Subject: Re: [Asrg] Re: 6. Proposals: LMTP proposals]

From: Fridrik Skulason <[email-masked]>
Date: Mon, 1 Dec 2003 09:16:32 +0000

> LMAP is supposed to be checking the IP of the connected client against DNS. 
> Unless they can forge a TCP connection with the MTA without seeing any of 
> the traffic, they can't pull that off with LMAP going. Now, if they were 
> actually fastmail.fm users, that would be another story. In particular, I 
> think dealing with that falls under the umbrella of 'local policy'.

LMAP will never eliminate all cases of forgery - which actually has a
rather nasty side-effect.  Think of it as the "survival of the fittest"
in action.  If something like LMAP was universally adopted, any spam
mechanism not affected by it would be "encouraged", so to speak.

So, which cases would not be affected by LMAP?  Now, in addition
to all the "non-forged" methods (disposable accounts, rogue ISPs and so
on) there is the following:

   A spammer gains access to a compromised computer, and determines
   the mail address of the owner of the machine.  The spam is then
   sent out in the name of the owner of the machine, just as if
   the real owner was actually pressing the keys.  

In other words, widespread implementation of LMAP (which would be a good
thing) would lead to more compromised machines (which would be a bad 
thing) ;-)

-- 
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email-masked]       fax:   +354-540-7401

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Philip Miller <[email-masked]>
Date: Mon, 01 Dec 2003 07:11:35 -0500

> thing) would lead to more compromised machines (which would be a bad 

In the case you cite, the recipients gain two advantages over the current 
situation: they have soemone to hold accountable, and that someone has an 
interest in cooperating.

--
Philip Miller

---

From: Bill Cole <[email-masked]>
Date: Mon, 1 Dec 2003 08:48:37 -0500

>thing) would lead to more compromised machines (which would be a bad

That raises the question of whether significantly more compromised 
machines is a possibility, or whether we are already seeing that 
problem limited by factors other than 'demand' from spammers and 
others. We've already seen worms that send spam, install backdoors, 
install open proxies, install SMTP relays, and check-in compromised 
machines for orders from their master to attack anti-spam facilities. 
It seems to me that the demand is already effectively infinite. what 
would likely increase if the fraction of spam using machines that 
have been blatantly taken over.

That's not a bad thing. Right now there are a significant number of 
spammers who work in the very dark gray area of abusing open relays, 
open proxies, and insecure web-mail systems. Making those tools 
worthless will drive the slimeballs using them off to mechanisms like 
full system compromise which cannot be argued by anyone sane to be 
anything less than criminal: the spammer cannot argue to his provider 
or law enforcement that a crackable system was intentionally left 
that way so he could crack it, as some now argue successfully in 
regards to open proxies and open relays.

-- 
Bill Cole
[email-masked]

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 01 Dec 2003 08:54:30 -0500

Mark E. Mallett wrote:

> On Mon, Dec 01, 2003 at 09:16:32AM +0000, Fridrik Skulason wrote:
> 
> What solutions are there that don't suffer this problem?
> 
> (greylisting and other sorts of limiters might not, so much, but
> that's the sort or things that "owning" machines get around, too.)
> 

It then becomes a bigger incentive on the ISPs to start detecting and 
blocking malicious machines.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"And this too shall come to pass"
-------

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 01 Dec 2003 12:13:55 -0500

> mechanism not affected by it would be "encouraged", so to speak.

  No.

  Adding security in one are of the network changes the cost-benefit
ratio for attacks in other areas of the network.  This is a very
different statement than what you made.

> thing) would lead to more compromised machines (which would be a bad 

  Tough sh*t for them.

  By the same argument, I shouldn't put locks or an alarm in my house,
because that encourages thieves to go after my neighbour, instead of
me.

  Such arguments are ridiculous, and either originate from a
misunderstanding of the security space, or a hidden agenda to prevent
*any* anti-spam measures from being implemented.

  To repeat what I've been saying since the start of ASRG: If one of
the requirements for this group is that nothing changes, then we
should all give up, and disband the group.

  Alan DeKok.

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 01 Dec 2003 17:58:45 -0500

> Fridrik Skulason <[email-masked]> wrote:
[..]
> *any* anti-spam measures from being implemented.

I believe that Fridrik was pointing out a simple fact - any effective 
anti-spam solutions would force spammers to seek other venues, including 
the increased use of hijacked computers.

> should all give up, and disband the group.

Our goals are is to determine how to provide maximum benefits with at 
least intrusive changes possible. While changes are necessary, we need 
to evaluate which changes have the most effect and the least cost.

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"I ate your Web page. / Forgive me. It was juicy / And tart on my 
tongue." (MIT's 404 Message)
-------

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 02 Dec 2003 11:15:44 -0500

> the increased use of hijacked computers.

  Yes, but it was leaning towards being biased against a solution,
because of the change in cost.  To quote him again:

>> In other words, widespread implementation of LMAP (which would be a
>> good thing) 

  That's nice...

>> would lead to more compromised machines (which would be a bad
>> thing)

  Absolutely not.  I could argue just as well that it's a Good Thing,
because it now gives the admins & programmers incentive to fix their
systems.

  We already KNOW those machines may be compromised.  We already KNOW
that changing the cost/benefit ratio for one behaviour will make
others more appealing.  It makes no sense to even insinuate that
deploying a solution has negative effects on pre-existing broken
systems.  It's false logic.

  I'm sensitive to negativity about any proposal (more so for LMAP),
because of the history in ASRG of nonsensical, irrelevant, false, and
contradictory reasons people have used to oppose any proposal.

  The deployment, or not, of a proposal makes zero difference as to
the ability to compromise those machines.  Therefore, that risk should
have ZERO INFLUENCE on the decision to deploy that proposal.  Anyone
who claims that such risks should influence the deployment decision
looks to me like they have an agenda to prevent that deployment.

  Alan DeKok.