Subject: RE: A spammer subscribed to this list ?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 4 Aug 2004 09:31:46 -0700

> In the early days of the asrg mailing list, there were spammers
> subscribed without any doubt. And they weren't just listening. Some
> people were trying to jam the mailing list with high bandwidth blabla
> and spreading wrong technical informations (wrong quoting of technical
> proposals and other e-mails). I'm pretty sure that some of them were
> at least related to spammers (maybe authors of spamming software).

I agree with Hadmut's analysis here. 

> So why shouldn't it be any different here? Whatever you do, expect the
> spammers to be prepared. 

I am on a number of anti-phishing mailing lists and even though they 
are by invitation only and have very highly controlled distributions
we assume that there is information leakage.

Sure the bad guys are reading. There are clearly people who are playing
both sides of the fence. We have to think in terms of the attacks that
they will attempt.

We are not designing a system here that depends on secrecy of the
design for its security.

There are mechanisms that people could in theory use to obtain a
false assurance that an email is authentic. These are known to 
involve BGP and DNS attacks that are already the subject of concern
and mitigation.

There are also means by which a message can be sent that makes it 
appear that the recipient cannot expect authentication to work 
without additional data. This is not a concern at this point since
there is no requirement to implement MARID at all and the worst 
case is no different from the status quo, the messages end up going
through spam filtering.

I am not concerned about spammers discovering this information, it
has been discussed repeatedly.

I am however concerned about spammers spreading FUD to derail the
process, and as is quite clear, it is not even necessary for the
spammer to mail to the list to do this, nor is this necessarily 
the most effective means of doing so.

Some of these guys are expert social engineers. So consider this for
an attack. You call up someone who is known for being somewhat 
obssessional on a particular issue and wind him up with a line about 
how MARID is the work of Voldemort.

Just a thought.

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 04 Aug 2004 14:59:31 -0400

"Hallam-Baker, Phillip" <[email-masked]> wrote:
> false assurance that an email is authentic.

  To change the topic slightly, while the use of MARID may ensure that
the email is authentic, that information isn't very useful.  We
already know that spammers think their email is authentic.  What *is*
useful is using MARID to find email that *isn't* authentic.

  e.g. I've talked to people who say that 90% of the SPF records they
see are from spammers.

  Why?  Because people are using SPF in conjunction with anti-spam
systems like Spamassassin, and giving *positive* scores to email which
passes SPF.  The end result is that spammers can *gain* by publishing
SPF records, as their spam is more likely to get through.

  If, instead, Spamassassin (and similar systems) were to give *zero*
additional score for a sender which passes SPF, then spammers would
have nothing to gain by publishing those records.  SPF could still be
used in conjunction with Spamassassin, to take messages which fail
SPF, and either reject them, or give them high negative scores.

  The practice of having positive scores in spamassassin for SPF
records should be strongly discouraged.  It ensures that spammers can
gain from using SPF/MARID, and contributes to the spam problem.

  To put it another way, if a site publishes SPF records, you still
have no idea whether or not you can trust email from that site.  But
you *can* decide that email which doesn't pass SPF for a site is
definitely untrustworthy.

  Alan DeKok.

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 4 Aug 2004 12:24:06 -0700

Alan,

> SPF records, as their spam is more likely to get through.

That's a very interesting point.

It means that spammers have (partly) changed their behavior and
started to use their own domains for sender addresses. 

Does anyone have examples of such domains?

regards
Hadmut

---

From: wayne <[email-masked]>
Date: Wed, 04 Aug 2004 14:44:26 -0500

> useful is using MARID to find email that *isn't* authentic.

Positive authentication is useful for whitelists.  

> SPF records, as their spam is more likely to get through.

I caught the very end of the ASRG audio session yesterday and I heard
someone giving this claim.  I think this claim is completely bogus.

First off, the current version of spamassassin doesn't check SPF
records, it is the yet-to-be-released version 3.0 that will do it.  

> SPF, and either reject them, or give them high negative scores.

That is *exactly* what Spamassassin does.  I have no idea where the
assumption that the Spamassassin folks are clueless came from.  They
understood these issues when they were participating in the SPF
mailing lists last year.

> definitely untrustworthy.

Publishing SPF records alone does not make a domain trustworthy.  It
does, however, let you safely decide whether the domain is worth
whitelisting or blacklisting.

-wayne

---

From: Rand Wacker <[email-masked]>
Date: Wed, 4 Aug 2004 13:18:40 -0700 (PDT)

> understood these issues when they were participating in the SPF

Yes, hopefully they have learned to avoid mistakes like this after the
wild swing in scores (first positive then negative) to things like Habeus
and (unverified) PGP signatures.

