Subject: [Asrg] 0. General - Revocation of Posting Privileges for Hector Santos

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 21 Dec 2003 03:16:58 -0500

Hector,

As per section 5.3 of RFC 2014, the chairs have made a decision to 
revoke your posting privileges to the ASRG discussion list. This 
decision was made because you have continued to ignore the scope of the 
ASRG list and posting guidelines, continued to promote your CBV system, 
and personally attacked other list members.

As has been the case before with Mark McCarron 
(https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg06363.html), 
  if you can stay in scope, and stop flaming, we may conditionally allow 
you to have posting privileges again.

Information about managing your subscription to the list, may be found here:

https://www1.ietf.org/mailman/listinfo/asrg

Sincerely,
Yakov Shafranovich
Co-Chair, ASRG

-------- Original Message --------
Subject: Wasted time?
Date: Sat, 20 Dec 2003 12:40:14 -0500
From: Hector Santos <[email-masked]>
Organization: Santronics Software, Inc
To: Anti-Spam <[email-masked]>, Yakov Shafranovich <[email-masked]>

I don't wish to be wasting time providing any feedback or information or
comments if I am going to censored.  I posted mail that never was
distributed.

Please let me know if I am allowed to post in the group. It is a simple
Yes or No answer. If no, simply remove me from the list and don't send 
me any list mail.

...

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"All that is gold does not glitter" (LOTR)
-------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris" <[email-masked]>
Date: Sun, 21 Dec 2003 23:03:27 +1030

Hi All

An interesting job was recently advertised on a software coders auction
site.

It goes something like this....

=======================================

Coder wanted to create perl mail program

Mail program operates as an MTA-intermediate

Mail program must be able to forge the previous domain in the MTA chain,
this domain is selectable and will be a valid domain with a reverse DNS

Mail program must be able to switch domains using domain list text file

...

=======================================

From what I can see this "job" specifically targets anti spam measures that
use reverse DNS (ip blacklists) to determine the sender. by simply saying my
name is joe.com and I got message from jane.com for you.

because everybody knows jane.com the message is accepted. (until Jane is
blacklisted through no fault of her own)

Which of the proposed systems will overcome this form of "spoofing"? Is this
what is reffered to as "envelope forging" I tried a search on Gmane but did
not come up with much.

The only two forms I can think of are a pull system (you just knew I was
going to say that) and a message digest key (yahoo etc). ( I am ignoring
Challenge Response Systems as they seem to be both patented and without real
value IMHO)

from what I have read and I admit to some slackness here, most other
verification systems ignore the MTA-i and just concentrate on the MTA-s.

In which case as the supposed sender domain is legitimate (and perhaps even
the senders email address) the message slips thru most filters.

By simply monitoring the IP blacklists the spammer changes the spoofed
source domain as soon as the current one gets listed. so no messages are
lost.

also if the spammer simply gets a one month account on any of thousands of
available servers he just deletes the source code on one server and moves to
the next when joe.com gets listed as the source of the spam.

Chris

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 21 Dec 2003 14:48:41 -0500

...

That is not necessarily true, usually you check the incoming MTA's IP, 
not the one further away. This is how open relays get caught, even the 
ones claiming to relay mail from Yahoo.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Power tends to corrupt, and absolute power corrupts absolutely" (Lord 
Acton)
-------