March 2009 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] how to detect spambots - SPAMTrusted
by Frank Gadegast 16 Mar '09

16 Mar '09

Jeffrey Race wrote: > This simple wheel reinvented many times; need only to apply > current knowledge. If someone will work with me we can > submit the described RFC as is or improved as needed > > > <http://www.camblab.com/misc/univ_std.txt> > based on > <http://www.camblab.com/nugget/spam_03.pdf> > Great. I see two points here: - the group should define regulations to force RIPE-members to detect spam originating from their own IPs - the group should force members to have a working abuse email address (its sad, that the once defined abuse-mailbox field in RIPEs whois never made it to be a needed field, this should be changed ASAP) Our own blacklist under http://www.dnsbl.de sends out thousands of spam reports daily to the email addresses of the network administrators found in RIPEs whois. Most email address do not work (user unknown, mailbox full aso), a lot do send auto-replier with ticket numbers (telefonica is great with this), but never an email, that the case has been solved, most do not react. Currently there are only 2% answering or fixing the problem. Why do we not recommend to implement a system at RIPE, where abuse reports could be CCed to (including the netblock and the email address a report was sent too, the system then could check, if it was the right address and store a timestamp, any ISP should then be informed how he could send an email to RIPE to inform that hes working on it or that the case was fixed) so that RIPE can messure, wich ISP is really fixing abuse cases ? And: if any ISP collects more than 100 cases that are open for more than two weeks without any reaction, the problem network blocks are simply revoked by RIPE ;o) RIPE should be able to implement such a harsh system, because any member signed to not pollute the internet already. Kind regards, Frank > > Jeffrey Race > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

14 35

passive botnet tracker
by Dr. Alexander K. Seewald 09 Mar '09

09 Mar '09

We've built and run a prototype passive botnet tracking system in Austria for the last year. A journal paper is pending and should be ready for the conference - hopefully only a week away from the final version. The gist: Based on a darknet (i.e. unused IP addresses), we analyze incoming packets and classify them into (currently eight) different spambot types based on learned idiosyncrasies of packet and protocol, and reference data (currently by Marshall). The system is based on machine learning techniques, scales extremely well, and can utilize all kinds of reference data. However, to track all spambots worldwide (according to ShadowServer's estimates), we need about 1.5 million unused IP addresses. In times of IPv4 shortage, that is quite a tall order. Unfortunately, spammers have not switched to IPv6 yet - in the full past year, we could not find a single IPv6 packet originating from a spambot. This will probably change in the future, but until we have enough sample data to train our models, IPv6 cannot be used reliably. Lack of reference data (i.e. known botnets, bot types, DDoS/spam sending activity etc.) has been our greatest obstacle so far. We intend to extend the system towards TCP/IP stack fingerprinting (for those bots which have their own stack) and towards true botnet tracking (e.g. by analyzing access patterns & timings) Any comments are welcome. We will try to be at RIPE-58, provided we can get a small talking slot there - half an hour should suffice. Best, Alex -- Dr. Alexander K. Seewald Seewald Solutions www.seewald.at Tel. +43(664)1106886 Fax. +43(1)2533033/2764

12 17

Re: [anti-abuse-wg] survey ?
by Frank Gadegast 06 Mar '09

06 Mar '09

Leo Vegoda wrote: > Hi Frank, > > Frank Gadegast wrote: > > [...] > >> Somebody responsible simply has to step forward and do >> something, there will be no consensus with that many members. > > You mean you want an autocracy? No, thats democracy. Some people step forward and take responsibility. Some of them are being elected and do the job. And you can vote for somebody else, when you dont like, what they are doing. > How will you get everyone to follow the rules of this leader or king? The reason the decision making process is the way it is, is because there is no way to compel network operators to obey a king. If RIPE and the RIPE NCC began to operate in a way that most people thought was unreasonable then most people would ignore RIPE and the RIPE NCC. Well, the provider are ignoring RIPE anyway. They can ignore whatever is helpful to protect the users from spam, because there are no strict rules from RIPE to help against spam-friendly provider. The abuse-field is not mandatory. There are no regulations in RIPE membership contracts, that members are responsible for abuse they cause. But thats, what RIPE has to do to stop abuse. This workgroup is absolutely useless, if there is no interest or consense between all members, because there are members, that will block all regulations against abuse, because they make profit with spam or are not willing to invest time and money to protect the internet. Guess why the abuse-field never made it to be mandatory. Think about, why we are talking over a year now about a clear definition of abuse, without any result. So what now ? Will this group generate a recommendation soon ? Ever ? A test: ------------------------------------------------------------------ everybody on this list, should simply reply now ( ) I want RIPE to have regulations against abuse ( ) I want RIPE to take consequences against spam friendly members ------------------------------------------------------------------ We can stop talking, if we do not get 100% positive response to the first question, because any minority can then stop the whole definition process. We can also stop talking, if we do not get a 100% positive response to the second question, because regulations without consequences will be ignored like it is now. And: if some on this list are not answering, they are not against abuse and will block any progress. Kind regards, Frank > Regards, > > Leo > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

