Subject: [Asrg] Solving spam == Solving zombies/botnets

From: "Walter Dnes" <[email-masked]>
Date: Tue, 2 Dec 2008 00:25:37 -0500

On Sat, Nov 29, 2008 at 09:50:55PM -0600, mathew wrote
> On Sat, Nov 29, 2008 at 18:29, Rich Kulawiec <[email-masked]> wrote:
> 
> > Yes.  I have spam-in-hand from multiple incidents.  And it is of course
> > not necessary for them to guess, since they could (a) subscribe to those
> > lists and harvest part of the subscriber list (b) grab the archives of
> > [some] lists and harvest part of the subscriber list (c) go through the
> > "address books" and stored mail on any zombied system and note any mailing
> > list which any mail address in use on that system is subscribed to
> > (d) go through any zombie which happens to be a mailing list server (e)
> > etc.
> >
> > So why don't we see more of it?  I suspect because it's not worth
> > their trouble -- yet.
> 
> 
> Then perhaps we should consider a side-discussion of ways to combat the
> problem?

  Here's an opportunity to discuss the FUSSP-killer.  Email is really
machine-to-machine, which is assumed to be a "reasonable facsimile" of
person-to-person.  If a machine can be zombied, then, with the aid of a
key-logger, any certificate/password/jumping-through-flaming-hoops that
a person can supply can also be supplied by his machine.  This is what's
known in crime-fighting circles as "an inside job".

  Botnets have evolved.  Instead of trying to send a million emails a
night through one zombied machine, botnets now send 4 emails a night
through each of 250,000 machines.  The latter is almost impossible to
detect, versus the former.

  What it boils down to is that to majorly reduce spam, we have to
majorly reduce botnets/zombies.

-- 
Walter Dnes <[email-masked]>
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Lyndon Nerenberg <[email-masked]>
Date: Mon, 1 Dec 2008 22:15:17 -0800

> detect, versus the former.

Perhaps not at the IDS level, but Spamassasin and the like are  
agnostic to injection rate.

While traffic analysis can help flag suspicious traffic, only content  
analysis will know to a degree that's trustworthy for automated  
processing.  This is why DCC fails -- it can't tell the difference  
between a flood of spam and a flood of legitimate mailing list traffic.

--lyndon

---

From: Andrew D Kirch <[email-masked]>
Date: Tue, 02 Dec 2008 01:25:23 -0500

> majorly reduce botnets/zombies.

I concur, I'm just not sure that we're going to pull it off.  There's
little to no liability for the provider.  I'd love to see someone start
suing yahoo, or the web cafe, or the compromised server that phishing
attacks come through.  Unless you hit their pocketbook they simply don't
care.

Andrew

---

From: "Gerald Klaas" <[email-masked]>
Date: Tue, 2 Dec 2008 08:36:08 -0800

> attacks come through.  Unless you hit their pocketbook they simply don't
Sue the ISP?  Why would it be any easier for an ISP to determine that
Granny's PC is
pwn3d than it is for the rest of us?  Why not sue Granny?  (a la MPAA)

I agree with the observations that pwn3d machines can do anything their
owners
can do, so who's responsible for abuse?  Is it the machine owner?  Is it the
ISP?  Why not
the OS provider?  Why not the MUA or MTA licensor?   They're all victims of
the
original perpetrator.  Why not pursue legislation that would make it easier
for all
of the victims to pursue the original perpetrator?  A couple days ago,
someone
talked about the mailbox sticker in Canada that "opts out" of unsolicited
flyers in
the mailbox.  Does it work?  Not at a technical level.  Certainly the guy
delivering
a Chinese menu can ignore the sticker.  But what's the punishment, and how
does
the recipient pursue damages?   I'd like to see a voluntary, distributed
"opt-out"
notice for e-mail boxes along with legislation defining damages for
violators, that
would allow victims of Granny's compromised machine to pursue the real perp.

