Slashdot Mirror
Carrier Trick To Save IPv4 Could Help Spammers
Julie188 writes "As public IPv4 addresses dwindle and carriers roll out IPv6, a new problem has surfaced. We have to move through a gray phase where the only new globally routable addresses we can get are IPv6, but most public content we want to reach is still IPv4. Multiple-layers of NAT will be required to sustain the Internet for that time, perhaps for years. But use of Large Scale NAT (LSN) systems by service providers will cause problems for many applications and one of them is reputation filtering. Many security filtering systems use lists of public IPv4 addresses to identify 'undesirable' hosts on the Internet. As more ISPs deploy LSN systems, the effectiveness of these IPv4 filtering systems will be hurt."
Like microsoft.company.com Simple solution.
Those who said NAT wasn't the answer: You are correct, unless you are a spammer, in which case this is a windfall.
"There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
Because when one of our university email account gets hacked and starts spamming, other providers block our SMTP server, effectively knocking out communications between us and that ISP. NATing wouldn't change that, unless spammers use their own SMTP server behind a NAT router.
Bring on DNSSEC and DKIM.
I'm sure if we wait just a little while some spammer will send us the 'magic bullet' for this problem via their preferred delivery method.
IP filtering has always been useless from a security standpoint. Same goes for MAC address filtering.
Anyone anywhere can change both easily. Blocking addresses is only a matter of convenience.
This "news" just means that tons of "security" software and filtering hardware (Barricuda, anyone?), is being exposed as the useless, inflexible crap that they are, and the companies behind them are trying to point fingers at large network operators while simultaneously touting their next version, which will have IPv6 support. Maybe. Which totally won't solve the IPv4 issues, but never you mind that.
Comment removed based on user account deletion
Keep all your bullshit about NAT saving the world in this thread where it can be ignored by people who actually know what they are talking about please.
Welcome back, Gopher.
end user customer networks (the ones most likely to go this route) are already on various "mail shouldn't be coming from here" blacklists, and those customers also should be already using the isp's mail servers for outgoing mail. it's a small incremental step, nothing more. Those running servers will necessarily get unique addresses and not be affected by reputable blacklists that are correctable.
I work for an IP reputation company (and am not representing it in this post).
This is not a complicated issue. The LSN portals will merely have to add a tracking header to all mail they process (and block anonymous direct mail if they want to escape DNSBLs' wrath). This is already an issue with webmail (e.g. Google doesn't add the tracking header, so it's MUCH harder to trap spam originating through GMail than it is through providers like Hotmail who do provide this extra tracker).
Use my userscript to add story images to Slashdot. There's no going back.
It's not just spammers. A lot of on-line games, for instance, record the IP address used to log in to a game in the account's history. Customer Support then uses that to help determine eg. whether a claim of a hacked account is valid or bogus. Large-scale NAT is going to mess with that by confusing the record: one computer may appear to be using a different IP address for each login, and multiple unrelated computers can appear to have the same IP address. And with a lot of games moving towards RMT, a hacked account can mean the loss of real money for the player. When CS tells that player "Sorry, the login where the items were sold/transferred came from one of the IP addresses you normally log in from, the problem's on your end." and the player learns that that's because his ISP is NATing their entire network, he's not going to be happy.
is delicious.
So, why not just have a public database of LSNs and have them run extended ident service? (I.e., you supply it with local-remote port pair and it will tell you the IPv6 address of the NAT'd peer. Then you just use that for the peer identification from then on.)
It's not the fall that kills you. It's the sudden stop at the end. -Douglas Adams
Seriously, IPv6 is there to replace IPv4. Tell everyone who whines 'tough shit' switch over already. If I have to pay an extra 5 dollars a month for a year to my ISP for that to happen then I would. Just stop trying to extend the life of IPv4 when there is a suitable replacement already available.
Having been intimately involved with spammers over the years I can say that this change will only escalate the ongoing game of use / burn / blacklist / move on. Yes, more poor commercial entities will unknowingly and unwillingly have to call in Wally the IT guy to help them get off some blacklist somewhere so their mail will flow, but in the grand scheme this will not change the processing power of the mail bots or tilt the scales in a significant manor. IMHO.
... lists of public IPv4 addresses to identify "undesirable" hosts ...
Legitimate mail servers will still need an IP address, whether that is IPv4 or IPv6. Their outbound SMTP connections can just use that same IP address. The real issue involves all those end user (broadband and dialup) IP addresses, which more and more will be multiple users sharing them for outbound connections, with no inbound. Make those have zero reputation. Let the IP addresses which are associated with real mail servers have the reputation earned by its behavior.
One big difficulty will be mail servers stuck only on IPv6 trying to deliver mail to those on IPv4, and visa-versa. But this is at least a substantial subset of the IP space. That means it can hold out for a while on IPv4, until enough IPv6 is deployed to make a "mad rush to IPv6 for email" can happen. But in the mean time, those who can do mail exchange between servers on IPv6 will be pretty much spam free, for at least a while. When spammers get on IPv6, then we know IPv6 is "happening".
