Slashdot Mirror
Spammers' Upend DNS
Saint Aardvark writes "eWeek reports on the latest trick of spammers: getting around DNS-based lookups. By registering a domain *after* the spam goes out advertising it, they can get around blacklists. However, that causes all sorts of problems for ISPs and anti-spam services. Paul Judge, CTO at Ciphertrust, says "Even in large enterprises, it's becoming very common to see a large spam load cripple the DNS infrastructure.""
Until they pass a law that makes it completely legal to kill spammers, the spam problem will not go away.
I'm a big tall mofo.
Thank goodness we can now register domains and have them active within 30 minutes!
Oh look, my foot's bleeding. Someone must have shot it.
cyn, free software and *nix operating systems enthusiast.
The article goes on to say that some anti-spam applications do as many as 30 dns lookups. This is a design problem with the apps, not with DNS. Do less lookups, minimize the problem. I'd venture that after checking with a few of the major blacklists, you've pretty much hit the point of diminishing return in distinguishing spam/ham.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
yeah! and make drugs illegal too! that'll teach 'um.
"Nobody owns the fucking words man." - James Dean
Email authentication, or the wholesale abandonment of email as a viable communication platform?
When a DNS query goes to an ISPs DNS server, and the entry does not exist, does it go to the root servers?
Secondly, do invalid domain names get cached (I'm thinking not)?
Who cares about typos? If it doens't exist don't forward it. Plain and Simple.
I don't get it.
So I send out a million spams, all saying "go to www.stratjaktsmadeupdomainname.com for hot viagra and lower mortgage payments."
The domain doesn't exist, and people click on it, which "cripples" dns because the dns servers have to respond with a "no such domain name" reply?
How does this cripple them? Was DNS not designed to handle fat-fingered domains gracefully?
What happens, do all the requests for my domain get propogated up the chain, is that the crux of the problem? If so, doesn't DNS update like, quite often (several times a day) now? There's no need to kick all requests up to the top, right?
I don't need no instructions to know how to rock!!!!
this is not meant as any kind of informative post, but every time i read something like this, or receive another spam in my Inbox, i feel a bit of both sadness and anger...
here is a wonderful tool that made communication easy, fast and cheap but is absolutely being ruined by the malicious few with absolutely no morals, ethics or concerns for others.
just like those orphan traders at tsunami disaster areas... i really would like to have a chance to confront these disguisting people and try to make sense of their thought process...
Some anti-spam group should set up a spam filter that looks for domain names, and registers any that it sees that aren't valid. They would point to a web site that politely explains to users how stupid they are for clicking on a link in spam.
I expect spammers would drop that technique quite quickly if that were done.
DNS could play a role in beating spam. DNS servers suffering from "spam overload" can see that they're handling a lot of the same lookups, that are overloading them. They could flag their responses back to the isolated SMTP servers that are processing the spams, which can tell that they're all the same message. So the distributed network can identify spams, and at least require the senders to share some of the processing load (through another extension to the SMTP and DNS protocols). A more severe response that might affect mere mass-mailers (different from "spam" because content is either noncommercial, or was solicited by the recipient) would be to report such spam-suspects to blacklist servers, which in turn inform users spam filters.
Having had several mass-mailed (big Cc: lists) urgent messages filtered out by corporate spam filters in the past couple of months, I know we need a much better system. Spam is taking down DNS, blocking SMTP, and, even worse, censoring legitimate message needles in the spam haystack. We need network protocols to get smarter, taking advantage of the distributed intelligence that can kill spam. Can the IETF overcome its interest in perpetuating the spam that pays for so much of the Internet, in leading us out of the spam trap?
--
make install -not war
You've misunderstood the problem ...
The domains sending the email exist, but the ones advertised in the email do not. Because SpamCop (et. al) punish not only the sending IP block, but also the advertised host/IP block, spammers are advertising sites that won't exist for a few hours, tricking SpamCop (et al) into reporting on domains that don't exist and therefore cannot be penalized.
2advanced.net - Business Quality Hosting
BIND, at least, does negative caching. Surely this means the load on DNS servers due to looking up the non-existent spam domains is minimal.
Also, once the mail server has decided that a bounce reply is undeliverable (because of no DNS records), surely it is going to dump the email immediately, rather than continuning to attempt to deliver it?
So is this a case of SOME brain dead implementaions of DNS and mail servers, or a real problem for all?
The real "Libtards" are the Libertarians!
I hate this new trend! I have to wait until morning until I can order my v!@gra!!!
