Subject: [domainrep] scope question - what apps?

From: Stephen Farrell <[email-masked]>
Date: Mon, 09 Aug 2010 21:19:24 +0100

I think I asked this in Maastricht, but worth doing on
the list: for what applications are we considering
communicating reputation related information?

I assume email is scope, but what else? (If anything.)

S.

---

From: Tony Hansen <[email-masked]>
Date: Mon, 09 Aug 2010 16:22:19 -0400

start with email and see if it gets traction? (I could see possible 
application in sip, sms, http.)

     Tony Hansen

---

From: Paul Ferguson <[email-masked]>
Date: Mon, 9 Aug 2010 16:54:10 -0700

That's an interesting perspective.

With regards to Internet security, that is debatable.

For example, we have both an IP reputation system for e-mail, but a domain
& web reputation system based on when/how/if we have seem malicious content
on a particular domain (and calculate an applicable score accordingly),
thus allowing administrators to set their own thresholds for blocking.

I am I correct in assuming that the scope of "reputation" has not been
determined yet?

Thanks,

- - ferg

-- 
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

---

From: Nathaniel Borenstein <[email-masked]>
Date: Tue, 10 Aug 2010 08:12:25 -0400

How, if at all, should a domain's reputation differ for different protocols?

It seems to me that if a domain has been compromised or demonstrated to be antisocial in one context, it is highly likely to be equally untrustworthy in other contexts as well.  If that's the case, reputation is very nearly protocol-independent.

I certainly believe we should start out focused on email, but we shouldn't rule out the possibility that there's very little that will differ from protocol to protocol, and we should try to avoid being unnecessarily email-specific.  -- Nathaniel

On Aug 9, 2010, at 4:22 PM, Tony Hansen wrote:

> start with email and see if it gets traction? (I could see possible application in sip, sms, http.)
> 
>  Tony Hansen
> 
> _______________________________________________
> domainrep mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/domainrep

---

From: SM <[email-masked]>
Date: Tue, 10 Aug 2010 07:55:25 -0700

At 05:12 10-08-10, Nathaniel Borenstein wrote:
>It seems to me that if a domain has been compromised or demonstrated 
>to be antisocial in one context, it is highly likely to be equally 
>untrustworthy in other contexts as well.  If that's the case, 
>reputation is very nearly protocol-independent.

It's difficult to get people to agree on whether a domain is 
antisocial or not.  A domain may be used to provide more than one 
service.  The domain reputation is generally assessed  for a protocol 
and used as input for the service provided.

Reputation can be protocol-independent if promiscuity is protocol-independent.

Regards,
-sm

---

From: Douglas Otis <[email-masked]>
Date: Tue, 10 Aug 2010 09:19:17 -0700

On 8/10/10 5:12 AM, Nathaniel Borenstein wrote:
> I certainly believe we should start out focused on email, but we shouldn't rule out the possibility that there's very little that will differ from protocol to protocol, and we should try to avoid being unnecessarily email-specific.
Nathaniel,

A domain would not be what is compromised, unless perhaps their DNS is.

A server carrying a message on behalf of a domain might be compromised, 
or it could be used by the domain's marketing department in an ad 
campaign using a poorly vetted list of email addresses.  Such activity 
may not affect other protocols.  When a system is compromised, it often 
is not limited to exploiting a specific domain or protocol, where 
blocking a particular domain often will have a very short term impact 
measured in hours.

While a large portion of spam is emitted by compromised systems, the 
presence of spam does not also equate to the domain having been 
compromised.  If such a measure of being compromised were used, then 
nearly all major providers would be judged as compromised, due to the 
level of spam being emitted by their customers through their main servers.

Unlike a scheme that attempts to identify the specific system when using 
IP addresses or server certificates, using a domain as an identifier is 
far more complex, and far more disruptive when assessed incorrectly.

Swapping domain names for IP addresses will not provide the benefit of 
better isolating compromised systems.  This difference should be 
reflected in taking greater care in how a domain name is obtained,  how 
the domain was authenticated, and the protocol being used.

