Why can't DNS servers perform spam or mal-ware blocking/filtering?

[Virus Guy]

Instead of always updating your hosts file or updating (innoculating)
your browser with programs like AdAware/Spybot, doesn't it make more
sense to use a DNS server that is constantly updating it's own lists
and essentially blocking junk domains?

Sure, that might be a bit too much to ask of the root servers (might
be illegal too) but why can't some third party run a bank of DNS
servers that does mal-blocking ?

Say, return DNS requests for known-bad domains to a default IP that
brings up a web page that says something like "the domain your browser
is trying to access is bad for your computer's health" ?

That would be one way to block e-mail phishing and address-testing
spam links, web sites infected with trojans, etc (assuming it the
servers were updated relatively quickly, all the time).

 

[David Arnstein]

If you want to take matters into your own hands, you can run a relay
DNS server (software) right on your own peecee. The most popular
software for this purpose is probably DNSKong, available from
http://www.pyrenean.com.

Personally, I prefer to use dnrd, which is hosted at sourceforge. It
is a matter of taste, I suppose.

In any case, the reason that I like using a DNS relay is that I don't
need a titanic, rapidly changing "hosts" file. Consider the case of
doubleclick.net. In order to block out traffic from this classical
shitpile, you could list every possible host in the domain:
a.b.doubleclick.net, y.z.doubleclick.net; it's quite a list. There are
web sites dedicated to cataloging active hosts within such unpleasant
domains, but they have to be frequently updated.

Since I use DNS relay software, I can block out all traffic to
doubleclick.net with one line of text. In dnrd, that text looks like
domain doubleclick.net +auth

I believe that DNSkong is even more powerful, it seems to have some
kind of wildcard capability. It may be able to block doubleclick.net,
doubleclick.fr, doubleclick.de, and so on, all with one line of text.
I don't actually use DNSKong, so I'm not sure about this.

In any case, I'm a big believer in relay DNS servers. They are a much
smaller maintenance headache than hosts files.

 

[Art]

Instead of always updating your hosts file

Never have found the need.

or updating (innoculating)
your browser with programs like AdAware/Spybot,

Never have found the need.

doesn't it make more
sense to use a DNS server that is constantly updating it's own lists
and essentially blocking junk domains?

Never have found the need.

Sure, that might be a bit too much to ask of the root servers (might
be illegal too) but why can't some third party run a bank of DNS
servers that does mal-blocking ?

Never have found the need.

Say, return DNS requests for known-bad domains to a default IP that
brings up a web page that says something like "the domain your browser
is trying to access is bad for your computer's health" ?

Simply use a Gecko based browser and IE only for trusted
sites. It's that simple.

That would be one way to block e-mail phishing and address-testing
spam links, web sites infected with trojans, etc (assuming it the
servers were updated relatively quickly, all the time).

Why do things the hard way?

Art

http://home.epix.net/~artnpeg
Free antivirus:
http://www.ik-cs.com/programs/virtools/KASFX.EXE
http://www.claymania.com/KASFX.EXE
http://tinyurl.com/azzkc

 

[Jeffrey F. Bloss]

Sure, that might be a bit too much to ask of the root servers (might
be illegal too) but why can't some third party run a bank of DNS
servers that does mal-blocking ?

Because they'd become unusable in a relatively short time as the BadGuys(tm)
moved around to avoid the blocks.

Say, return DNS requests for known-bad domains to a default IP that
brings up a web page that says something like "the domain your browser
is trying to access is bad for your computer's health" ?

That would be one way to block e-mail phishing and address-testing
spam links, web sites infected with trojans, etc (assuming it the
servers were updated relatively quickly, all the time).

Most of this type of activity is transient. The product of someone
compromising a random machine or using a throwaway account somewhere. If
you start blocking these sites at the DNS level all you'd be doing is
penalizing the victims a second time.

--
Hand crafted on October 12, 2005 at 10:43:26 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Virus Guy]

Because they'd become unusable in a relatively short time as the
BadGuys(tm) moved around to avoid the blocks.

It's similar to what Spybot or AdAware does (or MVP hosts file) and
no-one makes the same claim that the bad guys are "moving around" the
blocks in that situation.

[tangent: Is there a way to get a list (daily, weekly, etc) of new
domain registrations, the vast majority of which (I'm thinkin) are
going to be used for spam/fraud/phishing/e-mail-verification (and are
usually quickly de-activated after a spam run)? The theory here is
that if you are really agressive, you tie that list automatically into
your DNS blocking strategy and you shit-can all new domains for a
month or two. Then you remove the block for those domains as they
age. The two month period should allow any legit bad domain to get
canned, so by the time your DNS lifts it's block on them they're
already dead. A really good system would combine new domain
registrations with e-mail content scanning and look for those new
domains in the header or body of e-mail to identify them as spam and
shit-can them]

Most of this type of activity is transient. The product of
someone compromising a random machine or using a throwaway
account somewhere.

