Subject: [Asrg] rfc honeypot-in-addressbook technique

From: Andy Dawson <[email-masked]>
Date: Fri, 25 Mar 2011 15:41:14 +0100

Hi,

l don't know if this is an appropriate list, or if I'm about to present an
old/un-viable idea. for both of these points i apologize in advance.

As a gmail user, i am almost imune to spam/phishing mails. however,
everytime someone in my addressbook infects their computer with malware, i
receive spam, as it comes from an authorized account which i 'trust', and
are obviously sent to all contacts available to the compromised account.
Most of the mails i receive in this way come from unsavvy relatives -
contacts i dont want to simply delete.

Thinking about the process used to succesfully send these mails, i arrived
at the following what if:

What if, before the sender's email account had been compromised, they had
added "any alias" [email-masked] to their contact list. had they
done so as soon as their account was abused, the following could
automatically be determined :

- an email accout which has been compromise
- the content and headers of a spam message
- a spam/phishing site
- the ip of a malware-infected machine.

For each of these points, action could be taken, in addition to updating
spam detection mechanisms, stopping scam-sites before they afect many users,
or even auto-blocking affected email accounts.

Before wasting effort where others have gone before, is there any milage in
this idea?

Regards,

Andy Dawson
(Web Developer)

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 25 Mar 2011 11:37:22 -0400

On 3/25/2011 10:41 AM, Andy Dawson wrote:

> Before wasting effort where others have gone before, is there any milage
> in this idea?

There may be some work you could do in this area, but I think you have 
to develop the idea a bit better in terms of achievable goals and 
practicality before expending too much effort on it.

Years ago we implemented something like this in our global address list, 
so that we could detect if someone in the company got infected and 
started spewing.  Many other organizations undoubtedly did the same.

But the days of those types of viruses is _long_ past (predates even 
Netsky/Bagel etc).  I think those addresses are still there, but I don't 
think they've raised an alarm in the better part of a decade.  Viruses 
just don't do that no more.

You could consider the "compromise of gmail/yahoo/aol... accounts" as a 
new type of something that behaves the same way.  It can be a technque 
for sites to find out when someone has leaked their address books 
counter to policy.  But...

Consider - not necessarily as parts of a technique, but helping you 
steer it:

- traction - how likely are people to voluntarily put such addresses in 
their address books?  Not enough to matter.  Broader solutions are needed
- noise - how are you going to distinguish infestations versus users 
deliberately blasting their entire address book?
- results - what are you going to do when you find one?
- identifiability - you need to be able to figure out _who_ got 
infected, even if you don't have tracing information or even a useable 
From:.
- survivability - how do you prevent the malicious from evading it?  The 
honeypot addresses can't be too obvious.

---

From: "John Levine" <[email-masked]>
Date: 25 Mar 2011 15:43:58 -0000

>deliberately blasting their entire address book?

I'd be particularly worried about noise, since so many people seem
willing to let the social network du jour scrape their address book
and blast out invites to everyone.  That seems pretty spammy to me,
but I suspect many of the people who do it would disagree.

R's,
John