To encourage IPv6, those who are on it can do things like adding extra goodies to IPv6 users. I do know a lot of porn is already there. Maybe extra features on web sites can be made to work on IPv6, too.
now we need to go OSS in diesel cars
Maybe as all mail behind NATs get blocked by spam filters the network administrators will actually start blocking mail from infected hosts in their network so that legit mail is accepted again. Wishful thinking?
As more ISPs deploy LSN systems, the effectiveness of these IPv4 filtering systems will be hurt.
That doesn't follow. The folks in dynamic space (the same space that will be served by LSNs) are already considered spammers when they connect to a non-local SMTP server. The only reason they're scored instead of outright blocked is that there's no rigorous list of what is and isn't a dynamic space. It makes no difference to the server whether it filters a range of IPs or a single IP.
Identifying the individual spammer from an abuse report is slightly more difficult, but only slightly. And if you're behaving like a good net citizen, you probably blocked outbound 25 at the LSN box to begin with so you're not getting any reports because your virus-laden customers aren't able to successfully spam.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
If your mail server supports IPv6, the mail will go sender's client to sender's MTA to your MTA, all via IPv6, with full headers. So the problem only affects recipients who are slow getting their mail servers IPv6 enabled, who force senders to reroute their mail through an IPv6 to IPv4 gateway. So seems to me it's a good reason to hurry up and get your servers on IPv6.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
I still think the best way to handle this would have been by high bit extension in each octet field.
Yeah, I know, the theoretical non-constant numeric address length would have been a serious pain to predict the hardware for back in the '80s, when (ergo, I wish) they might have had the foresight to reserve the high bits at each level for possible other uses.
But it would have been nice if an ISP could have, by definition, its own extendable address space to allocate out of, and any customer could further extend their own allocation, down to, say, 6 octets max in the '80s, 7 max in the '90s, 8 in the decade just completing.
I appreciate the fact that IPV6 should give us this ability, at least in a one- or two-shot way, but I think it's generally a mistake when the data structure itself limits a resource that is known to have a tendency to expand.
(And, yes, I consider the above to be funny in the sick humor sort of way.)
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
The last time I contacted my ISP about this they told me (again) that they have no plans to implement IPv6.
This was just a few months ago.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
My requests have been meeting deaf ears for years.
Unfortunately, the alternative ISPs are doing the same thing here. (But I should check again soon. I'm getting tired of these guys since the legacy monopoly here bought them out.)
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
You shouldn't be running a "server" at home anyways. The internet was created so that you could buy services from large companies like your ISP. Running your own server at home is socialist. Think of the children!
Many IT professionals including myself feel that IPv6 is a joke and is unnecessary in most practical scenarios. Arguments I tend to throw out on face value are "why not IPv6?" and "we're running out of IPv4 addresses". Keep NAT'ing IPv4 until the cows come home - no one except tech geeks will really care if we do.
heh sweet that means slashdot can never ban me right?
your friendly neighborhood synonymous coward
wait did i do that right?
all dynamic ip users, are restricted to their provider (isp) smtp service. ISP acts as the only smtp relay. Users are not allowed to open port 25 beyond the ISP's address space.
they filter and monitor everything (e.g. torrents). why not filter port 25, even validate against proper SPF. Am I the only one using SPF for my domains...?
I work for an IP reputation company by Khopesh (112447)
on Friday December 17, @07:00PM (#34594978) Homepage
What's that mean exactly? What sort of work goes on around that (in other words, online? What is it you & your colleagues do to protect "IP reputation"??)??
Just curious.
A responsible ISP already blocks outgoing smtp port by default unless explicitly requested otherwise by the user. Let's hope more ISPs will join that camp with LSN because they are too lazy to cope with the abuse mails...
It's a vague term. I've seen it before, but it can mean anything from a company that gets mistakes removed from IP blacklists (usually a consequence of a computer being compromised - once it's resecured, the blacklists need fixing too) to companies hired to manipulate google rankings, submit glowing product reviews to shopping sites and threaten critics with legal action. Just a very vague description
So I won't be subject to LSN (NAT) ever.
Many security filtering systems use lists of public IPv4 addresses to identify 'undesirable' hosts on the Internet. As more ISPs deploy LSN systems, the effectiveness of these IPv4 filtering systems will be hurt."
In other words, as IPv4 dies, using IPv4 for stuff won't work as well.
Using an IP address to determine the content of a message is a bad idea anyway.
It's like determining what cars are carrying drugs by looking at the license plates, and then punishing the car dealer for selling the car.
Your IPv4 black list is broken. IPv6 makes it more broken. Cry me a river.