You're confusing the source-machine (and forged header contents)
sending the mal-e-mail vs any target URL that is click-able (or opens
automatically) when the user views the e-mail.

If you start blocking these sites at the DNS level all you'd
be doing is penalizing the victims a second time.

You need to explain who you think the victom is and how they are being
penalized by doing DNS blocking of "bad" domains as it pertains to
spam or phishing e-mails.

Seems that any ISP that operates their own DNS server (and which is
used by the vast majority of their residential customers) could (or
should) impliment harmful domain-blocking using a subscription-based
package (if one even exists). Beats trying to get everyone to install
third-party software like AdAware/Spybot or a hosts file (and keeping
them updated). Do the blocking in one central place (the ISP's DNS
server) and scale the blocking based on the temperment or
vulnerability of the customer base - block known/bad mal-ware, fraud,
phishing domains first, then spam domains, then marketing domains
(like double-click). If an ISP wants to reduce traffic on their
network, would be a good solution to shit-can the useless HTTP junk
imbedded in most web pages.

 

[Jeffrey F. Bloss]

It's similar to what Spybot or AdAware does (or MVP hosts file) and
no-one makes the same claim that the bad guys are "moving around" the
blocks in that situation.

Sure they do. It's a cat and mouse game just like "real" virus activity.
That's why both those softwares need periodical updating.

It's also why both those softwares are imperfect, and why DNS level blocking
would be less so.

[tangent: Is there a way to get a list (daily, weekly, etc) of new
domain registrations, the vast majority of which (I'm thinkin) are
going to be used for spam/fraud/phishing/e-mail-verification (and are

???

You believe nobody but spammers/phishers are registering domains? You think
every legitimate potential domain owner already has one??

usually quickly de-activated after a spam run)? The theory here is
that if you are really aggressive, you tie that list automatically into

The more aggressive you are, the more you throttle innocent activity. That
is simply a fact of life. Massive slash and burn tactics have already been
tried by various spam lists for instance, and have been found unworkable.
The only of these that are valuable are the ones done in moderation.

You're confusing the source-machine (and forged header contents)
sending the mal-e-mail vs any target URL that is click-able (or opens
automatically) when the user views the e-mail.

I'm sorry, you're wrong. The *vast* majority of phishing emails originate
from compromised machines, or machines that are innocently misconfigured. A
smaller but significant amount come from people using "temporary" accounts,
but even the minor trouble of signing up for a free email is more work than
simply relaying through an open server, and a lot less effective. Only a
tiny fraction of this type of abuse comes from any permanent entity, if any
at all at this point.

You need to explain who you think the victom is and how they are being
penalized by doing DNS blocking of "bad" domains as it pertains to
spam or phishing e-mails.

You don't believe someone who has had their machine used for nefarious
purposes without their consent isn't a victim??

You don't think locking out a whole domain or IP block that may have any
number of legitimate sites or users because of this victim doesn't create
even more victims??

Seems that any ISP that operates their own DNS server (and which is
used by the vast majority of their residential customers) could (or
should) impliment harmful domain-blocking using a subscription-based
package (if one even exists). Beats trying to get everyone to install
third-party software like AdAware/Spybot or a hosts file (and keeping

I think you're taking the responsibility for ones personal "safety" and
placing it on a third party's shoulders. And I think you're creating a
whole new class of victims in the process, with no real ROI, by advocating
a method that's proven historically unusable to combat a problem that's
likely unsolvable.

--
Hand crafted on October 12, 2005 at 14:53:21 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Roger Wilco]

I think you're taking the responsibility for ones personal "safety" and
placing it on a third party's shoulders.

Yes, as he has indicated before with regard to tracking malicious
websites. The idea is to keep one own house in order - not to try to fix
the world. Just don't run the software that is vulnerable to attacks or
filter the ads out yourself with an HTML filter proxy.

....unless you're the type that never tires of playing whack-a-mole.

 

[Jeffrey F. Bloss]

Yes, as he has indicated before with regard to tracking malicious
websites. The idea is to keep one own house in order - not to try to fix
the world. Just don't run the software that is vulnerable to attacks or
filter the ads out yourself with an HTML filter proxy.

??

I was replying to the opinion that much of this should/could be filtered at
the DNS level... specifically by devising a special, but still "public"
server for the purpose.

It's *my* contention that broad strokes like this have limited value.
They're fine for hacking off the more obvious and repetitive offenders, and
it could be argued that nuking the entire KR and RU TLD's might be a good
thing. But routine offenders aren't the bulk of the problem, and in
general terms, this type of retaliation creates collateral damage in direct
perportion to the size of the ax.

