Bad spammer neighborhoods

I’ve been collecting data about IPs that have been attempting to spam my mail server for the past few months, and today I decided to take a look at what neighborhoods of /24 networks are the most heavily populated with spamming IPs. Here’s the list of the top ten “worst neighborhoods” trying to send me spam, mostly with dictionary attacks against my domain. These are all blocked by the CBL, so none of this spam actually gets through, but it ties up my bandwidth. I’ve put an asterisk (*) next to the ranges that are probably actually smaller than /24s based on the distribution of IPs. Does anybody have a tool that already exists to identify likely bad ranges to block based on the distribution of known bad IPs? All I did here was count IPs within a /24, but it would be nicer to identify the likely ranges of badness at both a more fine-grained and broader level. Note that these bad neighborhoods may be neighborhoods of poorly secured machines, or they may be neighborhoods of malicious machines. Either way, the providers are not doing a good job of cracking down on malicious activity from their networks. 1. 64.32.26.0/24 (25 IPs) 45 46 51 52 54 66 68 73 81 90 100 102 104 111 113 126 155 157 163 168 194 199 204 236 242 AS 46844 | 64.32.26.0 | ST-BGP - SHARKTECH INTERNET SERVICES Upstream provider: AS 7922 | 64.32.26.0 | COMCAST-7922 - Comcast Cable Communications, Inc. *2. 89.232.105.0/24 (24 IPs) 21 24 29 32 48 57 59 63 64 68 76 89 93 94 97 101 103 107 114 117 126 129 137 139 AS 28840 | 89.232.105.0 | TATTELECOM-AS Tattelecom.ru/Tattelecom Autonomous System Upstream provider: AS 6854 | 89.232.105.0 | SYNTERRA-AS SYNTERRA Joint Stock Company 64.32.26.0 3. 208.84.243.0/24 (20 IPs) 13 30 63 68 78 92 99 123 148 150 175 176 179 185 196 199 216 219 226 250 AS 40260 | 208.84.243.0 | TERRA-NETWORKS-MIAMI - Terra Networks Operations Inc. Upstream provider: AS 22364 | 208.84.243.0 | AS-22364 - Telefonica USA, Inc. *4. 83.149.3.0/24 (17 IPs) 5 6 12 14 16 18 21 22 25 28 30 40 42 47 48 51 63 AS 31213 | 83.149.3.0 | MF-NWGSM-AS OJSC MegaFon Network Upstream providers: AS 12389 | 83.149.3.0 | ROSTELECOM-AS JSC Rostelecom AS 20485 | 83.149.3.0 | TRANSTELECOM JSC Company TransTeleCom *5. 76.164.227.0/24 (16 IPs) 138 155 159 174 182 186 194 199 202 206 210 218 222 230 238 246 AS 36114 | 76.164.227.0 | RDTECH-ASN - R & D Technologies, LLC Upstream providers: AS 6473 | 76.164.227.0 | WCIXN4 - WCIX.Net, Inc. AS 35937 | 76.164.227.0 | MARQUISNET - MarquisNet LLC 6. 76.164.232.0/24 (15 IPs) 13 21 24 33 36 38 40 43 48 57 198 206 218 232 234 AS 36114 | 76.164.232.0 | RDTECH-ASN - R & D Technologies, LLC Upstream providers: AS 6473 | 76.164.227.0 | WCIXN4 - WCIX.Net, Inc. AS 35937 | 76.164.227.0 | MARQUISNET - MarquisNet LLC 7. 77.120.128.0/24 (15 IPs) 20 37 50 85 93 104 107 112 159 162 187 232 239 248 252 AS 43011 | 77.120.128.0 | DATASVIT-AS ISP Datasvit AS Number Upstream provider: AS 25229 | 77.120.128.0 | VOLIA-AS Volia Autonomous System *8. 78.138.170.0/24 (12 IPs) 66 68 77 78 160 166 178 189 190 193 202 211 AS 28840 | 78.138.170.0 | TATTELECOM-AS Tattelecom.ru/Tattelecom Autonomous System Upstream provider: AS 6854 | 89.232.105.0 | SYNTERRA-AS SYNTERRA Joint Stock Company 64.32.26.0 9. 77.232.143.0/24 (12 IPs) 33 37 40 63 69 104 175 182 190 215 218 251 AS 42145 | 77.232.143.0 | BSTV-AS OOO Bryansk Svyaz-TV Upstream provider: AS 20485 | 77.232.143.0 | TRANSTELECOM JSC Company TransTeleCom *10. 95.154.113.0/24 (12 IPs) 140 178 181 185 193 195 197 206 218 246 248 254 AS 44724 | 95.154.113.0 | OCTOPUSNET-AS Octopusnet LTD Upstream provider: AS 34470 | 95.154.113.0 | PTKOM-AS PortTelekom Autonomous system

