Subject: [Asrg] Challenge-Response and Spam Bounces

From: doug campbell <[email-masked]>
Date: Wed, 02 Nov 2005 00:02:50 -0800

I know this is somewhat old hat, but some spammers recently started 
using my domain as the bounce address for their spam (not as nasty as a 
Joe Job, but pretty bad nonetheless).  I started getting a lot (read 
"several thousands") of messages inbound to either the null address or 
an invalid user address of my server; the messages were of three types 
-- 554s (unknown recipient or, more sadly, mailbox full), 
challenge-response requests, and spam bounces.  The latter two are the 
subject of my post.

Challenge-Response requests:  A company with the moniker 
"spamarrest.com" has sold a few challenge-response systems, and each 
such targeted system has duly e-mailed my server a challenge for each 
spam message.    I'm trying to make up my mind if I should spend a few 
hours responding to the challenges (thus making life miserable for 
"spamarrest.com" -- after all, it was THEY who contacted ME first) or if 
I just should leave well enough alone.

Spam Bounces:  There is an anti-spam boundary appliance called a 
Barracuda, and there are apparently a lot of Barracudas swimming around 
on the Internet -- many Barracuda systems attacked by the spammers also 
dutifully sent my server an e-mail telling it that my spam had been 
stopped by the appliance (only it wasn't my spam, of course).   I've 
cruised the Barracuda site and they call this situation  "backscatter" 
and offer suggestions on configuring the appliance not to do it;  sadly, 
each appliance comes configured by default to do "backscatter".  The  
technical suggestions seem on the order of closing the barn door after 
the cows have escaped.

Both of the above are sort of like someone flaming Joe -- I just can't 
see the logic.

[email-masked]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Wed, 2 Nov 2005 03:51:29 -0500 (EST)

> [...spam blowback...] the messages were of three types -- 554s
> (unknown recipient or, more sadly, mailbox full), challenge-response
> requests, and spam bounces.  The latter two are the subject of my
> post.

> "spamarrest.com"

The people who held spamarrest.com at the time ran an anti-spam
"service" that, among other things, scraped its customers'
correspondents' addresses - and then spammed them with ads for
spamarrest.  Unless the current holder of the domain is not the then
holder of it (and I'd need a lot of convincing), run, do not walk, to
the "block anything that smells even vaguely of this domain" portion of
your mailer configuration.

> [...Barracudas...backscatter...] sadly, each appliance comes
> configured by default to do "backscatter".

The _just_ thing to do seems to me to be to have your mailer
autocomplain to Barracuda, once per misdirected backscatter message
received.  (Whether that would help in any way beyond making you feel
better is doubtful; I expect Barracuda would simply block you and
forget it.)

Autocomplaining to the generating site might do some good.

Beyond that, about all I can do is remark that when I ended up getting
hit with several thousand bounce blowback messages a few years back, I
made my mailer pick apart bounces and, if the bounced message didn't
bear certain traits that all my outgoing mail bears, reject the bounce.
(Sites that bounced in non-RFC3462 ways and didn't fix it I simply
blocked entirely.)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 02 Nov 2005 11:58:53 +0100

doug campbell wrote:

> A company with the moniker "spamarrest.com"

Enough said, an MLM scheme pretending to be 'anti'-spam.

> I'm trying to make up my mind if I should spend a few
> hours responding to the challenges

Yes, you need on average five attempts per challenge,
it's not only evil, above all it's broken.  But maybe
they improved it in 2005.  Don't forget to spamcop the
challenge after you have confirmed it...

> There is an anti-spam boundary appliance called a
> Barracuda

...that should go immediately to SpamCop.

> they call this situation  "backscatter"

Unfortuately they don't call it "chapter eleven" :-(

An SPF FAIL policy worked for me.  Spammers are more
cooperative than these wannabe-"anti"-spammers.  Bye

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 2 Nov 2005 11:55:00 -0500 (EST)

doug campbell <[email-masked]> wrote:

> such targeted system has duly e-mailed my server a challenge for
> each spam message.  I'm trying to make up my mind if I should spend
> a few hours responding to the challenges (thus making life miserable
> for "spamarrest.com" -- after all, it was THEY who contacted ME
> first) or if I just should leave well enough alone.

If you have the time, I'd respond.

More importantly, I'd report every challenge as spam (to NANAS at
least).

> Barracuda, and there are apparently a lot of Barracudas swimming
> around on the Internet -- many Barracuda systems attacked by the
> spammers also dutifully sent my server an e-mail telling it that my
> spam had been stopped by the appliance (only it wasn't my spam, of
> course).  I've cruised the Barracuda site and they call this
> situation "backscatter" and offer suggestions on configuring the
> appliance not to do it; sadly, each appliance comes configured by
> default to do "backscatter".  The technical suggestions seem on the
> order of closing the barn door after the cows have escaped.

Likewise, report all of those as spam.  You might want to escalate by
telephone to the owners of the companies using them, warning them to
stop their participation in the DDOS attack against your network.

Seth