Subject: Re: [Asrg] Its all over for Challenge Response

From: Brett Watson <[email-masked]>
Date: Mon, 2 Feb 2004 13:22:45 +1100

Seth Breidbart says:
> If you steal the bandwidth from owned machines (the same way spam
> sending and some web hosting is stolen now), your costs are even less.

Jon Kyme responds:
> This is all getting silly.
> Numbers?
> Actual exploit?

I say:
Does anyone still seriously doubt that spamming miscreants are using third 
party computers as their web, mail and DNS hosts? Jon? This is not a new 
phenomenon anymore.

June 2003: ZDNet report on Sobig virus strain, which is a spam relay.
http://reviews-zdnet.com.com/4520-7297_16-4208055.html

July 2003: BBC report on "Superzonda" spamhaus, who compromised a British 
Airways computer (among others) to host their stuff.
http://news.bbc.co.uk/1/hi/technology/3036092.stm

New York Times (annoying registration required): Hackers Hijack PCs for Sex 
Sites. (I don't have a registration, so I haven't checked this one recently.)
http://www.nytimes.com/2003/07/11/technology/11HACK.html?ex=1058500800&en=dfe68a99bce4317d&ei=5062

July 2003: Analysis of "migmaf" malware, a reverse-proxy tool for third party 
hosting.
http://www.lurhq.com/migmaf.html

July 2003: The Register report on "webber" malware (more of the same).
http://www.theregister.co.uk/content/56/31801.html

September 2003: SecurityFocus forensics on a compromise in which machines are 
used as spam servers.
http://www.securityfocus.com/guest/24043

January 2004: SecurityFocus analysis of legal issues associated with "the 
Trojan did it" cases (as reprinted in The Register).
http://www.theregister.co.uk/content/56/34985.html

I hope that this is sufficient evidence to persuade the sceptic that spammers 
and other miscreants are ROUTINELY using compromised third party computers to 
do their dirty work. Any anti-spam proposal (particularly those that propose 
a cost-burden to the sender) should take this fact into consideration.

Regards,
TFBW

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 3 Feb 2004 17:33:29 -0800

>   Let's be grateful that it was a multi-billion dollar giant like AOL
> that Sanford Wallace chose to sue, and establish favourable 
> case-law for the anti-spam side.

Yes, and it is also a good thing that they did not sue some
clown like the SPEWS guy. It was a really bad thing when we ended
up with Emanuel goldstein of 2600 as the front guy on the 
DeCSS thing.

> > So? If we have good domain based authentication much better 
> for the MTA
> > to accept any mail that is authenticated and allow the MUA 
> to perform
> > filtering on the basis of domain owner reputation.
> 
>   What use is a MUA-based filter when your 10-megabyte inbox is
> rejecting inbound email because you're over quota ?

If I can tell my ISP what criteria to apply then that is OK for me.

> > I don't want my ISP making arbitrary decisions about what mail I
> > receive, I want to make those decisions myself, although I will
> > probably use third party info to do so.
> 
>   But what about the 95% of end-users who don't understand 
> CIDRs, how to
> invoke DNSbls in their filters, and end up begging their ISPs to do
> whatever is necessary to stop the flow of spam to their inboxes ?  Why
> shouln't they be allowed the *CHOICE* of outsourcing their 
> spam-blocking?

I am not going to argue on that one, clearly I have the right as an
end user to outsource spam blocking, but that should be my choice
not the ISP.

		Phill

---

From: "Eric D. Williams" <[email-masked]>
Date: Wed, 4 Feb 2004 21:44:48 -0500

Actually I was not commenting on your original thread of discussion I was 
commenting on your analysis of the 'locks' example.  IMHO that analysis, 
specifically, was erroneous.  I do recognize the motivation and accuracy of 
your original statement.  I think this is merely an issue my commentary being 
out-of-band to that original thread.  Sorry.

-e

On Wednesday, February 04, 2004 10:02 AM, Paul Tenny 
[SMTP:[email-masked]] wrote:
> Eric D. Williams wrote:
> > I hope this clarifies, what I think was the example.
>
> You missed the point of it by about 500 miles.
>
> Intent? Law? Violation? Did you even read what I said originally?
>
> I wrote;
> > It becomes exceptionally difficult when you rely on the law as part
> > of the solution to a problem.
>
> > I think our legal system has shown over and over it doesn't matter
> > how much you punish or threaten someone, the only way to stop them
> > is to put up a better defense against *them*, not their methods.
>
> I can't think of a reason someone would take something so wildly out
> of context for any reason unless they simply missed the point, so
> there it is.
>
> It doesn't have anything to do with what you think, or what he thinks,
> or what I think. Trying to punish people after they've done something
> wrong is not a solution, it's a fix. We don't need fixes, we need
> solutions.
>
> The answer's out there, trust me.
>

---

From: AccuSpam <[email-masked]>
Date: Mon, 09 Feb 2004 12:44:51 +0800

This rumored threat is probably a non-issue.  The IPv4 rate limiting could be
applied to any challenge (turning test) _submitted_ over IP (differentiate
"submission" from "accessing" the challenge content).  There are probably more
cost effective attacks for spammers to exploit:

http://www.accuspam.com/faq.php#as_automate

"...because spammers would not be able to amass enough unique IPv4 addresses
(at reasonable cost) to defeat significantly, useful volumes in their economic
model...AccuSpam's challenge method is most often not a response but a normal
visit to contact form..."

Note implicit requirement is to not serve (be able to access) the same
challenge twice in succession, so that the hijacked client can not use
Javascript to submit the challenge in an auxillary window or frame.  However,
note the exploit could work to the extent that if the client was made to submit
the challenge (not by proxy), i.e. the porn visitor did not receive what was
promised for his work or the porn content was always loaded (irrespective of
results of challenge submission) in side window or frame.  Theoretically it
might be possible to write a script that ran in auxillary window or frame which
could wait on timer to check the validity of the results of the challenge
submission by parsing the returned content in the other companion window or
frame.  I think serving the challenge over HTTPS would be sufficient so the
browser's security system prevents access from script in other window or frame
(url containing different domain).  Whether such client hacks could produce
popular porn sites (see volume requirements argument as well in link above), is
highly dubious.  The challenge results could return frame busting HTML and/or
insure they were on frame or window of sufficient size to interfere with
attempted client hacks.

Shelby Moore
http://AccuSpam.com

> spammers have found a way to break C/R schemes that have a 'turing test'
> component.
>
> You simply set up a free porn web site and get people to crack the turing
> tests in return for seeing the porn.
>
> http://yro.slashdot.org/article.pl?sid=04/01/28/1344207&mode=flat&tid=111&ti
> d=126&tid=172&tid=95&threshold=1
>
>             Phill