Subject: Large Spam Attack in progress

From: Glen <[email-masked]>
Date: Fri, 4 Aug 2017 14:08:16 -0700

All -

A rather widespread spam attack is currently underway, and the IETF
server is amongst its targets.

There are over 26,000 hosts involved in this "distribution" of emails,
which of course suggests a botnet.    The large distribution of
addresses implies a large number of subnets, making targeted blocking
impossible.

On a positive note, the IETF will at least be pleased to know that
more than 10,000 of those hosts are using IPV6.  Hooray for our side.

At any rate, despite the distributed sources, it's all SMTP.  And all
of the spam appears to be coming "From" random numeric user IDs at one
of four domains:

qq.com
126.com
163.com
sina.com

So, naturally, I've blocked incoming email from those four domains.
We're still seeing at least 5-6 incoming connections per second from
various hosts, but the mail processing appears to have been stopped
with the block.

*sigh*

Just wanted to let you know about this, in case you see junk in your
list moderation queues.

We'll continue to watch, as always, and adapt as needed.  Just now I
got two from "sohu.com" and "179.com".  On to the block list they go.

As always, any questions, let me know.

Glen
--
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: Michael Richardson <[email-masked]>
Date: Sun, 06 Aug 2017 18:01:49 -0400

> more than 10,000 of those hosts are using IPV6.  Hooray for our side.

Do they have valid reverse names?

Thanks for the update.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Glen <[email-masked]>
Date: Sun, 6 Aug 2017 16:14:10 -0700

> Do they have valid reverse names?

Hi Michael!

Alas, no, none of the IPV6 addresses did.  (I recall because, in
munging the log, I cut out "unknown" from all the lines, and there
were no exceptions.)

The IPV6 address distribution was a bit more interesting, however....
a few were in 2002:.... but almost all of them were in prefix 240e:
.... and with a few outliers, all of *those* were in:

240e:c0:8002 (7165 hosts)
240e:c0:e007 (2347 hosts)
and
240e:ec:4ad1 (1137 hosts)

Within each of those ranges, there were no other discernible groupings
- addresses were spread across the ranges.

And, a quick check shows all three of those blocks assigned to
"Chinanet Backbone"...

https://www.ultratools.com/tools/ipv6InfoResult?ipAddress=240e%3Ac0%3Ae007%3Adcf2%3Ac9d%3Afdbb%3A2e89%3A362d

The IPV4 address space had some possible groupings but mainly seemed
widely distributed (and most of them had no reverse names either).

Glen

---

From: Derek Atkins <[email-masked]>
Date: Mon, 07 Aug 2017 10:11:04 -0400

Glen,

> munging the log, I cut out "unknown" from all the lines, and there

That makes it easy.  Just do what Google does, and require a valid PTR
record for all incoming IPv6 email.  I would think that any valid email
sender would have a valid PTR record, whereas BotNets most likely would
not.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Michael Richardson <[email-masked]>
Date: Mon, 07 Aug 2017 10:52:07 -0400

> munging the log, I cut out "unknown" from all the lines, and there

Google email servers reject v6 connections without reverse maps.
It seems like a reasonable "must be at least this tall" check, although  many
might disagree.

    > And, a quick check shows all three of those blocks assigned to

sigh.

---

From: Glen <[email-masked]>
Date: Mon, 7 Aug 2017 10:26:05 -0700

> It seems like a reasonable "must be at least this tall" check, although  many

We are already configured to do something like that by default, and I
see lots of this kind of thing in the log:

2017-08-06T15:01:19.285596-07:00 ietfa postfix/smtpd[17799]: NOQUEUE:
reject: RCPT from unknown[49.88.153.38]: 450 4.7.1 Client host
rejected: cannot find your reverse hostname, [49.88.153.38];
from=<[email-masked]> to=<[email-masked]> proto=ESMTP
helo=<ggao.com>

However, I notice that this seems not to be hitting *any* IPV6 addresses.

I wonder if there's something in the Postfix config that needs a
tweak.  I shall investigate and report.

> sigh.

Totally agreed.

ip*tables -I INPUT 1 -s CHINA -j DROP

The temptation....

Glen

---

From: Glen <[email-masked]>
Date: Mon, 7 Aug 2017 11:44:40 -0700

> tweak.  I shall investigate and report.

And it seems there was a little messiness in the configuration.  I've
cleaned it up, redone all the rules and maps, and we now get:

2017-08-07T11:41:50.491348-07:00 ietfa postfix/smtpd[9330]: NOQUEUE:
reject: RCPT from unknown[240e:c0:e007:64f9:44ed:67b3:5d38:3062]: 450
4.7.1 Client host rejected: cannot find your reverse hostname,
[240e:c0:e007:64f9:44ed:67b3:5d38:3062]; from=<[email-masked]>
to=<[email-masked]> proto=ESMTP helo=<cssn.net.cn>

Woo-hoo!

Glen