- NZNOG - lists.nznog.org

Spoofed mail
by Matt Camp 21 Mar '02

21 Mar '02

Is anyone else getting strange spoofed mail from saarinen.org, or mail from there destined to lists with your own address as the spoofed source? Email to Juha isn't getting any sort of response, so I figure he's either been hax0red, or needs a beating with the clue stick. (possibly both?) Either way, Make It Stop. Now. ---------------- Return-Path: <owner-nznet-gargoyle-noise-gargoyle=noise.net.nz(a)noise.net.nz> Delivered-To: gargoyle-noise-gargoyle(a)noise.net.nz Received: (qmail 28603 invoked by uid 30); 20 Mar 2002 22:16:36 -0000 Delivered-To: nznet(a)paradise.gen.nz Date: 20 Mar 2002 22:16:36 -0000 Message-ID: <20020320221636.28602.qmail(a)tombstone.b.org.nz> From: gargoyle(a)tombstone.b.org.nz Cc: recipient list not shown: ; Received: (qmail 28590 invoked from network); 20 Mar 2002 22:16:33 -0000 Received: from saarinen.org (HELO ehlo) (203.79.82.14) by tombstone.paradise.gen.nz with SMTP; 20 Mar 2002 22:16:33 -0000 test Sender: owner-nznet(a)noise.net.nz Precedence: bulk Reply-To: nznet(a)noise.net.nz Return-Path: <testy(a)test.com> Delivered-To: gargoyle-noise-gargoyle(a)noise.net.nz Received: (qmail 11126 invoked from network); 21 Mar 2002 01:50:48 -0000 Received: from saarinen.org (HELO helo) (203.79.82.14) by tombstone.paradise.gen.nz with SMTP; 21 Mar 2002 01:50:48 -0000 test --- Matt Camp - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 4

Re: Spoofed mail
by Mark Foster 20 Mar '02

20 Mar '02

Amazing the influence 'script kiddies' have had on the way we diagnose problems, isnt it? :P At 14:40 21/03/02 +1200, Matt Camp wrote: >Ok, problem resolved... no script kiddies in sight, just some mail servers >refusing to do TLS happily, and majordomo adding headers when it should >be. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Matt, could you please call me?
by Juha Saarinen 20 Mar '02

20 Mar '02

Do a whois on my domain for the number. Can't email you... Sorry for the OT post, but I have no other way of contacting Matt. -- Juha Take off every sig! - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: The SRS and Lame Delegations
by Ewen McNeill 18 Mar '02

18 Mar '02

NOTE: I've been trying to avoid being drawn into this discussion, as I'm working with the registry implementation team at present, but I feel I should comment on this. In message <Pine.LNX.4.44.0203191150120.1813-100000(a)belsay.lionra.net.nz>, Andy Linton writes: >I'd argue that unless the name appears in the DNS it shouldn't appear in >the registry as its appearance of the name in the DNS that gives the >registry any authority it has. I'm generally of this view too. While I'm not totally against "database only" registrations, I tend to prefer that registrars that are "parking" names (for want of a description), do so by putting up DNS entries that point at a "this name is reserved for $foo" type webpage. (This also simplifies the code at the registry.) A lot of people typically check for name availability by looking for NS records, or web pages, or MX records for the zone; and I haven't yet seen a strong reason why this should be defeated. >I'd like to see the registry operate on the principle that the names >registered are listed in both the registry's database and the DNS (plus or >minus the next scheduled update). This implies that the nameservers should >be operational and checked at the time of resistration. However it doesn't imply that it should be the registry that does this checking that the nameservers are operational. The SRS (business framework) relies on the registrars Doing The Right Thing (tm) in various instances, and it seems to me that ensuring the nameservers are working is another thing that the registrars should be doing. Much of the "nameserver isn't ready yet" type concerns could be "solved" by simply requiring registrars to ensure that the nameserver is ready by the next zone build. (Then a registrar that is doing a registration against their own nameservers can simply schedule their nameserver reload to happen shortly before the registry zone build happens. Registrations against external name servers would probably need checking before registration, by the registrar, as they are now.) Some appropriate entity (perhaps the registry, but perhaps more appropriately the DNS manager) should be responsible for "quality checking" delegations, by periodically doing a zone walk and looking for lame delegations. When found the DNS manager could take the issue up with the appropriate registrar (in terms of "being a good registrar"). Registrars may wish to walk their own portion of the delegations periodically as part of being a good registrar/keeping their registrants in line. FWIW, I can't help thinking that this has been discussed a few times before in the past. Ewen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

RE: The SRS and Lame Delegations
by Zanetti David 18 Mar '02

18 Mar '02

From: Peter Mott [mailto:peter.mott(a)2day.com] > [1] Registrar should be able to register a name without specifying any name > servers Since Peter has raised this, how does everyone else feel about allowing registars to reserve names on behalf of nameholders in this way. Should the name have no entry in the zone, something explanatory like a TXT record, or should we not allow this at all, and that only fully delegated names be allowed? -- David Zanetti <david.zanetti(a)nzpost.co.nz> Security Engineer, New Zealand Post Desk: +64-4-496-4005 Mobile: +64-25-832-572 "Hope.. is a dangerous thing" This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

The SRS and Lame Delegations
by Zanetti David 17 Mar '02

17 Mar '02

Thorny issue I'm sure everyone has a view on: Should the SRS test given nameservers for a name for authorativeness at submission (ie, check for lame delegations), and if so, should it require all provided nameservers to give authorative answers, or a minimum number (suggest please :) ). If it does perform such checks, how often should it repeat them? Agreement by all is not being sought, just arguments either way. -- David Zanetti <david.zanetti(a)nzpost.co.nz> Security Engineer, New Zealand Post Desk: +64-4-496-4005 Mobile: +64-25-832-572 "Hope.. is a dangerous thing" This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 5

Re: The SRS and Lame Delegations
by David Farrar 17 Mar '02

17 Mar '02

> Thorny issue I'm sure everyone has a view on: > > Should the SRS test given nameservers for a name for authorativeness at > submission (ie, check for lame delegations), and if so, should it require > all provided nameservers to give authorative answers, or a minimum number > (suggest please :) ). If it does perform such checks, how often should it > repeat them? > > Agreement by all is not being sought, just arguments either way. Would another issue be whether the registry should do this checking at all, or should it be a policy requirement of registrars to check for this? DPF - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Spam on the increase again
by Simon Byrnand 11 Mar '02

11 Mar '02

At 12:50 12/03/02 +1300, Simon Lyall wrote: >On Tue, 12 Mar 2002, Simon Byrnand wrote: >> I've been trialing orbz and ordb in the last couple of months (not related >> to orbs) and they've been very good. Naturally I've kept a very close eye >> on it, but I've only had 2 instance where genuine mail wasn't getting >> through that I know of - and in both cases they WERE actually open relays. >> I was easily able to add an exclusion for those two servers until they got >> off their ass and fixed their open relay. (Both did after a couple of >> weeks) Both also have good and fast removal policies so they're not the >> sort of list that once you get on you can never get off...(ala the original >> orbs :) > >I find orbz a bit of a pain, they are very fast to add us when a customer >is open relay and using us as a smart-host. I've now got them notifying >me/noc directly so that as soon as then add us (provisionally I think) we >get notified and can (a) block the customer from our mail servers (b) >notify orbz to retest (c) contact the customer. If you're only a smart host for your customer who is actually the open relay, then at worst you should find yourself on their "outputs" list, but not on the "inputs" list. I only use the inputs list, which is what they recommend for exactly that reason...if others use the outputs list they do so at their own peril. Yeah, it might be a bit of a pain for you, but it has served its purpose - it's alerted you to an open relay within your netblock which more than likely has already passed some spam. (Otherwise nobody would have bothered to submit it to orbz in the first place) Actually I think they should notify the netblock owners by default rather than being "opt in", as it would get a lot more open relays fixed, but they say that would constitute spam ;) >With respect to NZ spammers we had a problem with one going around all the >Cyber Cafes and using computers there to send email, we have put in a >block for those however. I understand the spammer in question (various >e-gold (or something) related scams) was causing problems with other >people as well. Heh. I don't think I've come across that one. Yet... Regards, Simon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Spam on the increase again
by Simon Byrnand 11 Mar '02

