Security Incidents mailing list archives

Re: Massive SPAM Increase {-2.6} {-2.6}


From: Tim <tim-forensics () sentinelchicken org>
Date: Mon, 9 Oct 2006 17:29:23 -0400

Its purpose is to reject *all* mail from bogus MTAs - dialups, 
misconifigured servers, MTAs that aren't registered in the domains' DNS as 
a "legal" MX, MTAs that don't reverse properly, etc., etc.  If the email is 
forged in any way, it will never make it to DATA.

That's great, except it makes the internet more expensive for the little
guy.  If you're trying to run a non-spamming personal mailserver off of
a consumer DSL or cable line, you can get screwed by others' policies
like this because you may not have control over your PTR records or how
your ISP lists you as a non-MTA with other organizations.

Sure, argue that the little guy should just shell out for a better line,
but if he could, he wouldn't be the little guy.

I understand that a very large percentage of these lines are not sending
legitimate mail directly to you, but strictly blocking all of them
without any other information is a bit harsh.  Might be more fair to use
some form of boosting to combine information about dialup ranges with
other indicators.

cheers,
tim


P.S.- If you're wondering why such a little guy wouldn't just forward
all mail through their ISPs mail server, well, those cheap DNS/Cable
services often come complete with really slow, buggy, and terribly
configured mail servers, which is why a little guy might prefer not
letting his mail touch them.

------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. 
World renowned security experts reveal tomorrow's threats today. Free of 
vendor pitches, the Briefings are designed to be pragmatic regardless of your 
security environment. Featuring 36 hands-on training courses and 10 conference 
tracks, networking opportunities with over 2,500 delegates from 40+ nations. 

http://www.blackhat.com
------------------------------------------------------------------------------


Current thread: