September 1997 - lir-wg - mailman.ripe.net

LIR WG at RIPE 28 - draft agenda
by Mike Norris 21 Sep '97

21 Sep '97

RIPE 28 - 24th to 26th September 1997 Local IR Working Group D R A F T A G E N D A 1. Preliminaries - select a minute-taker - agree agenda, times 2. RIPE 27 - minutes - actions - RIPE NCC Regional Registry to continue: - external auditing & monitoring - internal consistency and quality control - LIR courses (see Item 3 below) - RIPE NCC to re-publish ripe-140 as a new document with changes agreed (see Item 4 below) - M. Norris to start discussion on web-assisted reverse delegation, address assignment (see Item 5 below) - J. Keery to draft specs for web-based forms (see Item 5 below) 3. Reports from registries - European regional (RIPE NCC) - other registries, significant events - other regionals, coordination - APNIC - ARIN (formerly InterNIC) - AfriNIC 4. IP Address Space Assignment - RIPE policy, ripe-159 - registered PI addresses - use of available what-used-to-be-called Class A space 5. Registry procedures - web-assisted assignment, reverse delegation - tools, forms for local registries 6. Input/Output with other Working Groups - Database - Routing - DNS - NetNews - other 7. Statistics - reverse DNS counts, errors - effects of NAT, firewalls and private addresses 8. AOB - mailing lists - some information on the RIPE mailing lists, their purpose, how they are maintained, monitored and filtered. - anti-spamming proposals - we've seen some proposals from Luis Miguel Sequiera and some good discussion of anti-spamming measures on this list. The RIPE chairman will allow time for some discussion on this in the plenary, but at its meeting before the plenary, the LIR WG might like to bring the e-mail discussion to a conclusion and form a specific proposal for RIPE action. - - Mike Norris 19/9/1997

1 0

THANK YOU!
by Poul-Henning Kamp 20 Sep '97

20 Sep '97

1 0

Re: Spammers hapless fate = ISP toil and sweat
by Luis Miguel Sequeira 19 Sep '97