IMHO: One benefit of an ePostage system is that Granny has a reason to
protect her
machine.  If someone breaks into Granny's machine and spends all of her
stamps,
she has an immediate loss.  No court involved.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 02 Dec 2008 09:28:39 -0800

Walter Dnes wrote:
>   Here's an opportunity to discuss the FUSSP-killer.  

Or not.

When there is a solution to crime, there will be a solution to spam and other 
email abuse.

Until then, using the term FUSSP or the like, as if it were a goal, ensures 
unrealistic effort.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Douglas Otis <[email-masked]>
Date: Tue, 2 Dec 2008 13:43:05 -0800

On Dec 2, 2008, at 8:36 AM, Gerald Klaas wrote:
>
> Sue the ISP?  Why would it be any easier for an ISP to determine  
> that Granny's PC is pwn3d than it is for the rest of us?  Why not  
> sue Granny?  (a la MPAA)

Only the ISP is able to fully monitor the network traffic of their  
customers.  It is not reasonable to expect ISP customers, or even  
third-party monitoring services, will be able to track this problem  
nearly as well.  The simple impediment to a solution is that ISP don't  
want to inform their customers that they are part of a bot-net.   
Customers are then likely to blame the ISP for having allowed bad  
actors access to their system, and will expect expensive support as a  
result.

ISPs need a financial incentive to deal with the bot-net issue, rather  
than their current incentive to ignore the problem.  If ISPs are to be  
held accountable for containing a bot-net plague, they should be  
allowed to impose additional fees whenever they detect a compromised  
customer.  Customers should be required to obtain bot-net insurance to  
defray the costs related to dealing with bot-net systems.  Insurance  
companies that competitively set a price for their service, will  
assess the risks based upon the vulnerability and serviceability of  
the infected OS being insured.  Of course, insurance companies have  
clearinghouses to rate repeat offenders.

In deed, OS vendors are guilty of contributing to the problem.   
Scrubbing compromised systems has been complicated by the snarled  
amalgam of application settings, library extensions dependent upon a  
plethora of data structures within each API, and an endless variety of  
exchanged active content.  When hardware vendors offer writable flash  
on motherboards, video cards, hard and DVD drives, once a system  
becomes compromised, it becomes extremely difficult to ensure malware  
does not remain hidden beneath some virtual device or file system.  
This situation could be seen as being analogous to SUV manufactures  
whose products consume too much fuel, are dangerous to drive, and that  
are too expensive repair.  Customers may eventually opt for cleaner,  
smaller, better organized, and ultimately much safer solutions.   
Prices charged by insurance companies may help consumers make informed  
decisions that are forced to consider the burden caused by unsafe  
products.  Any government regulation regarding consumer product  
security is likely to favor those vendors able to influence  
legislature, which seems unlikely to improve the situation.  It would  
seem that requiring bot-net insurance would offer the incentives  
needed for market driven solutions.

-Doug

---

From: Barry Shein <[email-masked]>
Date: Tue, 2 Dec 2008 13:07:23 -0500

> attacks come through.  Unless you hit their pocketbook they simply don't

Not to beat a dead horse...(not dead, sleeping!)

A major motivation for pursuing some sort of e-postage is to create an
economic motivation to deal with these zombies.

Right now it's pretty clear that, in particular, huge consumer ISPs
can shrug their shoulders and say "can't think of anything to do about
zombie bot armies on our nets which conforms to our business/marketing
model".

I believe e-postage can change that equation.

I know, I know: how? why? when? where? who?

Anyhow, I just thought I would stop in this msg at stating that as an
overarching goal.

-- 
        -Barry Shein

The World              | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 800-THE-WRLD        | Login: Nationwide
Software Tool & Die    | Public Access Internet     | SINCE 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Rich Kulawiec <[email-masked]>
Date: Tue, 2 Dec 2008 20:12:34 -0500

> between a flood of spam and a flood of legitimate mailing list traffic.