5 4

Re: [anti-abuse-wg] survey ?
by Frank Gadegast 06 Mar '09

06 Mar '09

Leo Vegoda wrote: > Hi Frank, > > Frank Gadegast wrote: > > [...] > >> Somebody responsible simply has to step forward and do >> something, there will be no consensus with that many members. > > You mean you want an autocracy? No, thats democracy. Some people step forward and take responsibility. Some of them are being elected and do the job. And you can vote for somebody else, when you dont like, what they are doing. > How will you get everyone to follow the rules of this leader or king? The reason the decision making process is the way it is, is because there is no way to compel network operators to obey a king. If RIPE and the RIPE NCC began to operate in a way that most people thought was unreasonable then most people would ignore RIPE and the RIPE NCC. Well, the provider are ignoring RIPE anyway. They can ignore whatever is helpful to protect the users from spam, because there are no strict rules from RIPE to help against spam-friendly provider. The abuse-field is not mandatory. There are no regulations in RIPE membership contracts, that members are responsible for abuse they cause. But thats, what RIPE has to do to stop abuse. This workgroup is absolutely useless, if there is no interest or consense between all members, because there are members, that will block all regulations against abuse, because they make profit with spam or are not willing to invest time and money to protect the internet. Guess why the abuse-field never made it to be mandatory. Think about, why we are talking over a year now about a clear definition of abuse, without any result. So what now ? Will this group generate a recommendation soon ? Ever ? A test: ------------------------------------------------------------------ everybody on this list, should simply reply now ( ) I want RIPE to have regulations against abuse ( ) I want RIPE to take consequences against spam friendly members ------------------------------------------------------------------ We can stop talking, if we do not get 100% positive response to the first question, because any minority can then stop the whole definition process. We can also stop talking, if we do not get a 100% positive response to the second question, because regulations without consequences will be ignored like it is now. And: if some on this list are not answering, they are not against abuse and will block any progress. Kind regards, Frank > Regards, > > Leo > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

1 0

Re: [anti-abuse-wg] passive botnet tracker (combined reply)
by Dr. Alexander K. Seewald 04 Mar '09

04 Mar '09

Peter, I think that focussing just on spam is misleading. Although it is currently the most profitable use of botnets, other uses are already demonstrated, such as DDoS, distributed password/encryption cracking, phishing - which could work without spam in several scenarios (e.g. changing HOSTS on the local PC, hacking DNS servers, etc..) - and most of these would tend to give spammers a way to make money without spam. So it is important to find out what they are doing and how many there are. Frank, I applaud your system. By your fast response you even get rid of the problem with static vs. dynamic IP addresses. As long as the major business for botnets is spam, this will continue to work. Of course if only a small set of providers use it, spammers will simply stop using your mailserver to send spam, once it begins to hurt them. Yes, it is relatively trivial to get the IP from the full mail headers (although it is safer to check the IP during the SMTP conversation - I once did a test and there was a difference of about 1% where IP addresses did not match) I even once wrote a system in 2004 to analyze each mail, check whois, find out the abuse email address and send an automatically generated abuse report there... used it for a few months, but as there was absolutely no reponse (well, some email providers complained that they cannot control what their users do...) I stopped it. Our system could be used in a similar way, but tracks even inactive bots which are currently not used to send out spam. Of course they need to generate some other traffic, the nature of which is currently not well understood. Best, Alex -- Dr. Alexander K. Seewald Seewald Solutions www.seewald.at Tel. +43(664)1106886 Fax. +43(1)2533033/2764

1 0

Call for Agenda Items for RIPE 58
by Brian Nisbet 02 Mar '09

02 Mar '09

Colleagues, As you may have seen, registration has opened for RIPE 58 in Amsterdam. With this in mind I'd like to solicit agenda items for the WG session. We would be especially interested in anti-abuse experiences which involved interaction with government or evolution of legislation, but I do not, in any way, intend to be restrictive. If you have a presentation or any information that you think may be of interest to the working group, please let Richard or I know. Regards, Brian.

1 0