July 25, 2009 · 4 min

How Twitter got compromised

TechCrunch has published “The Anatomy of the Twitter Attack," a detailed account of how “Hacker Croll” used people’s password-selection habits, use of multiple online applications, publicly available online information about people, and flawed “I forgot my password” mechanisms to gain access first to individuals’ personal webmail accounts and then to Twitter’s internal systems. It’s a good idea to use randomly generated passwords, stored in a password safe, so that they’re different with every service you use. It’s also a good idea to split personal and corporate accounts. Lately I’ve taken to using randomly generated information for my “I forgot my password” answers, as well, and keeping that in my password safe just like another password. The “secret questions” for password recovery are a vulnerability when so much personal information is being shared on the Internet. That’s how Sarah Palin’s email account was compromised last year, as well. ...

July 24, 2009 · 2 min

Science-based medicine conference, part 6: online health and social media, and Q&A

This is the sixth and final part of my summary of the Science-Based Medicine conference at TAM7, which will be followed by a summary of TAM7 itself. Part one, Dr. Steven Novella’s introduction, is here. Part two, Dr. David Gorski on cancer quackery, is here. Part three, Dr. Harriet Hall on chiropractic, is here. Part four, Dr. Kimball Atwood on evidence-based medicine and homeopathy, is here. Part five, Dr. Mark Crislip on chronic Lyme disease, is here. The sixth session speaker was Dr. Val Jones, CEO of BetterHealth, on “Online Health and Social Media: The Good, The Bad, and The Ugly.” In this last post of my SBM conference summary, I’ll cover her talk as well as the Q&A panel that concluded that day’s events. Personal Story Dr. Jones began her talk with her personal history–she was raised in Nova Scotia by hippie parents from New York City and grew up on a farm with cows. She said her parents were “moderately weird”–they would ascribe magical powers to yogurt, but they vaccinated their children. She called herself a “shruggie” with respect to complementary and alternative medicine (CAM)–ambivalent about whether there could be anything to it. She worked with the Ontario March of Dimes, became a doctor, did biophysics and vaccination research at the Mayo Clinic, and earned her M.D. in physical medicine at Columbia. She then worked at Medscape with George Lundberg, editor of JAMA, and created the Clinical Nutrition & Obesity journal there (at Medscape). She was then recruited by RevolutionHealth, an online provider of health information started by Steve Case of America Online. She described it as an “OnStar system for navigating the health care system.” She moved to Washington D.C. to take the job, and, as she put it, “entered the Twilight Zone." Revolution Health She served as an editorial director and medical reviewer with a staff of 100 doctors across the country, and “couldn’t believe the crap that came across [her] desk. Who are these people and why are they so into their colons?" At one point, an article was submitted from a writer for Alternative Medicine magazine that claimed olive oil cures breast cancer. The study behind the story showed that breast cancer cells in a petri dish, exposed to a chemical found in olive oil, made some kind of genetic change–that was transformed into an alleged cure for breast cancer. The company developed a health tracker tool, and developers kept adding trackers based on what they thought would be cool, such as a “hot flash tracker.” She asked, “Why?” The developers answered, “so they can tell the doctor if a hot flash occurred at 2 or at 3 o’clock!” There was no clinical review of the tracking tools. Medicine Chest Another product was developed called Medicine Chest, which allowed people to vote their medicines up or down for how much they like them. “It’s not going to be misinformation, it’s the wisdom of crowds,” the developers said. Not only could users vote on their medicines that were listed, they could add suggestions of their own in free-format text fields. The display of the results on the site didn’t distinguish FDA-approved treatments from what people entered in on their own. The result was that the best treatment for headaches, back pain, strains, etc. was narcotics, followed by marijuana. The best treatment for diabetes (without distinguishing type 1 from type 2) was dog walking. Dr. Jones compared this to the Citizens’ Briefing Book on Obama’s change.gov website, where the general public could vote on what they considered to be the most important issues, with the resulting winner being the legalization of marijuana. Other recommended treatments from the Medicine Chest feature included yogurt for colon cancer, acupuncture for ovarian cysts, herbal treatments for hip fracture, and steroids for cellulitis (which she observed is “very bad and dangerous”). Other similar sites took things to a further extreme, such as Patientslikeme.com, which allowed patients to conduct and report their own clinical trials online. This led to promotion of fish oil to slow the progression of multiple sclerosis and ALS. And beer and dogs as a treatment for lack of motivation. She cited a quote from Poincare: “Science is facts; just as houses are made of stones, so is science made of facts; but a pile of stones is not a house and a collection of facts is not necessarily science." She searched the Internet for help understanding the craziness, and came across Orac’s Respectful Insolence blog, which she followed for several months. The last straw for her at Revolution Health was when it promoted chelation as a treatment for autism, which could kill a child, and she felt violated her Hippocratic Oath. Dr. Jones listed a set of psychological factors which lead people to wrong conclusions, of the sort you might find in Kahnemann & Tversky’s Judgment Under Uncertainty. On the list was the Hawthorne Effect, which purportedly showed that any change made in a business environment temporarily improves productivity. This effect was named after a study of worker productivity based on data collected after changes in lighting and other conditions at the Hawthorne Works between 1924 and 1932, but subsequent studies have failed to replicate the effect. The original data was recently rediscovered and reanalyzed by Steven Levitt (author of Freakonomics) and John List, with the result that “we find that existing descriptions of supposedly remarkable data patterns prove to be entirely fictional. There are, however, hints of more subtle manifestations of a Hawthorne effect in the original data." Miscellaneous Slides She concluded her talk with a few slides with various observations, such as The Onion’s “NSF: Science Hard” article and a quote from Surgeon General Rich Carmona that the average American understands medicine at the 4th to 6th grade level. She pointed out that there’s a cottage industry of quack cancer treatment providers around the M.D. Anderson cancer center, taking advantage of cancer patients. She criticized the 1994 passage of DSHEA and its signing into law by Bill Clinton, which exempted dietary supplements from FDA approval requirements unless they’re found to be harmful. She quoted lots of examples of harm from whatstheharm.net. She recommended Memorial Sloan Kettering’s herbal guide, noting that “doesn’t work” is the conclusion for most descriptions, and recommended ClinicalTrials.gov for accurate information. And she closed with a quote from Hippocrates: “There are two things, science and opinion; the former begets knowledge, the latter ignorance." Q&A There was then a Q&A panel with all speakers. The first questioner came up to note that the CDC of Maine recently sent pediatricians copies of Paul Offit’s book, Autism’s False Prophets. He also noted that humor of the sort in the “That Mitchell and Webb Look” clip about the homeopathic emergency room was effective, and we need more things like that. Steven Novella responded that we need lots of different things, not any one thing, because AltMed has its marketing down pat. Another questioner asked if there was a way for social media to work effectively in medicine, to which Dr. Jones responded that MedHealth “has lifeguards in the pool–physicians to moderate.” In a later comment, she pointed out that MedHealth has 200-300 doctors who answer questions for free, because the referrals they get as a result more than make up for the [opportunity cost]. Someone else said that the book Snake Oil Science needs to be turned into an easily usable website, and complained that Quackwatch is hard to use and too polemical. Dr. Novella agreed that SBM needs to provide more, better, and more usable information. It would be good to have a place where you can find overviews on topics, allow you to dig as deep into technical detail as you want, and provides a list of sentinel references. (This is essentially what the TalkOrigins Archive provides for the creation/evolution debate, in particular with Mark Isaak’s Index of Creationist Claims; the power of providing these kinds of broad and deep archives of reliable material was one of the key points of the talk I gave in June to the American Humanist Association.) Another questioner asked whether there is anything we can do to get rid of the National Center for Complementary and Alternative Medicine. Dr. Novella said that it is becoming more widely known that NCCAM’s Trial to Assess Chelation Therapy, its largest and most expensive trial to date, is loaded with “quacks and criminals” (guilty of insurance fraud and worse) and “totally corrupt,” as has been reported by the Associated Press in several good stories. Bioethicist Art Caplan has pointed out that these are unethical experiments on human subjects that would (should?) never be tolerated by NIH. (NCCAM is part of NIH.) NCCAM has spent $1.2 billion $2.5 billion of taxpayer money to date, and produced zero new treatments. Someone raised the question of what kinds of questions to ask your own doctors to make sure they’re giving good advice. Dr. Jones suggested asking, “Do you use UpToDate?”, which is a service that searches the world medical literature regularly and provides current data reviewed by 300 full-time reviewers. Dr. Gorski suggested asking whether a doctor follows the NCCN guidelines, which are evidence-based cancer treatment recommendations. Dr. Novella observed that just using Google, a “pull approach,” how most people look for medical information online, is highly unreliable because “bad sites are good at looking like good sites.” (I’d suggest that a more specialized search engine is a better way–Tim Farley suggested some ways of creating such capabilities at TAM6 last year.) Dr. Hall said that Stephen Barrett’s rule of thumb for distinguishing good from bad sites is that “if it’s selling something, it’s a bad site.” I’m not sure how effective that rule is, since even good sites are typically selling something. Someone raised a problem for use of prior probability, noting that it could have made us miss out on the discovery of lithium as a treatment for bipolar disorder, since it was originally postulated on rather shaky grounds. He gave a second example as SSRIs, which are effective in treating depression, but the original MAOI hypothesis of their operation has been refuted. Dr. Novella responded by saying that first of all, no known mechanism should imply a neutral prior probability (i.e., 0.5). Second, in deciding what to research, it’s better to err on the side of the implausible–but not for treatment. He further suggested that lack of mechanism should not be equated with implausibility. Dr. Atwood seconded that there is a difference between lack of mechanism and contravention of a physical law, and made reference to the discussion that he and I had during the break. He gave aspirin as another example of a substance where the mechanism was discovered later than its effectiveness, and expressed doubt about the questioner’s story of the discovery of lithium’s usefulness. David Whitlock raised the question of framing, asking why we don’t draw the distinction as science-based vs. faith-based medicine. Dr. Novella responded that this would cause more problems than it would solve, at least in the United States, because of the immunities granted to the free exercise of religion. A questioner wondered whether it might at least stop the government from paying for “faith-based” medicine under single payer. (I don’t think we’re likely to get single payer, and I note that we still have an Office of Faith-Based Programs, so I think this is not a good suggestion.) Dr. Gorski noted that very little CAM is actually religion-based. A questioner asked how corrupt the Cochrane data is, to which Dr. Atwood replied that the contributions on CAM subjects are unreliable, but reviews of substances are good and Cochrane in general is good. Dr. Novella said that he uses Cochrane to get studies and results, but ignores their conclusions, and pays close attention to authorship. Dr. Hall said that when it comes to meta-analysis, if the result is negative, you should believe it, but if the result is positive, you should look further. Dr. Novella noted that the systematic reviews in Cochrane aren’t actually meta-analyses. And that pretty much wrapped up the day for the Science-based Medicine conference. If you’d like to continue on to my summary of The Amazing Meeting 7, it begins here. UPDATE (July 19, 2009): I’ve been reminded that I neglected to mention one of the more interesting questioners, a massage therapist who stood up and said that he was probably the only “woo practitioner” in the room (though the doctors disagreed that massage therapy really counts as “woo”–and see Dr. Atwood’s talk, where he classified massage therapy as having high prior plausibility), who regularly attends CAM conferences. He complimented the speakers and the audience for having a level of displayed intelligence, sophistication, and scientific knowledge that is not seen at those CAM conferences. ...

