Comments on: Injecting Spam and Malicious Attacks via Prefix Hijacking http://www.narus.com/blog/2007/09/04/injecting-spam-and-malicious-attacks-via-prefix-hijacking/ Real-time traffic insight from the Office of Narus’ CTO Thu, 07 Aug 2008 23:05:00 +0000 http://wordpress.org/?v=2.0.3 by: Andrew Radley http://www.narus.com/blog/2007/09/04/injecting-spam-and-malicious-attacks-via-prefix-hijacking/#comment-7008 Mon, 24 Sep 2007 15:49:01 +0000 http://www.narus.com/blog/2007/09/04/injecting-spam-and-malicious-attacks-via-prefix-hijacking/#comment-7008 This is a good piece on spamming technicques coming into the market. There is an assumption however that I'm not sure I agree with - that spam is sent from mail servers and not from bot infected PCs. If the mail is sent from a bot infected PC, it would be extremely common for that PC to be behind a NATing device, and therefore forging IP addresses simply doesn't work. The potential place where this could work is for servers (proxies/mail servers/relays) that are public facing with real address space that are compromised. Even here there is a caveat - the carrier has to have their network configured to route traffic for IPs they don't own - not a wise idea and there are standards that say you shouldn't allow this to happen. There is however significant benefit in monitoring the senders of email as it is by monitoring this end of the conversation taht you can be most accurate in detecting spammers, which I believe your platform would be able to do. This is a good piece on spamming technicques coming into the market.

There is an assumption however that I’m not sure I agree with - that spam is sent from mail servers and not from bot infected PCs. If the mail is sent from a bot infected PC, it would be extremely common for that PC to be behind a NATing device, and therefore forging IP addresses simply doesn’t work.

The potential place where this could work is for servers (proxies/mail servers/relays) that are public facing with real address space that are compromised. Even here there is a caveat - the carrier has to have their network configured to route traffic for IPs they don’t own - not a wise idea and there are standards that say you shouldn’t allow this to happen.

There is however significant benefit in monitoring the senders of email as it is by monitoring this end of the conversation taht you can be most accurate in detecting spammers, which I believe your platform would be able to do.

]]>