Ironically enough, I feel local filters and intelligent software choices
(read: a little education) are far more effective and don't negatively
impact anyone but the end user and their minions. That's a win-win
situation in my little mind.

...unless you're the type that never tires of playing whack-a-mole.

<evil sneer>



--
Hand crafted on October 12, 2005 at 17:44:38 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Leythos]

I was replying to the opinion that much of this should/could be filtered at
the DNS level... specifically by devising a special, but still "public"
server for the purpose.

Since many email services use RBL methods, which do a DNS lookup on the
email, it's already in place using special purpose DNS servers. Take a
look at RBL and spam on google some time.

 

[Jeffrey F. Bloss]

Since many email services use RBL methods, which do a DNS lookup on the
email, it's already in place using special purpose DNS servers. Take a
look at RBL and spam on google some time.

I understand this, and for classical commercial spam the rules are a bit
different. The source is a bit different. What I was replying to was a
scenario that more or less "started" with phishing, then virus propagation,
went to "stupid web tricks", and then on to spam. Using DNS to block all of
these things.

The first two almost never have anything to do with any specific domain or
IP block. They're typically compromised or infected machines. Spammers
*also* have come to use compromised machines or misconfigured SMTP servers
to a growing extent as spam becomes a "prosecutable" offense, or even as
RBL's limit their ability to use their own equipment. In fact, I hear
rumors that hard core spammers are employing script kiddies who own large
numbers of bots to spread spam. The going rate is $100 US per 50 bots, I
believe.

So even the intended targets of RBLs suffer from black listing. They can and
*do* cause collateral damage. The more aggressive they are, mot more damage
they cause. And the more effective they are, the more they increase the
chances they'll cause collateral damage.

Of all these problems, nefarious web sites would be the most likely to be
impacted in a significant way by raw DNS blocking. And to be brutally
honest, they're not much of a problem to a competent user who uses
"quality" software, keeps it updated, and doesn't leech rAd cOOl WaReZ from
questionable sites.

RBLs and theoretical "blocking" DNS servers have or might have a place, but
for most of the suggested problems they're useless. In fact in some
situations they'd likely start blocking a source *after* it's moved on to
other domains, in which case the block is 100% bad and 0% good. Phishing
sites for instance, are that transient. And in almost *all* cases they'll
cause some number of innocent users to be unable to send mail, do business
on their web site, reach sites in certain "neighborhoods", etc, etc, etc.
We already see this effect with current blacklisting practices.

If you're going after habitual offenders, or providers that just don't seem
to care about their users abusing their equipment, then putting the boots
to domains works just fine. But some of these problems never were a domain
related problem, and the others are gradually becoming domain unrelated in
part *because* of RBL's and such.

--
Hand crafted on October 12, 2005 at 21:30:31 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Virus Guy]

Of all these problems, nefarious web sites would be the most
likely to be impacted in a significant way by raw DNS blocking.
And to be brutally honest, they're not much of a problem to a
competent user who uses "quality" software, keeps it updated

If the various anti-spyware and anti-adware (and anti-mal-ware)
programs function by protecting your browser (or e-mail program) from
accessing certain domains, and if saying that the religious use (and
updating) of that software on an individual-user basis is good and
effective, then applying those same rules to a DNS server (being used
by thousands or millions of people) is equally effective but much more
ergonomic (because it can "protect" a huge user-base with much less
collective effort).

The authors of mal-content would not necessarily know the extent that
such DNS-based blocking is in use, because they would have to have
physical access to user or client-side internet access on hundreds if
not thousands of ISP's in north america, europe and asia. And even if
they became aware (though low traffic) that their mal-domains weren't
being accessed, what are they going to do about it?

They've already tried (and in some cases have) poisoned DNS servers.
They already have access to thousands or millions of computers
infected with trojans giving them back-door access to the internet.
They know if they unleash a torrent of DOS against some DNS servers
that the torrent will be turned off pretty quick by the ISP's.
They've infected legit web server farms with malware that serves up
browser exploits.

It's one thing to say that it's up to individual users to fend for
themselves. But ISP's know that many of their customers are not
technical and if their "internet experience" becomes unsatisfactory or
too much hassle that they will un-subscribe, so ISP's have to deal
with spam (ironically, spam that is sent by infected PC's on other ISP
networks) or users will get turned-off of e-mail (arguably the
"killer-ap" of home internet use) and their own infrastructure (DNS
servers in particular) are put under strain when too many of their own
customers machines are infected with spam-ware and begin hammering the
DNS servers and increase network latency for all users.

ISP's should be blocking port-25 packets from leaving their networks
(unless they come from their own SMTP servers) and they should return
127.0.0.1 for DNS lookups to know mal-domains.