19 Sep '97

Hello, I normally just lurk around this mailing list, but I think I'll contribute my two cents this time... Spamming is a serious problem. Here at Esoterica where I am, unsolicited email was about one half of total email traffic - which is quite a lot. Thus, our postmaster has dedicated all his available time to implement anti-spamming measures. What he found out is this: Firstly, far from being "mindless robots", the companies in the spamming business are cold-hearted professionals. They have teams of professional programmers spending all their time just to develop new and more effective ways of illegally sending out unsolicited email - using several clever relaying mechanisms. They work full-time on the job. They are a strong force which will easily overthrow any basic measures taken against spamming - like simply filtering up domains, or blocking traffic from relaying machines. Secondly, they are vindictive and protect their own jobs. This means that if an ISP tries to agressively implement anti-spamming mechanisms, they will fight back! And how they do this? For instance, they send out forged emails with these ISP's addresses. What happens? Entities receiving the forged emails will complain to the ISP in question. The ISP replies telling that the emails are forged, trying to make them understand that this is the "spammer's revenge". Most of these entities either don't care or don't believe, so they just shut the ISP off their firewall (especially if on the next day they get a new lot of unsolicited email apparently coming from the same forged addresses...). This forces the ISP to open up themselves to spamming from this particular company, hoping that they won't forge spamming attempts in the future... As you see, they're quite clever. Their businesses and jobs depend on their cleverness. How can ISP's successfully "fight back"? First, and foremost, they need to assume that the "threat" is serious. Secondly, allocate resources to the job - this means a *lot* of time. But thirdly, and I think that's the major issue here, by sticking together. While a single postmaster probably won't be able to do much work single-handedly, having a group to coordenate the work is helpful. Some free time taken from a group of postmasters adds quickly up to a "task force" of some magnitude... Basically, what our postmaster found out is that denying access is not a good measure - spamming companies will try every trick of the trade to get through or else they will try to hurt the blocking ISP in some way. UUNet, for instance, has publicly announced their "zero tolerance" towards spammers - it's no wonder that perhaps half of the spammers use now forged emails (and dial-up accounts) coming from UUNet to spam the net. Their hope is getting enough ISPs blocking UUNet's traffic so that UUNet is "forced" to "open" their machines to spamming again... (in our case, as a transit customer of UUNet I obviously can't block traffic through them :-) ) Better is just to difficult their action. Remember that their jobs depend on getting as many messages through as possible (using third-party relayers). If a sendmail configuration just lets a few messages through, or selectively blocks some domain for a while, this means that this machine will only deliver a few messages - when spammers rely on tens of thousands to be delivered. This is uninteresting to them. They will thus use other machines as relays. Of course, this also means that your own users will see a delay on the sending of their own, legitimate messages. It's a tradeoff. By using a combination of these tricks one can try to keep the spammers away for a while - until they develop a new creative method for spamming again. We have seen all sorts of very clever and ingenious methods to get through. Who knows what else they will invent next? By keeping a mailing list with several postmasters' contacts it's possible not only to exchange domains from where the spammers usually attack, but anti-spamming techniques and tricks. There are some steps being taken at a national base here in Portugal (from where I'm writing :-) ) but, as shown by the traffic generated on this list on this topic of spamming, I'm going to make the suggestion again, at this level... Do you think that there is some interest in mantaining a mailing list for all postmasters from the LRs for the sole purpose of discussing anti-spam techniques and listing spamming domains and relay machines? Would RIPE be interested in "sponsoring" this mailing list? BTW, searching through the RIPE's Web site, the only mention to spam is on RIPE-162, chapter C2.1. This basically states the commitment of RIPE to mantain the mailing lists spam-free. I wonder if there is already a "task force" in place for anti-spamming measures. We're aware of some efforts on an international basis - mostly some Web sites with interesting information and data on anti-spamming measures, with associated mailing lists - but to my personal knowledge, there is no such coordinated effort at RIPE (so far :-) ). There is also an issue of local laws. Filtering out spam *could* be illegal on some countries (it violates freedom of speech). In Portugal, spamming is actually illegal - it's "unsolicited email", and this is an abuse of a third party's infrastructure, ie. using computational (and telecommunications) resources that you aren't allowed to. This makes it a crime according to Portuguese law. There is a case of mail bombing (a particular kind of spamming...) brought to court - it will take ages to be ruled and probably the offender will get away with some community work :) but it will be judged in court. Of course, on other countries, freedom of speech may be more important than using others' telecommunications resources. I wonder if local laws will actually work *against* a RIPE-based global effort across Europe. On 12-Sep-97 "Scott A. Marlin" wrote: >Which basically means that any customer is free to spam. The ISP is >there to take the rap and clean up afterward. I think for such matters, >the "spammer" should be held responsable ... like being charged a flat >or hourly rate for the cleanup job. This is the case around here. Of course, catching the spammer and actually condemning him/her in court in order to charge him/her that rate is another story, especially if we're talking about an international incident. Better to prevent him/her to spam on the first place. >Incidently, in the cited case, I sent a mail to an address mentioned in >the ad asking them to stop sending the ads. What I got back was another >mail from another source (obviously from a blind mail-robot) with *lots* >of info about their services. > >At the bottom of the e-mail was an URL address for those who wished to >stop the ads from being sent. Waaaay down at the bottom of this web site >plugged full of promotional information was the opportunity to >"register" my name in the database of those who didn't want to receive >any more spam (the name of the link was a baby crying "mommy ... they >thpammed me again".) Really ! One of the major issues about spamming customers is knowing how many people were actually reached by a spamming effort. Spamming companies have found out that these two tricks - "send email here to be deleted from our database" and "click here to remove yourself from our database online" - are the best to know if you're reaching people. Also, many postmasters will contact the spamming company in order to complain. Based on all this feedback, spamming companies can determine a "success rate" for their spamming efforts. This keeps their own customers happy... A better way to deal with this is simply ignore the message, and make sure that all your users ignore the spam, too. In the long end, this means a lower "success rate" for a particular domain/spamming technique, so the spamming companies will probably try somewhere else. >The entire operation took about 30 minutes. I haven't heard from them >since. But I have recieved at least 10 unsollicited e-mails since then. My bet is, they will try again and again and again. The problem is, each time your address is found on a Usenet post, on a subscription web site or on a mailing list, there is a high probability of someone "selling" your email address to a spamming company. For instance, I'm receiving spam to addresses that have been disconnected 2 and 3 years ago... DejaNews and other public sites with lots and lots of addresses are a perfect place to get all those addresses for the spamming lists... - Luis Sequeira ____ \ Esoterica - Novas Tecnologias de Informacao, SA :-) Luis Miguel Sequeira /___, lms(a)esoterica.pt http://www.esoterica.pt/