-Rand

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 4 Aug 2004 22:48:25 +0200

On Wed, Aug 04, 2004 at 02:59:31PM -0400,
 Alan DeKok <[email-masked]> wrote 
 a message of 36 lines which said:

> records should be strongly discouraged.

Wether MARID encourage or discourages it will make no
difference. Scores of the various tests in SpamAssassin are not
determined by an human trying to guess wether "sex" should be more an
indication of spam than "viagra", or less. Scores are determined by
using the actual tests against a corpus of spam and a corpus of
ham. See http://wiki.apache.org/spamassassin/HowScoresAreAssigned.

So, scores do not depend (too much) on human opinion or
prejudice. Wether SPF "pass" is a good spam marker or not will be
determined automatically.

Do note that, at the present time, the scores of all SPF-related tests
are very low (probably reflecting the small number of SPF-enabled
domains). See http://spamassassin.apache.org/tests.html and search for
SPF.

---

From: "Douglas Otis" <[email-masked]>
Date: Wed, 4 Aug 2004 14:10:31 -0700 (PDT)

> Positive authentication is useful for whitelists.
...
> understood these issues when they were participating in the SPF
...
> whitelisting or blacklisting.

Do not expect Sender-ID to ever allow blacklisting.  Sender-ID is too
complex and relies upon the security of mail channel which does not exist.
 The Sender-ID records contain a series of possible domains, and the PRA
allows for the evaluation of less recent headers. Where the message had
emerged remains unknown.  If to blacklist a domain, it must be verified
where the mail was sent.  The point behind this type of negative listing
is to improve policies related to access.  As many domains may share an
MTA server, the only policy enforcement that makes sense is the ISP
forcing use of this MTA.  Any other downstream domain could claim to be
one of these Sender-ID identities.  Sender-ID makes assumptions that are
not valid, if this is used to blacklist.

-Doug

---

From: Graham Murray <[email-masked]>
Date: Thu, 05 Aug 2004 08:14:51 +0100

>   e.g. I've talked to people who say that 90% of the SPF records they

That is certainly not what I am seeing here. Granted it is only a
small sample (as I do not keep spam for long) and as I use SPF on the
MTA I do not see SPF Fail (as they are refused). In my spam folder at
the moment, I have

SPF Pass        0
SPF None        203
SPF Neutral     5
SPF Soft-Fail   6
SPF Unknown     4

---

From: Michel Bouissou <[email-masked]>
Date: Thu, 5 Aug 2004 12:29:56 +0200

Le jeudi 5 Août 2004 09:14, Graham Murray a écrit :
> That is certainly not what I am seeing here.

To advance the discussion with some real-life example, you will find below the 
list of domains for which my (relatively low-traffic) personal server has 
received a "MAIL FROM:" in the last days (for any kind of messages, either 
legitimate or spam or forged), and that DO have an SPF record.

Some of these domains are known spamming domains. Others obviously look like 
spammer throwaway domains. But many are also perfectly legitimate domains.

The funny thing is that I've seen many "obvious spams from spamming domains" 
being rejected with an SPF FAIL. Which means that spammers have set-up SPF 
records that do not correspond to the machines from which they send or 
forward. Thus they are shooting themselves in the foot ;-)

I've noticed that *many* times, I saw rejections of "SPF failing spam-domains" 
come by batches of 3 or 4, in the same minute or so. In such cases, most of 
these actually show the same SPF record.

The SPF record thay usually shows for these is:
yesanother.com text "v=spf1 ip4:216.65.64.1/24 ip4:216.65.3.1/24 
a:send1.surgeweb.com mx -all"

An example of such a "batch of 3 or 4" is:

Aug  4 19:41:44 reject: RCPT from unknown[80.253.1.54]:
550 <[email-masked]>: Sender address rejected: Violation SPF: [...]
from=<[email-masked]> helo=<intelsat.ru>

Aug  4 19:41:58 reject: RCPT from intelsat.ru[80.253.1.52]:
550 <[email-masked]>: Sender address rejected: Violation SPF: [...]
from=<[email-masked]> helo=<intelsat.ru>

Aug  4 19:42:43 reject: RCPT from atlas.aquitaine.iufm.fr[195.220.161.3]:
550 <[email-masked]>: Sender address rejected: Violation SPF: [...]
from=<[email-masked]> helo=<atlas.aquitaine.iufm.fr>

Aug  4 19:44:33 reject: RCPT from mail.probit.wroc.pl[81.219.229.100]:
550 <[email-masked]>: Sender address rejected: Violation SPF: [...]
from=<[email-masked]> helo=<mail.probit.wroc.pl>

