Subject: Re: [Asrg] An "ideal" false positive (TMGRS take 2)

From: Rich Kulawiec <[email-masked]>
Date: Sun, 14 Feb 2010 17:47:35 -0500

On Fri, Jan 29, 2010 at 02:33:56PM +0000, Ian Eiloart wrote:
> So, does that mean that all computer mediated communication is pointless?

Of course not. But it does mean that anything originating on an
end-user system should never be used as an input to a security policy
mechanism, since The Bad Guys can either fabricate or block an
arbitrary number of such inputs as they see fit. [1]

---Rsk

[1] Within the constraint that they can only do so from those systems
which they control.  But given that the number of such systems is
already very large and still growing, and that there is no reason
at all to think that this trend will reverse or even slow down, this
constraint is not really very limiting in practice.

---

From: Steve Atkins <[email-masked]>
Date: Sun, 14 Feb 2010 15:04:51 -0800

> arbitrary number of such inputs as they see fit. [1]

You sent the email I'm replying to from an end user system, so there's an innate paradox in that statement.

Cheers,
  Steve

---

From: Michael Thomas <[email-masked]>
Date: Sun, 14 Feb 2010 15:51:44 -0800

> arbitrary number of such inputs as they see fit. [1]

Why is "security policy" different than "crown jewels"? If they own my
machine, they can tar up a svn checkout of the crown jewels and do 
immeasurably
more harm than shipping bogus anti spam reports.

That and it might be *good* for them to start trying to game AS 
reporting stuff:
if the backend started looking for those patterns, they'd probably stick 
out like a
sore thumb, and you could put the machine in the penalty box.

Mike

> _______________________________________________
> Asrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/asrg
>

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 14 Feb 2010 18:57:28 -0500

> You sent the email I'm replying to from an end user system, so there's an innate paradox in that statement.

Actually, no.  My email message is NOT an input to a security
policy mechanism.

---Rsk

---

From: der Mouse <[email-masked]>
Date: Sun, 14 Feb 2010 18:59:51 -0500 (EST)

>> You sent the email I'm replying to from an end user system, so
>> there's an innate paradox in that statement.
> Actually, no.  My email message is NOT an input to a security policy
> mechanism.

It is if people design security anything based on it.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 14 Feb 2010 19:02:34 -0500

On Sun, Feb 14, 2010 at 03:51:44PM -0800, Michael Thomas wrote:
> immeasurably more harm than shipping bogus anti spam reports.

Perhaps, but (a) that would be far more difficult to automate
(b) it might or might not serve their purposes (c) it would have
limited impact.

> reporting stuff: if the backend started looking for those patterns,
> they'd probably stick out like a sore thumb, and you could put the
> machine in the penalty box.

I'm sure that SOME of their attempts to game these would be sufficiently
heavy-handed as to stick out like a sore thumb.  I'm equally certain
that some of them would not.  Don't underestimate the enemy's intelligence,
diligence, or guile.

---Rsk

---

From: Michael Thomas <[email-masked]>
Date: Sun, 14 Feb 2010 16:16:37 -0800

> (b) it might or might not serve their purposes (c) it would have

Yeahbut, this is all about work/reward on the part of the bad guys.

> that some of them would not.  Don't underestimate the enemy's intelligence,

I'm not. That's why we need to keep some perspective about these kinds 
of things.
They could spend their time crafting a Stealth Antispam Report Bomber, 
or they could...
hack something up to steal a company's crown jewels with their army of 
owned machines.
Or any number of other things that we've not even considered. Looking 
too far down this
decision tree is perilous because while we get stovepiped into 
categories (i'm an AS d00d!)
happily lopping off all of the other threats branches since it's not our 
job, the bad guys aren't so
constrained.

 From that standpoint, you're already completely hosed if you have owned 
machines on your
net. Them gaming an AS reporting mechanism is the *least* of your worries.

Mike

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 14 Feb 2010 19:23:09 -0500

On Fri, Jan 29, 2010 at 06:59:09PM +0100, Alessandro Vesely wrote:
> >On Thu, Jan 28, 2010 at 07:04:42PM +0100, Alessandro Vesely wrote:
> >> Alice reports as spam a message from Bob, either by mistake or out
> >> of curiosity.
> >
> >But there is no way to know that Alice actually filed the report
> >or that Bob actually sent the message.
> 
> Botted users and nonsensical users would result in disputes that
> will eventually reveal their true nature.

How, exactly?

Keep in mind that botted users now constitute a significant fraction
of the Internet's total population (whether we're counting "users"
as "human beings" or "email accounts". [1])  Further, The Bad Guys who
have their hands on those 100M+ systems out there can use them,
or any other systems they have access to, to create an essentially-unlimited
number of accounts at any/all of the 10K+ freemail providers out there. [2]

So if there was some strategic reason why having billions of email
accounts, whether "real" or "fake", would provide them with an advantage:
they could make that happen with minimal effort.  They've already long
since demonstrated the ability to do this -- and to do so at rates
that vastly outpace anybody's attempt to keep up with them.

> (For the time being, let's
> discard the case that _both_ Alice and Bob are botted, with their
> bots playing funny games with one another.)

Why should we do that?  Spammers/abusers won't.  They already have
the capability to do this, and if they can somehow game the system
by doing so, *they will*.  Sure, they'll probably make some misteps,
some of which will be obvious, perhaps even laughable, but they'll
learn soon enough.  And some of them will become very good at it.

We know this because they've done it before.

*Anything* that presumes that end-user systems actually belong to
the end-users who think they own them is going to be highly susceptible
to manipulation -- and more so every day, every week, every month
that goes by.  It's only a question of whether or not the enemy
will choose to trouble themselves doing so, and I think that
if it inconveniences them or cuts into their profits, they will.

---Rsk

[1] I've been trying to estimate how mail sets of credentials have
been compromised.  If we take very conservative estimates for zombie'd
systems (100M), email accounts (5 per system) and web sites (10 per
system) we get 1.5 billion.  If we use more realistic number, we
get 5 billion.  If we go with some of higher/outlier numbers 10-20 billion.

I suppose the best that can be said is that it's clearly a large
and monotonically-increasing number.  And that nobody, anywhere,
is taking any effective action to put a stop to it.

[2] Given that there are approximately 10K freemail providers/domains,
clearly it's within the reach of spammers or other bad guys to create
enormous numbers of accounts -- should they have a reason to do so,
and obviously they do, and they have.  They use these to send spam,
to act as dropboxes for spam, to register domains, etc.; there is no
reason to think they wouldn't use them to game reporting systems and
every reason to think they would.

---

From: der Mouse <[email-masked]>
Date: Sun, 14 Feb 2010 19:58:04 -0500 (EST)

> The Bad Guys who have their hands on those 100M+ systems out there
> can use them, or any other systems they have access to, to create an
> essentially-unlimited number of accounts at any/all of the 10K+
> freemail providers out there. [2]

Quite.

This exerts pressure (in the evolutionary sense) against trusting
anything from those webmail providers.

I consider this a good thing.

It also is a reason the botnet herders (the smarter ones, at least)
will be hesitant to use that ability, because if that evolutionary
pressure gets strong enough to get "the net" to start distrusting those
webmailers more strongly and actively, the value of having that access
drops correspondingly.  They (FWVO "they") won't spend that coin unless
they believe they'll get enough value to make it worth it.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 15 Feb 2010 10:14:10 +0100

>>  will eventually reveal their true nature.

Through human interaction. That's the only way the paradox can be 
"solved".

> as "human beings" or "email accounts". [1])

Such a huge number would easily overwhelm any abuse team, unless the 
latter is equipped with tools that allow it to cope with that. The 
ability to aggregate reports cleverly has been mentioned as a useful 
requirement.

> they could make that happen with minimal effort.

One advantage is break the system in such a way that it cannot be used 
to lock them out. Discredit good users, weaken deliverability of abuse 
reports, stun abuse teams, and more DoS-style attacks could be 
attempted for that sake. However, the advantage is not immediate: 
they'd be actually attacking single mailbox providers.

> if it inconveniences them or cuts into their profits, they will.

Well, to carry that analysis thoroughly through, we must consider 
whether there is a real distinction between end-user and end-user 
system. They are both highly susceptible to manipulation. Ian has told 
appalling examples. Out of the email context, let me mention the 
current political trend in my country: the more they lie, the more 
they get elected --the way they whisper "so what", with an almost 
imperceptible head-shake, peeved by the talk-show presenter finally 
coming out with some evidence that they have been lying for most of 
the time that they have been blatantly and vehemently championing 
their own action.

Consider that we will use end-user systems for election polls, sooner 
or later. How would it make a difference whether end-users are so 
gullible to let their systems be compromised, rather than their 
brains? What we can do is to provide a means for /some/ people to get 
out of that mud. Which people and which systems, will be each mailbox 
provider's choice.

---

From: Ian Eiloart <[email-masked]>
Date: Mon, 15 Feb 2010 10:18:12 +0000

> Actually, no.  My email message is NOT an input to a security

ASRG doesn't influence security policies?

Actually, all emails that are scanned by security mechanisms, are inputs to 
that mechanism. That's especially true if the mechanism is a learning 
mechanism, like a bayesian filter with auto-learning.

So, of course, are all emails to abuse@ or postmaster@. I get surprisingly 
few of each.

You're correct, of course, to caution that automatic reporting mechanisms 
will be subject to automated poisoning. We should, of course build 
mechanisms to defend against such attacks. I'd suggest the following:

1. Reports should be submitted over an authenticated channel. If the 
mechanism is SMTP, then it needs to be ESMTPSA, or via a verified feedback 
loop supported by DKIM signatures or SPF.

These measures don't make us immune to attack, but they do raise the bar.

2. Reports should be ignored if the subject of the report can't be 
verified. That is, if an email isn't on the system AS DELIVERED, you should 
not accept a report against that email.

3. An heirarchy of possible actions should be available in response to a 
set of reports, for example (a) unsubscribing the reporter from a mailing 
list; (b) blocking delivery to the reporter's mailbox; (c) blocking 
delivery to an entire mailstore; (d) reporting up the channel; (e) 
involving official regulators; (f) calling the police.

4. The action selected should be proportionate to the confidence that one 
has in the report. Confidence might be built by aggregating reports, by out 
of channel confirmation, or by admin eyeballing the offending message. 
Client machines that we administer (on campus) might be given more 
weighting than others.

NB: Some actions - (a) and (b) - are already available to black-hats, so 
automatic reporting mechanisms are not introducing a new risk. The 
mechanism, if well implemented, will make it easier for end users to block 
senders. Of course, the mechanism might be easier for black-hats to achieve 
those particular ends, but the system could guard against by using 
out-of-channel confirmations.

Other actions, (c), (d) and (f) would require different levels of 
investigation, but if I can make it easier for end users to report spam, 
then I can focus my investigations on incidents that affect more people 
rather than incidents that affect the loudest shouters or the people 
closest to me in the organisation.

-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/

---

From: John Levine <[email-masked]>
Date: 16 Feb 2010 17:32:43 -0000

>ASRG doesn't influence security policies?

Not directly.  It's a research group.

R's,
John

---

From: John Levine <[email-masked]>
Date: 16 Feb 2010 17:32:43 -0000

R's,
John