Re: [Asrg] Zombie spam

[Dave Crocker <dhc at dcrocker.net>]

Barry,

 >> 2. The compromised machine uses their local provider's MTA to do the
 >> cross-next sending. The problem, here, is much more difficult.  How can
 >> the provider know whether the machine is compromised?  What is is doing
 >> that it should not be doing?

BS> Generating complaints (including RBL additions)?

BS> I know, you were asking about something more pro-active, before one
BS> has to respond to complaints etc.

right.  I was asking about "technical" characteristics of zombie traffic
that distinguishes it from "legitimate" traffic.

the instant we start trying to use things like "complaints" we are in
the realm of social assessment, not technical, nevermind the fuzziness
and politics of it.


BS> It might however seem like a good service for someone like the DCC
BS> folks to sell. Pay them to keep your ISP's mail servers in a watch
BS> list so you can be alerted by them when some threshold is exceeded.

I'll guess that 'threshhold' refers to something like amount of traffic
from a particular host, on the theory that greater load means it might
be a zombie.  Of course, the clever spammers control enough machines
that they well might just keep the per-zombie traffic load below that
limit...


BS> It might be difficult to distinguish from forwarding hosts.

Right.  And, alas, this leads us down the path of considering having
forwarding hosts be registered with the ISP.

The part of this that might not be so crazy is that providers often
distinguish charges between low-traffic and high-traffic hosts within
their networks.


BS> Oh let's just admit it, we're seriously f*****d.

I thought we all had already done that.

The challenge, now is to followup up that fact with... hmmm. can't think
of a clever comment that won't get me into all sorts of political
correctness trouble.





d/
--
 Dave Crocker <mailto:dcrocker at brandenburg.com>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>


_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg