Subject: Re: [ietf-smtp] [Shutup] Proposed Charter for the "SMTP Headers Unhealthy To User Privacy" WG (fwd)

From: "John Levine" <[email-masked]>
Date: 30 Nov 2015 03:11:50 -0000

>> But, in general, that information is essential to identifying spoofed header
>> fields: it's by tracing the chain of "from" addresses in Received header
>> fields that one can determine that someone is attempting to do something
>> fraudulent.
>
>Can you cite a real-world example of a case where you did something like this recently, and explain how you were able to do what you
>claim, above, is possible using just the header fields in the message?

Spam filters have been doing Received chain analysis for about 20
years.  The principle is straightforward, the source in each header
should match the recipient in the header below it, and timestamps
should be in the right order.  There's also heuristics based on
knowing what real headers from popular mail systems should look like.

The scripts I use to send off spam complaints do header analysis to
figure out who to complain to, and not to complain to addresses in
fake headers, so I'd say I do this about 100 times a day, every day,
in addition to spamassassin doing it on every incoming message that
it filters.

If you want to look at some code, spamassassin is at
http://spamassassin.apache.org/.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 30 Nov 2015 03:23:46 -0000

>Sunday, Nov 29, 2015 1:13 PM John Levine wrote:
>> It's not even privacy vs. ops support, it's privacy issues via some
>> hints of sender's location vs. privacy issues via the recipient
>> getting spammed, phished, and malware'd.
>
>The only Received: header fields that you can trust are the ones that were added by servers in your administrative domain.

Not at all.  If you get mail from a provider you know to be
trustworthy, you can trust the headers they add.  Given that mail is
dominated by large providers, and any individual mail system tends to
exchange mail with the same people over and over, you can cover a
great deal of your mail with a modest number of sort of special cases
for providers you know.  For example, I live near Ithaca NY so I
exchange a lot of mail with Cornell, which is full of students who
never saw a malware-infested game they wouldn't install.  So it's
useful to have scripts that can look at their headers so I can tell
them who needs to be thwacked today.

>the Received: header field needs to contain is a token that can be used to backtrace the message to its origin using the logs:

Um, we have some scaling issues here.  Large providers send and
receive billions of messages a day so looking up stuff in the logs is
non-trivial.  Also, when you're trying to shut down a phish campaign,
you want to do it ideally in minutes, at worst hours, not whenever
someone can get around to pulling some log info from a distant server.

There are a lot of people on ietf-smtp familiar with large mail
systems, so perhaps it would be more productive to ask questions about
how stuff actually works.

R's,
John