12 24

RE: Spammers hapless fate = ISP toil and sweat
by Toby Williams 19 Sep '97

19 Sep '97

So.. Sysadmin's have a range of techniques for stopping unsolicited mail, but everytime it's used, a new way is found to get around it. This sounds to me like spam is going to go on forever. Earlier on in this discussion, it was mentioned that spammers use test accounts to see if they get mail back - if you spam, you need to know how effective you are so that you can punish whoever tries to stop you etc. It makes sense. So why not focus upon making the spammers think they have succeeded. If there is a way of stopping spam to all but the test accounts then we are on a winner ;-) Maybe spammers could even get sloppy, if they thought that their work was successful. Any ideas as to how this could be achieved? As a second way of stopping spam, I think Europe has to push for a very clear law which defines spamming and can be used to prosecute those that are careless enough to give away their origins. Currently being a spammer could be deemed as a bit of a "buzz" - trying to beat the sysadmins at their own game etc. How about making spammers realise that they're disliked and are on a very fine line towards getting locked up ...seriously, if spamming is to be stopped for good, unfortunately spammers will have to be shown zero tolerance in legal terms. Either this will be achieved through court cases based on existing laws (such as the Portugese "unsolicited use of resources" law) or through new legislation specific to spam. Does anyone have access to legal resources who would be able to point us in the right direction? OK, I accept I have committed a bit of a "faux pas" mentioning Law ;-) but as far as I see, we are all having our resources used to devalue the commodity we trade in - Internet, and the only way to stop this is to 1. Make spammers think they're winning when they're not and 2. Make spammers pay for their abuse ten times over until they get the message that European ISPs will not tolerate abuse of their resources. Otherwise, as is the situation currently, our message will be "we don't like them, but will continue to play the game by your rules". Regards, Toby Williams BusinessNet UK - Internet for Business -----Original Message----- From: Poul-Henning Kamp [SMTP:phk@critter.freebsd.dk] Sent: 17 September 1997 19:54 To: Ina Faye-Lund Cc: local-ir(a)ripe.net Subject: Re: Spammers hapless fate = ISP toil and sweat In message <3.0.1.32.19970917202718.0190e980(a)online.no>, Ina Faye-Lund writes: >At 16:01 17.09.97 +0200, Poul-Henning Kamp wrote: > >>Have RIPE send a formal letter to AGIS and the IEMMC who >>houses most of these creep, and tell them that either they will >>cease to send spam to the following list of top level domains: >>{be, dk, ...} effectively today or the RIPE will orchestrate >>a pan-european filtering of all AGIS and IEMMC member networks >>until such filtering is in place. It should be pretty simple to >>simply filter all routes based on AGIS AS#(s), and maybe inject >>a bogus route for the IEMMC members networks. > >That sounds like a good idea. Hmm... What about rejecting in the >router; access-lists? That's what we mostly use, and that would Simply deny all routes that originate in AS4200 :-) -- Poul-Henning Kamp FreeBSD coreteam member phk(a)FreeBSD.ORG "Real hackers run -current on their laptop."

4 5

Re: Spammers hapless fate = ISP toil and sweat
by Espen Vestre 19 Sep '97

19 Sep '97

Luis Miguel Sequeira <lms(a)esoterica.pt> writes: > I fail to understand from where these guys get Internet connectivity. > It would violate almost any AUP I know of... Unfortunately, some well-known ISPs, especially Psi.Net and UUNet, but several others also, continue to give these guys internet connectivity. Customers of these providers are starting to discover that they are losing mail connectivity, so let's hope the AUP-ignoring ISP's will lose in the (not too) long run. -- regards, Espen Vestre Telenor Nextel AS Norway

