from my blocklist entries...

#        dnsbl.sorbs.net aggregate return codes are:
#   http.dnsbl.sorbs.net    127.0.0.2
#  socks.dnsbl.sorbs.net    127.0.0.3
#   misc.dnsbl.sorbs.net    127.0.0.4
#   smtp.dnsbl.sorbs.net    127.0.0.5
#   spam.dnsbl.sorbs.net    127.0.0.6
#    web.dnsbl.sorbs.net    127.0.0.7
#  block.dnsbl.sorbs.net    127.0.0.8
# zombie.dnsbl.sorbs.net    127.0.0.9
#    dul.dnsbl.sorbs.net    127.0.0.10
#badconf.rhsbl.sorbs.net    127.0.0.11
# nomail.rhsbl.sorbs.net    127.0.0.12

  Another example is zz.countries.nerd.dk.  A query on an IP address
will return 127.0.X.Y where (X * 256) + Y == ISO country code of the
country where the IP address in question is hosted.

  In both of the above cases, the idea is to reduce DNS traffic.  Rather
than querying half-a-dozen of the sub-zones, I query the master zone,
and check for any returned values which I want to use.  Similarly, I
could do multiple queries to cn.countries.nerd.dk, tw.countries.nerd.dk,
kr.countries.nerd.dk, etc, etc.  But it's less-bandwidth intensive at
both ends to use the master zone.  There is nothing preventing this type
of response being interpreted in a different manner that includes
granularity.

> Many commercial ISPs would like to make the decisions themselves.
> Filters such as SpamAssasin would probably be better off basing data
> on a larger scale than a simple yes or no.

  SPEWS already has a "level 1" and "level 2" response.  Is this along
the lines that you're thinking of ?  Similarly, Spamhaus has multiple
lists, with one (ROKSO) reserved for blatant, unrepentant spammers.
Between coded numeric valus, and separate subzones for various degrees
of spamming, the granularity you are looking for is already available
in real-life.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 10 Feb 2004 14:01:59 -0500

Walter Dnes wrote:
> "aggregate zone", which can return multiple multiple values.

What bothers me is that these codes vary from list to list. Would a 
standard set of codes help?

Second problem that I have is the use of 127.xxx IP addresses for this. 
This is really not something that should be done via IP addresses, a 
custom SRV, RR or TXT record would server a much better purpose.

> of response being interpreted in a different manner that includes

We should explore other protocols beside DNS for exchanging this data.

> of spamming, the granularity you are looking for is already available

I am actually looking at things like SenderBase and SpamCop - how many 
spams were caught, how many emails sent, etc.

Additionally, as I mentioned above, I am looking into whether some 
standard format and protocol would ease the use of blacklists.

Yakov
-------

---

From: Eugene Crosser <[email-masked]>
Date: Tue, 10 Feb 2004 23:12:22 +0300

Hello genlemen,

I am new here; I am a postmaster and sysadmin for a major ISP in my
country, and a programmer (mostly open source).  Lately, we are doing
rather active antispam R&D and that's why I subscribed to this maillist.

> custom SRV, RR or TXT record would server a much better purpose.

This decision of dnsbl maintainers to use 'A' RRs has always made me
feel uneasy.  Given that the search key is a reverse dotted quad IP
address, it seems quite logical to use 'PTR' RR, which would give you
alphanumeric namespace for the return codes.  Or TXT or any other: 'A'
seems the least suitable of all.

I think that if a dnsbl standard is ever proposed, it sould not use 'A'
RRs.  Maybe TXT would be best, as they allow more flexible syntax, like
that used by SPF.

[if I am not supposed to post here not being an asrg member, tell me]

Regards
Eugene

---

From: "Walter Dnes" <[email-masked]>
Date: Wed, 11 Feb 2004 01:32:47 -0500

On Tue, Feb 10, 2004 at 02:01:59PM -0500, Yakov Shafranovich wrote

> standard set of codes help?

  Back in the days of the DNSbl-BCP sublist, I proposed a rough draft
for certain metadata.  Right now 127.0.0.2 seems to be the de-facto
standard for single-purpose zones, where a binary YES/NO is sufficient.
Aggregate zones are a special case, depending on what they want to do.
For the SORBS example, adjacent IP addresses are the way to go.
zz.countries.nerd.dk is trying to encode a numeric result.

> Second problem that I have is the use of 127.xxx IP addresses
> for this.  This is really not something that should be done via
> IP addresses, a custom SRV, RR or TXT record would server a much
> better purpose.

  Don't forget that the internet is global, and there are many languages
and character sets for that matter.  Should TXT messages be in English
or Chinese ?  Which character set ?  Please justify.  On the other hand,
numeric codes, in the form of an IP address can be interpreted in any
language.

> We should explore other protocols beside DNS for exchanging this data.

  If we can find a better mousetrap, by all means.  The major advantage
of DNSbls is that they can be implemented without basic changes in the
infrastructure.  That is a problem that has caused grief with many
anti-spam proposals.