 

[Jeffrey F. Bloss]

If the various anti-spyware and anti-adware (and anti-mal-ware)
programs function by protecting your browser (or e-mail program) from
accessing certain domains,

They do not, at least not primarily or not in total. Site blocking works
fine for known bad guys like Doubleclick (sp?), but threats don't come from
known bad guys alone. There isn't a piece of anti-malware on the market
that doesn't rely primarily or heavily on content checking and "looks
like". Site blocking is a useful addition if used judiciously, but far from
a solution on its own.

They've already tried (and in some cases have) poisoned DNS servers.
They already have access to thousands or millions of computers
infected with trojans giving them back-door access to the internet.

Exactly why DNS level blocking is likely to fail, or create more havoc than
it solves. More and more attacks are coming from outside the "home" domain
of the attacker... from those "thousands of millions of computers with ...
back doors".

Why should these people be punished?

Let's look at the critter from another angle. For the sake of argument let's
assume DNS servers did "RBL" style site blocking as you describe, and some
attacker compromises a server in say... one of eBay's clusters. Aggressive
site blocking locks down access to eBay for 48 hours or so. Are you willing
to assume responsibility for the millions of dollars lost by eBay and it's
user base?

It's one thing to say that it's up to individual users to fend for
themselves. But ISP's know that many of their customers are not
technical and if their "internet experience" becomes unsatisfactory or
too much hassle that they will un-subscribe, so ISP's have to deal

I agree to a point. Providers do need to be involved for the reasons you've
stated. But there has to be a happy medium. Ultimately a user's safety is
their own responsibility. Providers have neither the resources nor the
legal or moral responsibility to assume a role as sole guardian.

ISP's should be blocking port-25 packets from leaving their networks
(unless they come from their own SMTP servers) and they should return
127.0.0.1 for DNS lookups to know mal-domains.

Not a chance. You're truly proposing a "cut your nose off to spite your
face" solution. There's perfectly valid reasons for SMTP traffic to be
originating from user's machines. The copy of Postfix running on the box
I'm at right now being one of them. What you suggest is nothing more or
less than crippling "the net" to fend off an abusive minority. Totally
unacceptable.

--
Hand crafted on October 12, 2005 at 23:15:25 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Doc]

Instead of always updating your hosts file or updating (innoculating)
your browser with programs like AdAware/Spybot, doesn't it make more
sense to use a DNS server that is constantly updating it's own lists
and essentially blocking junk domains?

Sure, that might be a bit too much to ask of the root servers (might
be illegal too) but why can't some third party run a bank of DNS
servers that does mal-blocking ?

Say, return DNS requests for known-bad domains to a default IP that
brings up a web page that says something like "the domain your browser
is trying to access is bad for your computer's health" ?

That would be one way to block e-mail phishing and address-testing
spam links, web sites infected with trojans, etc (assuming it the
servers were updated relatively quickly, all the time).

I don't fancy having any 'censorship' applied that is out of my control,
reeks of 'big brother'. I much prefer to maintain my own HOSTS file and
Restricted Zone.

Is your definition of 'malware' the same as mine ? In a lot of cases it
would be, but equally, in a lot of cases it wouldn't be.

 

[Virus Guy]

Exactly why DNS level blocking is likely to fail, or create more
havoc than it solves.

How many people are running spybot, or adaware, or the mvps hosts
file?

They function by complete blocking of some domains (some block
irritating advertizing or tracking mechanisms imbedded in web pages,
some block known mal-ware or phishing domains, etc. Point is that
that stuff isin't causing "havoc" among the thousands or millions of
distributed individual users, so the rules or the blocks in effect
could be harmlessly put into place at the DNS level.

More and more attacks are coming from outside the "home"
domain of the attacker...

Don't get me started spitting at Micro$haft for foisting XP on the
home user market, complete with wide-open backdoor services all
hackers enjoy.

Yes, netbios and other ports are being hammered at all the time on
residential networks. Presumably some of that traffic could be
blocked by a few simple configuration settings on the ISP's own
network-spanning switches. If ISP's had any brains, they'd ask
suppliers of the DSL/Cable modems that they buy in bulk to set them up
to block those ports (in and out-bound). Problem solved, and no harm
done to end-users.

from those "thousands of millions of computers with ...
back doors".

Why should these people be punished?

Who's being punished? And how? I don't see that.

Let's look at the critter from another angle. For the sake of
argument let's assume DNS servers did "RBL" style site
blocking as you describe, and some attacker compromises a
server in say... one of eBay's clusters. Aggressive
site blocking locks down access to eBay for 48 hours
or so. Are you willing to assume responsibility for the
millions of dollars lost by eBay and it's user base?

Red herring argument.

Ad Aware, or Spybot, or any available updated hosts file would never
add ebay.com to their own blocking or protection strategy, and neither
would an agressive DNS-based strategy because of a transient threat on
a legit server.

Now some spammer that registers "pay-pal.com" or "City-bank.com" and
sends out account-confirmation spam then (1) it would be good to get a
daily list of newly-registered domains and look for obvious fraud or
identity theft-based names and have DNS servers block them before any
spam ever gets sent, or (2) at least when those domains start showing
up in spam then that's when you want to have them blocked at the DNS
level.

What hasn't been talked about much is that domain registrars have a
vested interest in allowing mal-domains to be registered and not
revealing them in any sort of publically-accessible diary. They would
be the ones that would cry out against widespread use of DNS blocking,
because their own business would suffer if mal-domain registration
declined.

Ultimately a user's safety is their own responsibility.
Providers have neither the resources nor the legal
or moral responsibility to assume a role as sole guardian.

Sole guardian - no.

Doing simple things to configure their residential networks to make
them safer? Hell yes, and it's moronic that they haven't.

If ISPs blocked port-25 (ie spam) from leaving their networks 3 years
ago, then many many different viruses and trojans would never have
been written because the value of taking over a home computer would be
drastically reduced if that computer is rendered incapable of acting
as a relay for spam. If ISP's blocked netbios ports from outside
their network (and blocked them as much as possible inside) then again
the spread of other forms of mal-ware would have been reduced.

Not a chance. You're truly proposing a "cut your nose off to
spite your face" solution. There's perfectly valid reasons
for SMTP traffic to be originating from user's machines. The
copy of Postfix running on the box I'm at right now being
one of them.

You have got to be kidding. how many residential users are running
their own mail servers? How many ISP's actually allow it? How many
are using their ISP's http-based e-mail services and not POP?

Some (or many) ISP's naturally allow port-25 for a user to send e-mail
through the ISP's mail server (and not to any outside the network).
And that is just fine in 99.9999% of the cases. Nothing stopping you
from retrieving mail from servers outside the network. I do it all
the time.

You want to send mail, have it go through your ISP's server. They
won't add a tag-line, and they probably won't scan it for content, and
they probably won't put a limit on it's size, and they will let you
mung the header any way you want. That should be more than enough for
any user. You want to run your own server? Then buy a commercial or
business account.

What you suggest is nothing more or less than crippling
"the net" to fend off an abusive minority. Totally
unacceptable.

Tell me how the average home user would be affected if their ISP
blocked port-25 packets from dynamic IP's (within the ISP's network)
from reaching the internet at large?

Tell me how you specifically would be affected.

 

[Virus Guy]

I don't fancy having any 'censorship' applied that is out of my
control,

Then you can use some other DNS server that doesn't do blocking.

I'm saying that for a good chunk of residential internet users (who
don't even know what usenet is, let alone read these discussions) that
such a managed DNS server is completely appropriate for them.

 

[Jeffrey F. Bloss]

How many people are running spybot, or adaware, or the mvps hosts
file?

They function by complete blocking of some domains

That's only a *part* of their function. When dealing with known habitual
abusers it's completely acceptable. But weeding out "occasional" nefarious
activity from other hosts absolutely requires other methods. Sadly, that
occasional activity is becoming the rule rather than the exception.

(some block
irritating advertizing or tracking mechanisms imbedded in web pages,
some block known mal-ware or phishing domains, etc.

Both Spybot and Adaware do. I don't believe there's any that don't, aside
from hosts file type solutions.

Point is that
that stuff isin't causing "havoc" among the thousands or millions of
distributed individual users,

Only because host blocking isn't used indiscriminately. You need look no
further than some of the more aggressive spam block lists to see how overly
aggressive blocking makes them unusable.

Don't get me started spitting at Micro$haft for foisting XP on the
home user market, complete with wide-open backdoor services all
hackers enjoy.

On that we couldn't agree more. All operating systems and softwares have
their problems, but Micro$loth seems to go out of its way to make those
holes unbearably easy to exploit.

Who's being punished? And how? I don't see that.

Huh?

How can sanctioning someone for being the victim of a computer break in
*not* be viewed as re-victimizing that person?? Would you place a home
owner under house arrest if burglars busted through their window?

Red herring argument.

It's a perfectly legitimate argument. Using eBay as an example was bit of
"poetic license", granted, but substitute some smaller and lesser known
business and the scenario plays out the same. One of Mom and Pop's home
based business machines gets compromised, some miscreant uses it to send
out 1000 phishing emails and sets up a cute little page to collect the
data, and Mom and Pop loose the ability to sell their WhizBang 3000 coffee
mugs to the 25 or so people who might want to buy one this week.

Same same with your suggestion that new domains be put on some sort of
administrative "hold". You're penalizing people who have just paid their
pesos for the right to do business or merely express themselves, before you
have any clue what so ever that they're doing anything wrong.

The only thing that changes between these scenarios and the eBay flourish is
the dollar figures. Maybe.

Now some spammer that registers "pay-pal.com" or "City-bank.com" and
sends out account-confirmation spam then (1) it would be good to get a
daily list of newly-registered domains and look for obvious fraud or
identity theft-based names and have DNS servers block them before any
spam ever gets sent, or (2) at least when those domains start showing
up in spam then that's when you want to have them blocked at the DNS
level.

Presupposition of guilt. Never a good thing.

What hasn't been talked about much is that domain registrars have a
vested interest in allowing mal-domains to be registered and not
revealing them in any sort of publically-accessible diary. They would
be the ones that would cry out against widespread use of DNS blocking,
because their own business would suffer if mal-domain registration
declined.

That's possible, but unlikely. I'd suggest that the stigma of being a known
abuse promoter would cut into profits at least as much as disallowing
transient scumbags from trying to register "sounds like" domains.

Sole guardian - no.

Doing simple things to configure their residential networks to make
them safer? Hell yes, and it's moronic that they haven't.

I think your idea of a moron and mine differ. I also think you're missing
some of the more technical aspects and ramifications of what you're
proposing...

If ISPs blocked port-25 (ie spam) from leaving their networks 3 years

It doesn't work that way. Blocking traffic originating from port 25 would
accomplish nothing. SMTP connections are made from arbitrary source ports
TO port 25. If you block traffic destined for port 25 you instantly break
the ability for any user to buy and/or use any perfectly legitimate third
party email providers.

FWIW, SBC is trying exactly what you're suggesting, and failing. They found
out almost immediately that they had to implement a semi-automated "opt
out" mechanism, and that this mechanism is quite popular. There's rumors
they're considering scrapping the project after about 6(?) months.

ago, then many many different viruses and trojans would never have
been written because the value of taking over a home computer would be
drastically reduced if that computer is rendered incapable of acting
as a relay for spam.

Blocking port 25 wouldn't prevent this.

If ISP's blocked netbios ports from outside
their network (and blocked them as much as possible inside) then again
the spread of other forms of mal-ware would have been reduced.

Netbios isn't so much a problem these days. Most of the nefarious activity I
see still centers around SQL. The rest is oddly enough ICMP, either
"probes" from people who would presumably attack further after the right
response (like the almost nonstop brute force attacks against SSH daemons),
or DoS/DDoS attacks.

Of course that activity is just from my POV. Other areas may be experiencing
different types of attacks. But in any case, neither of these can be flatly
blocked for reasons similar to the SMTP problem.

You have got to be kidding. how many residential users are running
their own mail servers?

I am for one. And for perfectly legitimate reasons which are really none of
anyone's business but mine. I can name about 100 or so others who are
doing the same off the top of my head.

Yes, I realize that 101 compared to a bazillion or so total internet users
is insignificant, but that's not the issue. Why should *I* be penalized
because someone else refuses to play by the rules?

How many ISP's actually allow it? How many
are using their ISP's http-based e-mail services and not POP?

I'd say a few, but from my experience the majority configure their copy of
Outbreak Excess. Even fewer configure a real email client.

Some (or many) ISP's naturally allow port-25 for a user to send e-mail

There's very few ISPs that block outbound SMTP traffic as far as I'm aware,
and the only one that I am personally aware of is having problems with it.

Oddly enough, what is apparently blocked fairly frequently is SMTP traffic
within an ISP's sphere of influence. It's not possible for me as a
Roadrunner customer to send mail to my rr.com account through my local SMTP
server for example. I can, however, send locally generated SMTP traffic
anywhere else.

And no, I'm not sure why that is. My knee jerk assumption is that Roadrunner
is making some attempt to "watch out for its own" while not breaking
everyones outside connectivity.

through the ISP's mail server (and not to any outside the network).
And that is just fine in 99.9999% of the cases. Nothing stopping you
from retrieving mail from servers outside the network. I do it all
the time.

You want to send mail, have it go through your ISP's server. They

What plausible reason is there to prohibit someone from using an outside
email provider? Aside from draconian control or sheer anal retentiveness I
can't think of one. Truth be known, users are FAR more likely to have a
safe and happy emailing experience with most third party providers than
they are with their ISP's standard service. Dedicated email providers
typically offer much better spam and virus filtering for example. How many
ISP's offer challenge/response systems for instance. Or white listing?

For that matter, why should these third party providers be put out of
business because a minority refuses to play nice with the other children??