-Doug

---

From: Paul Ferguson <[email-masked]>
Date: Tue, 10 Aug 2010 10:24:16 -0700

On Tue, Aug 10, 2010 at 9:19 AM, Douglas Otis <[email-masked]> wrote:

>> It seems to me that if a domain has been compromised or demonstrated to
>> be antisocial in one context, it is highly likely to be equally
>> untrustworthy in other contexts as well.  If that's the case, reputation
>> is very nearly protocol-independent.
>>
>> I certainly believe we should start out focused on email, but we
>> shouldn't rule out the possibility that there's very little that will
>> differ from protocol to protocol, and we should try to avoid being
>> unnecessarily
>> email-specific.
>
> Nathaniel,
>

Hi Doug,

What about 100% malicious domains? There are literally *thousands* of
domains that have been created by criminals which have no "legitimate"
content, but rather booby-trapped with exploits, malware, etc.

In fact, there is entire industry (Black Hat SEO) dedicated to drive
traffic (read: unwitting victims) to these domains...

- - ferg

---

From: Douglas Otis <[email-masked]>
Date: Tue, 10 Aug 2010 12:12:30 -0700

On 8/10/10 10:24 AM, Paul Ferguson wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Tue, Aug 10, 2010 at 9:19 AM, Douglas Otis<[email-masked]>  wrote:
>
Paul,

Email represents a store and forward service, where no system directly 
involved in the distribution of malware or phishing may have been 
compromised, or the domain identifiers used actually originate from the 
administrative domain.  Taking a simple view should still strive to 
understand what is an authentic source,  and what represents a 
compromised system.  When it comes to email and domains, email is 
significantly different from other direct services.

Some domains are indeed being used extensively for illicit purposes.  
But an illicit domain being used as desired by the domain owner has not 
been compromised.  As you suggest, these often deal with no legitimate 
traffic.  Another point that might be made is that reputation for such 
domains often arrives too late.

There might be a compromised server within some large enterprise, would 
you then suggest their entire domain is compromised?  Google's safe 
browser protocol in open source browsers is clearly aimed at addressing 
phishing and the distribution of malware using http without always 
impacting an entire domain.

When discussing reputation, email is different as it often represents a 
mixture of sources.  Some are from compromised systems that also have a 
legitimate purpose,  where owners of the compromised systems should be 
notified.  In addition, the distribution of malware in email does not 
mean a providers outbound servers have been compromised.  I was 
attempting to underscore the importance of understanding what it means 
to have authenticated the domain.

In my first message to this list, I said:
.---
Irrespective of whether a service attempts to make positive or negative 
assertions, domain reputation, with a possible exception of malicious 
content, must relate to the administrative domain running the server and 
issuing the message.  The fundamental criteria for deciding whether a 
message is abusive relates to whether recipients receive a reasonable 
level of benefit over that of the sender.  In other words, where the 
message is sent is often more significant than actual content, unless of 
course the content is blatantly abusive.
'---

-Doug

---

From: Paul Ferguson <[email-masked]>
Date: Tue, 10 Aug 2010 12:18:58 -0700

The issue for me here is, if you're talking about e-mail *only*, than I can
certainly agree that it is worth examination of a way to "authenticate" a
domain -- however, I can certainly image domains which could be
"authenticated" which still send undesirable traffic (e.g. spam, malware,
money mule scams, etc.), and there is already a plethora of solutions in
the market to address these issues.

Having said that, the issue of "domain reputation" is a tricky one *when
not applicable* to e-mail, and this is where the concept is most
interesting to me.

That is also why I would like to see this discussion focus more on the
scope of "domain reputation" -- I don't think limiting this concept to
e-mail is actually a big step forward, IMO.

$.02,

- - ferg

> Some domains are indeed being used extensively for illicit purposes.  But
> an illicit domain being used as desired by the domain owner has not been
> compromised.  As you suggest, these often deal with no legitimate
> traffic.
>  Another point that might be made is that reputation for such domains
> often arrives too late.
>
> browser
> protocol in open source browsers is clearly aimed at addressing phishing
> and the distribution of malware using http without always impacting an
> entire domain.
>
> attempting to
> underscore the importance of understanding what it means to have
> authenticated the domain.
>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 10 Aug 2010 13:30:37 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Paul Ferguson
> Sent: Tuesday, August 10, 2010 12:19 PM
> To: Douglas Otis
> Cc: [email-masked]
> Subject: Re: [domainrep] scope question - what apps?
> 

I agree, and that's why I think there may well be a variety of different domain reputation vendors: email signers, web URLs, etc.  I think we should try to cater to all of those by staying as generic as possible.

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 12 Aug 2010 12:35:54 +0200

Douglas Otis wrote:
>>>> untrustworthy in other contexts as well.

