Re: malware warning
Thats not it.. But I finally found it: https://blog.apnic.net/2018/07/12/shutting-down-the-bgp-hijack-factory/ -- Original message -- From: Niels Bakker To: nanog@nanog.org Subject: Re: malware warning Date: Sat, 22 Jul 2023 19:42:58 +0200 * b...@uu3.net (b...@uu3.net) [Sat 22 Jul 2023, 10:24 CEST]: > The only interesting action I ever saw was: > "Shutting down email spam factory"; where some network was depeered from > internet completly. Well done. > (Somehow I cannot find post about that anymore). AGIS: https://en.wikipedia.org/wiki/Apex_Global_Internet_Services -- Niels.
Re: malware warning
* b...@uu3.net (b...@uu3.net) [Sat 22 Jul 2023, 10:24 CEST]: The only interesting action I ever saw was: "Shutting down email spam factory"; where some network was depeered from internet completly. Well done. (Somehow I cannot find post about that anymore). AGIS: https://en.wikipedia.org/wiki/Apex_Global_Internet_Services -- Niels.
Re: malware warning
Oh, just dont bother. The battle is over and we lost it, because good people are too soft. The only interesting action I ever saw was: "Shutting down email spam factory"; where some network was depeered from internet completly. Well done. (Somehow I cannot find post about that anymore). The only sane action I see is go virtual. I mean, create overlay virtual network, make VPN PoPs and put services there. Looks kinda over kill maybe, but at least, we get back the control. -- Original message -- From: Bryan Fields To: nanog@nanog.org Subject: Re: malware warning Date: Fri, 21 Jul 2023 22:49:18 -0400 On 7/18/23 9:14 PM, Randy Bush wrote: > i did not think i was special, and assumed everybody is getting them. > but i figured that if i kept one or three people from falling for the > trap it was worth the pollution. I've done quite a bit of looking into this, tying to prevent it. It's not being pulled from the archives. The basic premise of it: 1. send email only to direct posters to the list, never through the list. 2. subscribe using a gmail account as a normal member for harvesting 3. scrape the new posts and use email in from: header to send spam to 4. wait some $TIME after the post and send the spam 5. The spam will never be able to be linked to the subscribed account I've been able to track these "ingestion" accounts and kill them when found, but it's impossible to do it without false positives. VERP is used for the list emails, but short of a bounce, that doesn't really help. About the only supported option that would mitigate this is wrapping all posts through the list as from the list. This still would expose the email addresses in the email, and we could rewrite them, but it breaks more than it fixes. I've seen proposals where all messages get wrapped and each individual email address found in the message is re-written to a unique address via a mail forwarding domain, but i can't see this working with such a diverse list. This also would break after some time. This is also not something supported off the shelf in most mailman or other MLMs. I'd love to kill this spam, but the openness of the email discussion list format makes it hard to do. If anyone has ideas on how we can kill this I'd love to shut it down. -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net
Re: malware warning
On 7/18/23 9:14 PM, Randy Bush wrote: > i did not think i was special, and assumed everybody is getting them. > but i figured that if i kept one or three people from falling for the > trap it was worth the pollution. I've done quite a bit of looking into this, tying to prevent it. It's not being pulled from the archives. The basic premise of it: 1. send email only to direct posters to the list, never through the list. 2. subscribe using a gmail account as a normal member for harvesting 3. scrape the new posts and use email in from: header to send spam to 4. wait some $TIME after the post and send the spam 5. The spam will never be able to be linked to the subscribed account I've been able to track these "ingestion" accounts and kill them when found, but it's impossible to do it without false positives. VERP is used for the list emails, but short of a bounce, that doesn't really help. About the only supported option that would mitigate this is wrapping all posts through the list as from the list. This still would expose the email addresses in the email, and we could rewrite them, but it breaks more than it fixes. I've seen proposals where all messages get wrapped and each individual email address found in the message is re-written to a unique address via a mail forwarding domain, but i can't see this working with such a diverse list. This also would break after some time. This is also not something supported off the shelf in most mailman or other MLMs. I'd love to kill this spam, but the openness of the email discussion list format makes it hard to do. If anyone has ideas on how we can kill this I'd love to shut it down. -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net
Re: malware warning
i did not think i was special, and assumed everybody is getting them. but i figured that if i kept one or three people from falling for the trap it was worth the pollution. randy
Re: malware warning
On 7/18/23 7:02 PM, Randy Bush wrote: malware email is so common i normally do not warn of it. but, in this case, the attacker is extracting quotes from nanog and luring folk into clicking. e.g. I've been getting messages like those described on again and off again for quite a while. -- I've been reporting them like spam. I've seen similar for other mailing lists. I didn't think that NANOG was special in any way. P.S.A. Please do cripple URLs in questionable messages. Let's at least make it so that people have to actively stab themselves and can't simply fall on a knife. Grant. . . .
Re: malware warning
Brothers the latest thread is direct reference to ROGERS - CANADA -July 08 2022 outage.. and My Ref in General.. NANOG can be considered " Com Pro Mised".. sad.. but . True! On Tue, Jul 18, 2023 at 8:10 PM Matt Corallo wrote: > I get quite a bit of spam that is a "reply" to old NANOG posts (some > dating back a year or more). > Seems to only happen on some specific threads, dunno why though. > > Definitely recommend using a nanog-specific alias and auto-spam-folder'ing > anything to that alias > that isn't CC nanog@nanog, that seems to get rid of it. > > Matt > > On 7/18/23 5:02 PM, Randy Bush wrote: > > malware email is so common i normally do not warn of it. but, in this > > case, the attacker is extracting quotes from nanog and luring folk into > > clicking. e.g. > > > > From: takaha...@fukushitrust.com > > Subject: Re: jon postel > > To: Randy Bush > > Date: Mon, 17 Jul 2023 04:01:47 -0700 > > > > Hello! > > > > We would like to present to you several alternatives for presentations > and find out your thoughts and > > opinions, please let us know whatever you think about it. > > > > https://dognibs.com/8jh/ogr/g0h436ttqbw > > > > Waiting for your reply > > > > > Does anyone have any stories about working with or near John they > > would like to share with the > > list? It would definitely make my day > to hear more about the early > internet somewhere around i have a > > protocol violation ticket he issued. --- Who says that routing > unallocated address space is ungood? -- > > Randy Bush Routing unallocated address space is ungood! -- Jon Postel > randy > > > > > > > > and > > > > From: off...@daimontrade.com.ua > > Subject: Re: Reverse DNS for eyeballs? > > To: Randy Bush > > Date: Tue, 18 Jul 2023 02:56:36 -0700 > > > > Hello, > > > > Modified paperwork regarding For this month. Kindly read through it > attentively. > > > > https://soocoop.net/e24/1s0/7ckl0icu7h > > > > We appreciate your attention. > > > > > I would say the absence of reverse DNS tells useful info to > receiving > MTAs - to preferably not > > accept. yep > -- Liz *** 416.660.5456
Re: malware warning
I get quite a bit of spam that is a "reply" to old NANOG posts (some dating back a year or more). Seems to only happen on some specific threads, dunno why though. Definitely recommend using a nanog-specific alias and auto-spam-folder'ing anything to that alias that isn't CC nanog@nanog, that seems to get rid of it. Matt On 7/18/23 5:02 PM, Randy Bush wrote: malware email is so common i normally do not warn of it. but, in this case, the attacker is extracting quotes from nanog and luring folk into clicking. e.g. From: takaha...@fukushitrust.com Subject: Re: jon postel To: Randy Bush Date: Mon, 17 Jul 2023 04:01:47 -0700 Hello! We would like to present to you several alternatives for presentations and find out your thoughts and opinions, please let us know whatever you think about it. https://dognibs.com/8jh/ogr/g0h436ttqbw Waiting for your reply > Does anyone have any stories about working with or near John they > would like to share with the list? It would definitely make my day > to hear more about the early internet somewhere around i have a protocol violation ticket he issued. --- Who says that routing unallocated address space is ungood? -- Randy Bush Routing unallocated address space is ungood! -- Jon Postel randy and From: off...@daimontrade.com.ua Subject: Re: Reverse DNS for eyeballs? To: Randy Bush Date: Tue, 18 Jul 2023 02:56:36 -0700 Hello, Modified paperwork regarding For this month. Kindly read through it attentively. https://soocoop.net/e24/1s0/7ckl0icu7h We appreciate your attention. > I would say the absence of reverse DNS tells useful info to receiving > MTAs - to preferably not accept. yep
