Subject: RE: [ietf-dkim] New Issue: 4.2 needs new Attack Item: InconsistentSignature vs Policy Attacks

From: <[email-masked]>
Date: Tue, 31 Jan 2006 12:36:45 -0500

The hacker does not need access to my zone, he just attaches a lookalike
header yes " And to have *any* rule that allows bypass of defense
based upon the receipt of a header from outside your control is
extremely dangerous." But folks will do it anyway

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: Michael Thomas [mailto:[email-masked]] 
Sent: Tuesday, January 31, 2006 12:08 PM
To: Oxley, Bill (CCI-Atlanta)
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [ietf-dkim] New Issue: 4.2 needs new Attack Item:
InconsistentSignature vs Policy Attacks

[email-masked] wrote:
> If I do not publish any key records and a bad actor whips up an email
> purported to be from me with a fake signature attached, a non dkim
> compliant mta may have a rule that states "signed messages are
probably
> okay" that might bypass some spam checking software. Before DKIM is
> fully adopted/deployed expect to see this happen,

Unless the attacker also has access to your zone, they won't
be able to insert their key into it, and thus the signature will
never verify. And to have *any* rule that allows bypass of defense
based upon the receipt of a header from outside your control is
extremely dangerous. It would be nothing better than a 
security-through-obscurity backdoor.

		Mike

_______________________________________________
ietf-dkim mailing list
http://dkim.org

---

From: Dave Crocker <[email-masked]>
Date: Tue, 31 Jan 2006 09:48:33 -0800

Bill,

> extremely dangerous." But folks will do it anyway

By "lookalike" do you mean social engineering with a related name string, such 
as citibank.com vs. c1t1bank.com, or do you mean something else.

If something else, please elaborate.

On the other hand, if you mean the name confusion thing, I would guess that that 
is entirely out of the scope for this working group, since it really pertains to 
reputation mechanisms, associations between domain names and brands, etc.

d/
-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>
_______________________________________________
ietf-dkim mailing list
http://dkim.org