Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky)
From: Szilveszter Adam <adam () hif hu>
Date: Thu, 04 Mar 2004 15:55:37 +0100

Maybe I should know better, but I can't resist...

Bill Royds wrote:

 Having a MS record would not eliminate spam coming from users validated on
the sending server, but it would identify the server that it comes from as
"knowing" the sender name. Compromised client boxes would need to use the
ISP mail server to send mail, rather than  spewing it directly, since the
servers allowed on the MS entry for that domain would not include the client
host.

Which would help you because? After all, today's experience indicates that any offenders reported to the respective abuse@ addresses get dealt with swiftly, effectively and they fix their ways soon after this. Sure.

Also don't forget that there are ISPs where you can get on without registering and the ISP fees are paid through your phone bill. (so-called Internet-by-call)

  Either the ISP owing the server blocks spam spew or that ISP gets a
blackhole block that would be very effective.

No it wouldn't be. I as a customer of an ISP have *absolutely* NO responsibility for what my ISP does or doesn't do. And no, "change ISPs" is not an option. Just like "change your place of work" isn't. If we do not want to create a two-tier Internet society, where the "full" Internet citizens are the ones who have their own systems that they admin, with fixed IP blocks and own domains, and there are "all the rest" whom the "first-class" never even thinks about or if they do than only in terms of them being a menace that limits the "pros" to play with this new toy they have built for themselves, than no. I as a user and customer of an ISP have as much right to use Internet services as anyone else, regardless of what my ISP or place of work or country or whatever does.

   Yesterday I inspected the spam I had in my spam bucket for kinds of
actual senders (last sender on Received header for my ISP). Of 11 spam
messages in the last hour, 9 were from compromised machines sending
directly. If they had to send this stuff through their ISP (comcast,
telstra, swbell etc.), they would  be blocked fairly quickly. The envelope
from address was often Yahoo, so the ISP would block on this as well.

Which would be great because? You could not use several email addresses from the same MUA? Or your solution to this is the same: get your own domains, be your authoritative DNS too and reserve a fixed netblock while at it?

  Requiring MS entries would not block spam or viruses immediately but would
help make RBL lists more effective and prosecution of spammers easier
(easier to trace a registered user of an ISP).

RBL lists these days are like the "whistleblower line" of the BSA. If you want to hurt somebody, you report them since it is rather easy to get on but rather hard to get off, since most of the RBLs are run by exactly the people who think that they belong to the "first-class" netizens. Modern spam detection should no longer rely on them.

It seems that some people

a) ignore that societal problems cannot be solved by technology
b) are apperantly married to ideas just because they sounded cool at first.

Sz.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault