Subject: [Asrg] Re: 03.1 Re: Forgery in SMTP

From: [email-masked]
Date: Fri, 26 Dec 2003 16:14:04 -0600

>>>>>There are two problems caused by the potential forgery that is possible in 
SMTP:
>>>>1. Filtering by sender's address is hard when someone could forge a friend's
>>>>address.

>>>  Which is where accountability comes in.

>Walt: I think Alan is implicitly referring to the LMAP technology, which 
>WILL allow the victim to prevent abuse of their name.
>Of course, it doesn't work IRL yet, and I can see how you wouldn't 
>realise he was referring to it. 
>Flamewar quenched, I hope.  Chill, guys.

To begin with, spam volumes become far less of a problem (inboxes overflowing, 
byte volumes, spool space, bandwidth, etc etc) when the spams are simply 
smaller.

I've previously suggested as a BEGINNING to the solution that recipients be able 
to whitelist "authorized" senders to send them "special" type posts.

By default, an unrecognized or unauthorized person would be able to send the 
recipient a "simple", small post... no attachments, no HTML-burdened content 
(including NO embedded images, no scripting, etc)!, maybe with an upper-bound 
size of 10K or 50K or something.

Note that this no-images, no-attachments, no-HTML-burdened rule immediately 
squashes the GREAT majority of tricks that spammers employ to obscure their 
message or hide their content from filters and keyword scanners and the like.  
It also virtually eliminates in one fell swoop the great majority of viruses and 
worms.

This approach is simple, straightforward, easily implemented at the recipients 
end (or their ISP) and immediately effective.  It doesn't require any great 
global redesign of the Internet.

While it is POSSIBLE to get past it (if for example the virus gets lucky and 
manages to forge a From address which just happens to be authorized to send 
attachments (and moreover, EXECUTABLE attachments) to the recipient, the numbers 
are still WAY smaller than they are now... perhaps small enough that the 
resulting success rate will be too small for the virus or worm to end up being 
viable.

Now, I have lately been getting "junk" spam messages which contain NO visible 
purpose whatsoever... they don't point at any Web site, they don't have any 
apparent return receipt requested, they just contain a bunch of random words.  
Perhaps these are ONLY being sent to see if they bounce back as undeliverable... 
hard to say!  Perhaps their "real" content is in an HTML-burdened alternative 
version (which gets stripped out of all E-mail upon arrival here).  I don't know 
that much of any spam filter is likely to end up blocking mail like this (but 
then again, it's not clear what other benefit there would be for spammers to 
send it, either).  Certainly if this were to get widespread, it would be almost 
as annoying as the familiar commercial-type spam shilling for porn sites or 
hawking herbal penis enlargement.

>>>>2. One can't hold the victim of the forgery accountable for the junk
>>>>transmitted.

>>>  Why not?  If they haven't done anything to prevent the (ab)use of
>>>their name, how can the recipient tell if a message is real, or
>>>abusive?

>>  A spammer sends out a viagra spam "From: "Alan DeKok" <[email-masked]>".
>>How are the 20 million strangers it's addressed to going to *REJECT* it?
>>At these volumes, merely accepting the email and storing it in
>>recipients' "spam folders" will cause smaller ISPs to run out of
>>mailspool space.  

That's pretty much an oxymoron... if they're getting 20 million copies of it, 
then they're probably not a "smaller" ISP.  

Certainly it WOULD be possible to "mailbomb" a given target (maybe smaller) ISP 
(e.g. a virus or worm which would commandeer victim computers and cause them to 
each send thousands and thousands of E-mail messages to target ISPs or users) 
but that's going to be possible anyhow, and is really pretty much outside the 
topic that WE are tasked with dealing with.  That's really more of a Denial of 
Service attack.

>>What actions can *YOU* take that would allow
>>verification/authentication of the "From:" during the SMTP transaction ?

I'm not convinced that it's necessarily practical and maybe not even desirable 
to even try.

First of all, there are many legitimate reasons for people to send E-mails 
through relays, foreign ISPs, or other services not usually associated with 
their From: address.  They might be travelling (perhaps even internationally) at 
an Internet cafe, airport waiting lounge E-mail kiosk, cruise ship Internet 
access lounge, in-airplane E-mail service, public library, or post office.  In 
each of these cases, they clearly want the replies to come to their own (perhaps 
"vanity") domain, and maybe they never will ever again even be at the point 
where the prior E-mail message was actually sent from.  

What's more, consider the case of mailing lists (Yahoogroups is a good example) 
as "anonymizers" of sorts of messages.  They forward messages (as individual 
messages or perhaps as digests) and these sorts of mailing lists are terribly 
important to large classes of internet users.  Sometimes these messages bear the 
original sender's From address, sometimes they bear the list's From address.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Philip Miller <[email-masked]>
Date: Sat, 27 Dec 2003 01:52:54 -0500

[email-masked] wrote:
> [snip]

We're talking about different 'From' addresses. None of the proposals we're 
working on deal with the 'From:' header as it appears in the message body. 
 From what I've seen, it's possible that Yahoo's "Domain Keys" proposal 
might, but we don't know.
All of the LMAP implementation proposals deal with the envelope from 
address, also know as the return path. That's the parameter to the MAIL 
command in SMTP. If travelling people want to set up their domain so that 
any source can use it in a MAIL FROM, they're welcome to, just as all 
recipients are welcome to block mail claiming to be from that domain.

> original sender's From address, sometimes they bear the list's From address.

Mailing lists are a different case. Most mailing lists rewrite the return 
path so that bounces are delivered to the mailing list server or 
administrator rather than random posters on the list. Any modern mailer that 
doesn't do this better have pretty damn good reasons not to.

Philip Miller

---

From: Matthew Elvey <[email-masked]>
Date: Mon, 29 Dec 2003 23:32:42 -0800

On 12/26/2003 2:14 PM, [email-masked] sent forth electrons to convey:

>...By default, an unrecognized or unauthorized person would be able to send the 
>size of 10K or 50K or something....
>
>  
>
Not a bad idea, though I don't see it spreading like wildfire.   But the 
spam making it though my current filters would mostly make it through 
this filter too.

>purpose whatsoever... ...  Perhaps their "real" content is in an HTML-burdened alternative 
>version (which gets stripped out of all E-mail upon arrival here).  
>
This is so for spam I've received recently.