Re: [spoofing-tf] Source Address Validation Architecture (SAVA), BOF proposal @ IETF

[Rob Beverly rbeverly@localhost]

On Thu, Sep 14, 2006 at 05:13:37PM +0300, Pekka Savola wrote:
> >Sure, but again, consider the recent DNS amplifier attacks and
> >filter circumvention attacks (using spoofing to send UCE).
> 
> I'd be interested in seeing more references on the SPAM-spoofing.  I 
> assume you refer to hijacking an address space (possibly a bogon, 
> possibly in use), sending spam, and switching the prefix continously. 
> This is quite different than 'traditional' spoofing because above also 
> requires propagation of false routing information instead of simply 
> sending bogus packets.

Actually, I wasn't referring to prefix hijacking.  Spammers like
to use botnets.  To combat botnets, providers started filtering
outbound port 25 SYN to everywhere but the provider's MTA(s).  To
combat these filtered hosts, spammers are now doing the following:
  1. find a connection that allows spoofing (e.g. dialup).  Assume
     a host D is on that dialup and under control of spammer.
  2. control a compromised host H on a network that filters outbound tcp 25 SYN
  3. Use the dialup host D to send a SYN to a victim MTA with the source
     address of H
  4. D communicate the initial sequence number to H so that H can
     properly ACK the incoming SYN-ACK (and complete the 3-way
     handshake).

There are other variations of such triangular routing (and attacks)
There have been a few conversations on NANOG about this; the first
one I can find readily is:
  http://www.cctec.com/maillists/nanog/current/msg09179.html

Regards,

rob