From mike@mtcc.com Sat Jan 26 05:39:15 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F330121F8769 for ; Sat, 26 Jan 2013 05:39:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3iBNZJiDrK5g for ; Sat, 26 Jan 2013 05:39:14 -0800 (PST) Received: from mtcc.com (mtcc.com [IPv6:2001:5a8:4:9fe0:224:8cff:feaa:6d9b]) by ietfa.amsl.com (Postfix) with ESMTP id 01CD621F8522 for ; Sat, 26 Jan 2013 05:38:25 -0800 (PST) Received: from takifugu.mtcc.com (takifugu.mtcc.com [50.0.18.224]) (authenticated bits=0) by mtcc.com (8.14.3/8.14.3) with ESMTP id r0QDcMDo009586 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Sat, 26 Jan 2013 05:38:23 -0800 Message-ID: <5103DC4E.4090004@mtcc.com> Date: Sat, 26 Jan 2013 05:38:22 -0800 From: Michael Thomas User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.22) Gecko/20090605 Thunderbird/2.0.0.22 Mnenhy/0.7.5.0 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=421; t=1359207503; x=1360071503; c=relaxed/simple; s=thundersaddle.kirkwood; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=mtcc.com; i=mike@mtcc.com; z=From:=20Michael=20Thomas=20 |Subject:=20spam=20down? |Sender:=20 |To:=20Anti-Spam=20Research=20Group=20-=20IRTF=20 |Content-Type:=20text/plain=3B=20charset=3DISO-8859-1=3B=20 format=3Dflowed |Content-Transfer-Encoding:=207bit |MIME-Version:=201.0; bh=oAkiauLR4gFmXlbqgv6ePk5zby5tVeX2944lcHrJH0w=; b=W8ZLr1qU+eOZUPjwiMhHLpJSlIG4k672MJfwg9baD+tWfAF1tez1lwTDh0 OPvA1u1ddUNdNF7bpMOpWst3xlkAMrZeQPe/mVgWWu8hof0J117OixLZLnT1 O2gnNnI2Y38w9KV6k7Cm2ToIuO/n74g50qbdGEVjAyVsJQV4IBeuA=; Authentication-Results: mtcc.com; v=0.1; dkim=pass header.i=mike@mtcc.com ( sig from mtcc.com/thundersaddle.kirkwood verified; ); dkim-asp=pass header.From=mike@mtcc.com Subject: [Asrg] spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Jan 2013 13:39:15 -0000 There was a little side box in the current Economist that spam was down from 80+% to 67% and credited it to, among other things "sophisticated authentication" which I assume means DKIM and SPF. First is there actual evidence that spam is on the wane? And if so, does it actually have to due in part with authentication? I'd be ecstatic to hear that the latter was true, but correlation is not causation. Mike From martijn.grooten@virusbtn.com Sat Jan 26 06:42:32 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02AA921F84B9 for ; Sat, 26 Jan 2013 06:42:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.185 X-Spam-Level: X-Spam-Status: No, score=-8.185 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YE6A-iMTvrF6 for ; Sat, 26 Jan 2013 06:42:31 -0800 (PST) Received: from mx6.sophos.com (mx6.sophos.com [195.171.192.176]) by ietfa.amsl.com (Postfix) with ESMTP id 2877E21F84B6 for ; Sat, 26 Jan 2013 06:42:30 -0800 (PST) Received: from mx6.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id B74C37516B1 for ; Sat, 26 Jan 2013 14:42:28 +0000 (GMT) Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx6.sophos.com (Postfix) with ESMTPS id 90861751582 for ; Sat, 26 Jan 2013 14:42:28 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Sat, 26 Jan 2013 14:42:29 +0000 From: Martijn Grooten To: Anti-Spam Research Group - IRTF Thread-Topic: [Asrg] spam down? Thread-Index: AQHN+8qOullVsN4E9UKSipftH4oAUZhbqwgp Date: Sat, 26 Jan 2013 14:42:27 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20B66F2A@ABN-EXCH1A.green.sophos> References: <5103DC4E.4090004@mtcc.com> In-Reply-To: <5103DC4E.4090004@mtcc.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.64.