Content analysis is (a) not necessary and (b) a losing proposition, as
spammers can raise the cost to arbitrarily high levels.  I think the concept
behind the DCC is sound (while recognizing its drawbacks) and need to
go find a link to an interesting paper which might provide some guidance
on how to modify/refine/extend it.  (Sorry, couldn't come up with it
while scribbling this, will dig around and send.)

---Rsk

---

From: Rich Kulawiec <[email-masked]>
Date: Tue, 2 Dec 2008 20:29:02 -0500

> majorly reduce botnets/zombies.

We can't; we can only mitigate the consequences.  I realize that's
kind of a grim statement, but attackers are way ahead of defenders
on this front and have at least one serious bit of leverage: the
unwillingness of hundreds of millions to abandon their OS of choice,
no matter how pitifully insecure it has proven itself to be.

However: "they", for some values of "they", can majorly reduce the
*access* of botnets/zombies, should they have sufficient reason to do so.
And that's where I think economic motivation comes in -- not via
construction of an epostage system, but by their desire to continue
enjoying the privilege of access to others' networks and services.

To put this another way: any anti-spam measure which a priori assumes
that it's "our" problem is unlikely to sway "them" that it's theirs.
ISPs and others whose networks are emitting torrents (sorry!) of spam
have no reason to care because there are no consequences -- and every
reason not to care, since caring costs money.

The trick, I think, is to turn "our" problem into "their" problem,
thus (a) mitigating the consequences for us and (b) providing them
with motivation sufficient to get them to address it.

It's called a "blacklist", and we've all seen various models of those
in operation.  What it amounts to really, though, is "selective revocation
of privileges". (i.e. nobody out there has any "right" to use example.com's
mail or web server and example.com may grant/revoke privileges at its whim.)

I point to the recent cases of Atrivo and McColo as examples of what
*could* be done quite effectively.

This goes beyond just spam, by the way: the same approach can/could be
used to deal with attempted HTTP exploits, SSH dictionary attacks, etc.
If one observes a host engaged in any of these abusive behaviors, then
either:
	a) it really belongs to the enemy, e.g. it's a box they bought
		and paid for and connected somewhere
	b) it (at least temporarily) belongs to enemy, because it's
		been wrested away from its putative owner
	c) it's been subverted by enemy in order to launch or redirect
		an attack (e.g., open SMTP relay)
	d) it's broken

In any of these cases a suitable response is "stop letting it access the
service in question" (or possibly "stop letting it access anything").
This solves "our" problem by denying privileges to an attacker and
potentially makes it "their" problem, if there's actually a responsible
"they" in charge somewhere.  (And clearly on some rogue networks, there
isn't.  But rogue networks have upstreams, see examples above.)

Of course we'd all be better off if network operators detected these
forms of abuse outbound from their operations, rather than waiting for
us to detect them inbound to ours.  And they could -- not all of them,
granted, not all the time, but certainly more than enough to make a
sizable impact on the problem.

But, mostly, they haven't.  They won't.  They have no reason to.  The
days when people would try to solve problems they perceived as "someone
else's" ended here about two decades ago, and it now seems necessary to
ensure that problems land squarely on the desks of those responsible --
in order to get their attention and provide them with some motivation.

I don't like this situation much.  But clearly, asking "them" nicely
"would you please do something about the 51,000 zombies on your network?"
isn't going to accomplish anything.  I think asking them nicely while
refusing all SMTP traffic from their /18 is likely to be more persuasive,
particular if that refusal is widespread.  (Which is of course the trick.)

---Rsk

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 03 Dec 2008 15:42:23 +0530

> majorly reduce botnets/zombies.

Hooray!  Let it be shouted throughout the land: on 12th December 2008, the
ASRG caught up to the anti-spam conversation circa 2006.

---

From: Barry Shein <[email-masked]>
Date: Wed, 3 Dec 2008 16:30:38 -0500

> ASRG caught up to the anti-spam conversation circa 2006.

It's sort of one of those necessary vs sufficient arguments.

If, for example, you could identify and reject all unwanted mail the
botnets (for email spam anyhow) would cease to exist on their own,
there'd be no economic reason for them to continue operating.

OTOH, it is true that the only reason spammers can operate as they do
is via botnets. Period.

That's the only way they can get access to the resources necessary to
do what they do, and the only way they can get access to ip mobility
which is absolutely necessary to their crime; without ip mobility we'd
just block them and be done with it.

It's like the triangle of fire: heat/fuel/air. In this case it's
economic-motive / bot-armies. Stop either and spam will almost
certainly cease to be a problem worth worrying about.

-- 
        -Barry Shein

---

From: Steve Atkins <[email-masked]>
Date: Wed, 3 Dec 2008 13:39:39 -0800

> OTOH, it is true that the only reason spammers can operate as they do

That's an interesting perspective. One that's wrong, though. An awful
lot of quite profitable spam never goes anywhere near anything remotely
resembling a botnet.

In fact, given how poorly mail sent directly from botnets is delivered  
I'd
suspect that a typical user at a competent ISP wouldn't see that much
of it, compared to spam from other sources.

The operational problem of the deluge of traffic from them is there,
but it's not the entirety (or even a large fraction of, by any measure
other than traffic) of the problem for a recipient.

> just block them and be done with it.

Mail sent from "mobile" IPs doesn't get delivered particularly well,  
which
is why the effective spam is sent from elsewhere.

"Botnets" are the "direct-to-mx" of 2008. Interesting, and a cause of
quite a lot of traffic, but not the be-all and end-all of spam delivery.

Cheers,
   Steve

---

From: "David Nicol" <[email-masked]>
Date: Wed, 3 Dec 2008 17:22:23 -0600

On Wed, Dec 3, 2008 at 3:39 PM, Steve Atkins <[email-masked]> wrote:
>
> Mail sent from "mobile" IPs doesn't get delivered particularly well, which

"forward after auth" works essentially perfectly aside from
opportunists abusing relay rights from a shared NAT facade.

-- 
"Refusing to move when ordered, he was tragically mulched." -- The Onion
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Wed, 3 Dec 2008 22:29:27 -0500

> lot of quite profitable spam never goes anywhere near anything remotely

Ok, that's an interesting assertion.

Are they achieving IP mobility in some other way? If not, why don't we
just block them?

The only other major route I'm aware of are hijacked routes but thus
far I don't think they're that big an actual source of spam, correct
me if I'm wrong.

You make three references to "some other way" in the note (I didn't
quote all of it) but never quite spell it out. Here's your
chance. Educate us!

-- 
        -Barry Shein

---

From: Steve Atkins <[email-masked]>
Date: Wed, 3 Dec 2008 19:51:09 -0800

> quote all of it) but never quite spell it out. Here's your

Oh, there are quite a few. One common factor of one category
is spam being sent from originating IP addresses which also emit
a lot of email that doesn't cause complaints.

One example of that is spam sent through ESPs. Another is spam
being sent through ISP smarthosts (sometimes from compromised
machines within the ISP, but sometimes not). Another is spammers
who are careful with their traffic and list management in order to
manage complaint rates to a plausible level.

Another category is spam being sent from dedicated machines,
or at least dedicated IP addresses, for weeks to months before
moving to another address range or provider. IP mobility doesn't
need to be on a minute by minute process, it only needs to keep
ahead of filtering and enforcement.

Another category is spammers sending low-ish levels of spam from their
own systems, and never quite breaking the level of volume
where that causes them serious operational problems, but still
being quite a lot of mail in aggregate.

In terms of mail that makes it to the inbox, past fairly simple,
conservative filters, I see much more of these than I do
mail sent from botnets.