Now for the list of SPF-enabled domains MAIL FROM: that my personal server has 
seen in the last days. Make your own mind about which of these are 
legitimate, and which are spammers' ;-)

121mailoffers.com
121mailoffers.net
126.com
12.com
12inch.com
163.com
1cooloffers.com
573dls.com
abso-bloody-lutely.com
abv.bg
access-one.com
ac-montpellier.fr
acsinc.net
adelphia.net
adlikon.ch
alsation.com
altn.com
another.com
antihunt.com
aol.com
arboi.fr.eu.org
arsenal-fanatic.com
arvelh.com
asiacontent.com
aspware.net
bellatlantic.net
bellsouth.net
bigbgns.com
bloody-minded.com
bluebell.saar.de
blueyonder.co.uk
bol.com.br
bugzilla.spamassassin.org
carteblache.com
c.dk
charente.de
club-internet.fr
comedycottage.com
csoft.bg
dailydiscounts121.com
dartmail.net
dbc.mtview.ca.us
did-the-earth-move.com
dieboerse.de
dlznstlz.com
DNSreport.com
duo.quattro.co.za
e123discounts.com
earthlink.net
edailydiscounts.com
edt02.net
email.ro
erldls.com
eskimo.com
faberoonie.com
flashmail.com
froffers.com
garlic.com
gc.net
getgrtdeals.com
getronics.com
gmail.com
gmx.at
gmx.net
google.com
gorillanation.studiostore.com
grtdeals.com
handinhand.co.uk
hushmail.com
idcj.com
iet.hist.no
ilikeaeroplanejelly.com
i-love-ayr.com
iloveswindon.com
inbox.ru
incredimail.com
interia.pl
irislink.com
ism.com.br
iwantanother.com
kendra.com
kolumbus.fi
leaveitwithme.com
listbox.com
list.ru
lists.sourceforge.net
mail.com
mail.ru
mediascape.de
mycooloffers.com
narod.ru
nass.com.au
nastypieceofwork.com
nessus.org
nls.net
nordnet.fr
nytimes.com
ourcooloffers.com
paregos.se
petersen.mail.dk
playingcupid.com
pobox.com
pop.com.br
puk.ac.za
real.com
regularflow.com
reply.mb00.net
rldls.com
rog.de
sergeant.org
seznam.cz
skymail.fr
snark.thyrsus.com
snogtastic.com
soter.com.br
speed.net
symantec.com
testmail.com
theonering.net
trans-it.de
tv2lorry.dk
unicode.org
uol.com.br
uptodata.com
usbank-email.com
v2.listbox.com
verizon.net
vip.163.com
weezing-fan.com
wonderware.com
world-foundation.org
xmailserver.com
xyzdeals.com
yandex.ru
yeah.net
yesanother.com
zipmail.com.br
zzapp.org

-- 
Michel Bouissou <[email-masked]> OpenPGP ID 0xDDE8AC6E

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 05 Aug 2004 11:58:10 -0400

wayne <[email-masked]> wrote:
> assumption that the Spamassassin folks are clueless came from.

  My comments were about the people using spamassassin, who can, and
do, edit their rule database.

  I haven't looked at Spamassassin to see how it interacts with SPF,
or what recommendations it makes for user-edited rule databases & SPF.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 05 Aug 2004 12:11:37 -0400

> ham. See http://wiki.apache.org/spamassassin/HowScoresAreAssigned.

  I am saying that we know a-priori, that giving positive marks to
messages which pass SPF checks is not a good idea.

  Your statement also appears to contradict Wayne's assertion about
Spamassassin.

> domains). See http://spamassassin.apache.org/tests.html and search for

  Which has a "-0.001" for SPF_PASS, or marking the message as somehow
"better" for passing SPF.

  While this score is low enough to not effect much, I think it should
be forced to zero, otherwise spammers will *gain* by publishing
MARID-style records.  If the neural net method is still used, I'll bet
that the score for SPF_PASS won't get significantly far from zero, for
the reasons I outlined previously.

  Passing MARID checks is *no* indication of whether or not the
message is spam.  And if, as we've seen, spammers publish lots of
MARID records, then there's a non-zero chance that a neural net may
decide there's a correlation between spam & MARID records, which means
MARID won't be as useful for everyone else.

  Alan DeKok.

---

From: Michel Bouissou <[email-masked]>
Date: Thu, 5 Aug 2004 18:37:53 +0200

Le jeudi 5 Août 2004 18:11, Alan DeKok a écrit :
> be forced to zero

Practically speaking, -0.001 is equivalent to zero. The difference is that if 
you use zero, the SPF tests may be skipped alltogether (usualy when a test 
score is zero, SA bypasses performing it), and if it is -0.001 the test will 
be performed and its result may be reflected into SA added mail headers 
(depending upon configuration).

