Subject: [Asrg] 0. - General - Consent and SoBig

From: [email-masked]
Date: Sat, 23 Aug 2003 13:01:55 -0500

I think it's appropriate to point out that a consent framework where a recipient 
would need to specifically enable HTML, and (separately, particularly this part 
here) attachments, on a sender-by-sender basis (and, moreover where one could 
categorize attachments by either filename extensions or types by category... 
text, Acrobat, fonts, images, executables, sound, video, etc)... and only enable 
for a given sender the TYPE(s) of attachment that one EXPECTS that sender to be 
sending to the recipient... would have made this SoBig fiasco a non-event.

Most of these recipients who allowed this worm to infect their computer probably 
would NOT have had authorized those senders to send attachments at all, let 
alone EXECUTABLE attachments.

And of course, these "multi-extension" attachments (like document.doc.pif) 
wouldn't (shouldn't!) fool a better attachment extension/type filter.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Sun, 24 Aug 2003 00:37:54 +0200

At 1:01 PM -0500 2003/08/23, [email-masked] wrote:

>  Most of these recipients who allowed this worm to infect their
>  computer probably would NOT have had authorized those senders
>  to send attachments at all, let alone EXECUTABLE attachments.

	I disagree.  If you have a consent framework system, and the 
dominant monopoly application vendor chooses to default to turning 
off all security, by far the vast majority of users will leave it 
that way.  Thus, they would remain vulnerable.

	This entire problem would have been a non-event even without a 
consent framework system, if the dominant monopoly application vendor 
actually paid any attention whatsoever to the issue of security from 
a user perspective.

	A consent framework system is neither a necessary condition nor 
sufficient, unless it is a fundamental requirement of the most basic 
kind of operations.  However, such a system may be an enabler, 
especially during a time of transition from an old system that 
doesn't use it to a new system where it is integral.

	However, to be truly effective, we have to make sure that we do 
everything possible to create a system in which all possible 
implementations default to "secure" mode, as opposed to "insecure".

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

---

From: [email-masked]
Date: Sat, 23 Aug 2003 20:54:33 -0500

>	I disagree.  

That's mostly because you didn't pay attention to what I said, or didn't hear 
the discussion on these points here before.

>If you have a consent framework system, and the 
>off all security, 

Points:

  1)  If all the security is turned off, it doesn't matter what type there was 
or who turned it off... there's no security.  

  2)  I've always proposed as key elements of my suggested consent system that 
the default state (for unspecified senders) is to disallow HTML and to disallow 
attachments.  Recipients could turn enable HTML, and/or attachments, at their 
option FOR SPECIFIC INDIVIDUAL SENDERS (or sender domains) and probably also 
specifying WHICH classes of attachments they expect from any of those senders.

So if a user follows the "path of least resistance" they'll get only plain ASCII 
text E-mails, which are relatively easily handled by content filters.

> by far the vast majority of users will leave it 

Right basic argument, but reaching the wrong conclusion.  Most users will leave 
the default protections in place for most senders, only opening it up where 
needed.  Since *few* senders ever have need to send attachments (and 
particularly even fewer needing to send executable ones!) it's a safe bet that 
SoBig would have never achieved anything like this kind of wild success if the 
great majority of its propagating E-mails went directly into the bit bucket.

>actually paid any attention whatsoever to the issue of security from 

Actually, even if Outlook and IE and Windows were all "secure", I think one can 
fairly argue that there are 'enough' clueness users of AOL's insecure client 
software that there would still be a problem.  The consent framework, and 
default to removing (or better, intercepting entirely) HTML and attachments on a 
per-sender, per-addressee basis, really ought to be done at the ISP or domain 
provider level.

I fully agree that Microsoft has done some pretty stupid crap over the years, 
including enabling HTML by default, but a lot of other software suppliers aren't 
a whole lot better.

>sufficient, 

Nor is anything else, when you get right down to it.  If there were an obvious, 
100% watertight, 100% effective solution to these problems we wouldn't have to 
have this list and be discussing all these different ideas... the problem would 
have been fixed a long time ago.