"IP Reputation" systems are basically a step beyond DNSBLs (which only consider things as white vs black). There is a decent explanation in Wikipedia's Sender's IP verification section of their E-mail authentication article.
Use my userscript to add story images to Slashdot. There's no going back.
So what you're saying is that Google has decided to fully claim reputation-ownership of the mail their users are sending. They're staking their reputation that their users don't generally spam. If it was a big enough problem you would blackhole all of gmail, right now you're upset because due to the large volume that gmail sends, any percentage of spam is a problem.
I see no reason for that kind of gall. It's merely not a priority for them to open up that kind of information because it helps third party spam filters. Suppressing that data grants a competitive advantage to the GMail (and possibly Postini) services as using that internal information would lead to better filtering of a large email source. ... Don't forget that Google wants to manage your corporate email.
If you're considering the privacy angle, that's rather far-fetched. All other email systems (including webmail and SMTP) track this (so there is no reasonable expectation to place on this sort of behavior; those who want to hide their IP should be using TOR or some other anonymizing proxy).
Use my userscript to add story images to Slashdot. There's no going back.
authenticated mail (which can be done on port 25, it doesn't have to be 587, but should be these days because of port 25 filtering) is not normally subjected to blacklist filtering
Authenticated mail on port 25 is subject to port 25 blocks by those ISPs that don't deep-packet-inspect to distinguish unauthenticated SMTP from authenticated SMTP (RFC 2554) or encrypted SMTP (RFC 2487). But I guess ISPs are far less likely to block 465 or 587.
If your isp has unreliable mail service, then find another one --- there is no shortage of options there.
Find another what? Did you mean find another mail service, aka a "smarthost"? That's difficult if your ISP blocks the ports that smarthosts use. Find another ISP? In a lot of cases, it's either the one broadband ISP in your area or dial-up.
""IP Reputation" systems are basically a step beyond DNSBLs (which only consider things as white vs black). There is a decent explanation in Wikipedia's Sender's IP verification section of their E-mail authentication article" - by Khopesh (112447) on Saturday December 18, @01:54PM (#34601326) Homepage
Thanks - that's to BOTH yourself, and SuricouRavenn, who also replied here in regards to "IP Reputation" & what it is (I have a message for SuricouRavenn here also -> http://yro.slashdot.org/comments.pl?sid=1903798&cid=34559886 regarding Windows Defender/Microsoft Security Essentials) - thank you!
I do MUCH THE SAME as a DNSBL, albeit locally... via custom HOSTS files - here is why (long read, but detailed & I think you MAY find it, informative, possibly):
---
20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:
1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).
2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).
3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.
4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).
5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).
6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders
7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:
GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):
http://ddanchev.blogspot.com/
http://www.malware.com.br/lists.shtml
http://www.stopbadware.org/
http://blog.fireeye.com/
http://mtc.sri.com/
http://news.netcraft.com/
http://www.shadowserver.org/
REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):
http://www.mvps.org/winhelp2002/hosts.htm
http://someonewhocares.org/hosts/
"It's a vague term. I've seen it before, but it can mean anything from a company that gets mistakes removed from IP blacklists (usually a consequence of a computer being compromised - once it's resecured, the blacklists need fixing too) to companies hired to manipulate google rankings, submit glowing product reviews to shopping sites and threaten critics with legal action. Just a very vague description" - by SuricouRaven (1897204) on Saturday December 18, @10:39AM (#34599726)
Thanks - that's to BOTH yourself, and Khopesh, who also replied here in regards to "IP Reputation" & what it is, since he does it also!
YOU MAY FIND HIS EXPLANATION INFORMATIVE -> http://tech.slashdot.org/comments.pl?sid=1915408&cid=34606948 because it's quite detailed, & of course, it comes from "the horses' mouth" (in that he does that & works for such a concern, etc./et al).
(NOW - I also have a message for YOU, which I believe you WILL FIND HELPFUL! It's in regard to Windows Defender also -> http://yro.slashdot.org/comments.pl?sid=1903798&cid=34559886 regarding Windows Defender/Microsoft Security Essentials).
USE WINDOWS DEFENDER or MICROSOFT SECURITY ESSENTIALS "SETTINGS" TAB, & "Excluded Files and Location" list item IF NEED BE, to exclude custom HOSTS files from scanning!
That's just information you may be able to use, to overcome hassles you say you saw with Windows Defender (the precursor to Microsoft Security Essentials) & HOSTS files!
Funny part is, even though I use a custom HOSTS file with well over 913,000++ items blacklisted in it? I have YET TO SEE MICROSOFT SECURITY ESSENTIALS BOTHER ME ON HOSTS FILES! I give you the "work-around"... easy to do!
APK
P.S.=> Again - Thats information on Windows Defender OR Microsoft Security Essentials? That's in return for your, and Khopesh's reply, on what an "IP REPUTATION" service is, & what it does... apk