Subject: Re: [Fwd: [Asrg] Re: Documents for LMAP BOF]

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 09 Feb 2004 14:08:38 -0500

Hallam-Baker, Phillip wrote:
>>  99.99% of the spam I get is forged.  Call me naive, but this says to
>>me that spammers believe that forgery is an important part of the
>>spamming process.
> 
> 
> The way I look at it the spammers are using the forgery to get round the
> existing filter technology and blacklists. Deny them that tool and the
> existing mechanisms become more effective.
> 
> it is a geschtalt thing.
> 

What I find problematic is that there is an existing identity in email - 
IP addresses. If blacklists are made to be more feature rich, possibly 
becoming reputation services, that might help. So I am not sure why 
going to domain identity or sender identity makes a difference. One 
compelling argument made so far is that IP owners do not care if their 
identity gets stolen, but domain owners and senders do. IF you raise the 
cost for IP owners, they will start to care.

My second problem, is that there are multiple ways to introduce sender 
identity into email. We should stop back for a second, and look at the 
problem from a bird's eye view. If we were to be designed the email 
system from scratch, how would sender identity be implemented? Would 
spam still exist in such system?

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"I ate your Web page. / Forgive me. It was juicy / And tart on my 
tongue." (MIT's 404 Message)
-------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 17 Feb 2004 10:14:59 -0500

A week ago, Yakov Shafranovich <[email-masked]> wrote:
> going to domain identity or sender identity makes a difference.

  IP addresses are short-lived, and machines at an IP are being
hijacked to send spam.  You can't have a blacklist if one IP sends 10
spam in 5 minutes, and then disappears for a week.

> One compelling argument made so far is that IP owners do not care if
> their identity gets stolen, but domain owners and senders do. IF you
> raise the cost for IP owners, they will start to care.

  It has nothing to do with identity.  It has everything to do with
accountability.  Temporary IP addresses are not accountable, and in
many cases, cannot practically be made accountable for the small
amounts of spam they send.  But there are tens of millions of such
systems, resulting in huge volumes of spam.

> spam still exist in such system?

  Personally, I wouldn't introduce sender identity.  I would introduce
long-term accountability.  I don't care who sent the message, so long
as someone is willing to take the blame when something goes wrong.  If
the accountable party doesn't stick around long enough to be held
accountable, then they're not an accountable party.

  e.g. A whitelist could state "this IP has been an MTA for a year",
and a blacklist could state "this IP sent lots of spam in the past
week".  The combination of the two will mean that most legitimate mail
from the whitelisted IP's will get through to the recipients, but
legitimate email from *non* white-listed IP's may get put into the
"maybe spam: do content filter" bucket.

  Alan DeKok.

---

From: Daniel Feenberg <[email-masked]>
Date: Tue, 17 Feb 2004 10:49:10 -0500 (EST)

> spam in 5 minutes, and then disappears for a week.

But what is the harm in leaving the IP address in the database? If
tomorrow it isn't a spammer, it is still a dynamic IP address, and I don't
want mail from that address, do I? And tomorrow its new address goes on
the list. 

The difficult decisions in refusing mail come from IP addresses that send
both spam and legitimate mail, such as major ISP mail servers. A dynamic
IP address will hardly ever be the source of legitimate mail, so it isn't
a hard decision. 

Furthermore, an individual operating an MTA on a dynamic address doesn't
have much ability to pressure you to accept his mail. He is clearly
capable of using mailertable to divert mail to you through his ISP, or he
wouldn't be able to install Sendmail in the first place. And if he brings
up confidentiality concerns, you can decide for yourself if they are
relevant. 

I am aware that many people feel that RBLs can't do a good job on hijacked
PCs, but I haven't seen a convincing explanation yet. It may be that they
haven't done a good job yet, because not all the dynamic addresses are on
the RBLs yet. But it only takes time.

---

From: Philip Miller <[email-masked]>
Date: Tue, 17 Feb 2004 23:49:36 -0500

> want mail from that address, do I? And tomorrow its new address goes on

The harm in leaving it in the database depends on the stated policies of the 
database operator. If the users of that list know that known dynamic 
addresses are being left on after they have been used and discarded, and 
still want to use it, that's fine. If users are told or assume that the 
database lists known currently-spamming addresses, then leaving dynamic 
addresses lying around would be bad.

> up confidentiality concerns, you can decide for yourself if they are

Confidentiality is not the only possible concern when dealing with ISP mail 
servers. My provider's outgoing servers occasionally experience unacceptable 
delays, and have occasionally been blacklisted. I'm here because I want to 
push forward a standard that will allow me to claim accountability for what 
my server sends, so that mail form it will be accepted, as it often isn't 
now by certain large ISPs unless I relay through my ISP's server.

> the RBLs yet. But it only takes time.

RBLs should never have to list dynamic addresses. Think about the term 
"real-time blackhole list". I doubt there are many addresses that shift 
between dynamic and static allocation, considering that that would make them 
dynamic by definition. All dynamic addresses belong not on RBL lists, unless 
they are in the middle of a spam run, but on DUL and equivalent lists.

Perhaps when we have lists of likely hijacking targets, some MTA vendor 
might implement security scanning against connecting clients to test for 
obvious signs of hijacking.

Philip Miller

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 18 Feb 2004 14:07:08 -0500

Philip Miller wrote:
>>>> What I find problematic is that there is an existing identity in 
>>>> email - IP addresses. If blacklists are made to be more feature 
>>>> rich, possibly becoming reputation services, that might help. So I 
>>>> am not sure why going to domain identity or sender identity makes a 
>>>> difference.
>>>
>>>
> The harm in leaving it in the database depends on the stated policies of 
> the database operator. If the users of that list know that known dynamic 

The same would apply for expired domains as well - if a domain blacklist 
is maintained and the domain is seized or expired, and then someone else 
registers it, the new owner will be stuck with the listing. Although 
this is less likely with domains than IP addresses.

The bottom line is that the main problem with any kind of blacklist - 
IP, domain, sender, etc. is the humans maintaining it. "Those who ignore 
history are doomed to repeat it" - if we ignore the problems with 
current IP blacklists then we will repeat the same problems with other 
kind of blacklists like domain lists.

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Power tends to corrupt, and absolute power corrupts absolutely" (Lord 
Acton)
-------