July 15, 2009 · 11 min

Republican states lead in divorce, teen pregnancy, and porn subscriptions

Charles Blow has an op-ed piece in yesterday’s The New York Times commenting on the spate of recent Republican sex scandals which contains this infographic (an aptly named “blowchart”) ranking the states based on divorce rates, teen pregnancy rates, and subscriptions to online porn sites as a percentage of broadband subscribers. Blow suggests that conservatives address this hypocrisy by becoming more concerned about what goes on in their own bedrooms than in everyone else’s. It also highlights the ineffectiveness of abstinence-only sex education. (BTW, the data for the third column comes from the work of Ben Edelman (PDF), who I’ve cited here before for his excellent work on spyware and adware, and on the ineffectiveness of TRUSTe.) UPDATE (June 30, 2009): There’s at least one error in this chart, in that Tennessee should be red, not blue, near the bottom of the broadband porn column. ...

June 28, 2009 · 5 min

Bad military botnet proposal still being pushed

I just came across an April 2009 BBC story which shows that USAF Col. Williamson is still promoting his idea of building a U.S. military botnet to engage in offensive denial of service attacks against foreign targets on the Internet. But I haven’t seen him respond to any of the criticisms of his bad idea, including in the online forum of the journal where he published it. I think a more effective idea would be to adjust the computer crime statutes to provide immunity to prosecution (or at the very least an affirmative defense to criminal charges) for private responses to attacks that meet certain criteria, so that ISPs, security researchers, and competent individuals could engage in offensive actions against compromised machines to disable malicious software or take them off the network. Perhaps some kind of licensing or bonding would do the trick, and ISPs could put an exception into their acceptable use policies for entities that met the criteria. That’s also my partial response to this more recent BBC story about “what rules apply in cyber-wars” which led me to find the Williamson article.

June 27, 2009 · 1 min

Technology tidbits

From the Technology Quarterly report in the June 6-12, 2009 issue of The Economist, a few articles of interest: Gasoline/compressed-air hybrid vehicles may prove more cost-effective than gas-electric hybrids.Bigelow Aerospace wins challenge against export control regulations that would have required non-U.S. passengers on space flights to be treated as recipients of technology transfers, which would have required an onerous approval and monitoring process. (Not reported in the story is that Robert Bigelow is now funding MUFON to pay UFO researchers.)Delay-tolerant network protocol (DTN), developed with assistance from Vint Cerf, has been tested to transfer data between NASA’s EPOXI probe and earth-based stations, which will lead to an interplanetary internet that includes the International Space Station.The heart of the cockroach has been used as the model for a new type of low-cost artificial heart for humans.Researchers are devising a laser-based defense mechanism to shoot down mosquitoes rather than missiles. Funded by the Gates Foundation, the prototype cost is only about $100. We’d like one. ...

