Subject: [Ipsec] spam

From: "Perry E. Metzger" <[email-masked]>
Date: Fri, 04 Jun 2004 16:30:41 -0400

Is there a reason posting to this list can't be restricted to
subscribers? The spam levels are insane.

Perry

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Sun, 06 Jun 2004 20:32:01 +0300

Strangely, yours is the only post my email client thought was that.  It 
might be because you actually used the s-word.

Anyway, as has been pointed out before, the letters mostly seem to 
originate from legitimate subscribers.  The emails and names can easily 
be harvested from web archives and other methods.  Since SMTP is 
basically insecure, anyone can pretend to be a list member and send 
this stuff to the list.

On 04/06/2004, at 23:30, Perry E. Metzger wrote:

> subscribers? The s-am levels are insane.
>
> Perry
>

---

From: "William Dixon" <[email-masked]>
Date: Sun, 6 Jun 2004 16:37:04 -0400

I agree. The best option is to get our current hoster to filter spam and
viruses for this list. I assume TIS does this for other lists, so I'd hope
there isn't an additional cost. But if there's a cost, I can contribute
some. I'd also be happy to go through the pain of changing the list name and
resubscribing, and finding another list hoster if TIS can't provide
filtering. I've noticed I've received s-word email within 1-2 hours of
posting. That's ridiculous.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Yoav Nir
> Sent: Sunday, June 06, 2004 1:32 PM
> To: Perry E. Metzger
> Cc: [email-masked]
> Subject: Re: [Ipsec] spam
> 
> Strangely, yours is the only post my email client thought was 
> that.  It might be because you actually used the s-word.
> 
> Anyway, as has been pointed out before, the letters mostly 
> seem to originate from legitimate subscribers.  The emails 
> and names can easily be harvested from web archives and other 
> methods.  Since SMTP is basically insecure, anyone can 
> pretend to be a list member and send this stuff to the list.
>

---

From: "Perry E. Metzger" <[email-masked]>
Date: Mon, 07 Jun 2004 00:10:32 -0400

Yoav Nir <[email-masked]> writes:
> originate from legitimate subscribers.  The emails and names can
> easily be harvested from web archives and other methods.  Since SMTP
> is basically insecure, anyone can pretend to be a list member and send
> this stuff to the list.

However, those of us who run mailing lists find that although anyone
"can" forge a list member's address, it is almost unheard of that it
actually happens. Restricting my lists to subscribers only has
eliminated 100% of the spam going to them.

As for the problem of people who would like to post from an address
other than the one they subscribe from, as I've noted, mailman, which
is already used to manage this list, can handle that trivially, so this
isn't a problem, either.

I'm a subscriber to several hundred mailing lists (yes, really) and
all but a handful of them restrict posting to subscribers.

Perry

---

From: "Theodore Ts'o" <[email-masked]>
Date: Mon, 7 Jun 2004 00:02:30 -0400

> posting. That's ridiculous.

We're actually using [email-masked], actually.  The
[email-masked] address was just there for backwards
compatibility.  And ietf.org is supposedly using spamassassin as well,
but apparently it's not tuned particularly well.

What we can do is get rid of the forwarding, which might help for a
little while (until the spammers adapt).  

						- Ted

---

From: Yoav Nir <[email-masked]>
Date: Mon, 7 Jun 2004 09:32:56 +0300

Lots of the virii we get appear to come from uri at lucent dot com, who 
I know is a legitimate subscriber because he posts real messages.  I 
don't know about hugh at toad dot com, but that's only because he 
doesn't post.  He might very well be a legitimate lurker.

---

From: "Perry E. Metzger" <[email-masked]>
Date: Mon, 07 Jun 2004 09:48:39 -0400

Yoav Nir <[email-masked]> writes:
> Lots of the virii we get appear to come from uri at lucent dot com,

The viruses are trivially stopped by blocking all the vulnerable
microsoft file types, such as .exe and .zip. I don't see such postings
because my hosts already block them.

Perry

---

From: Paul Koning <[email-masked]>
Date: Mon, 7 Jun 2004 10:09:24 -0400

>>>>> "Perry" == Perry E Metzger <[email-masked]> writes:

 Perry> Yoav Nir <[email-masked]> writes:
 >> easily be harvested from web archives and other methods.  Since
 >> SMTP is basically insecure, anyone can pretend to be a list member
 >> and send this stuff to the list.

 Perry> However, those of us who run mailing lists find that although
 Perry> anyone "can" forge a list member's address, it is almost
 Perry> unheard of that it actually happens. Restricting my lists to
 Perry> subscribers only has eliminated 100% of the spam going to
 Perry> them.

That certainly would not be true for the IPsec list -- I've looked
over enough IPsec message headers to say that.  FOr IPsec, the
percentage of forged addresses is clearly quite large.

     paul

---

From: "Perry E. Metzger" <[email-masked]>
Date: Mon, 07 Jun 2004 11:38:40 -0400

> percentage of forged addresses is clearly quite large.

Not if you exclude viruses. The amount of spam from forged addresses
is nil -- the virus activity is separate.

However, the viruses are trivially blocked with a rule matching a
regular expression like this:

/^Content-(Type|Disposition):.*(file)?name=.*\.(asd|bat|chm|cmd|com|cpl|dll|exe|hlp|hta|js|jse|lnk|ocx|pif|rar|scr|shb|shm|shs|vb|vbe|vbs|vbx|vxd|wsf|wsh|zip)/

My machines block all email matching that regexps and as a result I
see no viruses at all.

-- 
Perry E. Metzger		[email-masked]

---

From: Chris Trobridge <[email-masked]>
Date: Mon, 07 Jun 2004 17:31:33 +0100

>My machines block all email matching that regexps and as a result I
What I'm seeing is that all the virused emails are being detected (by a 
Gauntlet firewall) and I'm just getting reports about the virus being 
removed.  IT says we don't run the firewall.  My guess is that it's been 
checked before it reaches the IETF list server.  The emails I've looked 
at are coming from valid addresses and are addressed to the tislab list 
address.

All the 'spam' I've seen is addressed from [email-masked] to 
the same address.

Chris

**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept for the presence of computer viruses.
*****************************************************************************

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Mon, 7 Jun 2004 10:49:27 -0700

The list admin has taken some action that should eliminate all the 
recent spam and viruses we have seen.

How about we talk about IPsec instead?

--Paul Hoffman, Director
--VPN Consortium