Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NANOG: users

Abuse procedures... Reality Checks

 

 

First page Previous page 1 2 3 4 Next page Last page  View All NANOG users RSS feed   Index | Next | Previous | View Threaded


frnkblk at iname

Apr 11, 2007, 6:50 PM

Post #76 of 83 (1782 views)
Permalink
RE: Abuse procedures... Reality Checks [In reply to]

It truly is a wonder that Comcast doesn't apply DOCSIS config file filters
on their consumer accounts, leaving just the IPs of their email servers
open. Yes, it would take an education campaign on their part for all the
consumers that do use alternate SMTP servers, but imagine how much work it
would save their abuse department in the long run.

Frank

-----Original Message-----
From: Frank Bulk
Sent: Wednesday, April 11, 2007 5:10 PM
To: 'nanog [at] merit'
Subject: Re: Abuse procedures... Reality Checks


On Tue, Apr 10, 2007 at 07:44:59AM -0500, Frank Bulk wrote:
> Comcast is known to emit lots of abuse -- are you blocking all their
> networks today?

All? No. But I shouldn't find it necessary to block ANY, and wouldn't,
if Comcast wasn't so appallingly negligent.

( I'm blocking huge swaths of Comcast space from port 25. This shouldn't
really surprise anyone; Comcast runs what may well be the most prolific
spam-spewing network in the world. I saw attempts from 80,000+ distinct
IP addresses during January 2007 alone -- to a *test* mail server.
I should have seen zero. The mitigation techniques for making that
happen are well-known, have been well-known for years, and can be
implemented easily by any competent organization.)

This, by the way, should not be taken as indicative of either what
I've done in the past or may do in the future. Nor should it be
taken as indicative of what decisions I've made in re other networks.

---Rsk


swmike at swm

Apr 11, 2007, 11:26 PM

Post #77 of 83 (1785 views)
Permalink
RE: Abuse procedures... Reality Checks [In reply to]

On Wed, 11 Apr 2007, Frank Bulk wrote:

> It truly is a wonder that Comcast doesn't apply DOCSIS config file filters
> on their consumer accounts, leaving just the IPs of their email servers
> open. Yes, it would take an education campaign on their part for all the
> consumers that do use alternate SMTP servers, but imagine how much work it
> would save their abuse department in the long run.

There are several large ISPs (millions of subscribers) that have done away
with TCP/25 altogether. If you want to send email thru the ISPs own email
system you have to use TCP/587 (SMTP AUTH).

Yes, this takes committment and resources, but it's been done
successfully.

--
Mikael Abrahamsson email: swmike [at] swm


leigh.porter at ukbroadband

Apr 12, 2007, 2:17 AM

Post #78 of 83 (1778 views)
Permalink
Re: Abuse procedures... Reality Checks [In reply to]

Mikael Abrahamsson wrote:
>
> On Wed, 11 Apr 2007, Frank Bulk wrote:
>
>> It truly is a wonder that Comcast doesn't apply DOCSIS config file
>> filters
>> on their consumer accounts, leaving just the IPs of their email servers
>> open. Yes, it would take an education campaign on their part for all
>> the
>> consumers that do use alternate SMTP servers, but imagine how much
>> work it
>> would save their abuse department in the long run.
>
> There are several large ISPs (millions of subscribers) that have done
> away with TCP/25 altogether. If you want to send email thru the ISPs
> own email system you have to use TCP/587 (SMTP AUTH).
>
> Yes, this takes committment and resources, but it's been done
> successfully.
>

You don't even need to do that. We just filter TCP/25 outbound and force
people to use our mail servers that have sensible rate limiting etc.
People who use alternate SMTP servers can fill in a simple web form to
have them added to the exception list. We have about 50 on this list so far.

--
Leigh Porter


fernando.andre at tvtel

Apr 12, 2007, 3:14 AM

Post #79 of 83 (1798 views)
Permalink
RE: Abuse procedures... Reality Checks [In reply to]

Citando Frank Bulk <frnkblk [at] iname>:
" but imagine how much work it
> would save their abuse department in the long run"

I think that Comcast trouble isn't has much has the company's affected I keep
the idea that the best is to rate limit incoming connections and a lot of
filtering to prevent the spam flood and keep hardware costs Low.

Placing the filtering on the user will make the user cry a lot against
the ISP,
change ISP and keep the problem. They really don't care about their computer.

By using rate limit on incoming connections a lot of dynamic address's are
blocked.

"Additionally, upper management gives or takes away manpower many times
without
the understanding of what 'should' be done to be a good netizen and this
defines how much effort can be spent on fixing the problems. "

This is the biggest problem "upper management" really doesn't care and
the time
to use on this problems is not accounted.

So controlling the number of messages that leave your SMTP server is a
solution
and PBL from spamhaus is a good thing ! SPF also good but will lead to
complains
( tuff )

Blocking tcp destination port 25 to outside the network might work well
on small
and without concurrent ISP, on big ones I doubt it.

------------------------------------------------------------
Fernando Ribeiro
------------------------------------------------------------

----------------------------------------------------------------
http://www.tvtel.pt - Tvtel Comunicações S.A.


admin at digibase

Apr 12, 2007, 10:55 AM

Post #80 of 83 (1789 views)
Permalink
Re: Abuse procedures... Reality Checks [In reply to]

On Thursday 12 April 2007 06:14, Fernando André wrote:
> Citando Frank Bulk <frnkblk [at] iname>:
> " but imagine how much work it
>
> > would save their abuse department in the long run"
>
> I think that Comcast trouble isn't has much has the company's affected I
> keep the idea that the best is to rate limit incoming connections and a lot
> of filtering to prevent the spam flood and keep hardware costs Low.
>
> Placing the filtering on the user will make the user cry a lot against
> the ISP,
> change ISP and keep the problem. They really don't care about their
> computer.
>

Agreed - 90-98% of end users could care less about their computer security, no
matter who makes them look at the problem, they just "want to chat with aunt
{lilly|mary|other} in God knows where" or to "close that business deal in New
York", They don't want to bother with ports, IP, firewalls, etc, and I don't
think that will change easily.

And as said previously, the person will ignore their ISP and cancel and move
to another SP if the ISP hassles them with blocking their email, stopping
certain apps, etc.

This isn't only a spam problem. it's also a problem with personal machines
getting botnetted, virus'd, trojan'd over and over and over again.

Why? There's simply no end-user accountability.

> By using rate limit on incoming connections a lot of dynamic address's are
> blocked.
>
> "Additionally, upper management gives or takes away manpower many times
> without
> the understanding of what 'should' be done to be a good netizen and this
> defines how much effort can be spent on fixing the problems. "
>
> This is the biggest problem "upper management" really doesn't care and
> the time
> to use on this problems is not accounted.
>

Agreed again - Upper management business-types that are not involved in the
actual operations of their businesses are most of the time not clueful enough
to realize the problems, no matter how many times people explain it to them,
they simply only see if it's making them money.


> So controlling the number of messages that leave your SMTP server is a
> solution
> and PBL from spamhaus is a good thing ! SPF also good but will lead to
> complains
> ( tuff )
>
> Blocking tcp destination port 25 to outside the network might work well
> on small
> and without concurrent ISP, on big ones I doubt it.
>
> ------------------------------------------------------------
> Fernando Ribeiro
> ------------------------------------------------------------
>
> ----------------------------------------------------------------
> http://www.tvtel.pt - Tvtel Comunicações S.A.


sil at infiltrated

Apr 13, 2007, 4:15 AM

Post #81 of 83 (1796 views)
Permalink
Re: Abuse procedures... Reality Checks [In reply to]

Last post for me on this thread... Dirty Networking 101

So the other morning I found a contact for a company who'll for
now remain unamed, this contact is on this group...Sent them
yet another message (3 this week):

<new message>
To whom it may concern,

One of my servers has been heavily under attack for the past 24
hours from your IP space. There were 10726 attempts to log into
my VoIP server within the last 24 hours. Please sanitize this
machine from your network. Attached is the logfile.
</new message>

10726 attacks in a variety of forms. Why should I NOT ban this
network and its clients from reaching my networks. Can someone
please help me understand the logic of being called something
akin to a crybaby, spoiled sport, unfair admin since I am now
going to block their /17?

