Subject: Re: [Asrg] 1a. Inventory of Problems - Spoofed mail addresses

From: Brett Watson <[email-masked]>
Date: Thu, 5 Feb 2004 13:53:45 +1100

(Subject changed in an attempt to conform to posting guidelines. I think the 
subject under discussion -- mail sent from A to B at the request of third 
party C -- falls under section 1a.)

Alan DeKok wrote:
>  Is it really that difficult for your local browser to copy the web
> page, and send it?

Seth Breidbart responded:
> Difficult?  No.  Copyright violation?  Yes.

To which I say:
How much sympathy are we due to offer in cases where the obstacle is 
self-imposed? Arbitrary publication X probably offers a "mail this item to a 
friend" service in preference to simply authorising you to do the same on the 
basis that the former alternative gives them greater data about who is 
getting their articles. Theoretically, it reveals to publication X the email 
addresses of two readers: a sender, and a person that the sender thinks is an 
interested party. Assuming that the sender isn't abusing the facility, that 
is.

The major problem with this kind of third party mail request is that it does 
not fit with any viable proposed method of sender authorisation. The only 
viable practice that I can envisage involves the publication using its own 
address as the envelope-sender address, and the "Sender:" address in the 
message. The "From:" address in the message can be set to the address used by 
the person requesting the mailing. If the transmission is blocked due to 
policy constraints at the recipient's end, then that's just tough luck. If 
failure to verify the veracity of data entered in such a web-form results in 
widespread abuse and consequent blacklisting of the publication's mail 
servers, then that's par for the course.

I guess I'm proposing a BCP, really. It goes like this:

Scenario: party A sends mail to party B at the request of party C. Example: 
Chris wants publisher Aardvarks.example.com to mail an article to Bob. The 
subsequent mail transaction has Aardvarks.example.com as the SMTP-sender, and 
Bob's mail server as the SMTP-receiver. "MAIL From:" is given as a 
bounce-handling address at Aardvarks.example.com (possibly utilising VERP), 
which allows an LMAP-like system to bless the use of the given address. This 
would not be possible if Chris' address were used at this point. "RCPT To:" 
is given as Bob's address. In the message itself, "Sender:" is an appropriate 
Aardvarks.example.com address, "From:" is Chris' address, and "To:" is Bob's 
address. If the message is refused for any reason, the bounce-handler at 
Aardvarks.example.com is in a position to notify Chris of this failure via 
email.

It is the responsibility of Aardvarks.example.com to make sure that all 
potential abuse vectors in this system are minimised, since it bears the risk 
of blacklisting if third parties attempt to use it as a weapon of abuse. I 
won't engage in a comprehensive review of potential abuse vectors here. I do 
note that the use of Aardvarks.example.com as a "MAIL From:" address closes 
one potential abuse path, since there is no possibility that a bounce will be 
directed at an innocent third party. Contrast this with the case where "MAIL 
From:" is the address provided in the web-form.

Regards,
TFBW

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Za'mbori, Zolta'n" <[email-masked]>
Date: Thu, 05 Feb 2004 20:56:23 +0100

> Aardvarks.example.com is in a position to notify Chris of this failure via 

IMHO there are no 100% solution to this situation. (Other than the 
copy-paste "solution".)

If Aardvarks.example.com will be the MAIL FROM than MTA doing white-list 
filtering at the SMTP level will refuse this email even the white-list 
contains the email address of Bob.

If Bob's address will be the MAIL FROM than MTA with transport path 
enforcing filter will refuse the email.

If both Aardvarks.example.com and Bob are in the MAIL FROM: (source 
route notation) then non RFC compliant MTAs will refuse or mishandle the 
email.

z2

---

From: George Schlossnagle <[email-masked]>
Date: Thu, 5 Feb 2004 16:29:44 -0500

On Feb 5, 2004, at 2:56 PM, Za'mbori, Zolta'n wrote:

> Brett Watson wrote:
>> Scenario: party A sends mail to party B at the request of party C. 
>> Example: Chris wants publisher Aardvarks.example.com to mail an 
>> article to Bob. The subsequent mail transaction has 
>> Aardvarks.example.com as the SMTP-sender, and Bob's mail server as 
>> the SMTP-receiver. "MAIL From:" is given as a bounce-handling address 
>> at Aardvarks.example.com (possibly utilising VERP), which allows an 
>> LMAP-like system to bless the use of the given address. This would 
>> not be possible if Chris' address were used at this point. "RCPT To:" 
>> is given as Bob's address. In the message itself, "Sender:" is an 
>> appropriate Aardvarks.example.com address, "From:" is Chris' address, 
>> and "To:" is Bob's address. If the message is refused for any reason, 
>> the bounce-handler at Aardvarks.example.com is in a position to 
>> notify Chris of this failure via email.
>
> If Aardvarks.example.com will be the MAIL FROM than MTA doing 
> white-list filtering at the SMTP level will refuse this email even the 
> white-list contains the email address of Bob.