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Asrg] spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Jan 2013 14:42:32 -0000 > First is there actual evidence that spam is on the wane? I believe there is. Measuring spam is tricky, and different sources may use= different definitions and methods, but all agree that the global volume of= spam has declined over the past four years. Note that a reduction from 80% to 67% would mean the volume of spam has hal= ved, rather than reduced by 13%. I believe most sources claim that reductio= n, since late 2008 (the McColo shutdown), is even bigger than that. > And if so, > does it actually have to due in part with authentication? I'd be > ecstatic to hear that the latter was true, but correlation is not > causation. I think it has little to do with that, but that it's mostly because botnets= are able to spew out a lot less than they used to. The graph used here sho= ws a strong correlation between drops in the volume of spam and big takedow= ns: http://krebsonsecurity.com/2013/01/spam-volumes-past-present-global-local/ It's good to keep in mind that the spam "that's not being sent anymore" was= relatively easy to block. See for instance: http://www.lightbluetouchpaper.org/2009/07/17/how-much-did-shutting-down-mc= colo-help/ Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From clewis+ietf@mustelids.ca Sat Jan 26 08:03:14 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 547EF21F8619 for ; Sat, 26 Jan 2013 08:03:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.441 X-Spam-Level: X-Spam-Status: No, score=0.441 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rnu8yztN7L7I for ; Sat, 26 Jan 2013 08:03:11 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id AAA5421F8551 for ; Sat, 26 Jan 2013 08:03:10 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id r0QG32sj009145 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sat, 26 Jan 2013 11:03:03 -0500 Message-ID: <5103FE36.7010908@mustelids.ca> Date: Sat, 26 Jan 2013 11:03:02 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <5103DC4E.4090004@mtcc.com> In-Reply-To: <5103DC4E.4090004@mtcc.com> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Jan 2013 16:03:14 -0000 On 13-01-26 08:38 AM, Michael Thomas wrote: > There was a little side box in the current Economist that spam was > down from 80+% to 67% and credited it to, among other things > "sophisticated authentication" which I assume means DKIM and SPF. > > First is there actual evidence that spam is on the wane? And if so, > does it actually have to due in part with authentication? I'd be > ecstatic to hear that the latter was true, but correlation is not > causation. In the wane ... how? Is the real question. Absolute volumes have indeed changed, as this graph (and many others) show: http://cbl.abuseat.org/totalflow.html but that doesn't tell the whole story. The reality is that authentication (we're talking DKIM/SPF/DMARC) has relatively little effect. They're pretty easy to make irrelevant. There are fewer bot families than there used to be. Bot takedowns have made major inroads. Still, there are a couple left that can dwarf what we've seen before _if_ it was attractive to fire them off. Kelihos and Festi are bigger than Rustock or Srizbi ever were. The defenses we have for bots are well-developed and widely-deployed. The ROI has declined markedly, so the bot armies are often left idle. What we're seeing instead, is an evolution from the massive scatter-gunning of a Rustock infecting a home computer, to that of compromised servers, compromised user accounts etc. These are harder to deal with, harder to stop, harder to filter. So, while there are fewer spams in the Internet, I strongly suspect that more of them are getting through. Spammers may not be spamming as much but they are spamming "better". From bzs@world.std.com Sat Jan 26 11:20:03 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9786D21F88D1 for ; Sat, 26 Jan 2013 11:20:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PZ6SWOtCi1Yx for ; Sat, 26 Jan 2013 11:20:03 -0800 (PST) Received: from TheWorld.com (pcls5.std.com [192.74.137.145]) by ietfa.amsl.com (Postfix) with ESMTP id C938721F88EA for ; Sat, 26 Jan 2013 11:20:02 -0800 (PST) Received: from world.std.com (root@world.std.com [192.74.137.5]) by TheWorld.com (8.14.5/8.14.5) with ESMTP id r0QJJUnE016375 for ; Sat, 26 Jan 2013 14:19:32 -0500 Received: (from bzs@localhost) by world.std.com (8.13.6/8.13.6) id r0QJJUki025117; Sat, 26 Jan 2013 14:19:30 -0500 (EST) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <20740.11329.978731.29007@world.std.com> Date: Sat, 26 Jan 2013 14:19:29 -0500 To: Anti-Spam Research Group - IRTF In-Reply-To: <5103DC4E.4090004@mtcc.com> References: <5103DC4E.4090004@mtcc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Subject: Re: [Asrg] spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Jan 2013 19:20:03 -0000 It depends a lot on how and particularly where spam is measured. Most naive measurements, I'd say 99% of what we hear about, only care about what hits an end-user's screen. By that time it's had to run a gauntlet of blocks at sources, blocks at ISPs, and whatever spam filters are in the user's MUA. So the report of reduction could just as well mean that any one, or all, of those are improving. Or of course that less spam is being sent out. Those of us more involved in the infrastructure of the internet tend to be at least as concerned with the volume of attempted deliveries of spam. The gates may hold back the barbarians, but you still have barbarians at the gates! Perhaps that leads to some useful taxonomy since the model is pretty straightforward. Volume of spam sourced, volume of spam which leaves the network it's sourced from, volume received at providers, volume delivered to a mailbox, and volume seen by an end-user. Those are all different measurements and each interesting in its own way. -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Dial-Up: US, PR, Canada Software Tool & Die | Public Access Internet | SINCE 1989 *oo* From rob@invaluement.com Tue Jan 29 19:03:22 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2527321F886F for ; Tue, 29 Jan 2013 19:03:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OwDFH-AbNTzB for ; Tue, 29 Jan 2013 19:03:21 -0800 (PST) Received: from mail.powerviewmail.com (mail.powerviewmail.com [204.9.77.40]) by ietfa.amsl.com (Postfix) with ESMTP id 2FFF821F88A1 for ; Tue, 29 Jan 2013 19:03:17 -0800 (PST) Received: from ([204.9.77.40]) by mail.powerviewmail.com (IceWarp 10.4.3) with ASMTP id PEH80315 for ; Tue, 29 Jan 2013 22:03:15 -0500 Message-ID: <51088D73.2050806@invaluement.com> Date: Tue, 29 Jan 2013 22:03:15 -0500 From: Rob McEwen User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130107 Thunderbird/17.0.2 MIME-Version: 1.0 To: asrg@irtf.org References: <5103DC4E.4090004@mtcc.com> <5103FE36.7010908@mustelids.ca> In-Reply-To: <5103FE36.7010908@mustelids.ca> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Jan 2013 03:03:22 -0000 On 1/26/2013 11:03 AM, Chris Lewis wrote: > What we're seeing instead, is an evolution from the massive > scatter-gunning of a Rustock infecting a home computer, to that of > compromised servers, compromised user accounts etc. These are harder to > deal with, harder to stop, harder to filter. > > So, while there are fewer spams in the Internet, I strongly suspect that > more of them are getting through. EXACTLY!!! Along those lines, there has been an uptick in hijacked domains where, instead of the spammer buying their own domain, they break through a hoster's security (or obtained the FTP credentials), and then they install their spammy scripts or pages. Then, when they send out their spams, the domains are not so easily blacklist-able because the various URI or domain blacklists often skip listing these due to the false-positive-prevention-filters preventing such listings. In other words, the same legitimacy or "good reputation" which would cause a URI blacklist's engine to purposely NOT blacklist innocent decoy domains... often give these hijacked domains a free pass, too. Therefore, over at invaluement.com, we made recent improvements to our ivmURI blacklist to allow us to now more surgically target many of these hijacked domains, yet without lessening our protections against blacklisting innocent "decoy" domains. FOR EXAMPLE... The following is a list