June 2004 - NZNOG - lists.nznog.org

RE: Map/schematic over NZ Internet connectivity?
by Brendan Murray 13 Jun '04

13 Jun '04

> Message: 3 > Date: Sun, 13 Jun 2004 11:26:20 +1200 > From: Juha Saarinen <juha(a)saarinen.org> > Subject: Re: [nznog] Map/schematic over NZ Internet connectivity? > To: jon.brewer(a)worldnet.att.net > Cc: 'NZ NOG' <nznog(a)list.waikato.ac.nz> > Message-ID: <40CB911C.3010600(a)saarinen.org> > Content-Type: text/plain; charset=us-ascii; format=flowed > > Jonathan Brewer wrote: > > > I tried InternetNZ with this very question about a year ago, and the > > answer was no. > > I guess there was no follow-up along the lines of "... but we're working > on it"? Give me good/adequate/useful/whatever reasons for doing it and I'll take it to the INZ tech committee. Always nice to add things to the ToDo list. More usefully - others on this list probably already have some/all of a map - where can we access that information if INZ does decide its worth putting together? And how do we keep it up to date?

2 1

Re: [nznog] Zombies
by Ewen McNeill 11 Jun '04

11 Jun '04

In message <20040610051613.GJ20881(a)stateless>, Nicholas Lee writes: >On Thu, Jun 10, 2004 at 04:58:31PM +1200, Ewen McNeill wrote: >> [... suggesting] anti-spam legislation, a legal duty be placed on people >> not to connect/allow to remain connected an insecure/0wned/infected >> system under their control. > >Unlike vehicles, access to the internet for most people is not via a >"public road". [...] >A WOF/license for driving the internet just seems like needless legisation. I actually didn't suggest a WOF/license for driving on the Internet (this time -- although I do actually think it's a good idea). What I suggested was that those who have allowed systems they own to become unsafe/damaged so that they cause harm to others should be made responsible for that harm. And it doesn't seem like needless legislation to me. It's not _my_ systems (or any of the ones I'm responsible for administering) which are sending thousands of spam messages, viruses, worms, to machines across the world. I just get to receive thousands of them a day via all these machines of people who are not taking responisbility for the systems they're connecting to a common resource (viz, the Internet). As Juha says there is a problem with patches not being available. I'd be quite happy to allow "no vendor patch" as a complete defense for the end user (although if the issue is well known the vendor should perhaps be culpable). I'd even be willing to conceed "vendor patch too recently released, couldn't patch everything" with in a reasonable amount of time of the patch coming out. Simply persuading someone to take responsibility for the never-been-patched, installed-stuff-at-random, insecure-OS-design boxes would dramatically reduce the problem. >ISPs already have the power to regulate users this way via their TOS. Its >clear though that all ISPs would have to subscribe to the above for it >to have long-term effect. The days of ISPs taking responsibility for the actions of their users appear to be a fading memory. It's unlikely any ISP would block users with infected machines these days unless all ISPs did it; the only way that all ISPs are likely to do it is if it's a legal requirement. (Otherwise it's a prisoner's dilemma situation.) Ewen

7 6

Re: [nznog] Zombies
by neil gardner 10 Jun '04

10 Jun '04

OK, serious thought here... Bear with me... I may be a) Describing an existing system or b) way off base. Transparent SMTP proxy intercepts all messages and maintains a running total of emails sent per source IP. This running total is actually stored as a time distribution (ie. 10 emails in 10 minutes, then none in 10, then 100 in ten etc) Rulebase periodically examines this time distribution for each source IP. Something like If last 3 matches are >10, >10, >10 then block for 30 minutes per strikeout(sourceIP) and increment strikeout(sourceIP) by one. After expiry of downtime, open them up again. After (say) 90 minutes of non-abhorrent behaviour, decrement strikeout(sourceip) by one. If strikeout(sourceIP) gets to threshold (Say 10) then email user and 48 hours later disable account unless they contact helpdesk and claim to have addressed the situation. You probably want cleverer rules to identify bursts of email, and possibly a training period with rules referrent to earlier data from the same source - this should be able to reliably identify legitimate high volume users - especially if you build in a time of day factor. This should quickly throttle zombies and disable the account if not fixed, but allow for brief infections to be throttled, and if fixed, NOT need manual intervention to unblock. It may impact some legit heavy email users, but mail will bounce, and it should fix itself. Just a thought. Cheers - N. >>> Simon Lyall <simon(a)darkmere.gen.nz> 10/06/2004 1:46:38 p.m. >>> It looks like there are lot of NZ based Zombies sending very large amounts of Spam ( much of it in German) to some ISPs. This has really been going hard over the last hour. I'm seeing adsl accounts at xtra, iprolink and ihug, xtra dialups etc etc. As a related issue, how do people feel about a whitelist RBL of NZ mail servers, It looks like it's not good to just whitelist NZ IPs -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.

6 7

Re: [nznog] Zombies
by Ewen McNeill 10 Jun '04

10 Jun '04

In message <s0c876cc.089(a)LEO.ALLIEDTELESYN.CO.NZ>, "neil gardner" writes: >To be fair though, in mentioning an opt-out system I was thinking of >clueful users deliberately running their own servers that would notice >within minutes that port 25 had been blocked - not the SMTP AUTH crowd >which may be significantly less clued up and not notice why their >previously working 'Email Thingy" isn't working anymore. The clueful users can always build tunnels and route stuff through the tunnels. I do this from my laptop when working in various organisations where I still want to send mail via my own mail server (because, eg, it's the only one listed in the SPF rules). SMTP AUTH is harder, but at least as a first cut simply permitting connections that did SMTP AUTH would probably select for the "good" connections and ignore the bad ones. Much the same for STARTTLS -- anything using that is probably not malware, at least at present. Most malware barely manages to interoperate with SMTP servers let alone actually supporting "fancy" features. As I've suggested before blocking some of these services by default, and providing an "enable this service again" automatic system for clueful users would be nearly as useful as trying to do layer-7 filtering on the protocol. It could even require turning on again with every reconnection, totally doing away with the need for the ISP to store anything associating permissions with the user. (Anyone who can't automate a GET of, eg, http://ihaveaclue.$ISP/enable?services=smtp or similar on reconnect doesn't have the necessary clue.) On a related tack, I am seriously considering writing to the appropriate government ministers and suggesting that, as part of their proposed anti-spam legislation, a legal duty be placed on people not to connect/allow to remain connected an insecure/0wned/infected system under their control. With the first breach resulting in mandatory disconnection of the system from the network, not to be reconnected until person had completed a course on "network security" and had their machine certified "cleaned up" by someone appropriate. Subsequent breaches resulting in that and fines and/or longer periods of mandatory disconnection. IMHO such insecure/0wned/infected systems are a nuisance (in the legal sense of the word) and thus the owners of them should be responsible for the damage they cause. Ewen

4 3

Google and MaxNet
by Cameron Kerr 10 Jun '04

10 Jun '04

Hello, is anyone getting `Your client has issued a malformed request' messages from Google when connected via MaxNet? I've tried with lynx, links, and Firefox. I'm getting these messages, not because my client is issuing a malformed request, but rather that MaxNet's transparent proxy is serving this. tcpflow reports the following in the response. Note the line that says `HIT' in it. HTTP/1.0 400 Bad Request Date: Tue, 08 Jun 2004 22:59:04 GMT Content-Type: text/html Server: GFE/1.3 Cneonction: Close <=== Hmmm, this is interesting. Content-Length: 1207 Age: 40 X-Cache: HIT from proxy2.akl1.maxnet.net.nz Connection: close This doesn't always happen under Firefox (it happened the first time, but after that, it worked ok. I'm guessing it's because of the short lifetime (Age: 40 seconds). Can anyone duplicate this? Just to be safe, I've disabled the transparent proxy here, and have no other proxy configured (direct connection). This was happening last night too. -- Cameron Kerr cameron.kerr(a)paradise.net.nz : http://nzgeeks.org/cameron/ Empowered by Perl!

12 22

Re: [nznog] Zombies
by neil gardner 10 Jun '04

10 Jun '04

To be fair though, in mentioning an opt-out system I was thinking of clueful users deliberately running their own servers that would notice within minutes that port 25 had been blocked - not the SMTP AUTH crowd which may be significantly less clued up and not notice why their previously working 'Email Thingy" isn't working anymore. I had the further thought that you could use some higher layer content inspection device to drop all SMTP traffic unless it's either to your own SMTP IP, or part of an SMTP AUTH conversation but that is way less than trivial as you'd need to completely proxy the sessions up until SMTP auth at least.... I'd say it was do-able, but not trivial. Cheers - N. >>> Nathan Ward <nznog(a)daork.net> 10/06/2004 2:50:13 p.m. >>> On 10/06/2004, at 2:43 PM, Perry Lorier wrote: > This breaks SMTP AUTH for people who send mail via another machine on > the Internet, because that host is the only one allowed to send with > SPF. > You conveniently ignored the opt-out system he mentioned. However for such an opt-out system to work, your packet filters would have to adjust themselves as dynamic users log in and out. That would suck. -- Nathan Ward _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.

4 3

RE: [nznog] Zombies
by Gordon Smith 10 Jun '04

10 Jun '04

The problem with that would be dynamically assigned addresses, unless you included a lookup being done against your radius databases by the SMTP proxy, so that the user can be identified. Possibly, a better solution would be to analyse netflow data as it hits the collectors, and identify offending machines that way. By using netflow, you can extend detection of worms, etc to include all ports, rather than just port 25 Doing dynamic throttling of infected connections is much more difficult - there's not a large range of equipment out there that can do that reliably, although the Juniper ERX does spring to mind :-) But that's not a box you'd find in most ISPs Cheers, Gordon > -----Original Message----- > From: neil gardner [mailto:neil.gardner(a)alliedtelesyn.co.nz] > Sent: Thursday, 10 June 2004 3:20 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] Zombies > > > OK, serious thought here... Bear with me... I may be a) Describing an > existing system or b) way off base. > > Transparent SMTP proxy intercepts all messages and maintains a running > total of emails sent per source IP. This running total is actually > stored as a time distribution (ie. 10 emails in 10 minutes, > then none in > 10, then 100 in ten etc) > > Rulebase periodically examines this time distribution for each source > IP. Something like > > If last 3 matches are >10, >10, >10 then block for 30 minutes per > strikeout(sourceIP) and increment strikeout(sourceIP) by one. > > After expiry of downtime, open them up again. After (say) 90 > minutes of > non-abhorrent behaviour, decrement strikeout(sourceip) by one. > > If strikeout(sourceIP) gets to threshold (Say 10) then email user and > 48 hours later disable account unless they contact helpdesk > and claim to > have addressed the situation. > > You probably want cleverer rules to identify bursts of email, and > possibly a training period with rules referrent to earlier > data from the > same source > - this should be able to reliably identify legitimate high volume > users - especially if you build in a time of day factor. > > This should quickly throttle zombies and disable the account if not > fixed, but allow for brief infections to be throttled, and if > fixed, NOT > need manual intervention to unblock. It may impact some legit heavy > email users, but mail will bounce, and it should fix itself. > > Just a thought. > > Cheers - N. > >

3 2

RE: [nznog] Zombies
by Gordon Smith 10 Jun '04

10 Jun '04

Neil gets my vote. This is by far the best solution I've seen in years :-) And it's extendable to other protocols as well..... Cheers, Gordon

1 0

Re: [nznog] Zombies
by neil gardner 10 Jun '04

10 Jun '04

Point taken. OK, revised suggestion is this: Cut port 25 entirely, when people call to complain, press a button to play this recorded message. "Dear customer, in order to combat the Child pornography, Terrorist communications and Spam being sent by infected computers - WHICH YOU MAY HAVE! - we have blocked all popular email programs form communicating to the Intarweb thingy. In future, please feel free to use http://webmail.isp.co.nz for your email requirements. If on the other hand you support Child Pornography, are a member of an active Terrorist Cell, or wish to get a b1gger p3nis now!, then please press (1) and we'll unblock your evil Email connection." Cheers - Neil G ps. Sorry - I'll get back ontopic by about Tuesday week. :-) >>> Juha Saarinen <juha(a)saarinen.org> 10/06/2004 2:58:56 p.m. >>> neil gardner wrote: > To be fair though, in mentioning an opt-out system I was thinking of > clueful users deliberately running their own servers that would notice > within minutes that port 25 had been blocked - "Hey Mr/Ms Helldesker, how come nobody can send us mail anymore?" -- Juha NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.

1 0

Re: [nznog] Zombies
by neil gardner 10 Jun '04

10 Jun '04

>>> Simon Lyall <simon(a)darkmere.gen.nz> 10/06/2004 1:46:38 p.m. >>> >It looks like there are lot of NZ based Zombies sending very large amounts >of Spam ( much of it in German) to some ISPs. Would it not be relatively easy to drop all port 25 traffic unless it was directed at your own SMTP server? * (Or are the Zombies sending through your SMTP anyway?) Cheers - N. * - Allow an opt out for anyone that even notices - if they notice, they won't be part of the problem. NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.

3 2