Combating Abuse Brian Nisbet NOC Manager HEAnet

Introduction SMTP was never expected to handle this. Huge volume of , huge volume of abuse. Not restricted to just spam. –Viruses –Phishing –Malware Links

General Principles “Be liberal in what you accept, be conservative in what you send.” – Jon Postel –Also, your network, your rules. Multiple areas to consider: –Technical measures –Education –Policies & Procedures –Tools

Technical Measures Realtime Block Lists –DNS based, some free, some charge. –HEAnet Anti-Spam service offers Trend Micro ERS and Spamhaus Zen service. –Spamcop - bl.spamcop.net –combined.njabl.org –Checked in order, rejected on first match. –Check early, at Connect or Mail From: –Make your own! Port 25 outbound!

Restrict SMTP connection volumes. –Make sure to reserve some for internal users. Close open relays! Rules based system/spam heuristics. –Spamassassin - –Rules need constant monitoring/adjustment. –Maintain spam corpus for checking. –Whitelists vital. –Tailor score to suit individual needs. –Mark at one score, filter at another.

Reject mail from sources that announce with a single word. Beware of mailservers claiming to be you! Authorised users only. Secure connections. Greylisting –Delaying mails and waiting for resend. –Accepts ‘known’ mail immediately. –Rather controversial. Tarpitting

Backup MX Backup MXs used to be vital. Now more likely to be a vector for abuse. Recommendation is to only use MXs you control. Need to have exactly the same filters in place. Modern Internet substantially more secure. Mailservers resend for 2 – 4 days before abandoning. Consider a virtual machine.

Anti-Virus Anti-virus on your MX a must. AV that isn’t updated, isn’t AV. –Once per hour is good, once per day is maybe ok. Block “dangerous” extensions. –Multiple lists, mainly executables. Keep updated. –SMTP is not a file transfer protocol. Quarantine and release systems are questionable.

Phishing & Links Servers and clients beginning to detect this. Also detectable with programs like Spamassassin. Main tool is education. Also change message to remove clickable links.

DKIM, SPF etc Various systems in the wild to prove the sender is who they say they are, and often to assign a reputation. Worth configuring SPF to make sure of deliverability. Much discussion about usefulness for receiving. Spammers (either intentional or bots) often are who they say they are. Websites: – –

Education Users should feel safe when online, but not too safe! –You wouldn’t give your credit card number to someone you bumped into in town? Some users will always think “Maybe this time it’s real?” Make sure you never send out a real mail that looks phishy. Never: –Ask for passwords. –Put in a link to a login page in an unsolicited mail. –Offer millions of dollars in exchange for a bank a/c number.

Policies & Procedures Abuse contacts must be published & monitored. Reports must be acted on as a matter of urgency. Systems taken offline, a/cs closed. Users and machines must be traceable. Allegedly legitimate outbound mail must comply with laws and general standars of good behaviour.

Irish law on spam is encoded in SI 535 of –Personal addresses are –Business addresses are Many SMTP server operators are more stringent than this. Decide on and publish your own code of practice. This may be part of a larger AUP.

Tools & Resources Vast number of SMTP and AV programs. –No official HEAnet recommendation. –Remember HEAnet Tech list. Spamhaus ( RIPE Anti-Abuse WG – RIPE Resource Explainer –