Many services authenticate users based on their email addresses.  For 
example, someone can open an account at gmail, use it to subscribe to a wiki 
web site, and then spam that wiki.  I'm not sure whether Nathaniel means this 
kind of antisocial behavior.  What should gmail do?

>>> A domain would not be what is compromised, unless perhaps their DNS is.

If email addresses are considered "domain citizenship", granting accounts 
anonymously, with no vetting whatsoever, should probably affect a domain's 
reputation.

>> What about 100% malicious domains?
> 
> When it comes to email and domains, email is significantly different from
> other direct services.

I think Doug is talking about typical mailbox providers.  They can have "bad" 
users, compromised users, and abuse teams.  Email marketers, MLMs, and other 
relays can also have users or customers on whose behalf the domain acts. 
This is where email is different.

> been compromised.  As you suggest, these often deal with no legitimate 

Right, and that traffic can be said to originate directly from the admins, 
not from the domain's users.

> Another point that might be made is that reputation for such domains often
> arrives too late.

That point only makes sense for negative reputation.

IMHO, the reputation of a domain is their ability in countering abuse.  Is 
their abuse team efficient and effective?

Perhaps, some domains would accept responsibility for what their users do, 
even for activities not directly related with the ability to send mail 
through the domain's MSA.  It looks an intricate policy issue to me.  At any 
rate, classifying domains according to how they grant new accounts may be an 
appealing task.

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 12 Aug 2010 12:24:13 -0600

On 8/12/10 4:35 AM, Alessandro Vesely wrote:
> example, someone can open an account at gmail, use it to subscribe to a
> wiki web site, and then spam that wiki.  I'm not sure whether Nathaniel
> means this kind of antisocial behavior.  What should gmail do?
> 
> If email addresses are considered "domain citizenship", granting
> accounts anonymously, with no vetting whatsoever, should probably affect
> a domain's reputation.
> 
> I think Doug is talking about typical mailbox providers.  They can have
> "bad" users, compromised users, and abuse teams.  Email marketers, MLMs,
> and other relays can also have users or customers on whose behalf the
> domain acts. This is where email is different.
> 
>> But an illicit domain being used as desired by the domain owner has
>> not been compromised.  As you suggest, these often deal with no
>> legitimate traffic.
> 
> Right, and that traffic can be said to originate directly from the
> admins, not from the domain's users.
> 
>> often
> IMHO, the reputation of a domain is their ability in countering abuse. 
> Is their abuse team efficient and effective?
> 
> Perhaps, some domains would accept responsibility for what their users
> do, even for activities not directly related with the ability to send
> mail through the domain's MSA.  It looks an intricate policy issue to
> me.  At any rate, classifying domains according to how they grant new
> accounts may be an appealing task.

For email services at a domain, yes. This is why I think the right level
is the application service, such as email, IM, or VoIP, because the
dimensions along which to measure a domain vary by application. For
example, in the XMPP community we've sketched out some factors that make
sense for us but probably don't make sense for email providers:

http://xmpp.org/extensions/xep-0275.html

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 13 Aug 2010 12:35:51 +0200

Peter Saint-Andre wrote:
>> Many services authenticate users based on their email addresses.
>> [...]
> dimensions along which to measure a domain vary by application.

Along that line, for HTTP, admin-edited content may be considered differently 
than users' blogs.

There is a positive range when reputation measures a domain's ability at 
controlling their users.

> For example, in the XMPP community we've sketched out some factors that
> make sense for us but probably don't make sense for email providers:
> 

What is named "Server Reputation" in that document, may well be called 
"Domain Reputation" in this list's context.  I think that sketch is a good 
example of how reputation can be measured.  Of course, some criteria are 
application specific.  The score is set up so as to suggest that scores in, say,

   domain._chat._rep.scorekeeper.example

are added (or have to be added by the client) to the generic

   domain._rep.scorekeeper.example.

As a minor point, I'd prefer logarithmic scales.  For example, there is no 
substantial difference between seven and six years of online service, while 
the difference between one and zero is very relevant.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Fri, 13 Aug 2010 07:14:04 -0400

On Aug 12, 2010, at 6:35 AM, Alessandro Vesely wrote:

> Many services authenticate users based on their email addresses.  For example, someone can open an account at gmail, use it to subscribe to a wiki web site, and then spam that wiki.  I'm not sure whether Nathaniel means this kind of antisocial behavior.  What should gmail do?

It's not what I was thinking of, but it's another good example.  I just doubt that, over the long term, we'll be able to maintain the notion of different reputations in different contexts for a single domain/IP address/email address.  If you knew that something had a bad reputation in one context, and no reputation in another context, mightn't the former reputation be better than nothing in the latter context?