On to semi-relevant news...

For those who care: Support Intelligence analyzed 22,000 ASNs
for every kind of eCrime including DDoS, Scanning, hosting
Malware, sending Spam, hosting a phish, or transmitting viruses
... 17 of the 100 networks listed are from ARIN. Six of the
seventeen are from Time Warner. 5 are from Comcast, 2 are from
Charter.

http://blog.support-intelligence.com/2007/04/doa-week-14-2007.html

That's their record. I now have 52 hosts dumping out syslog
records and can name about 30+ networks of which some of
the engineers from them are on this list. So what is their
left to do when points of contact fail miserably.

Maybe I will take a crack at writing a document based on the
amount of waste whether its bandwidth, time or money in blocking
venomous hosts from my subnets. Costs, benefits, experience,
pros, cons.

--
====================================================
J. Oquendo
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
sil . infiltrated @ net http://www.infiltrated.net

The happiness of society is the end of government.
John Adams
Attachments: smime.p7s (5.04 KB)


rsk at gsp

Apr 13, 2007, 4:53 AM

Post #82 of 83 (1783 views)
Permalink
Re: Abuse procedures... Reality Checks [In reply to]

On Sat, Apr 07, 2007 at 05:12:19PM -0500, Frank Bulk wrote:
> If they're properly SWIPed why punish the ISP for networks they don't even

"punish"?

Since when is it "punishment" to refuse to extend a privilege that's been
repeatedly and systematically abused? (You have of course, absolutely
no right whatsoever to expect any services of any kind from anyone other
than those you've contracted for. Everything beyond that is a privilege,
generously furnished to you at the whim of those operating the service.
It may be restricted or withdrawn at any time, for any reason, with or
without notice to you. Now as a general rule, we all have chosen to
furnish those services -- by default and without limitation. But that
doesn't turn them into entitlements.)

The word "punish" is completely inapplicable in this context.

> operate, that obviously belong to their business customers?

Questions:

1. Is your name on it in any way, shape or form?
(This includes allocations.)
2. Is it emitting abuse?

If the answers are "yes", then it's YOUR abuse. Trying to evade
responsibility by claiming that "it's one of our customers" is
just another pathetic excuse for incompetence.

> Of course, it doesn't hurt to copy the ISP or AS owner for abuse issues from
> a sub-allocated block -- you would hope that ISPs and AS owners would want
> to have clean customers.

Unless of course the ISP or AS owner *are* the abuser under another
name, or unless they're actively complicit. Both are quite common.

Beyond that: any *competent* ISP or AS owner will already know about
the abuse. They will have deployed measures designed to detect said
abuse well before anyone else out there reports it to them. (Example:
setting up their own spamtraps explicitly designed to catch their own
customers.) By the time an external observer reports a problem to them, it
should already be old news and already be well on its way to remediation.

---Rsk


sjsobol at JustThe

Apr 13, 2007, 1:01 PM

Post #83 of 83 (1782 views)
Permalink
Re: Abuse procedures... Reality Checks [In reply to]

On Fri, 13 Apr 2007, Rich Kulawiec wrote:

> Since when is it "punishment" to refuse to extend a privilege that's been
> repeatedly and systematically abused?

It IS punishment if it's in response to some sort of undesired behavior,
but it probably isn't UNJUSTIFIED punishment.

--
Steve Sobol, Professional Geek ** Java/VB/VC/PHP/Perl ** Linux/*BSD/Windows
Victorville, California PGP:0xE3AE35ED

It's all fun and games until someone starts a bonfire in the living room.

First page Previous page 1 2 3 4 Next page Last page  View All NANOG users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.