June 18, 2009 · 3 min

Tracking cyberspies through the web wilderness

Yesterday’s New York Times has an interesting article about how security researchers at the University of Toronto have helped uncover online spy activity, apparently conducted by the Chinese government, against the Dalai Lama’s office in India. One odd comment in the article: “And why among the more than 1,200 compromised government computers representing 103 countries, were there no United States government systems?" I find this particularly odd in that I’ve seen compromised U.S. government systems plenty of times in my information security career, including spam issued from military computers. I don’t find it plausible that the U.S. government has recently improved the security of all of its computers and networks so that there are no more compromised systems. In the context of the article, it’s discussing more specifically compromises due to the particular spy ring being monitored. The preceding sentences point out that they weren’t able to determine with certainty who was running it, and the immediately preceding sentence asks, “Why was the powerful eavesdropping system not password-protected, a weakness that made it easy for Mr. Villeneuve to determine how the system worked?" The question should actually have asked why it wasn’t encrypted, rather than “password-protected,” but the possibilities suggested to me here are that (a) this particular activity is being run by amateurs or (b) this particular activity was intentionally detectible as either (i) a distraction from other, more hidden activity or (ii) to put the blame on China by somebody other than China. ...

May 12, 2009 · 2 min

The Cybersecurity Act of 2009

There’s FUD spreading about Sec. 14 of the Cybersecurity Act of 2009, maintaining that it amounts to an effective repeal of the 4th Amendment for the Internet. That’s not so–the scope is restricted to “threat and vulnerability information” regarding the Internet, which I interpret to mean network service provider knowledge about compromised systems, botnets, etc., much of which is no doubt already being voluntarily shared with the government as is permissible under the Electronic Communications Privacy Act of 1986, when, in the course of a provider’s normal service monitoring, it becomes aware of possible criminal activity. I expect I’ll have more to say after I have a chance to read through the whole bill (PDF).

April 5, 2009 · 1 min

Immigration and jobs

Despite the common concern that immigrants to the U.S. take jobs that would otherwise go to American citizens, immigrants actually create jobs and promote innovation. Two recent articles in The Economist look at this topic. In the March 7, 2009 issue, a study by Harvard economist William Kerr and University of Michigan economist William Lincoln looked at how patent production changes in response to changes in the number of H-1B visa holders, immigrants with technical skills. When the number of H-1B visas was increased by 10%, total patenting increased by 2%, caused mostly by patent activity by immigrants. However, rather than reducing the number of patents by the native population, those also increased. In the March 14, 2009 issue’s special report on entrepreneurship, it’s noted that H-1B visas are capped at 85,000/year, and a maximum of 10,000 from any one country, increasing the wait for large countries such as India and China, where the wait time is about six years. There are over one million people waiting. This issue also notes that about half of Silicon Valley’s startups are founded by immigrants, and about 25% of all U.S. science and technology startups have a CEO or CTO who is an immigrant, and these companies employ 450,000 people and generate $52 billion in annual revenue. A quarter of U.S. patent applications in 2006 name foreign nationals as inventors or co-inventors. ...

March 21, 2009 · 3 min

Some interesting technology

The March 7th, 2009 issue of The Economist Technical Quarterly has some items of interest: Cool Earth Solar of Livermore, California is using balloons as solar energy collectors. Narasimharao Kondamudi, Susanta Mohapatra, and Manoranjan Misra of the University of Nevada at Reno have found a way to turn coffee grounds into biodiesel. David Whitten of the University of New Mexico and Kirk Schanze of the University of Florida have built “micro-sized ‘roach motels’” for capturing bacteria in hospitals and on the surfaces of ships. Nicholas Kotov and his team at the University of Michigan have come up with a way to coat cotton threads with carbon nanotubes which can be used to carry electricity, and to add an additional material that reacts with human serum albumin, in order to detect bleeding, which might be used by the military in monitoring soldiers.

March 15, 2009 · 1 min
Mastodon Verification