> I am actually looking at things like SenderBase and SpamCop

  Puh-lease, not Spamcop and SenderBase.  Those two are are absolute
jokes...

  - Spamcop, in it's early days, sent off complaints to IANA about spam
    originating from 10.0.0.0/8.  They've filtered such obvious junk,
    but I still don't trust them.  SpamCop is marketed to newbies who
    don't know how to parse headers.  As long as it relies on newbie
    users who can't parse headers, I will not trust them.  Like all
    automated software, it can produce some howlers.  People who can
    parse headers can catch the mistakes, newbies can't.  AOL gets
    blocked every now and then.  As a matter of fact
    http://www.spamcop.net/bl.shtml specifically states...
"This blocking list is somewhat experimental and should not be used
in a production environment where legitimate email must be delivered."

  - SenderBase, what can I say about them.  I've read quite a few posts
    by people I trust, saying that SenderBase has listed IP addresses
    that have never been used by mailservers.  OK, so that's 2nd hand
    stories.  Look up the following two URLs...
http://www.senderbase.org/search?searchString=0.0.0.0%2F16
http://www.senderbase.org/search?searchString=169.254.0.0%2F16

and click on the IP addresses they list.  Those damn spammers at IANA
again<g>.  Their listing is *MUCH* less of a joke today than it was back
in December, when there were tons of listings in RFC1918 and multicast
space.  If they've merely applied filters to zap obvious errors, I still
have reason to question the overall reliability of Senderbase listings.

  In other words, those two are the absolute last DNSbls I would use.
They are great for setting up strawman arguments about why DNSbls are
bad, but I wouldn't use them on my incoming email.  SPEWS produces less
collateral damage, fer-cryin-out-loud.

---

From: "Walter Dnes" <[email-masked]>
Date: Wed, 11 Feb 2004 01:35:19 -0500

On Tue, Feb 10, 2004 at 11:12:22PM +0300, Eugene Crosser wrote

> RRs.  Maybe TXT would be best, as they allow more flexible syntax, like

  As I've mentioned previously, the internet is global in scope.  Which
language and which character set do you propose to use for TXT messages?
IP addresses used as numeric codes can be handled in any language, and
character sets are immaterial.

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 11 Feb 2004 09:01:01 -0500

> numeric codes, in the form of an IP address can be interpreted in any

A new RR with its own format or a TXT record with its own format. I am 
not talking about a free form format, rather something like LMAP.

What I am basically trying to figure out is whether taking the entire 
mix of DNSBLs outthere with all of their various response codes, 
formats, etc. and standardazing it would help.

> infrastructure.  That is a problem that has caused grief with many

For major ISPs, bulk transfer of data might be better. To avoid DDOS, 
P2P might be better. There are other cases.

>>I am actually looking at things like SenderBase and SpamCop
....
> collateral damage, fer-cryin-out-loud.

Its a strawman - I am not refering to the use of them, rather to the 
data the main systems provide. ISPs can use such data to make their own 
decisions rather than relying on the BL operator to do it for them.

Yakov

P.S. My company's ISP uses SpamCop, so I know first hand exactly how 
much damage it is causing. So far efforts to drop it, haven't been 
successful :(

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"But in this world nothing can be said to be certain, except death and 
taxes" (Benjamin Franklin)
-------

---

From: Jose Marcio Martins da Cruz <[email-masked]>
Date: Wed, 11 Feb 2004 18:02:37 +0100

Not exactly the question asked by Yakov, but mainly about what RBLs will be.

If I look at our mail server who's sending spam, I can see that most of 
them are doing only very few connections a day : one, two or three. Very 
few gateways do more than five connections. - I'm talking about a 
mailserver with some thousand users and about 50 K connections a day.

This may indicate that many spam is sent by a distributed system of 
workers, and not by open relays.

If this is the case, and if this kind of way continues - the tendance 
will be to have more and more IP addresses to be inserted on blacklists.

Also, the time some particular IP address will be used by spammers have 
chances to be shorter than the address of an open relay.

The possible consequence is that the number of addresses may explode.

Nowadays, list.dsbl.org has 2100000 (two million and a hundred thousand) 
addresses.

Is it reasonable to consider that there isn't a limit on the number of 
IP addresses on a blacklist ?

-- 
  ---------------------------------------------------------------
  Jose Marcio MARTINS DA CRUZ           Tel. :(33) 01.40.51.93.41
  Ecole des Mines de Paris              http://j-chkmail.ensmp.fr
  60, bd Saint Michel                http://www.ensmp.fr/~martins
  75272 - PARIS CEDEX 06      mailto:[email-masked]

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 12 Feb 2004 03:21:20 -0500

> workers, and not by open relays.

  I've been seeing that for ~4 years now: 100's to 1000's of machines
originating spam.  Lately, though, it's been hitting 10k IP's.

> IP addresses on a blacklist ?

  Hard drives are cheap.  2^32 is a comparitively small number nowadays.

  The larger problem is that th eblacklists may well end up listing
20-50% of the IP's on the net.  That's another issue, which won't be
solved by blacklists.

  Alan DeKok.