11 Mar '02

At 14:00 11/03/02 +1300, David Robb wrote: >On Mon, 11 Mar 2002, Simon Byrnand wrote: > >> I don't know if anyone else has noticed the same thing, but spam seems to >> be on a major increase again, that makes last time (a few months ago when I >> started a thread about it then) seem like nothing by comparison. I've also >> read a couple of articles in the online press bemoaning the latest resurgence. > >I've seen a fairly large amount all with a similar pattern - all claiming >to be from [random characters](a)yahoo.com. Yep, I was seeing a lot of that too... Regards, Simon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Spam on the increase again
by Simon Byrnand 10 Mar '02

10 Mar '02

I don't know if anyone else has noticed the same thing, but spam seems to be on a major increase again, that makes last time (a few months ago when I started a thread about it then) seem like nothing by comparison. I've also read a couple of articles in the online press bemoaning the latest resurgence. I'm curious to know what (if anything) other ISP's are doing to try and counter the flood of spam that seems to be happening lately. Last time around I was mainly finding out about specific spam from customers forwarding it to me, this time around I'm receiving it myself as well, and in fairly large quantities. :-( So much so that I decided to go through and identify the source of my last weeks spam, including all the stuff in my postmaster bounce box for the last week. (Yeah, ok, I probably had too much time on my hands, but it was really frustrating me :) Double bounces are extremely common with spam, because all it takes is a spammer sending to a local address that doesn't exist anymore, (which happens frequently, because they like to target multiple envelope addressees with the same message and never remove anyone off their lists) using a reply to address which is fake. (Which is the case 95% of the time, including the infamous "Reply with the word REMOVE to be removed" messages) Because of that nearly every double bounce is spam, all nicely sorted for me including headers :) I ended up adding over 100 entries to my manual blocklist just in the one session...in a way its just a futile outlet for frustration, but I did find some interesting statistics: * The bulk of the spam for the last week (by message count) was sent by just a few (<20) sources, with one particular case where the same source was spamming the same 30 addresses nearly every hour. (Eeek) Most of the other sources were only one message a piece. (In other words they were probably randomly used relays, rather than the original source, since a number of the messages were identical although the last hop relay was different) * Almost every message has the return address forged, (surprise ;-) usually to a well known domain, like yahoo.com. * A large percentage have ip's that don't resolve. Together with setting the HELO response to the name of the domain they're impersontating, it can be easy to overlook their forgery in the Recieved by lines, eg: Received: from bigpond.com.au ([211.251.218.2]) It's not until you remember that the hostname should be within the parenthesis that you realise its fake.. :) * Some spammers seem to group email addresses together by domain name and send them as one message (presumably to save bandwidth, by letting the destination MTA handle the multiple delivery) but in doing so they often also list all the email addresses in the CC: field which looks VERY bad to any customer receiving that mail. (They think a group of email addresses have been "sold" to spammers, when its really just "normally" harvested addresses being sorted by domain) * Most ip addresses seemed to be either schools or businesses in Korea, or ADSL addresses in the US, Australia or the Netherlands. Very few (maybe 5%) of the spam actually came legitimately through the mailserver of the domain it purported to be from. Anyone else have any similar experiences ? Anyone else keeping track on spam or trying to fight it in any way ? While I'm on the subject, what is the accepted contact address these days for reporting spam to (NZ) ISP's ? postmaster@ or abuse@ or ? I forwarded a copy of spam that originated at an NZ ISP to postmaster@ their domain but havn't heard back yet. I realise that the postmaster address can be a bit over-used since thats where most MTA's like to send their delivery notifications etc to.... Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2