Slashdot Mirror
Why Do Email Admins Make Viruses Worse?
gripdamage asks: "Why are email administrators still sending virus bounce messages, when everyone knows viruses forge the sender? This effectively doubles the amount of email traffic due to the virus (triples in the case that the recipient is also notified). As one of the links says 'any AV software or admins that have it mis-configured [so] that it is continuing to send out notices...to forged senders, deserve to be ridiculed.' I have received 4 times as many erroneous bounce notifications, because of MyDoom , than the actual virus, so the bounce messages are much more of a problem! This is a problem deserving publicity, so that email admins will be shamed into doing the right thing." The problem is that most bounces are automated responses, the simple thing would be to turn them off. Of course, the rational of the automated response is to hopefully notify the infected user of the problem -- what a catch-22! What kind of policy would you recommend when it comes to spam, e-mail and automated responders?
(fp!)
This sig no verb.
If i send a mail to billabab@hotmail.com but meant to send it to millybob@hotmail.com, than i appreciate a bounce. A good virus spoof will make it too hard to differentiate genuine and false return addresses.
--
FreeNET user? Comfortable with the adverse selection?
SPF. If SPF checks out OK, then send the virus notification. If not, don't bother.
Bounce the headers of the message, and possibly some text. Do not bounce any attachments. If the "sender" is real, they will know their own message by that; if it is fake, bandwidth is not overused.
I can't say that I don't give a fuck. I've just run out of fuck to give.
I have received 4 times as many erroneous bounce notifications, because of MyDoom , than the actual virus, so the bounce messages are much more of a problem!
I agree that the bounces are damaging, but they usually don't multiply the damage; assuming one bounce per virus email, that is only 1x as harmful as the virus itself.
Most AV will not bounce the emails (these are the ones you don't see of course), reducing the ratio of (bounced emails) / (total emails) to below 1.
If you are the admin of a mailserver, NEVER BOUNCE OR REPLY BASED ON ANYTHING EXCEPT THE INFORMATION IN THE ENVELOPE HEADER.
I am fucking tired of seeing mail bounced to my server and email address, just because my email address (or domain) was in the From: portion of the message. They should be smart enough to take a look at the envelope portion of the header and see there is a difference.
Also, stop notifying senders that "you may have a virus". At all. If you want to do this for your own users, that's fine - but stop sending this shit to people outside of your domain!
And third... GAH... Where to begin. I give up.
But this doesn't serve their purposes. Their goal, in the event of a virus outbreak, is to advertise. When people are getting viruses, they start looking for AV software, and that's the perfect advertising opportunity.
I always write back to the postmaster@domain to complain that their software is advertising, and I include a Cc: to the AV vendor, so they can see the negative publicity that results. It might help if everyone else did the same....
I'm very bothered by this. I'm going to send a message about this to everyone I know. I suggest you all do the same.
It's an advertisement, pure and simple. It's entirely to the software manufacturer's benefit to take the opportunity to advertise to third parties with you as the middleman.
And it works. I've had grey haired suits forward bounce messages to me to ask about the other products, asking whether we might want that instead of or in addition to the package I'd already put in place for them.
I'll take because we can for $200?
I report all mistaken anti-virus bounce as spam to DCC, Pyzor, Razor. Since the primary motivation that anti-virus companies set bounce as default is to advertise their product, I consider it unsolicited mail.
Send a bounce message back using windows messaging service. If they're dumb enough to leave that open, then they're dumb enough to not keep up with the latest virus scares. Otherwise, any competant admin doesn't need to be notified.
and should be recognised as such.
AV vendors know damn well that 99% of viruses spoof addresses. More than anyone else, since studying viruses and figuring out what they do is their JOB!!
The only possible excuse for this behaviour is that they get FREE ADVERTISING out of it. It's spam advertising AV software and/or mail filters, plain and simple. It should be treated the same way as any other spam.
455fe10422ca29c4933f95052b792ab2
Many admins think that they are lord of the castle, if you suggest a change to the email system, like cancelling the bounce, the first answer is NO like you are stepping in their territory.
I used to work for a place where the admin also got so paranoid with spam that he blocked entire domains like yahoo and hotmail even though there were at least a dozen legitimate customers that used those email services as their primary business email.
It isnt until there is a backlash or fear of losing their castle that some will make a change.
Sometimes you just have to be the loudest voice in complaining and go over their head and reason with their boss. Explain that a flood of redundant emails is bad practice and that in many peoples eyes a bounce message saying "virus found!" with your companies domain makes people think that YOU have the virus. Sounds strange but it happens. You bounce a message and you get a call saying "You guys have a virus... we just got an email about it" coming from the internal staff, then spend the next 15 minutes explaining that they are protected and that the bounce was only informational and still they dont always get it.