---

From: Andrzej Filip <[email-masked]>
Date: Thu, 12 Feb 2004 09:58:35 +0100

> 20-50% of the IP's on the net.  That's another issue, which won't be

We may consider switching from blacklist to whitelist or "mixed list".

Mixed list:
if IP itself is listed then return its status
if IP is located in "bad neighborhood" the return "bad IP"
return "good IP"

-- 
Andrzej [en:Andrew] Adam Filip http://anfi.freeshell.org backup: [email-masked]

---

From: Eugene Crosser <[email-masked]>
Date: Thu, 12 Feb 2004 13:25:39 +0300

>From our experience, great majority of today's spam comes from a
distributed system of *zombies*, i.e. home and office workstations that
where trojened by some kind of virus.  Because this set of dangerous
machines is very dynamic (new ones get infected, old ones are healed by
antivirus programs), I think that blacklist approach is not effective
and should not be used to address this problem.

OTOH, LMAP looks very promising against this kind of trouble, if widely
deployed.

Eugene

---

From: Jose Marcio Martins da Cruz <[email-masked]>
Date: Thu, 12 Feb 2004 13:07:10 +0100

> and should not be used to address this problem.

Yes, that's what I was thinking about. Open relays usually may remain 
much longer on blacklists than zombies, as the problem on the first case
comes from MTA configuration. Zombies are used for very short time. So, 
blocking zombies IP address shall be very quickly and can be removed 
faster than open relays. I agree with you when you say blacklists shall 
not be used to address zombies problems.

But if we agree that great majority of spam comes from zombies, why
should we continue to use blacklists.

We use blacklists and we have one DNS server serving rbl requests.
named process in this machines eats almost 900 MBytes of memory. Sure,
memory is cheap, disk is cheap, bandwidth is cheap - but ther's a
limit if blacklists are less efficient than other methods.

Or maybe I'm wrong.

---

From: Daniel Feenberg <[email-masked]>
Date: Thu, 12 Feb 2004 07:50:12 -0500 (EST)

...

> limit if blacklists are less efficient than other methods.

Can you explicate further? I would have thought that zombies were
an ideal target for an RBL. They produce only spam, so there is no
problem of blocking legitimate mail and their owners do not complain
about the listing. 

Of course if the IP address dynamically assigned, there is the remote
possibility that the next user will have legitimate mail, but this writer
at least believes they should forward that to an MTA with a static
address. It would be helpfull in defusing some of this controversy
if sendmail had a "dynamic IP" option which caused it to use the smarthost
if and only if the direct route was blocked. It is quite possible that
many of these users wouldn't notice the difference, and only care because
it bit them unexpectedly.

As to memory usage of BIND, by the time every possible IP address needs to
be in the RBL, memory will be cheap enough to make this possible.

---

From: Eugene Crosser <[email-masked]>
Date: Thu, 12 Feb 2004 17:02:17 +0300

> problem of blocking legitimate mail and their owners do not complain

May I try?

1. When you blacklist an open relay, you can verify with almost 100%
accuracy that this is in fact an open relay.  Alleged zombie cannot be
verified to be a zombie with that level of certainty.

2. Even initial allegation of an IP address as a zombie may be
problematic.  They often send only a few hundred spam messages at a
time.  You can expect the same to come from a perfectly legal ISP server
before their antispam facilities are triggered and the offending client
is blocked.

3. Given the rate at which the number of infected machines may grow, the
data in blacklist is doomed to lag behind, and there will be significant
number of not-yet-blocked active zombies.

That's why I think that blacklisting is a poor remedy for zombie
problem.

Eugene

---

From: "denny" <[email-masked]>
Date: Thu, 12 Feb 2004 09:17:10 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Daniel
> Feenberg
> Sent: Thursday, February 12, 2004 7:50 AM
> To: Jose Marcio Martins da Cruz
> Cc: Eugene Crosser; Yakov Shafranovich; ASRG
> Subject: Re: [Asrg] 2. Improving Blacklists and Reputation Services
> 
> 
> 
[denny] 
AFAIK blacklists work on blocking "subnets" worth of IP's so one zombie can
windup blocking an entire domain, of if say you are in a web-hosting farm
possibly a group of domains. I think this has been done for two reasons:
1)  much simpler and economic to maintain such a list.
2)  more incentive for a "legit" ISP / WebHost provider to "clean house".
> address. It would be helpfull in defusing some of this controversy
[denny] 
I think you are mostly right, about the sending mta I think in the end that
the entity that has the address block and ASN number related to it has to be
in a position of some responsibility for what traffic they allow across
their network. While this topic can get very nasty and ugly (eg p2p
fileshare) in the area of email I personally feel it's very clear that
allowing random IP's to act as servers of email services is a problem.
How to fix it is coming into focus as we all work on the problem.

As for "Of course if the IP address dynamically assigned, there is the
remote possibility that the next user will have legitimate mail"

Well that's a very dynamic problem, rather like computing odds on a winning
lotto # which will vary over time based on ticket purchases and other
factors. :-)