of about 2,500 domains which are CURRENTLY hijacked with "live" spammy URLs present: http://dnsbl.invaluement.com/urls-hijacked-by-spammers-Jan-29-2013.zip Actually, the number of such hijacked domains blacklisted by invaluement is much larger, but we narrowed it down in THAT example list to only those domains NOT currently blacklisted by either SURBL or Spamhaus's DBL list... to make it more interesting! See the included "notes" text file for more details. PS - as the notes file mentions, please don't throw these into manual local blacklists since many of these sites will fix their problems and then get removed from ivmURI. These generally shouldn't be permanently blacklisted. Again, see the included "notes" file for more information. -- Rob McEwen http://dnsbl.invaluement.com/ rob@invaluement.com +1 (478) 475-9032 From dotzero@gmail.com Wed Jan 30 06:27:12 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7679221F8698 for ; Wed, 30 Jan 2013 06:27:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lyBpP2rEFyiK for ; Wed, 30 Jan 2013 06:27:11 -0800 (PST) Received: from mail-lb0-f170.google.com (mail-lb0-f170.google.com [209.85.217.170]) by ietfa.amsl.com (Postfix) with ESMTP id 39F4421F8691 for ; Wed, 30 Jan 2013 06:27:10 -0800 (PST) Received: by mail-lb0-f170.google.com with SMTP id ge1so2203492lbb.15 for ; Wed, 30 Jan 2013 06:27:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:in-reply-to:references:date:message-id :subject:from:to:content-type; bh=86lZwEo4tw0/8B8F/3MLehXAez3UMEBkpaNIQ2PwQ5s=; b=zhHyz1OcmB4rdn5vfzMMZL5y62kDkNJJJ9l2kPXBDtkSCwwnT9Dl1Ce++wjBSaONjk ZagcZ3AnbUUknM6XPYfkqkW8H694FVh1pqmONlEY4JIHOinVCh0m5saEwn7BpbsjXi0v d2KCRkGLrG8xSXNqgjuk1CQo97MSM2My6ldzAnYLuHLvIlJPHuDtH0x6G6NLRXIBr046 EBn96ai7lqOf3XxRTEZIoAE45IIlfYAwdOQq2WhYP9UjmbRexH5wtpX1fU1WkYoi2ET5 Lgnn8ilO2PeZN9E/Eg4vZlRnuL69nl2jSbou80lKFbnI3s9fSF9UrMhQkoR026aSGGts jS0w== MIME-Version: 1.0 X-Received: by 10.112.29.201 with SMTP id m9mr2024388lbh.96.1359556029686; Wed, 30 Jan 2013 06:27:09 -0800 (PST) Received: by 10.112.180.105 with HTTP; Wed, 30 Jan 2013 06:27:09 -0800 (PST) In-Reply-To: <5103FE36.7010908@mustelids.ca> References: <5103DC4E.4090004@mtcc.com> <5103FE36.7010908@mustelids.ca> Date: Wed, 30 Jan 2013 09:27:09 -0500 Message-ID: From: Dotzero To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Jan 2013 14:27:12 -0000 I'm late to the party but as opinionated as ever.... On Sat, Jan 26, 2013 at 11:03 AM, Chris Lewis wrote: > On 13-01-26 08:38 AM, Michael Thomas wrote: >> There was a little side box in the current Economist that spam was >> down from 80+% to 67% and credited it to, among other things >> "sophisticated authentication" which I assume means DKIM and SPF. >> >> First is there actual evidence that spam is on the wane? And if so, >> does it actually have to due in part with authentication? I'd be >> ecstatic to hear that the latter was true, but correlation is not >> causation. > > In the wane ... how? Is the real question. > > Absolute volumes have indeed changed, as this graph (and many others) show: > > http://cbl.abuseat.org/totalflow.html > > but that doesn't tell the whole story. > Agreed > The reality is that authentication (we're talking DKIM/SPF/DMARC) has > relatively little effect. They're pretty easy to make irrelevant. > I think it depends on what you mean by "relatively little effect". >From my perspective - given the current statof adoption - it may not have an effect on the overall ecosystem but it is certainly pushing the bad guys from abusing (sending) domains that are implementing strong email auth efforts to ones that are not. My comment is a generalization but I see it with the domains I work with and I think those who watch abuse against financials see similar behavior. The bad guys still test but at the end of the day it is about ROI for them as much as it is for a legitimate business. It would be interesting to see (I don't have the data) if there is any kind of shift from sending