Message-ID: <491C9377.8010100@nortel.com>
Date: Thu, 13 Nov 2008 15:52:07 -0500
From: "Chris Lewis" <clewis@nortel.com>
Organization: Nortel
User-Agent: Thunderbird 2.0.0.17 (Windows/20080914)
MIME-Version: 1.0
CC: IETF <ietf@ietf.org>
Subject: Re: IP-based reputation services vs. DNSBL  (long)
References: <49172BCE.2000705@network-heretics.com>	<alpine.LSU.2.00.0811111711310.14367@hermes-1.csi.cam.ac.uk>	<4919C264.4000209@network-heretics.com>	<4919C6FA.909@earthlink.net>
 <4919CB7C.3070604@leisi.net> <4919D1FC.9070801@earthlink.net>
 <4919FD8F.5010200@nortel.com>
 <2788466ED3E31C418E9ACC5C316615572FFB38@mou1wnexmb09.vcorp.ad.vrsn.com>
 <491B1977.9060504@nortel.com>
 <2788466ED3E31C418E9ACC5C316615572FFB40@mou1wnexmb09.vcorp.ad.vrsn.com>
In-Reply-To: <2788466ED3E31C418E9ACC5C316615572FFB40@mou1wnexmb09.vcorp.ad.vrsn.com>
Precedence: list
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: ietf-bounces@ietf.org
Errors-To: ietf-bounces@ietf.org

Hallam-Baker, Phillip wrote:
> To answer your question about how they got round port 25 blocking, my
> guess is that they sent the initial packet out on yet another connection
> that was unblocked.

Actually, I answered that question - they didn't "get around port 25
blocking".  They never sent from the (say AOL dialup) side, only from
the high speed side.   "three way handshaking" emulation of what's
supposed to be "two way", but physically only two (not three) machines.
 Since they're on the same machine, the timing is not much of an issue.
 Got high speed spam emission, at the expense of burning (lots of) free
AOL low speed access dialup disks.  Especially if you pipelined (whether
the recipient said it was okay or not) multiple parallel SMTP streams.

[The recipient usually has no way of knowing whether you're really
waiting for it's SMTP command return codes or not.  Which is exemplified
by one particular type of HTTP proxy attack.  Arrange the entire sending
side's SMTP commands in one buffer (eg: a HTTP CONNECT proxy), and send
it all at once.  Works just fine if you don't care about errors.  Which
high volume spammers don't.]

> I have seen something similar described recently in the context of a
> cyber-conflict type attack.

Potentially still useful technique, where the economies are different.
_______________________________________________
Ietf mailing list
Ietf@ietf.org
https://www.ietf.org/mailman/listinfo/ietf