Seriously VG, I don't think you've thought this through all the way. Not a
personal jab, but I really think you need to examine what you're proposing
a little closer.

won't add a tag-line, and they probably won't scan it for content, and

There's another perfectly legitimate use for third party or local email
servers... privacy. That's the core reason I run my own server in fact.

Tell me how the average home user would be affected if their ISP
blocked port-25 packets from dynamic IP's (within the ISP's network)
from reaching the internet at large?

Tell me how you specifically would be affected.

I'd be looking for another ISP, for one.

--
Hand crafted on October 13, 2005 at 03:56:52 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Tim Smith]

How many people are running spybot, or adaware, or the mvps hosts
file?

They function by complete blocking of some domains (some block
irritating advertizing or tracking mechanisms imbedded in web pages,
some block known mal-ware or phishing domains, etc. Point is that
that stuff isin't causing "havoc" among the thousands or millions of
distributed individual users, so the rules or the blocks in effect
could be harmlessly put into place at the DNS level.

Here are some of the problems with doing it at the DNS level (assuming
we are talking about the ISPs doing it):

1. There's quite a lot of malware that isn't malware for everyone. That
is, I might think something is malware that you think is not, and vice
versa. If we handle our own blocking, that's fine. If the ISP does it,
one of us is going to think they blew it. An example of this would be
Gator (or whatever they are calling themselves now). A hell of a lot of
people got that by actually choosing to download it and install it. An
ISP that tried to block it would get a lot of complaints from customers.

(This is similar to the reason that spam blocking works much better on
the end-user's end. There are some people out there who actually do
apply for mortgage refinancing by email or ask for information on
getting erections or whatever. That's all spam when it comes to my
mailbox, but it is not spam when it comes to the boxes of people who
asked for it, and the ISP doesn't know the difference. A bayesian
filter on the end user's machine does).

2. Legal troubles. Most ISPs nowadays offer more than just basic
internet connectivity. They offer their own custom portal pages, and
search engine interfaces, and maybe even toolbars and stuff like
that--often the same kind of things that the malware programs try to
provide. If an ISP blocked somesite.com as malware, and the ISP also
offers something that is similar to what somesite.com offers (e.g., they
both offer a search engine front end), somesite.com would complain that
they are being blocked because they compete with the ISP, and raise
antitrust and unfair competition issues.

3. It wouldn't be very effective. Throw-away domains are cheap, and
much malware doesn't even need a domain. (And once malware is on your
machine, there's nothing that requires it to use your ISPs DNS server).
The malware makers could easily adapt to a world with DNS blocking at
the ISP level with barely a hiccup.

 

[tim]

How many
ISP's offer challenge/response systems for instance.

No sane ISP I hope.

tim

 

[Jeffrey F. Bloss]

No sane ISP I hope.

Just out of curiosity, why would you consider challenge/response methods,
like the ones implemented by almost every mailing list in existence to
thwart the subscription of a third party, "insane"? They might be a little
"cumbersome" for the average user, but their purpose is to *promote* some
level of sanity.

Or were you implying that setting challenge/response as a default for any
new account would be crazy??

--
Hand crafted on October 13, 2005 at 10:56:58 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Virus Guy]

How can sanctioning someone for being the victim of a computer
break in *not* be viewed as re-victimizing that person??
Would you place a home owner under house arrest if burglars
busted through their window?

Anyone that is operating a server (HTTP, NNTP, SMTP, etc) for business
or recreation, and who's domain has not been identified as one that
historically hosts or support spam/UCE/phishing/fraud/identity theft,
will never get their domain included in a blocking list (such as a
hosts file, or Adaware, or Spybot, etc) if their servers get
"trojanized" or infected or comprimized with mal-ware. - UNLESS the
operators of said servers do nothing to remove the mal-ware.

The idea of applying the same blocking on a DNS server applies
similarly. It would not be effective or logical [you call it
"victimizing them"] to apply such blocking to someone's domain if
their machines were victimized by mal-ware. [But read this: Blocking
their domain WHILE THEY ARE INFECTED is actually a good thing. It
would prevent the distribution of secondary payloads if their machines
were unwittingly hosting them, and more than likely their site would
crash because of the unwanted traffic being directed to them].

One of Mom and Pop's home
based business machines gets compromised, some miscreant uses it
to send out 1000 phishing emails and sets up a cute little page
to collect the data, and Mom and Pop loose the ability to sell
their WhizBang 3000 coffee mugs to the 25 or so people who might
want to buy one this week.

Again, unless Mom and Pop don't fix their server (assuming they even
run their own server, which is rare because most small business
hosting is done by third parties) Mom and Pop have absolutely nothing
to fear from coordinated DNS blocking - unless mom and pop are in the
SPAM/phishing/UCE business anyways.