But the consent framework that I proposed is still a simple, cost-effective, 
user-comprehensible, surprisingly effective system that will put a serious dent 
in BOTH spam AND malware, and moreover will do so in a way that is incrementally 
implementable and that offers a near-immediate payback to those who go to the 
effort to put it in.  That sounds to me like it covers a lot of the requisite 
bases, and while avoiding nearly all the 'headaches' and implementation barriers 
that most of these other systems we've proposed are afflicted with.

>unless it is a fundamental requirement of the most basic 
>kind of operations.  

It ought to be offered by ISPs and domain providers, although interested 
individual users could still set it up, I'd think, if the programming for it 
were done appropriately.

>However, such a system may be an enabler, 

I don't think you're going to see a worldwide transition to a totally new E-mail 
framework anytime soon.  There are too many individual mail packages and too 
much 'integrated' stuff already out there which adhere to the current standard.

>implementations default to "secure" mode, as opposed to "insecure".

That's the intention for the Secure Computing Initiative, which is what 
Microsoft is calling their development effort.  

It wasn't all that long ago that Sendmail (et al) all defaulted to installing 
with open relays and such too, so it's not as if Microsoft is the only guilty 
party in this industry.

---

From: "Christopher Bird" <[email-masked]>
Date: Sat, 23 Aug 2003 21:25:53 -0500

Without having conducted focus groups, etc. I don't have anything other
than anecdotal evidence for the following:

People seem to want to "personalize" everthing they do. That goes for
choosing curtains, to "skins" on Cell phones to a,most all aspects of
their lives. Having a Dallas Cowboys faceplate on my phone doesn't make
it work any better or worse.

The need to express "individuality" and to control *something* seems
paramount.

The computing that people have at their fingertips at home is really
pretty daunting so it is nice to be able to have a small victory over
some aspect of it.

Many people don't really understand the implications of anything (even
obvious things like hot coffee will burn you), so why would we expect
them to understand things that are almost entirely conceptual, esoteric
and interesting to those of us who make our living in the IT field?

Many people pass chat scripts among themsellves so that they can exert
some superiority over their peers. "My script can do X, yours can't"
kinds of behaviors.

Much email does legitimately contain attachments - even HTML because of
the first couple of points above or as the old joke goes, "They can".

So, I don't believe it is just a manufacturer thing. People will behave
in unsafe fashions and use tools in ways that make those of us who
design tools cringe. My ex-wife used to open paint cans and stir the
contents with screwdrivers. I am sure the inventor of the screwdriver
did not expect this. However, it did a decent job. Ruined the
screwdriver, but managed the paint well.

The point of all of this is that if we expect "disease" to be brought
under control by defaulting the vectors in such a way that the "out of
the box behavior" prevents the disease then I fear we are mistaken. It
is the equivalent of the "Just say No" campaign to stop drug abuse (or
was it teen pregnancy, I forget which). People will indulge in risky
behavior for a variety of reasons, especially when they are unable to
visualize the impact of the risk on the population at large.

Rather than insert comments into the text, I have chosen to copy some
pieces of the conversation and address them here.

Right basic argument, but reaching the wrong conclusion.  
> Most users will leave 

I think the previous writer is confusing need with want. For much of
what we do we perhaps need plain text. However for some of the reasons I
outlined earlier, we *want* to behave differently. Need is water. Want
is cola. We make more profit out of servicing wants than needs. The
commercial market place deals in wants not needs. So a "need based"
approach simply doesn't hold water. 

BTW it isn't just AOL users.......

I apologize for leaving the whole thread in (as follows) I wasn't sure
exactly what to snip.

Chris

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of [email-masked]
> Sent: Saturday, August 23, 2003 8:55 PM
> To: Brad Knowles; [email-masked]
> Cc: [email-masked]
> Subject: Re: [Asrg] 0. - General - Consent and SoBig
> 
> 
> >> computer probably would NOT have had authorized those senders  to 
> >> send attachments at all, let alone EXECUTABLE attachments.
> 
> >	I disagree.
> 
> 1977-2002  Twenty-fifth anniversary year of Local Area 
> Networking! Support the Anti-SPAM Amendment!  Join at 
http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they
"represent".
12/09/00: the date the Republican Party took down democracy in America.

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 23 Aug 2003 22:27:57 -0400

At 1:01 PM -0500 8/23/03, [email-masked] wrote:
>computer probably

The fact that they are so used to getting attachments that they click 
on one without thinking would seem to indicate otherwise.
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: [email-masked]
Date: Sat, 23 Aug 2003 22:57:36 -0500

>on one without thinking would seem to indicate otherwise.

Most of them are probably used to getting image or text attachments, or WAV 
files maybe, and never dream that these are executable program (or probably even 
how to tell the difference).

I still contend that most users would have a VERY small number of senders 
authorized to send the executable attachments, and thus would be spared the 
angst of most of these worms and viruses.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 24 Aug 2003 01:10:28 -0400

[Mod. moved to BCP area]

>angst of most of these worms and viruses.

This is best addressed within the BCP area. Would anyone like to volunteer?

---

From: Kee Hinckley <[email-masked]>
Date: Sun, 24 Aug 2003 09:10:31 -0400

>how to tell the difference).

I think you have it in the last statement.  .doc, .xls, .whatever. 
They don't know the difference.  They don't know what is "executable" 
and what is, and many probably aren't clear on the difference in any 
case.  All they know for sure is that when they click a file, 
something is opened.  That's not a bad thing--that's what it's 
supposed to do.  Unfortunately it means that the system needs to do a 
better job of protecting them.

---

From: [email-masked]
Date: Sun, 24 Aug 2003 14:36:13 -0500

>This is best addressed within the BCP area. Would anyone like to volunteer? 

What are you asking us to volunteer to do?  I'd like to help, although my time 
is limited (and unfortunately I've not got a salary to count on keeping the 
bills paid...)

---

From: Brad Knowles <[email-masked]>
Date: Sun, 24 Aug 2003 12:20:46 +0200

At 8:54 PM -0500 2003/08/23, [email-masked] wrote:

>  Right basic argument, but reaching the wrong conclusion.  Most
>  users will leave the default protections in place for most
>  senders, only opening it up where needed.

	If you can ensure that "default secure" is the required operating 
mode for all implementers.  I don't know whether or not we can make 
that claim.

>  Actually, even if Outlook and IE and Windows were all "secure", I
>  think one can fairly argue that there are 'enough' clueness users
>  of AOL's insecure client software that there would still be a
>  problem.

	I used to work at AOL.  I am more familiar with their client than 
I ever wanted to be.

	Actually, the AOL client is so simple that it doesn't really 
understand attachments, and certainly doesn't understand multiple 
attachments (in that case, the user sees a preview of the first 
bodypart, and the entire mail message is stored as an "attachment" 
that must be downloaded to be viewed).  It also doesn't understand 
anything about automatically executing code.

	It does now have an embedded HTML engine, but that doesn't allow 
for automatically connecting to external web servers and downloading 
additional content.

>  I fully agree that Microsoft has done some pretty stupid crap over
>  the years, including enabling HTML by default, but a lot of other
>  software suppliers aren't a whole lot better.

	I'm a pretty big critic of a lot of the incredibly stupid things 
that AOL has done (just ask Steve Case about the times I have 
publicly harassed him at company "all hands" meetings), and indeed I 
feel that they are an "Evil Empire" that is only very slightly better 
than Microsoft.  But this is a case where their stupidity has 
actually served them reasonably well.

	I definitely agree that there are plenty of companies out there 
that have done things almost as bad, as bad, or even worse than 
either Microsoft or AOL.  The difference is that most of these 
companies are no longer around, or have since learned their lesson.

>  Microsoft is calling their development effort.

	Uh, no.  Microsoft calls their stuff secure when they have some 
guarantees as to what they can prevent the user from doing.

	This is totally unrelated to real computer security, which has 
more to do with having guarantees as to what the machine is or is not 
capable of doing, and how malicious programs can be restricted from 
negatively impacting anything else on the system.

>  with open relays and such too, so it's not as if Microsoft is the only guilty

	No, not the only one.  But certainly the biggest.  Indeed, bigger 
than the entire rest of the industry put together.  Moreover, they 
have not learned the lesson (indeed, they show every indication of 
ensuring that they cannot possibly be forced to learn the lesson) and 
they continue to do the damn stupidest of things.