RE: Wired mag article on spammers playing traceroute games with trojaned boxes

[Mike Damm <MikeD () irwinresearch com>]

Actually, running a web server on 8290 isn't as easy as 80. SpamAssassin
tests (WEIRD_PORT) for this, as do many other filtering packages.

Forcing spammers to use non-standard ports will greatly increase their rate
of detection, and in turn help to solve the spam problem.

        -Mike


-----Original Message-----
From: jlewis () lewis org [mailto:jlewis () lewis org] 
Sent: Thursday, October 09, 2003 9:56 AM
To: Joe Boyce
Cc: nanog () merit edu
Subject: Re: Wired mag article on spammers playing traceroute games with
trojaned boxes


On Thu, 9 Oct 2003, Joe Boyce wrote:

> VA> Personally, I think preventing residential broadband customers from
hosting 
> VA> servers would limit a lot of that. I'm not saying that IS the
solution. 
> It's not like those customers are aware they are hosting servers, they
> most likely were exploited and are now unaware they are hosting
> websites.

That's obviously the case.  No spammer has "thousands" of legitimately 
purchased DSL/Cable connections.  The article pretty clearly says they're 
exploiting insecure windows (isn't that redundant?) boxes.

Trouble is, how do you stop this?  Just blocking common ports like 80 by
default (unless the customer plans to actually run a web server and asks
for the filter to be removed) won't work.  The spammers can just as easily
spam with urls containing ports (http://blah.biz:8290/) if they find 80
is filtered or find that filtering has become common.

So other than waiting some infinitely long time for a secure out of the 
box version of windows (and for everyone to upgrade), how do you stop 
this?  Widespread deployment of reflexive access lists?  Force all 
broadband customers to use NAT and let them forward ports or entire IPs to 
their private IP servers if they have any?  Wait for the legal system to 
catch and prosecute a few people who do this and deter others from trying 
it?  Convince registrars to kill domains that are clearly being used by 
thieves?
  
----------------------------------------------------------------------
 Jon Lewis *jlewis () lewis org*|  I route
 Senior Network Engineer     |  therefore you are
 Atlantic Net                |  
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________