spam targeting accounts at mailbox providers that validate to targeting (preferentially) accounts at mailbox providers that don't. > There are fewer bot families than there used to be. Bot takedowns have > made major inroads. Still, there are a couple left that can dwarf what > we've seen before _if_ it was attractive to fire them off. Kelihos and > Festi are bigger than Rustock or Srizbi ever were. The defenses we have > for bots are well-developed and widely-deployed. The ROI has declined > markedly, so the bot armies are often left idle. > True. It may also be true that the bot armies are being put to other uses. > What we're seeing instead, is an evolution from the massive > scatter-gunning of a Rustock infecting a home computer, to that of > compromised servers, compromised user accounts etc. These are harder to > deal with, harder to stop, harder to filter. > "We" should certainly be blocking on malicious URLs even if they are at otherwise legitimate sites. And if legitimate sites show a pattern of not addressing their problems then they should be blocked as well. This is no different than the open relay problem. I've had my share of issues over the years but I think most folks would say that I pay attention and deal with problems expeditiously. > So, while there are fewer spams in the Internet, I strongly suspect that > more of them are getting through. > I think it varies by mailbox provider. > Spammers may not be spamming as much but they are spamming "better". > Darwin was right. From clewis+ietf@mustelids.ca Wed Jan 30 07:40:15 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E2E321F8A9B for ; Wed, 30 Jan 2013 07:40:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.146 X-Spam-Level: X-Spam-Status: No, score=-0.146 tagged_above=-999 required=5 tests=[AWL=0.587, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZoAaIykh1lD0 for ; Wed, 30 Jan 2013 07:40:15 -0800 (PST) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id C918C21F8A89 for ; Wed, 30 Jan 2013 07:40:13 -0800 (PST) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id r0UFe6Ia014828 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Wed, 30 Jan 2013 10:40:06 -0500 Message-ID: <51093ED6.9010401@mustelids.ca> Date: Wed, 30 Jan 2013 10:40:06 -0500 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <5103DC4E.4090004@mtcc.com> <5103FE36.7010908@mustelids.ca> In-Reply-To: X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Jan 2013 15:40:15 -0000 On 13-01-30 09:27 AM, Dotzero wrote: > I think it depends on what you mean by "relatively little effect". >>From my perspective - given the current statof adoption - it may not > have an effect on the overall ecosystem but it is certainly pushing > the bad guys from abusing (sending) domains that are implementing > strong email auth efforts to ones that are not. If that were true, I wouldn't be seeing millions of paypal, linkedin, et. al. impersonations a day. But I do. Validation is so irrelevant that the spammers impersonate sites when it's clearly unnecessary. They use their facebook impersonation templates to send out pill spam for crissakes. If validation was making a difference, the ROI would suffer. I can only guess it isn't. The reality is that you don't have to forge the From/sender/helo et. al. to successfully impersonate any domain. Especially with the mail readers oh-so-carefully _not_ showing you the actual email address. > It would be interesting to see (I don't have the data) if there is any > kind of shift from sending spam targeting accounts at mailbox > providers that validate to targeting (preferentially) accounts at > mailbox providers that don't. Most spoofers are already bypassing validation. So why would it matter to them whether the mailbox provider is validating or not? From dotzero@gmail.com Wed Jan 30 11:15:41 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B4FA21F84FC for ; Wed, 30 Jan 2013 11:15:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.285 X-Spam-Level: X-Spam-Status: No, score=-2.285 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6teihdExAmoM for ; Wed, 30 Jan 2013 11:15:40 -0800 (PST) Received: from mail-la0-x22e.google.com (la-in-x022e.1e100.net [IPv6:2a00:1450:4010:c03::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 195F521F8886 for ; Wed, 30 Jan 2013 11:15:39 -0800 (PST) Received: by mail-la0-f46.google.com with SMTP id fq12so1395277lab.19 for ; Wed, 30 Jan 2013 11:15:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:in-reply-to:references:date:message-id :subject:from:to:content-type; bh=TrD/4Y0fEWqkm4pjcWbfQwBu/QCHJuQ4YjtBj6+cs2s=; b=hJRBrD5AdQiF32sMN8N0hz0H38C+3eX2ZfnatHSrDEoXubQni/6nVzvxrtx63IENLm BthO2MsfBVh25Q36/NQS+kMqg/QQ7Y1eYj1wp8HWy3Bsv3rm4R2q1b5F2mz12f/gW0wU Czf72pJEEHm2a+vOF/Bfn1Kw3Q7nQex5GNGXM+jHMVJ6JgunYFOYGuDW3l5eXLq2zmUc 5wgaD4U+B6993C4HpbxqEamRdrtJIzea+VvzWAPld19bzLTPR+4cGMxcjLsQtN4eUQFE 49f38CKvwTACWt/sZX1iNn18NmGGrK8U7yeqDq0XVmzR448Mtak4XT4KWGdns5mLExRW ZrOw== MIME-Version: 1.0 X-Received: by 10.112.8.163 with SMTP id s3mr2296224lba.113.1359573325944; Wed, 30 Jan 2013 11:15:25 -0800 (PST) Received: by 10.112.180.105 with HTTP; Wed, 30 Jan 2013 11:15:25 -0800 (PST) In-Reply-To: <51093ED6.9010401@mustelids.ca> References: <5103DC4E.4090004@mtcc.com> <5103FE36.7010908@mustelids.ca> <51093ED6.9010401@mustelids.ca> Date: Wed, 30 Jan 2013 14:15:25 -0500 Message-ID: From: Dotzero To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Asrg] spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Jan 2013 19:15:41 -0000 On Wed, Jan 30, 2013 at 10:40 AM, Chris Lewis wrote: > On 13-01-30 09:27 AM, Dotzero wrote: > >> I think it depends on what you mean by "relatively little effect". >>>From my perspective - given the current statof adoption - it may not >> have an effect on the overall ecosystem but it is certainly pushing >> the bad guys from abusing (sending) domains that are implementing >> strong email auth efforts to ones that are not. > > If that were true, I wouldn't be seeing millions of paypal, linkedin, > et. al. impersonations a day. But I do. > No difference in the nature/behavior in the spamming? I can't speak for other brands in terms of the effect of email authentication/validation but I have seen it make a difference for our brands/domains. I know anecdotally that other brands have said the same. This is why I wrote that "it depends on what you mean by relatively little effect". I think we all know that spam/phishing is all about the social engineer. That means there will be some amount of friction pushing bad folks away from high value targets they wish to leverage. When I've looked in the past I've seen differentiation in abuse comparing financials that are aggressive in fighting abuse vs those that are less clueful. > Validation is so irrelevant that the spammers impersonate sites when > it's clearly unnecessary. They use their facebook impersonation > templates to send out pill spam for crissakes. If validation was making > a difference, the ROI would suffer. I can only guess it isn't. > > The reality is that you don't have to forge the From/sender/helo et. al. > to successfully impersonate any domain. Especially with the mail > readers oh-so-carefully _not_ showing you the actual email address. > You are assuming that the place of email auth is at the MUA and let the recipient figure it out. That IS an epic fail. And I agree with you that showiing the display name and hiding the email address is suboptimal. >> It would be interesting to see (I don't have the data) if there is any >> kind of shift from sending spam targeting accounts at mailbox >> providers that validate to targeting (preferentially) accounts at >> mailbox providers that don't. > > Most spoofers are already bypassing validation. So why would it matter > to them whether the mailbox provider is validating or not? > So I take it you aren't a fan of email authentication at all. I think we'll have to agree to disagree. Mike