What happened to the good old days, when I could order B0n3r Juic3 as soon as I got my mail!
Yup. If it shouldn't come in, and it can't be returned, drop it on the floor.
So often times my (l)users ask me why they received an email saying their computer is infected with a virus (bogus bounces due to a virii changing their source addresses)
My servers drop anything that doesn't seem right: virus infections, RBL tagged connections, obviously forged senders, etc. When a message gets delivered to the bit bucket; no more processing, no more network traffic, no more (l)user complaints.
And I never get a complaint.
What's that smell? Ah, that's my karma burning...
Failed requests (non existent domains) always go to the root servers.
2advanced.net - Business Quality Hosting
Either the journalist drastically misunderstood and misinterpreted what they were told, or one of the people interviewed is launching some magic snake-oil product that'll "solve" this non-existant problem. (Yes, I know exactly what spammers do. That's my job. I know exactly what DNS does, that was my previous job. This article is fiction.)
Overall I agree with this, but my concern is that if you parse the message and find invalid url's then a valid message will be dropped because of a malformed text string. While I suppose that's better than letting more spam through, I would be uneasy about the increase in false positives.
-nB
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
With Yahoo mail.
I typically get 80 messages a day which the builk mailer always finds. These last 2 or 3 weeks only half the spam is being caught and my mail box is becoming loaded again. I was wondering why the fail rate was going up.
My guess is Yahoo used dns lookups in its anti-spam software.
http://saveie6.com/
Spam involves criminal activity (fraud at the least). It involves many people (mail-senders, product suppliers, and some legitimate businesses like credit card processors, banks, and ISPs).
Smells like a Racketerr-Influenced Corrupt Organization to me. Anyone even remotely involved gets a ticket to the proverbial Federal PMITA prison for 20 years, $100k in fines.
These penalties and a wide net are all that can influence spam.
Wow. The article itself is ... stunning. On a per-word basis, I don't know where I've seen a higher concentration of misconceptions about DNS.
Most modern MTAs have the ability to reject email purportedly coming from domains that aren't registered. Just as one example, sendmail does this by default. Not registering domain names makes it *much* *easier* for me to avoid spam. I encourage spammers to adopt the practice described in this article.
Moreover, the costs of looking up nonexistant domains is roughly comparable to the costs associated with lookup up existing domains.
Of course, despite the article being worthless, it's still more than enough cause for the /. regulars to get whipped up into a frenzy.
the problem is that when you have to look up domains that don't exist it tends to take longer, especially for DNS servers, as my understanding they then ask ANOTHER server if it has it, etc and thus when you multiply that times about a billion... you end up killing/lagging DNS servers and the server recieving the mail in the first place ;p
To Accounting@bla.com:
Please authorise my PO so I may purchase the domainname OurNewProduct.com
Standard IANAL disclaimer, but:
Couldn't the spammers be sued for causing what amounts to a DOS attack on the recipient mailserver?
Also, if sexual predators and hackers can be barred from going online, and if corrupt executives can be barred from acting as corporate directors, why can't judges ban unrepentant spammers from going online, or carrying on an internet related business? (And extradited if they subsequently set up shop offshore)
My rights don't need management.
The invalid link may be a link to an internal website. For instance http://wiki.local./ is valid in the office but invalid outside the firewall.
Jeff
ipv6 is my vpn
Seems the simple solution is to cache "bad" addresses in your local DNS server for some specified period of time, probably in a LRU type cache to prevent Spammers from taking it down.
Adding features in your SMTP server that if a certain source has multiple failing emails, that source could be processed on a queue basis, or even automatically bitbucket anything from that address since spam comes in waves.
The cesspool just got a check and balance.
The article is just wrong, and there's a feedback post on the same page that explains why very well. (Although, what's with the stupid formatting?)
That's the one that by default, sends spam bounces to forged email addresses?
One line blog. I hear that they're called Twitters now.
OpenBSD's spamd will initially reject all mail from previously unknown sources. It will only permit access to sendmail after an attempt at redelivery. This has brought my spam load down to about zero.
Unless a spammer using the above trick attempted redelivery (which is unlikely), it would not cause a DNS flood.
spamd is only one of a great many reasons to consider OpenBSD on your critical servers.
Not according to the article:
The sending domains *don't* exist.
Honestly, this seems pretty overrated - any mail coming into our domain gets a single lookup - if the domain doesn't exist, it gets a 500. If the domain exists, but the DNS servers time out, it gets a 450.
Why anyone would accept mail from a domain that doesn't exist is beyond me.