[TOOLS-DEVELOPMENT] Mailman subscribe attacks redux

[Glen <[e-mail]>]

Good day:

You may recall that we have been experiencing an attack against Mailman, in
which a large number of automated subscribe requests to addresses of the
form "[e-mail]" are being sent by compromised
computers worldwide to the IETF's Mailman server.  A form of
Denial-of-Service, this attack has affected our lists and list admins, and
has caused us to generate a ton of outgoing/response mail that should not
be sent in the first place.

The volume of the attack has previously been low and manageable.  However,
overnight, the level of subscribe attacks against the IETF Mailman server
increased dramatically, to the point that Mailman's bounce processors were
getting overwhelmed and dying, triggering alarms and compromising mail
operations.

To answer some obvious questions:  This attack is distributed. Over 4000 IP
addresses from just last night were participating.  The addresses cannot be
blocked by normal automated means on our server, because we use
Cloudflare.  We would have to feed the addresses into Cloudflare, and that
is a laborious, manual process that does not scale.  And as we learned from
previous interactions with Cloudflare, there is not much that can be done
about attacks of this type from their side.

When this began, we provided expressions and guidance that would allow list
owners to ban these addresses on a per-list basis; alas, the adoption rate
of those recommendations was too low, and the attack increased too quickly.

Because a service outage is imminent, I have now instructed the servers to
reject all subscribe requests from all email addresses containing a "+"
sign.  Users posting subscribe requests containing a plus sign are referred
to the secretariat to complete their request.  The request is halted after
that message is displayed, and no further processing, notification of list
owners, or outgoing mail is generated: the request is deleted as an error.

Users already subscribed to lists using valid addresses of this form are
not affected.  They can still manage and remove their subscriptions
directly.  This only affects new requests... our server will no longer
attempt to process new requests containing + signs.  This behavior is not
optional or per-list, it applies server-wide and cannot be overridden on a
per-list basis.

While I note that some users (roughly 1011 "+" addresses currently exist in
Mailman, out of the 77809 total subscribers present at the moment) use this
address form for filtering, I note that Mailman also provides list-based
RFC2369/2919 headers that allow for filtering as well.  And I wish to make
clear again that we are not *refusing* subscriptions of this type - we are
just referring them for manual processing.

These changes are deployed as of now, and are effective for all IETF
mailing lists, regardless of list configuration settings.

I apologize for the inconvenience this will cause to new users wanting this
address format; however, the volume of the attack has left me with no other
choice.

As always, any questions, please let me know.

Glen
Glen Barney
IT Director
AMS (IETF Secretariat)