Whitelisting based on the MAIL FROM: is faulty at best - the 
forgability of that information is why this discussion is occuring at 
all.  In this situation, Aardvarks has no business or compelling 
interesting in putting Bob's address in the MAIL FROM:.  Bob is not the 
agent sending the mail, Aardvarks is.  Compelling reasons for Aardvarks 
to use their own address as the MAIL FROM: include:

a) they actually sent it
b) if Bill lied (intentionally or otherwise) about being Bob, now 
Aardvarks will be the one contacted, and they can correct their 
behavior.
c) Aardvarks stays in the loop of how their resources are being used.

// George Schlossnagle
// Postal Engine -- http://www.postalengine.com/
// Ecelerity: fastest MTA on earth

---

From: "Chris" <[email-masked]>
Date: Fri, 6 Feb 2004 14:55:10 +1030

Just a note on third party sending

from what I read some people seem to think its an aberration and not the
norm

It is quite the norm for some large websites

eg: Ebay

ebay cust 1 sends email to ebay cust 2 requesting details of auction item

for privacy reasons they don't simply give out email addresses
So ebay posts the mail using the from address as ebay cust 1

therefore ebay cust 2 can reply to ebay cust 1 directly

this is in effect a spoofed return address

Many "contact" based websites use this method

Nothing these websites do is wrong, they just take advantage of the way the
system was designed

Solutions?

There really isn't one except to insist that ebay et al routes all messages
AND replies through its server(s)
I am sure this is not something they would want to do

You *could* use the "From" field for ebay and the "ReplyTo" field for cust 1
but that would break many clients because as far as I am aware many ignore
this field and use the "From" field as the reply address

Hence they would reply to the wrong address eg ebay's sending address which
probably simply bounces mail

Regards
Chris

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Brett
> Watson
> Sent: Thursday, February 05, 2004 1:24 PM
> To: [email-masked]
> Subject: Re: [Asrg] 1a. Inventory of Problems - Spoofed mail addresses
>
>
> appropriate

---

From: Seth Breidbart <[email-masked]>
Date: Fri, 6 Feb 2004 00:42:31 -0500 (EST)

> You *could* use the "From" field for ebay and the "ReplyTo" field
> for cust 1 but that would break many clients because as far as I am
> aware many ignore this field and use the "From" field as the reply
> address

Then the client is already broken.  That's its users' problem.

Seth

---

From: Brett Watson <[email-masked]>
Date: Fri, 6 Feb 2004 19:17:43 +1100

> this is in effect a spoofed return address

At the risk of being patronising, I need to point out that this is *not* what 
we would call "spoofing". Here are the ABCs of email addressing.

There are two areas where email addresses are used: the "envelope", and the 
"message headers". The "envelope" is that part which is negotiated in SMTP 
using the "MAIL From:" and "RCPT To:" commands. The "message headers" are 
that part of the message (transmitted in the DATA phase of SMTP) which 
specify the message metadata, including certain address specifications, like 
"From:", "To:", "Cc:", "Sender:", "Return-Path:", and various others. The 
"message headers" are what the mail user gets to see, since the envelope data 
is not transmitted in POP or IMAP.

"Spoofed mail addresses" refer specifically to the "MAIL From:" part of the 
envelope. This is what LMAP-like proposals endeavour to validate. The "MAIL 
From:" address is the one that a bounce should be directed to in the case of 
a delivery failure part way through the relaying process. All the addresses 
in the "message header" can also be fabricated at whim by the sender (and are 
usually false in the case of spam or viruses). I don't know of any proposals 
to validate these header fields.

Please note that there does not need to be *any* relationship between the 
envelope addresses and the "From:", "To:", and "Cc:" headers -- not even when 
standards are followed to the letter. In the case of the eBay example, eBay 
is quite at liberty (protocol-wise) to send mail in which the "From:" header 
is an eBay customer's address, while the "MAIL From:" envelope address is an 
eBay address.

Regards,
TFBW

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 08 Feb 2004 06:22:52 -0500

> this is in effect a spoofed return address

  No.  Ebay is creating email accounts owned by Ebay, and managed by
ebay.  This has nothing to do with email spoofing.

> Solutions?

  There is no problem, so there is no solution needed.

  Alan DeKok.