There have been (few? many?) server farms that have been comprimized
over the past year or two. They are usually cleaned up within 24
hours. None of those domains (I'm sure) have ever made it into
Spybot's or AdAware's blocking or immunization data base. I would
expect the same to happen in a DNS-based domain blocking strategy. I
don't know why you can't understand that.

Same same with your suggestion that new domains be put on some
sort of administrative "hold". You're penalizing people who
have just paid their pesos for the right to do business or
merely express themselves, before you have any clue what so
ever that they're doing anything wrong.

If I run a small business, I might want to point my machines to a DNS
server (operated by myself, or a third party, maybe for free, maybe on
a subscription basis) that blocks all new domains until they are 2
months old (in addition to blocking known-bad domains). I think
that's a highly effective way to stop any trouble that my employees
might get themselves into by clicking on the wrong link, or by some
network-based malware that takes advantage of an OS-based vulnerabilty
and at some point tries to access the internet looking for secondary
payloads on newly-registered domains.

If I'm a big ISP, I might get lots of support calls if I block
newly-registered domains for 2 months. But not necessarily 2 days or
2 weeks. Or maybe I won't block domains based on
date-of-registration, but still block known-bad domains. You do
realize that any customer of the ISP can still point their computer to
any DNS on the internet they want to (that will allow connections from
them that is).

Presupposition of guilt. Never a good thing.

Item (1) above is presupposition. Item (2) is not.

I'd suggest that the stigma of being a known abuse promoter
would cut into profits at least as much as disallowing
transient scumbags from trying to register "sounds like"
domains.

You've got to be kidding. Domain registrars have no public profile or
exposure.

Look at someone like Go Daddy. They take money from all sorts of
bad-guys that register domains for the sole purpose of being used for
phishing scams or spam campaigns. I would love to be able to block
domains based on the registrar, but I can't see any way to execute a
mechanism that does that. If you could, THEN registrars would have an
interest to take business only from "clean" customers. Until then,
they suffer no real repercussions from registering any domain from any
customer - good or bad. Negative stigma in usenet discussions has no
connection to negative revenue.

It doesn't work that way. Blocking traffic originating from port
25 would accomplish nothing. SMTP connections are made from
arbitrary source ports TO port 25. If you block traffic destined
for port 25 you instantly break the ability for any user to buy
and/or use any perfectly legitimate third party email providers.

By blocking out-bound port-25 packets, you prevent users from setting
their out-going SMTP server to point to a machine outside the ISP's
network. You can still set the in-coming SMTP server to point to any
(external) machine anywhere on the internet, and you set your
out-going server to that of your ISP's server. You can send all the
e-mail you want, and it will appear to recipients as if it came from
the external server.

You still haven't explained why such a configuration wouldn't work in
your case. (you may not like to use your ISP's SMTP server to relay
your out-going e-mail, but you haven't explained technically why it
wouldn't work in your case).

And by the way, your ISP could easily block your ability to operate an
SMTP server if it violates the terms of your contract (and yes, you
could switch ISP's if they did, and they may or may not care if you
leave them, and you may or may not have to buy a business or
commercial account from someone else if you really really must operate
your own SMTP server).

The internet at large has paid a heavy price (in terms of spam, in
terms of trojanized machines that send/relay spam) by not blocking
out-bound port-25 packets from dynamic or residential IP space. The
"benefit" of allowing a precious few people to be able to send e-mail
to outside machines (or operate SMTP servers at home) is FAR
outweighed by the spam problem that has resulted because of it.

Blocking port 25 wouldn't prevent this.

Of course it would.

If ISP's had port-25 blocking in place on day 1, as a normal setting
for their network, (or if they had put it in place 3 or 4 years ago),
and if many ISP's had done this, then why would spammers/hackers be
writing viral or back-door code that would allow them to use home PC's
to act as spam relays if those machines actually couldn't relay the
spam anyways because of port-25 blocking?

I am for one. Yes, I realize that 101 compared to a bazillion or
so total internet users is insignificant, but that's not the
issue.

Yes it is. There are ways for you to operate your own server - ways
that probably involve paying an extra $10 a month for a business or
commercial connection. You and your 10 buddies are getting a free
ride at the expense of having a (residential) network infrastructure
that allows spam from infected machines.

It's not that I'd like to see ISP's block port-25 just to trash your
party. It's that the spam that comes with it comes at an absurd price
that everyone has to deal with at some level, and there's really no
justification for it.

Why should *I* be penalized
because someone else refuses to play by the rules?

Because blocking port-25 is the most effective way to stop spam.
Period. And it has been since late 2002/early 2003 (when
trojan-infected Windows XP machines connected to cable and DSL
residential networks started to appear).

And you are not being penalized. The work-arounds are trivial and
don't impact you in the slightest. That's the really galling part of
this situation.