Re: Greylisting BCP
Dave Warren <[email protected]>
| Newsgroups | gmane.ietf.asrg |
|---|---|
| Message-ID | <[email protected]> |
On 10/24/2011 1:33 AM, Murray S. Kucherawy wrote: >> -----Original Message----- >> From: [email protected] [mailto:[email protected]] On Behalf Of Douglas Otis >> Sent: Tuesday, October 18, 2011 8:39 PM >> To: [email protected] >> Subject: Re: [Asrg] Greylisting BCP >> >> Grey listing challenges stateful processing of the sender to test an >> often erroneous assumption that bots sending spam don't maintain state. >> Thanks to grey listing, many bots retry against the same recipients, >> just not always with the same message. > That doesn't sound like a "retry" to me, in the MTA queueing sense. For your claim to be true, it would mean bots institute MTA-style queue-and-retry systems, but that substantially increases the footprint on the infected machine. It's been my impression that their reluctance to do this is precisely why greylisting is perceived to be effective. Keep in mind that zombies don't necessarily need to create some copy of each message and "queue" it. Rather, it's just as simple as keeping track of MAIL/RCPT pairs that should be retried and this doesn't need to incur much of a footprint at all. Whether they have a DB entry to track which message they wanted to deliver or not is an implementation detail. Either way, it's well within the capabilities of a zombie running on a midrange laptop/desjtop computer. However, all of this misses a huge part of why greylisting can be a powerful tool: It's a happy accident that bots still don't retry properly. I only greylist if I'm already suspicious based on rDNS patterns, mismatching reverse DNS, and similar. I don't greylist because I care if they retry (although it's nice that so many still don't). I greylist to let URIBLs and similar have a chance to catch up and detect a new zombie, to let my bayesian have time to learn, and to hope they hit one of my traps and get themselves blacklisted. I don't advocate greylisting everything, I found it's too obnoxious for general purpose use here, but in cases where I'm already suspicious, it's a second chance for a poorly managed sender to get through some front-line filters. -- Dave Warren, CEO Hire A Hit Consulting Services http://ca.linkedin.com/in/davejwarren