Subject: Subscription Floods, Redux

From: Glen <[email-masked]>
Date: Fri, 23 Sep 2016 09:31:01 -0700

All -

Earlier this week Tony reported that an IETF list he manages was
getting spammed with subscribe requests.  This morning, I got a
similar report from Loa, so it seems that this is not limited to one
list.

The attacks come (at present) from permutations of:

[email-masked]
[email-masked]

and

[email-masked]
[email-masked]

These requests are coming from random IPs through the web interface.
As a result, I have no way to block them at the mail gateway.
(Postconfirm would catch and block those anyway - I wouldn't even have
to do anything.)

Moreover, Mailman does not have a "master ban list" that I can use to
block this for everyone.  Instead, as was the case last time,
individual list managers must choose to take action for their lists
directly.

The correct way to prevent these types of things is to go into your
list settings, to the "Privacy" zone (i.e.
https://www.ietf.org/mailman/admin/xml2rfc/privacy ), and add the
address(es) to the "List of addresses which are banned from membership
in this mailing list. " ("ban list")

Click the "more info" link under that field - it explains that you can
use expressions to further mitigate these things.

Tony provided me with the following expression:

^k\.?e\.?m\.?o\.?m\.?a\.?r\.?t\.?@gmail.com

(and similarly for the other name) which I'm now resending to all of
you as a pattern you can use as well.  (Thank you Tony!!!)

Loa further inquired

> Can we ban self-subscription entirely from this list? Just people added by the admins (wg chairs)?

You could set your list's subscribe policy to confirm+approve, but
that would just turn us into a spam source attacking that destination
address (GMail ignores periods in email addresses, so those are all
the same effective address) - which may actually be the intent here.
The attackers may not be attacking us, but instead trying to use us to
attack those two target mailboxes.

You can also set a regexp in your ban list like:  ^.*  (that's not
tested) to ban everything.

I'm sorry I don't have a bigger hammer here, but I hope this
information is helpful.

Please feel free to email me directly at any time if you need anything else.

Glen
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: jouni korhonen <[email-masked]>
Date: Fri, 23 Sep 2016 09:47:55 -0700

This particular spammer is an old "friend".. having dealt with his/her
previous attempts earlier. Mailman privacy settings have served at least me
well enough in past - it is a bit of work but not too much. When creating
your own filters I have used tools like https://regex101.com/#python or
http://pythex.org/ for quick verification.

- Jouni