Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Mon, Mar 22, 2004 at 12:33:25PM -0500, Tanner Lovelace wrote:
> Steven Champeon said the following on 3/20/04 12:42 PM:
> >Part of the problem currently is that some spammers have taken to using
> >infected Windows machines as spam cannons; estimates range from a few
> >hundred thousand to several million hosts to choose from, and many
> >believe that the spammers are behind the creation of the worms/viruses
> >themselves. So what I've started doing is blocking on any host with a
> >generic rDNS (e.g., 'dsl-1-2-3-4.bigisp.net') rather than simply using
> >BLs like SPEWS and the SBL. But even that has taken literally months to
> >compile, as the spammers find new networks, I map them, and the race
> >continues. On the bright side, I've cut our daily spam load down from
> >around 1500/day in mid-May to roughly 20/day today. And I'm working on
> >some more rulesets that should cut that down by two-thirds. But I've not
> >yet had a day with no spam at all - that's my goal.
> 
> And, how many valid messages do you block in there?

Surprisingly few. If you're worried about losing legit mail, you can
just block on hosts that HELO/EHLO with a generic IP, as they're almost
always spam.

But that lets through all of the spam from folks who forge their HELO
string but are sending from hosts with generic rDNS, which in my
experience are nearly always compromised Windows boxes running proxy
spamware.

In essence, I treat any host with generic rDNS as suspect on a policy
basis; it's not that I automatically assume it's spam, it's just mail
from a source I don't trust. And most of the ISPs I've had issues with
have been (eventually) cooperative WRT setting rDNS of statically
assigned hosts that are running mail servers legally. The rest can find
a smarthost for outbound mail or I whitelist them (though I have very
few like that; most of my whitelisted hosts simply /lack/ rDNS at all.)

The old school of "be liberal in what you accept, but conservative in
what you send" simply doesn't work in today's world, where the spammers
aren't holding up their end of the "deal".

Here's an example of why the problem won't be solved by simple DNSBLs
or without a unified effort by /all/ ISPs. The spammers who run these
compromised Windows proxies can shift quickly from one to the other as
mail is rejected by the previous ones. Here's a sample of activity from
my logs back in February (which I posted to spam-l):

-->8-- snip --8<--

In case anyone still wondered why it is necessary to simply block all
mail from hosts with generic rDNS, here's some more evidence of the round
robin activity discussed here earlier.

----------------------------------------------------------------------
WKS       Q 12:12:54 (9351)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 68.59.188.188
          (pcp02265132pcs.batlfl01.tn.comcast.net)
----------------------------------------------------------------------
WKS       Q 12:13:23 (9356)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 81.9.232.163
          (cmr-81-9-232-163.telecable.es)
---------------------------------------------------------------------- 
WKS       Q 12:15:21 (9513)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 200.55.72.231
          (200-55-72-231.dsl.prima.net.ar)
---------------------------------------------------------------------- 
WKS       Q 12:15:49 (9519)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 142.169.46.107
          (c142.169.46-107.clta.globetrotter.net)
----------------------------------------------------------------------
WKS       Q 12:15:51 (9520)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 142.165.147.216
          (hsdbsk142-165-147-216.sasknet.sk.ca)
----------------------------------------------------------------------    
WKS       Q 12:15:56 (9521)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 141.158.119.119
          (pool-141-158-119-119.pitt.east.verizon.net)
----------------------------------------------------------------------
WKS       Q 12:17:03 (9556)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 81.59.87.42
          (dslam42-87-59-81.dyndsl.zonnet.nl)
----------------------------------------------------------------------
WKS       Q 12:17:05 (9560)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 81.50.196.106
          (AToulouse-206-1-6-106.w81-50.abo.wanadoo.fr)
----------------------------------------------------------------------
WKS       Q 12:17:07 (9579)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 24.98.85.82
          (c-24-98-85-82.atl.client2.attbi.com)
----------------------------------------------------------------------
WKS       Q 12:17:13 (9589)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 80.236.74.213
          (ip-213.net-80-236-74.issy.rev.numericable.fr)
----------------------------------------------------------------------
WKS       Q 12:17:22 (9592)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 80.167.186.245
          (x1-6-00-0c-6e-28-c6-cd.k345.webspeed.dk)
----------------------------------------------------------------------
WKS       Q 12:17:25 (9593)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 80.138.216.95
          (p508AD85F.dip.t-dialin.net)
----------------------------------------------------------------------
WKS       Q 12:19:01 (9646)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 62.163.223.124
          (a223124.upc-a.chello.nl)
----------------------------------------------------------------------
WKS       Q 12:19:05 (9647)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 63.121.234.49
          (63-121-234-49.res.nb.cable.sigecom.net)
----------------------------------------------------------------------
WKS       Q 12:21:25 (9796)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 24.15.14.27
          (c-24-15-14-27.client.comcast.net)
----------------------------------------------------------------------
WKS       Q 12:21:26 (9797)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 83.117.87.199
          (c537557c7.cable.wanadoo.nl)
----------------------------------------------------------------------
WKS       Q 12:21:28 (9798)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 83.117.88.137
          (c53755889.cable.wanadoo.nl)
----------------------------------------------------------------------
WKS       Q 12:21:29 (9799)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 200.56.179.150
          (customer-GDL-179-150.megared.net.mx)
----------------------------------------------------------------------
WKS       Q 12:21:31 (9800)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 24.151.149.112
          (ip-wv-24-151-149-112.charterwv.net)
----------------------------------------------------------------------
WKS       Q 12:21:32 (9801)
      to: schampeo AT hesketh.com
    from: <aaauto1327 AT optonline.net> at 81.167.103.107
          (dyn-81-167-103-107.ppp.tiscali.fr)
----------------------------------------------------------------------

(WKS) is just a marker for "Well known spammer". Anyway, I count 20   
attempts, from the same sender, all from different machines, all with
generic rDNS indicative of broadband/dynamic/dialup service, in nine
countries (US, ES, AR, CA, NL, FR, DK, DE, MX) and on nineteen different
ISPs -- all within eight minutes of one another. Indeed, each attempt
within each group of attempts came mere seconds apart.

-->8-- snip --8<--

All the spammer has to do is send from one unblocked host, and they win.

> >And all this has taken a ridiculous amount of time, so sorry I got my
> >back up about the "lazy, stupid admins" comment earlier upthread. I've
> >basically wasted the flower of my youth on these scumbags, and I'm pretty
> >annoyed about the whole thing ;)
> 
> And rightly so.  I hate spam as much as the next person but I personally
> think that blocking any valid mail at all is too high a price to pay,

Oh, well. We'll just have to disagree on that, as it hinges on our
varying definitions of "valid mail". I come at it from the standpoint
that letting the swamp fester by allowing slackers to run
non-RFC-compliant and ill-secured mail servers is bad for the Internet.

If some blocked mail brings the lax up to a higher standard, so be it.

And all of my rejection messages begin with contact information, and I
accept abuse/problem reports at abuse@ and postmaster@, so if someone
has a problem they can contact me immediately (provided their brain dead
mail server doesn't rewrite the rejection message, like some apparently
do, but that's not really my fault nor within my power to fix) and I can
whitelist or try to educate them.

Back in 97-99 or so, the problem was legit mail servers badly
misconfigured to allow open relay. We fixed that problem, mostly, by
listing them (the stick) until they fixed their servers so we'd accept
mail from them again (the carrot). This is just another phase, made
worse by the prevalance of cheap broadband, the laughably poor security
of Windows, the fools who run those systems directly attached to the
Net, and the evil scumbags who take advantage of it.

> and any ISP who doesn't subscribe to that (i.e. who might be filtering
> my e-mail so I miss important messages) doesn't get my business.  Of
> course, that's why I run my own mail server, so I don't have to deal
> with that.

Sure - so you're not an AOL customer (they require rDNS) or a Verizon
customer (they filter based on SMTP callbacks, which is silly), etc. I
don't blame you.

But I have to do something about the spam - one of my customers actually
requested that their account be disabled a year ago; turns out she was
replying to all of her spam asking to be taken off the spammers lists (a
really stupid idea) and so at one point last year, mail to her (then
six-months-dead account) comprised *43%* of all our inbound spam, over
100 messages a day. I have customers for whom we routinely reject
upwards of 250-300/day. Tagging it all with headers so the end user
could filter was simply taking too much time and bandwidth, for stuff
we could have easily blocked.

And when we got hit with a joe job (someone sending out massive spam runs
with a forged address in our domain in the envelope sender) back in April,
I decided to do something about it. I found that something like 98% of the
spam we got in May was from hosts with generic rDNS, and very few FPs (on
the order of maybe three a week). It's been a very effective strategy here.

> BTW, the "lazy, stupid admin" comment was directed at the people
> who just use something like SPEWS (or similar) and don't make any
> effort to tailor things for their particular site.  You obviously
> don't fall into that category since you do lots of other stuff
> and have actually put thought into it.  Apologies for painting
> with too wide a brush.

Oh, no problem. 

-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com
Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today!
http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/