On the other hand, the bad guys might use a combined reputation system to do good things in one context to offset the negative reputation from the context in which they are making mischief.  

Perhaps instead of talking about reputations for each service, we should think about generic reputations with details about the kinds of negative information they're based on?   As in "Reputation = 3.1/100; abuse-types: phishing=7,spam=325,double-parking=1"  (Oh, goody, another registry.)  We might also worry about representing the recency of the bad events, too.  This is complex stuff, and I'm not sure we can (or should) reduce it to a really simple score. -- Nathaniel

---

From: "J.D. Falk" <[email-masked]>
Date: Fri, 13 Aug 2010 12:38:24 -0700

> It's not what I was thinking of, but it's another good example.  I just doubt that, over the long term, we'll be able to maintain the notion of different reputations in different contexts for a sin…

We've seen that in a few cases already, the most common example being use of email dnsbls to block irc or http traffic.  The CBL specifically mentions this in their terms and conditions:

"If you want to use the CBL to block protocols other than SMTP on port 25 (ie: IRC), realize this is officially UNSUPPORTED by the CBL team.

We appreciate that this is a useful thing to do, but you MUST NOT mention the CBL as being the source of a block and you should be prepared to provide "first contact" assistance for users encountering a block and potentially whitelisting on your service.

It should be absolutely clear that there will be a potentially large number of affected users who, through no fault of their own, will NOT be able to delist due to NAT, dynamic IPs, or other similar issues. Anyone using the CBL for blocking IRC, blog comments or whatever needs to know that they will get collateral damage and they will either have to manage that themselves with whitelisting or live with it."

http://cbl.abuseat.org/tandc.html

So the context isn't just a nice-to-have; it may be something the reputation provider feels is absolutely necessary.

> Perhaps instead of talking about reputations for each service, we should think about generic reputations with details about the kinds of negative information they're based on?   As in "Reputation = 3.1/100; abuse-types: phishing=7,spam=325,double-parking=1"  (Oh, goody, another registry.)  We might also worry about representing the recency of the bad events, too.  This is complex stuff, and I'm not sure we can (or should) reduce it to a really simple score. 

Could work.  Another axis I've seen is sometimes called "certainty," and includes some measure of recency along with the general reliability of particular data sources.

But in practice, I haven't come across any reputation clients who do their own math in real time based on these multiple axes.  They just want to know whether or not to accept the message, or the connection.  Everything else is left in the secret sauce realm.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Sun, 15 Aug 2010 11:51:58 -0400

> But in practice, I haven't come across any reputation clients who do their own math in real time based on these multiple axes.  They just want to know whether or not to accept the message, or the c…

This is a really good point.  Most users would prefer a binary answer.  The only ones I can think of who want more info are those who explicitly want to take in reputation data from multiple sources, which means they're aggregating data in order increase their confidence level or to resell it.  I don't think even they really need a whole lot of fine grain distinctions, simply heterogeneous conclusions to hedge their best with multiple authorities -- the more different the secret sauces, the better.

If those are the real clients for open reputation information exchange, we could make this vastly simpler.   A single integer from 1 to 100 might suffice.   Vendors could have vastly more complex systems internally, but a couple digits of precision could be plenty for the needs of the aggregators, who are basically hedging against systemic errors rather than doing fine-grained re-analysis.  -- Nathaniel

---

From: John Levine <[email-masked]>
Date: 15 Aug 2010 18:48:31 -0000

>This is a really good point.  Most users would prefer a binary
>answer.  The only ones I can think of who want more info are those
>who explicitly want to take in reputation data from multiple sources,
>which means they're aggregating data in order increase their
>confidence level or to resell it.

Well, there's always Spamassassin, which can mix just about anything into
the score.

R's,
John

---

From: Nathaniel Borenstein <[email-masked]>
Date: Mon, 16 Aug 2010 06:06:15 -0400

> Well, there's always Spamassassin, which can mix just about anything into

Sure, that's my first category ("want to in reputation data from multiple sources").  Spamassassin and its ilk can in fact be configured to compute scores based on degrees of precision that aren't really meaningful.   I'm not sure at what point increased precision becomes a confusion of precision with accuracy, but I doubt it does much harm.  So I guess my preference is a scheme that allows plenty of precision, but acknowledges that most consumption of the scores will only look at the most significant digit or two.  -- Nathaniel