headers
Dallman Ross | 3 Feb 2005 18:16

New types of Trojans coming

http://news.zdnet.com/2100-1009_22-5560664.html

Precis: Spam levels expected to rise with suddenness
soon, as blacklists become less effective.

--

-- 
dman
Permalink | Reply | 24 comments |
headers
Ruud H.G. van Tol | 3 Feb 2005 18:40
Picon

Re: New types of Trojans coming

Toen wij Dallman Ross kietelden, kwam er dit uit:

> http://news.zdnet.com/2100-1009_22-5560664.html
> Precis: Spam levels expected to rise with suddenness
> soon, as blacklists become less effective.

I see this as an advantage. A last, ISPs are forced to take 
prompt measures against infected machines of customers (or 
become and remain blacklisted).

--

-- 
Grtz, Ruud
Permalink | Reply | 0 comments |
headers
Professional Software Engineering | 3 Feb 2005 18:45

Re: New types of Trojans coming

At 18:16 2005-02-03 +0100, Dallman Ross did say:
>http://news.zdnet.com/2100-1009_22-5560664.html
>
>Precis: Spam levels expected to rise with suddenness
>soon, as blacklists become less effective.

Er, spammers have been using trojans for a while now already.  Yes, 
traditionally, the user's own PC is converted into a mail server and it 
delivers mail directly.  With some large ISPs (earthlink comes to mind) 
blocking outgoing SMTP originating from user systems, this technique isn't 
very effective.

However, viruses have for some time used the user's own ISP mail server (or 
at least that of the forged address snarfed from their saved email) to 
deliver messages, thereby lending some apparent legitimacy to the message 
(for instance, you can't block them using a dial-up list type DNSBL, 
because the machine passing the message to your host is an actual ISP 
mailserver, not the user's own machine).

Yes, blacklists aren't particularly effective against this 
chuff.  Ironically,  effecive post-reception filters are still successful 
at eliminating virtually all the spam, but once they've brought the crap 
INTO my server is when I get especially pissed about it - the messages 
rejected during the SMTP connection have a minimal impact - they don't 
generate a lot of net traffic or CPU load (though gobs and gobs of them can 
still borderline a DoS).  once you've forced your way into my mail host, 
you're providing me with further identifyable information - complete 
headers, URLs in the spew, etc - which can be used to identify the 
spammer.  Plus, for those areas which have anti-spam "laws" (such as they 
are), actually having the spam in hand is a crucial part of being able to
(Continue reading)

Permalink | Reply | 18 comments |
headers
Pettit, Paul | 3 Feb 2005 20:20

RE: New types of Trojans coming

> -----Original Message-----
> From: Sean B. Straw
> 
> At 18:16 2005-02-03 +0100, Dallman Ross did say:
> >http://news.zdnet.com/2100-1009_22-5560664.html
> >
> >Precis: Spam levels expected to rise with suddenness
> >soon, as blacklists become less effective.
> 
> Er, spammers have been using trojans for a while now already.  Yes, 
> traditionally, the user's own PC is converted into a mail 
> server and it 
> delivers mail directly.  With some large ISPs (earthlink 
> comes to mind) 
> blocking outgoing SMTP originating from user systems, this 
> technique isn't 
> very effective.
> 
> However, viruses have for some time used the user's own ISP 
> mail server (or 
> at least that of the forged address snarfed from their saved 
> email) to 
> deliver messages, thereby lending some apparent legitimacy to 
> the message 
> (for instance, you can't block them using a dial-up list type DNSBL, 
> because the machine passing the message to your host is an actual ISP 
> mailserver, not the user's own machine).
> 
> Yes, blacklists aren't particularly effective against this 
> chuff.
(Continue reading)

Permalink | Reply | 2 comments |
headers
Ruud H.G. van Tol | 3 Feb 2005 20:34
Picon

Re: New types of Trojans coming

Toen wij Pettit, Paul kietelden, kwam er dit uit:

> Well not sure where your getting your info from but my maillog and the
> feedback from many other mail server admins seems to refute your
> stand.

You fail to grok what Sean wrote. Please read it again.

--

-- 
Grtz, Ruud
Permalink | Reply | 0 comments |
headers
Dallman Ross | 3 Feb 2005 21:56

Re: New types of Trojans coming

On 03, 2005 at 09:45:26AM -0800, Professional Software
Engineering wrote:

> At 18:16 2005-02-03 +0100, Dallman Ross did say:
> >http://news.zdnet.com/2100-1009_22-5560664.html
> >
> >Precis: Spam levels expected to rise with suddenness
> >soon, as blacklists become less effective.
> 
> Er, spammers have been using trojans for a while now already.  Yes,
> traditionally, the user's own PC is converted into a mail server and
> it delivers mail directly.

Yes, and that's a crucial difference.