If what you care about is the traffic involved then the fact the vast
amount of botnet traffic is easy to detect and filter is completely
irrelevant, as it's still a lot of traffic and processing (at least  
until
you can push a big chunk of the work to the edge).

But if you're concerned about what the recipient actually sees in
their mailbox - a much bigger cost from my perspective - then
the lower levels of mail that are much harder for a conservative[1]
spam filter to detect are a big part of the problem, maybe more so than
typical botnet spam.

Given that's the stuff that tends to actually get delivered and be
seen by humans, it's going to be much more profitable per email,
as it's vastly more likely to be actually seen. Sufficiently more so  
that
it's probably a better business model for many products than the
naive high-volume spam that botnets tend to be used for. And, because
it's seen by humans, it's also a much higher cost to the recipient.

Cheers,
   Steve

[1] One that's suitable for typical end-user use, and doesn't cause
a noticeable false positive rate on typical consumer email.

---

From: Seth <[email-masked]>
Date: Wed, 3 Dec 2008 23:24:22 -0500 (EST)

> Are they achieving IP mobility in some other way? If not, why don't we

Most of my 419s come from Yahoo.

Seth

---

From: Rich Kulawiec <[email-masked]>
Date: Thu, 4 Dec 2008 08:14:17 -0500

On Tue, Dec 02, 2008 at 08:36:08AM -0800, Gerald Klaas wrote:
> Why not pursue legislation that would make it easier
> of the victims to pursue the original perpetrator?

(a) because that path is fraught with peril (b) because "your laws"
are not "our laws" for many values of (your, our) and conducting
trans-national investigation and litigation is a daunting task
(c) even when the original perpetrator is rather obvious this fact
is of little practical value (d) the legal system and associated
machinery does not consider spam to be a serious problem (e) which
argues, I suppose, that you can steal $25M and get away with it as
long as you do it 1/100 cent at a time instead of all at once and
(f) the net effect of all legal actions taken against all spammers
worldwide may be summed up in a word: "negligible".

---Rsk

---

From: Barry Shein <[email-masked]>
Date: Thu, 4 Dec 2008 12:15:04 -0500

> Most of my 419s come from Yahoo.

Well, since we're now debating about what amounts to a knowable fact
does anyone know of any reliable sources for this information?

-- 
        -Barry Shein

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 4 Dec 2008 13:29:23 -0500

> does anyone know of any reliable sources for this information?

I should think Seth is pretty reliable about what his own spam load
looks like ;-)

The point that Seth (and Steve) is really making here is that while BOTs
are 80-90% of all spam and IP blocking works well against them, there
are other classes of spam where IP blocking doesn't work nearly as well.

First there's the human shield technique, mostly exemplified by the
"Nigerian horde" phenomena.  Where Nigerian 419 spammers gravitate
towards something that they think is too big to block and nest there
until herculean efforts dislodge them.  For example, when our systems
were showing >95% of the email coming out of Gmail was 419 (we're
talking 10s of thousands per day).  As previously seen by places like
Tiscali, Wannadoo, Hotmail etc.

Second, there's snowshoers.  Too agile for something like spamhaus to catch.

Steve mentioned others.

---

From: "J.D. Falk" <[email-masked]>
Date: Fri, 05 Dec 2008 05:17:49 +0530

> are other classes of spam where IP blocking doesn't work nearly as well.

What's often forgotten here, though, is that those big ISPs who have
outbound spam problems have those problems not because of incompetence or
malfeasance, but because of those very same botnets attacking their
registration & webmail interfaces.

(Human 419ers cutting & pasting may be an exception; it's hard to be
certain.  If they're bots, they're really really good at randomness and have
extremely sneaky operators.)

But in any case, the all-too-common cry to blame the big ISPs has two
effects:

1. we lose sight of the magnitude of the problem

2. it alienates a group of people who have more to lose from spam than any
home anti-spam hobbyist

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 4 Dec 2008 21:32:03 -0500

> registration & webmail interfaces.