So -0.001 doesn't change anything for the actual scoring of the message except 
that it allows having the SPF results added to the message headers.

---

From: "Eric A. Hall" <[email-masked]>
Date: Thu, 05 Aug 2004 13:14:24 -0400

>   While this score is low enough to not effect much, I think it should

I haven't looked at this particular ruleset yet, but a score of zero
usually means "don't run the test"

But "pass" truly is meaningless, so not bothering with that specific test
does make some sense.

"fail" is the only hard result that means anything.

---

From: wayne <[email-masked]>
Date: Thu, 05 Aug 2004 13:09:44 -0500

>   Your statement also appears to contradict Wayne's assertion about

In Spamassassin, the more postivie the score, the more spammy the
message was found.  Giving a positive score for a pass from SPF is not
a good idea because an SPF pass is neither a sign of spam nor ham.
Failing an SPF check is a spam sign according to their genetic
alogrithm. 

Stephane's statements do not controdict mine, other than I didn't
correct your confusion over negative vs positive scores.  Stephane
explained *how* Spamassassin comes up with their numbers, I just
mentioned the result.

> "better" for passing SPF.

As others have pointed out, this has no real effect, it only means
that the results gets put into the headers.

-wayne

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 05 Aug 2004 14:52:42 -0400

Michel Bouissou <[email-masked]> wrote:
> Practically speaking, -0.001 is equivalent to zero.

  I had stated as much.

> The difference is that if you use zero, the SPF tests may be skipped
> alltogether (usualy when a test score is zero, SA bypasses
> performing it),

  Hmm... the scores are overloaded with additional, non-score
information.  I can see why they did that, but it then requires things
like "scores of epsilon", or -0.001, in order to get "zero", without
it's other effects.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 05 Aug 2004 15:04:10 -0400

wayne <[email-masked]> wrote:
> message was found.

  I understand.  My comments were about other anti-spam systems, too.
The intention was to describe the "spamminess" of a message, so
positive scores are positive indications of spam.  I should probably
have used the word "benefit" rather than "score", but I can't keep
track of which system uses what vocabulary.

  For implementation reasons, Spamassassin has chosen to invert the
"score", so "ham" is given negative scores.  It amounts to the same
thing, with different vocabulary.

> Stephane explained *how* Spamassassin comes up with their numbers, I
> just mentioned the result.

  My point then, as now, is that passing SPF or MARID checks means
*nothing* about the "spam" or "ham" nature of a message.  Any
anti-spam system should give *zero* additional benefit to messages
which pass those checks.  If those systems choose to implement zero as
a small negative number, that's their business.

  Having spamassassin use a neural net to determine the score for
SPF_PASS is wrong.  We *know* what the value is, from an analysis of
the system.

> that the results gets put into the headers.

  That's an implementation decision for Spamassassin.  My comments
about scoring were completely independent of reporting of that score.

  Alan DeKok.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 6 Aug 2004 14:57:57 +0200

On Thu, Aug 05, 2004 at 12:11:37PM -0400,
 Alan DeKok <[email-masked]> wrote 

> messages which pass SPF checks is not a good idea.

Such analysis are always dangerous ("We all know that spams are in
text/html only") and this is exactly why SpamAssassin switched to an
automatically-generated list of scores. It leaves less room to
personal opinions.
 
> And if, as we've seen, spammers publish lots of MARID records, then
> there's a non-zero chance that a neural net may decide there's a
> correlation between spam & MARID records, which means MARID won't be
> as useful for everyone else.

If the neural net decides so, fine with me. It's exactly for a similar
reason that SpamAssassin decided that "This mail is not spam" was a
good marker for spams...

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 06 Aug 2004 11:10:36 -0400

Stephane Bortzmeyer <[email-masked]> wrote:
> text/html only")

  That's not a good analogy.  We *know* SPF_PASS says nothing about
whether a message is spam or not.  We *know* SPF_FAIl says that the
domain publishing SPF has not authorized the message.

> If the neural net decides so, fine with me.

  Assigning negative spamassassin scores to SPF_PASS means that
spammers can benefit from using SPF.  Assigning positive spamassassin
scores to SPF_PASS means that non-spam will get punished for using
SPF.

  We want neither to happen, therefore anti-spam systems should assign
no benefit, and no penalty, for publishing MARID-style records.  If
you want to allow neural-net systems to assign scores, then you're OK
with either, or both, of the two scenarios from the preceding
paragraph.

  Alan DeKok.