Subject: Re: [EAI] Re: other thought about <eai@address <ascii@address>>

From: Soobok Lee <[email-masked]>
Date: Tue, 13 Feb 2007 08:40:36 +0900

>
>--On Monday, 12 February, 2007 23:46 +0900 Soobok Lee
><lsb at lsb.org> wrote:
>
>> This is another well-known example using BIDI control RLO
>>    (U+202E,right-to-left override). I applied this into 
>>    utf8-local-part.
>> 
>>    From: (RLO)dlt.mitciv at evil1.tld
>> 
>
>Anyone who permits <RLO> in an email address had better
>understand what he or she is doing and what the implications of
>it might be.  

In the case that the owner of evil1.tld is the attacker himself,
he/she might have understood that well, in order to exploit it for 
unlawful phishing purpose.

This WG and I  regard  current permissive rule on utf8-local-part
as "feature" and a design choice from good intents, but phishers 
might regard that as exploitable "security hole".

> We aren't going to be able to help avoid the mess
>that could cause without writing global rules about the use of
>Unicode and what characters can appear in local-parts, and we
>have agreed to not do that.   My own opinion is that it would be
>as stupid to insert such a character as it would be to insert
>X'0E' or (X'18' X'28') at the beginning of an ASCII local-part.
>One can do it, but the capability has been there all along and
>no one who is sensible and trying to get mail sent and delivered
>takes advantage of it.

For other cases, I agree with you.

Soobok

_______________________________________________
IMA mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ima

---

From: John C Klensin <[email-masked]>
Date: Tue, 13 Feb 2007 13:53:53 -0500

--On Tuesday, 13 February, 2007 08:40 +0900 Soobok Lee
<[email-masked]> wrote:

>> understand what he or she is doing and what the implications
>> of it might be.  
> 
> In the case that the owner of evil1.tld is the attacker
> himself, he/she might have understood that well, in order to
> exploit it for  unlawful phishing purpose.
> 
> This WG and I  regard  current permissive rule on
> utf8-local-part as "feature" and a design choice from good
> intents, but phishers  might regard that as exploitable
> "security hole".

Sure.

>> have agreed to not do that.   My own opinion is that it would
>> be as stupid to insert such a character as it would be to
>> insert X'0E' or (X'18' X'28') at the beginning of an ASCII
>> local-part. One can do it, but the capability has been there
>> all along and no one who is sensible and trying to get mail
>> sent and delivered takes advantage of it.
> 

But that was the point of mentioning the ASCII control
characters that are often used for code-table-shifting.  While
they are permitted in local parts on the wire, almost every
self-respecting MUA will go beyond the "wire" standard, either
imposing special quoting or simply deleting them before
transmitting or presenting the message.  The result is that a
phishing technique based on the use of such characters becomes
fairly ineffective.  I would assume we would see the same
behavior with formatting code points in Unicode.  One could
write a document explicitly suggesting such things if one wanted
to, but it is not part of this WG's task to generate, or even
review, such a thing (i.e., please don't turn this into another
long and distracting discussion on the WG mailing list).

     john

---

From: Soobok Lee <[email-masked]>
Date: Thu, 15 Feb 2007 13:36:13 +0900

On Tue, Feb 13, 2007 at 01:53:53PM -0500, John C Klensin wrote:
> they are permitted in local parts on the wire, 

SI/SO/ESC escaping sequences are permitted in quoted-form local-part
like "any_chars"@evil1.tld under RFC2822. Quoted display-name and 
comment can contain such strings as well.  

Such code-table-shifting based attacks are restricted by code tables and 
surrounding quotations marks. Forged email addresses using them will look 
so bizarre, so easily detected by end users.
 
But, that RLO (and <>'s NFKC-equivalents) examples do not change 
end user's default code table to achieve elaborate impersonations of 
arbitrary email domain name origins.

> almost every
> behavior with formatting code points in Unicode.  

> One could

Is there any active WG that can accept such topic  other than this WG?
As you know, IDNA and IDNA-update are very strict about permitted
Unicode characters in domain name parts of EAI email addresses. 
If they contain RLO, they will be rejected and return errors to users.

BTW, I am curious when idna-update list will be a formal WG.

Soobok

---

From: Harald Alvestrand <[email-masked]>
Date: Thu, 15 Feb 2007 07:12:34 +0100

> so bizarre, so easily detected by end users.
There used to be a fairly well known ESC hack for VT100 terminals that 
would reprogram a softkey on the terminal and trigger it - effectively 
forcing the terminal to send a text string defined by the attacker to 
the computer if the string was displayed.
For instance "rm -rf /".

Applications usually don't "display" ESC, and for good reason.