Re: Attack of the Killer Spam

[Eric Osborne <osborne () notcom com>]

> NANOG folk:
>
> Over the past few weeks, I have noticed an influx of SPAM(tm) transmitted by
> UUNet dynamic IP dial-up users (read: MSN, Earthlink, GTE, etc.) and relayed
> using Earthlink SMTP relays.  Am I turning senile prematurely, or has anyone
> else noticed this influx?

Yeah, I've seen some of it.

> Also, how easy would it be for Earthlink and other nationwide "ISP's" (or
> more accurately, UU/PSI resellers) to do the following?  This would not stop
> SPAM(tm) dead in its tracks, but I figure it would make it easier to hold
> spammers accountable at least... unless, of course, they use throw-away
> accounts, in which case there is not much that can be done...
>
> - institute anti-spam rules on their SMTP relays, i.e. only relay mail
> reporting to be from earthlink.net and the virtual domains they host

Um..I think "the virtual domains they host" may be the tricky bit.  
I don't know how UU/PSI do their mail serving, but if Earthlink has its d/u
customers point to a UU/PSI relay for SMTP delivery, there's the matter of
keeping everyone's records up to date.

OTOH, if Earthlink (or whomever - Earthlink is just an example, here) points 
its customers towards something like mail.earthlink.net for SMTP relay, see
below....

> - only allow SMTP relaying from IP's assigned to *their customers*
> dynamically (cross-reference Radius logs?)

Good idea, although I think it may have some negative impacts on performance.
Again, there's also the matter of keeping everyone's records in sync.
mail.earthlink.net seems to have some basic relay filters in place, although
I'm not sure what their complete ruleset is.

Take a look at somebody like Xcom (hi, marty!) - www.xcom.net.  I'm not 
affiliated with them in any way, but it looks like what they do may be useful.
A Layer 2 approach means that you can assign only _your own_ IPs to dialin
customers, which cuts out the aforementioned Radius cross-reference.

> Constructive feedback would be greatly appreciated!  Together, we CAN make a
> difference.
>
> Regards,
> Adam



eric