> However, viruses have for some time used the user's own ISP mail
> server (or at least that of the forged address snarfed from their
> saved email) to deliver messages, thereby lending some apparent
> legitimacy to the message (for instance, you can't block them using a
> dial-up list type DNSBL, because the machine passing the message to
> your host is an actual ISP mailserver, not the user's own machine).

The forgeries are a good tip for Virus Snaggers(tm), for example.  It
looks for them.

But, look: if a worm or zombie spam now gets sent by the virtual
server coded into the Trojan/zombie/worm program itself, it's one
thing.  The mail typically arrives at the recipient's server with
a fake server name and very few Received headers.  (Vsnag looks for
that kind of thing too.)  But if the mail is going to go out via
(Continue reading)

Permalink | Reply | 5 comments |
headers
Professional Software Engineering | 3 Feb 2005 22:06

Re: New types of Trojans coming

At 21:56 2005-02-03 +0100, Dallman Ross wrote:

>But, look: if a worm or zombie spam now gets sent by the virtual
>server coded into the Trojan/zombie/worm program itself, it's one
>thing.  The mail typically arrives at the recipient's server with
>a fake server name and very few Received headers.

_typically_ (i.e. MOST malware) yes.  There's a small number that relay 
through legit ISP SMTP hosts (and no, not your own inbound servers).  Not 
forged EHLO either.  It isn't a new technique there, and since spammers 
have been shifting towards virus/trojan applications to take over computers 
for bandwith, address lists, and obfuscating the true source of the spam, 
this "new" twist with spam should come as no surprise since it's already 
been employed with viruses.

>the ISP's usual channels, then the heuristic for identifying it
>gets a bit tougher.  That's what caught my interest.

The heuristic to catch the message via header-only criteria would be very 
difficult indeed.  IIRC, SA spots forged Outbreak headers - that may be 
something to check for with spam relaying.

---
  Sean B. Straw / Professional Software Engineering

  Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
  Please DO NOT carbon me on list replies.  I'll get my copy from the list.
Permalink | Reply | 1 comment |
headers
Professional Software Engineering | 3 Feb 2005 22:14

RE: New types of Trojans coming

At 13:20 2005-02-03 -0600, Pettit, Paul wrote:
> > (for instance, you can't block them using a dial-up list type DNSBL,
> > because the machine passing the message to your host is an actual ISP
> > mailserver, not the user's own machine).
> >
> > Yes, blacklists aren't particularly effective against this
> > chuff.
>
>Well not sure where your getting your info from but my maillog and the
>feedback from many other mail server admins seems to refute your stand.

I *DID* *NOT* say that blacklists are ineffective.  What I said is that 
they're ineffective for blocking zombie-spew being relayed via legitimate 
ISPs (by CUSTOMERS of those ISPs) - that'd be the "this chuff" which was 
outlined in the paragraphs preceeding my DNSBL comment.

Go grab another coffee and put less milk in it this time.

>As for virii worms using the ISP's mail servers for relaying, not true.

Yes, the vast majority of viruses deliver directly from the infected host 
to your MX.  There are tens upon tens of thousands of viruses - every last 
one of them doesn't do it's thing the exact same way as all the others.

I assure you, there are viruses which relay using either the mailserver for 
the infected user or the mailservers associated with the email addresses 
they're forging themselves to be from - while outbound SMTP servers are not 
necessarily the same as the inbound ones (for small outfits, they often 
are, but larger shops generally segregate them on performance grounds), and 
the latter are the only ones which have a defined standard for identifying
(Continue reading)

Permalink | Reply | 0 comments |
headers
Marek | 3 Feb 2005 22:23

Re: New types of Trojans coming

> But, look: if a worm or zombie spam now gets sent by the virtual
> server coded into the Trojan/zombie/worm program itself, it's one
> thing.  The mail typically arrives at the recipient's server with
> a fake server name and very few Received headers.  (Vsnag looks for
> that kind of thing too.)  But if the mail is going to go out via
> the ISP's usual channels, then the heuristic for identifying it
> gets a bit tougher.  That's what caught my interest.

New trojans even sent out spam directly from the users outlook, hotmail,
yahoo etc. However 95% of spammers are relay on URL's and that's a major
factor for most AI. Blacklisting url's is more popular these days.

Marek
Permalink | Reply | 0 comments |
headers
Dallman Ross | 3 Feb 2005 23:09

Re: New types of Trojans coming

Professional Software Engineering wrote:

> At 21:56 2005-02-03 +0100, Dallman Ross wrote:
>
> >the ISP's usual channels, then the heuristic for identifying it gets
> >a bit tougher.  That's what caught my interest.
>
> The heuristic to catch the message via header-only criteria would be
> very difficult indeed.  IIRC, SA spots forged Outbreak headers - that
> may be something to check for with spam relaying.

Agreed. I have had a forged-"HOTHOO" (as I call it -- that's even the
name of my var) recipe set in place for three years now, and it works
very well indeed.  (Headers-only, as usual.)

--

-- 
dman
Permalink | Reply | 0 comments |

Gmane