Virus protection is best operated SILENTLY! You as an admin can sweat the details but the clients should just "Know they are protected" and not be bothered with details. It's just good management.
Boredom's not a burden anyone should bear.
That really IS an interesting question. What is worse, bouncing it, or accepting it?
r it y.html
If an admin were to bounce it then the only way to take care of it *correctly* would be to parse the header and send it to the ISP of the luser who is infected. They will (hopefully) notify the owner of the affected machine, and THAT user gets to fix their machine. Or, they can boost the economy a little and hire someone to do it or go buy some AV software.
Now a better way in my opinion would be to blackhole all emails received. Why? Less processing. Less bandwidth. Propogation of the worm is stopped dead in its tracks. Those that have it will get rid of it soon enough (in theory) and the congestion caused by the worm will be less than if they were bounced.
Then, there are those like me who are still learning what being a sysadmin is, and rely on pre-made tools like this one:
http://www.impsec.org/email-tools/procmail-secu
As I understand it, it will either bounce OR blackhole the whole email.
Looks like I have some reading to do!
All comments, constructive critisism, and pointers are welcome!
Nobodies Prefect
Tidbits for Techs Technology Blog
I hate being forced into supposed "up"grades.
--Mike--
Why not strip the virus from the bounce, like some (too few) servers do? Even better, why not have the AV scanner integrate with the mail server, so that the bounce doesn't just bounce, but also SAYS "Hey, douchebag, you're infected!" Make the bounce message USEFUL.
jX [ Make everything as simple as possible, but no simpler. - Einstein ]
I think you mean rationale.
We have a semi-homebrew mail filter based on open source tech like customized spamassassin and mimedefang.
1) Messages which are obvious worms are not bounced at all, just dropped. This requires us to update the list of which AV hits are worms and which are just attachments in an otherwise legit mail. Obviously this isn't always kept up to date, but when a worm is wide-spread we make sure it isn't generating bounces. The bounces clog up the queue anyway.
2) Other messages are bounced, but only text portions, everything else is stripped out.
I believe it's better to err on the side of bouncing. I hate it when I send somebody a large attachment or a subject line with numbers in it, or something that trips a virus or spam filter, and the message is *silently dropped*. You want to kill email? Make it so you have to call the person on the phone to see if they got your message!
I was a little confused with all these posters talking about "free advertising" but then I realize you're talking about the off-the shelf products.. our system doesn't advertise anything except the name of the org and why the message was bounced at our servers.
So, if I had to choose, I'd say stick with the bounces. I'm not (very) worried about bandwidth, I'm worried about people losing control of their desktops to worms.
Bit Bucket (*woosh!*) He shoots, he scores!
Yes, ye olde bit bucket - silent but deadly. Virus-infected emails check in, but they don't check out (or get delivered). Saves disk space, too.
And don't ever send a bounce.
Send bounces only for mails not detected as either virus spam.
That would make everybody happy.
Amavis (running clamav) has an option in there to specify which virii should be dropped instead of replied to, although it's manual so until you know how your virus software will ID things you'll probably dump replies. Maybe it'd be handy for AV database maintainers to add a flag, like a 'from header spoofer, please don't reply or you'll just make things worse' boolean.
"People will pay big bucks for the luxury of ignorance."
Are we certain that they are bounces and not just viruses pretending to be bounces? The pattern of the messages I've received suggest to me that the viruses are trying to conceal themselves (poorly) as bounce messages.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
The best solution would allow notification to users who actually send a virus unknowingly yet drop all bogus bounce messages. The server receiving the bounce should look up the SMTP id from the bounced message and compare it against messages that have been sent out recently. Drop the bounce unless it matches something from the last three days. Having records of smtp id, sender, and recipient could also be helpful in investigations of where a virus originated from.
that about av database to have a flag for replying
I just filter out the automated responses. Hopefully, I won't be getting that many important ones.
Why don't we expect ISPs to filter email for viruses?
I know it would be expensive, that it would require people to do more work and buy more servers. But I don't see any other way of shutting down these mail virus storms.
This virus doesn't exploit any real holes. It depends on unsophisticated users doing something dumb. I don't think we're ever going to live in a world in which it won't be possible to trick unsophisticated users into doing something dumb. Does that mean we have to suffer through this crap indefinitely?
We can (and should) criticize Microsoft for creating an OS culture in which most people run everything with Administrator privs. But even if they fixed that, I'm not sure that this sort of thing would stop happening. The tricks virus writers use would just have to get better.
If all, or even most, ISPs filtered mail for viruses, they'd be much less of a problem.
I used to run a small ISP. When we started out, everyone had open relay SMTP servers. But gradually over time, the culture changed, and it was recognized that you had to close your relays if you wanted to be a good net citizen. ISPs that didn't had trouble getting other people to take their mail.
I know this isn't the same thing, because closing a relay is a one time config change and doesn't require you to run beefier servers. For large ISPs, filtering mail would cost real money.
I just don't see an alternative, though.
I have a wildcard email forward on my domain, and I'm going to get a couple of hundred copies of this virus today.
Problem here is that if you mark, defang and deliver some people will get hundreds of e-mails in their inbox which consist entirely of the attachment removed due to virus infection message. They inevitably come back to the mail administrator and report it as a problem: 'all of my e-mail is getting the attachments removed'. Far better just to log the event and place the infected e-mail into the bit bucket, never to bother anyone again. This approach doesn't cause lots of 'shells' being sent to the recipient and does not toss lots of NDR messages to the alegged sender (who probably did not originate it anyways given the methodology being used by the newer mass-mailer worms). Robert H
As I've seen it, there's multiple camps for what to do with email bourne viruses. Those that say strip the attachment, and those that say can the whole thing. I have always belonged to the "can it" group, and Mydoom is a good example. Before our virus scanner started catching them, I got at least 5 emails about how a hacker must have broken into the email system, because they got this message returned to them that they didn't send, etc. If the mail had a virus in it, just can the message.
Next, is what to do after you've tossed the mail: to notify or not to notify. Well, I'm the type that believes that *someone* should get a notification if an email is tossed (ie, mail should never disappear without some sort of DSN going somewhere). So in the case of non-mass-mailing viruses, I send a notice back to the sender telling them their mail was canned, and why.
So my question to other mail admins (which I recently posed to the amavis-new list), is why not rely on the virus scanner's naming schemes? I use f-prot here, and all viruses that fake sender email addresses end with "@mm" (for Mass-Mailer). So I told amavis to not notify the sender if the virus name contains "@mm", but to notify the sender if it does not.
Result? I've blocked over 8000 copies of Mydoom in the last 24 hours, and not sent a single mail to the "sender"s, but when one of the professors sent a mail out with a Word document attached that had a macro virus in it, he got a mail back saying the message was stopped and why.
Simple, elegant... but why don't others do similar setups?
Three dits, four dits, two dits, dah!
Radio, radio, rah rah rah!
Trust me, given the number of automated responses that go to invalid addresses and bounce back on the admins, we wouldn't leave it on if there wasn't some value in it.
If a suspect message is found it should notify the sender.
I send emails to some companies, they block all sorts of files. I tried to send a zip file that the customer, which was blocked.
I immediately got a message refused notice.
This allowed me to inform the customer that they would not get what I was trying to send, and we made alternate arrangements.
If they didn't send out the failure my customer would have been screwed, and I wouldn't have even known. When stuff doesn't happen in business you get blamed even when it is their fault.
In a large company,or even a small one, the workers and even managers can not overturn IS/IT polcies.
Ok, so I actually like my ISP's setup. They require a username/password combo to send any emails through their SMTP server, and include the sender's username in the header info. Makes it really easy to track down who is doing the spamming.
Disclaimer: I also work for them, so it makes my job as a first-line phone jockey easy to track down internal spammers.
During the last Sobig outbreak, I recieved over 100 bounces per day from a single ISP in New Zealand. I e-mailed them to stop, pointing out that Sobig forged its "From" header.
They apologized and informed me I wouldn't receive any more bounces -- because their servers would now silenty delete all e-mail from my account.
I wanted to write back and point out that (a) this didn't help all the other people they were bouncing Sobig too, and (b) I might actually want to e-mail someone using them as an ISP one day -- but I couldn't, because they had blocked me.
I should buy some cement.
Says I, as I attempt to manuver my way through about 1500 emails I've received in the last 4 HOURS on the OOo mod list
Looking for hardware (Currently need: Large Etch-a-Sketch) Have one? See my journal!
I think they strongly suspect it, they don't know.
Secondly only sometimes is the from false.
Someone might actually send the virus to someone else an email asking "What is this file you sent me".
For me silent failure is broken.
I have many times sent someone an email that they needed, only to find out it isn't getting through due to any of a multitude of reasons.
The worst is when their mailserver, which they don't control, blindly chucks email for stupid wrong reasons.
How hard would it be to create a virus scanner for email servers that can keep track of if a virus forges the from and if so not send the bounce message?
Whis whole issue is another reason to implement Sender Permitted From (SPF). If everyone ran SPF this type of virus would not be able to spread.
-Pascal