Subject: Re: [Asrg] Re: 6. Proposals: LMTP proposals]]

From: Fridrik Skulason <[email-masked]>
Date: Mon, 1 Dec 2003 17:35:12 +0000

> > In other words, widespread implementation of LMAP (which would be a good
> > thing) would lead to more compromised machines (which would be a bad
> > thing) ;-)
>     
> What solutions are there that don't suffer this problem?
      
I am not saying there are any better solutions.  LMAP (or something like that)
would go a long way towards reducing the problem caused by spam with forged
headers.   All I am saying is that if/when some method like LMAP will be
adopted, spammers will put increased emphasis on methods not affected by
LMAP, such as:
      
  1) "Disposable" accounts - get an account somewhere, violate the AUP
     and spam until the account is shut down.

  2) Rogue ISPs.

  3) Zombies...networks of compromised machines, used to send spam
     "in the name" of the owner of the machines.
      
Those are not reasons not to implement LMAP or any other protocol to reach
the same goal - I am all for any method that will reduce forgery - all I
am saying is that we can expect a changed strategy by spammers, and other
methods will be needed to deal with that.

-- 
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email-masked]       fax:   +354-540-7401

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Fridrik Skulason <[email-masked]>
Date: Mon, 1 Dec 2003 17:54:30 +0000

>That's not a bad thing. Right now there are a significant number of 
>spammers who work in the very dark gray area of abusing open relays, 
>open proxies, and insecure web-mail systems. Making those tools 
>worthless will drive the slimeballs using them off to mechanisms like 
>full system compromise which cannot be argued by anyone sane to be 
>anything less than criminal: the spammer cannot argue to his provider 
>or law enforcement that a crackable system was intentionally left 
>that way so he could crack it, as some now argue successfully in 
>regards to open proxies and open relays.

That's a good point, but I would not be too optimistic about the
possibility of going after them through the legal system, for several
reasons.  One is the difficulty of tracking them down - it may not
be worth the effort unless we are talking about a massive network
of tens of thousands of machines.  Another problem is one of 
jurisdiction.  Say for example that someone in Russia logs on a 
system in Moldavia, hacks into a system in Australia, and uses that
system to send spam to the US.  Now, where did the crime take
place, and which court would have jurisdiction in this case?  I
don't know, but then again, I'm not a lawyer - however, I can well
imagine some legal problems if a situation like this arises.