7 6

Spammers
by francois.weil＠chiptechnologies.fr 18 Sep '97

18 Sep '97

In this case, spammers have got two level of success ... First we did receive unsollicited messages, that I considere to be a kind of violation of property. Non depending of law, I can decide to respond or not, and I can decide if law allows to defend, or if it doesn't to agress spammer. The second level of success is that people generates lots of Emails, ..., sorry but I found it funny. Well. My attitude is to leave mailbox open, and to put most of contents in the basket. Filtering is not possible, as well as spammers use some technics that we have not time to study. A software filter could try to examine coherence of Emails. Such as a specific format which could contain legal informations. A legal mail should contain a real reply address, or something that certify that sender exists, and is ready to respond to any asks. If messages I receive does not contain some informations, I can decide to destroy them. If messages does not contain but come from precise addresses, I can decide to keep. It is an idea. When I take my mail in my post-mailbox, at home, I have the same attitude. Rgrds

1 0

Re: Spammers hapless fate = ISP toil and sweat
by Javier Llopis 18 Sep '97

18 Sep '97

On Wed, 17 Sep 1997 20:21:52 +0200, Ina Faye-Lund wrote: > >>There is also an issue of local laws. Filtering out spam *could* be illegal >>on some countries (it violates freedom of speech). > >I though that "freedom of speech" only gave you the right to say what you >wanted without fearing punishment from the government, but not where you >want. Now, I don't know the laws in all countries. Does anybody know >of any country with such laws? No, I don't think the issue has anything to do with freedom of speech. The spammers are using someone else's resources for their marketing campaign. Our mailbox REALLY IS a space for publicity, but it is OUR PROPERTY and using it without your consent is THEFT. Just as if someone interrupted a TV broadcast to show their own commercials without paying the studio who owns the frequency. No judge in any country would consider the rights to speech of the offender in this case. I don't know about you but if I could get $200 for every spam message that appears in my mailbox I would look forward to them and if my company could get a fair retribution for the messages relayed through their line and servers way they'll be happy to do it. The thing that makes spam evil is that neither Internet companies or the individuals who are the target for spam get any compensation for the abuse of their resources. ------------------------------------------------------------ Javier Llopis javier(a)bitmailer.com "It is best to assume that the network is filled with malevolent entities that will send packets designed to have the worst possible effect." - F.Baker, RFC1812 ------------------------------------------------------------

1 0

Re: Spammers hapless fate = ISP toil and sweat
by Espen Vestre 18 Sep '97

18 Sep '97

Nick Hilliard <nh(a)iol.ie> writes: > This is a bit off topic, but I disagree. If you're as unscrupulous as these > guys, getting new IP numbers is as easy as this: Are you suggesting that some of these guys are connected directly to the backbone and thus able to make BGP announcements? Oh-oh. -- regards, Espen Vestre Telenor Nextel AS

3 2

Re: Spammers hapless fate = ISP toil and sweat
by Pontus Ekman 17 Sep '97

17 Sep '97

At 17:38 1997-09-16 -0000, you wrote: >Hello, > >I normally just lurk around this mailing list, but I think I'll >contribute my two cents this time... > >Spamming is a serious problem. Here at Esoterica where I am, >unsolicited email was about one half of total email traffic - Luis, I would say your essay was more than two cents worth: More like two (sizeable) golden nuggets. I move RIPE that takes the suggested task force under consideration. The major problem may be to keep any analysis and proposed countermeasures out of the adversaries´hands. Pontus Ekman > -------------------------------------------------------------------------- Pontus Ekman tfn 08-783 20 40 pi.se AB e-mail Pontus.Ekman(a)pi.se BOX 24 116 fax 08-783 20 46 Karlavägen 104 pl 7 http://www.pi.se 104 51 STOCKHOLM Sweden --------------------------------------------------------------------------

2 1

discussions will be continued on lir-wg list
by Mirjam Kuehne 17 Sep '97

17 Sep '97

Dear local IR's, The list <local-ir(a)ripe.net> was meant to be used for announcements and information relevant for contributing local registries. Local registries are automatically subscribed to this list when they become a registriy and they cannot unsubscribe. Therefor we try to keep the traffic on this list very low. We have decided to move the discussions currently going on on <local-ir(a)ripe.net> to the working group list <lir-wg(a)ripe.net>. If you are interested in following these discussions you can subscribe to the working group list by using majordomo. If you have further questions, please do not hesitate to contact <ncc(a)ripe.net>. Kind Regards, Mirjam Kuehne Manager Registration Services RIPE NCC

1 0