I'm not forgetting it, nor was I ascribing blame.  Simply pointing out a
fact of life - the large free mails _do_ get infiltrated and spew spam.
That methods you might use against a compromised machine (blacklisting)
are much less effective unless you don't mind zapping legit email.
Which we don't want to do.  Unless it gets as ridiculous as we've seen
it get sometimes (like when gmail's output surpassed 95% nigerian and
Tiscali's was indistinguishable from 100%).

Secondly, the problem no longer appears to be primarily BOTNET.  There
seem to be just two currently major classes of spam related to the
freemail/freeweb suppliers: Nigerian horde invasions, and a form of blog
spamming.  Neither of which involve BOTNETs attacking the freemails
directly.

Nigerians aren't particularly sophisticated.  They don't need to use
BOTNETs - they can buy accounts from "captcha services" for a buck or
less per thousand or do it themselves.  There's enough of them that they
can repeatedly log in, cut-and-paste, without resorting to BOTNETs.
These are incredibly difficult to deal with - at least at my end, I can
just block their servers but trying to reign it in from the sending side
isn't.  I _know_ how hard it was to stop it at their end.

The other form is creating free web pages, and turning them either into
proxies to spam pages, or hosting the whole thing.  At one point, quite
recently, more than 10% of _all_ spam was pharmacy and gambling sites
advertised via live.com URLs.  The anjelina virus of a month or two ago
(also >10% of all spam) were by similar lifefilestore.com links.  The
spam wasn't being sent via MSN, it was being sent by BOTNET.  I _think_
the web sites were being created by some sort of automated process
(because the link names were consistent length random strings), but, it
didn't need the services of a BOTNET to do it - just a single program
instance chugging away - and perhaps changing IPs periodically.

[The problem with live.com is that the department involved with the
live.com stuff didn't seem to want to care about it.  It took a
concerted effort by many (including others within MSN) to make them pay
attention and nuke the sites - they weren't before.  At one point less
than two weeks ago, I was reporting several hundred _every_ hour,
representing spam volumes into my trap of _more_ than 100,000 per hour.]

> But in any case, the all-too-common cry to blame the big ISPs has two

I intended no blame.  Just pointing out reality.  It happens, and it's a
big problem that for the most part can't be resolved by blacklisting.
Ignoring it won't make the problem go away.  Ignoring it wouldn't have
gotten the live.com folks finally doing something about it.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Thu, 4 Dec 2008 22:14:17 -0500 (EST)

> It happens, and it's a big problem that for the most part can't be
> resolved by blacklisting.

Only for values of "can't" that approximate "could if we felt strongly
enough about it to bite that particular bullet, but we don't".

Widespread blacklisting _would_ solve it.  If gmail couldn't get their
mail to (say) 75% of (the rest of) the Internet because they were
spewing spam, you can bet they would shape up pronto.

The problem is that stopping spam over the long term is, for most
receivers, a lower priority than getting ham through in the immediate
term (even if it means mixing spam in with it).  It's only fringe
nutcases (like me) who are willing to refuse to tolerate spam spewing
even at the cost of blocking ham, and people and organizations willing
to put a lot of resources into doing accurate filtering (like Nortel,
in the person of Chris) that aren't participating....

As understandable as it is, that kind of readiness to let the whole
system slide down the tubes in the long term for the sake of
superficial functionality in the immediate term is in large part
responsible for our being in this state at all.  It feels sorta like a
Prisoner's Dilemma crossed with a tragedy of the commons, with a
time-scale component thrown in to keep things interesting.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Seth <[email-masked]>
Date: Thu, 4 Dec 2008 22:42:43 -0500 (EST)

> does anyone know of any reliable sources for this information?

I can read headers.

For that matter, has anybody here seen a Yahoo change of address
notice that wasn't spam?  Or a Yahoo calendar invitation?  I haven't.

Seth