Subject: Authentication and email

From: Gonzalo Camarillo <[email-masked]>
Date: Mon, 27 Jan 2003 16:35:04 +0200

Folks,

what happened finally with Dean's proposal of implementing security (at
least authentication and authorization) in the IETF mailing lists?

At present, IETF's SPAM filters take the From field of any incoming
message, and if the address belongs to a subscriber, they let the
message thru. However, in the last days, many SPAM messages received by
the SIPPING and SIP mailing lists tried to use real subscriber's email
addresses in the From field.

It is true that sometimes their guess is wrong. For example, today we
received a mail from "[email-masked]". If they had used
"[email-masked]" instead, the message would have passed
all our filters.

Maybe it is time to reconsider Dean's proposal, before spammers get a
little cleverer.

Gonzalo

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 27 Jan 2003 20:26:29 +0100

checking:

were those SPAM mails, or were those VIRUS mails?
we know that this has been a problem with virii, but so far, I haven't seen 
spammers using this deliberately.

                 Harald

---

From: Stephen Casner <[email-masked]>
Date: Mon, 27 Jan 2003 23:52:49 -0800 (PST)

> spammers using this deliberately.

That's been our experience on the AVT list.  We set a 25K length limit
to block the virii.

                                                        -- Steve

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 28 Jan 2003 13:52:39 +0100

--On 28. januar 2003 14:18 +0200 Gonzalo Camarillo 
<[email-masked]> wrote:

> They looked like SPAM mails to me. But in any event... does that matter?
>
> Are we going to wait until they *are* SPAM mails and they *have* email
> addresses of real subscribers before we make something?

far from it - the secretariat is testing out some antispam software even as 
we speak, and plans to make that service available to IETF-based lists.
BUT - ALL antispam software I've seen has false positives. This means that 
imposing antispam controls on mailing lists will mena that SOME postings 
that include things like LOTS OF YELLING will be delayed significantly in 
the process. (yes, the secretariat plans to do manual scanning of the 
caught spam to check for the false positives).

So it's not a free lunch.

                         Harald

---

From: Joe Macker <[email-masked]>
Date: Tue, 28 Jan 2003 10:09:25 -0500

Recent experience on the MANET list (around Atlanta timeframe) was virii also..
-joe

---

From: Stephen Casner <[email-masked]>
Date: Tue, 28 Jan 2003 09:47:03 -0800 (PST)

On Tue, 28 Jan 2003, Harald Tveit Alvestrand wrote:

> (yes, the secretariat plans to do manual scanning of the

I presume that is just for the ietf list (and others for which the
secretariat is the admin) but that wg lists would go in the mailman
hold queue like current non-subscriber mail?

                                                        -- Steve

---

From: Steve Coya <[email-masked]>
Date: Tue, 28 Jan 2003 13:54:12 -0500 (Eastern Standard Time)

I believe this will be for ALL email lists maintained at IETF.ORG

---

From: Andy Bierman <[email-masked]>
Date: Tue, 28 Jan 2003 11:26:02 -0800

>hold queue like current non-subscriber mail?

Can we change this policy slightly?
There are some emails that are so obviously SPAM, that they should
just be dropped instead of put in the hold queue.  Mail identified
to contain executables (virii) can also be dropped.

The WEB interface to manage the hold queue requires lots of 
frequent manual intervention.  In the 2 mailing lists I run,
the ratio of junk to legitimate WG mail is about 500:1.

>                                                        -- Steve

Andy

---

From: Randy Bush <[email-masked]>
Date: Tue, 28 Jan 2003 13:15:01 -0800

> I believe this will be for ALL email lists maintained at IETF.ORG

that will require ~ one fte

---

From: Gonzalo Camarillo <[email-masked]>
Date: Tue, 28 Jan 2003 14:18:02 +0200

Gonzalo

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 28 Jan 2003 04:39:39 -0500

> spammers using this deliberately.

Harald,

There definitely have been many non-virus spam messages sent out using
forgeries of one of my email addresses as the claimed source in the
From: line of the mail headers.  I have also seen non-virus spam
forgeries
using other IETF folks' mail address as the alleged source in the
From: line.

It is pretty clear that at least one spammer is using online archives
of IETF mailing lists as a place to grab From: information for their
header forgeries.  Sigh.

Ran

---

From: Gonzalo Camarillo <[email-masked]>
Date: Tue, 28 Jan 2003 17:15:58 +0200

Agreed. Having advanced anti-spam filters is great.

> So it's not a free lunch.

Well, I have to manually scan all the mails caught by the current filter
today anyway, so for me, the new filters come with no extra price.

But the issue Dean was bringing up was a different one. Just by chance,
Dean and I are attending a 3GPP-IETF workshop in San Francisco this
week, representing the SIPish working groups. We are telling those 3GPP
guys why all of their billion memory-limited terminals have to implement
S/MIME (they were quite opposed to that in the beginning), and how great
are self-signed certificates used in an SSH-like fashion... we also
explained them that if the SIP spec says that you MUST implement TLS and
S/MIME, they really MUST implement them.

And after giving them those speeches, we come back "home" to the IETF
and say that email security is undoable for our mailing lists for some
reason... it seems that MUSTs, SHOULDs and security considerations
sections do not apply to us ;o)

Gonzalo

-- 
Gonzalo Camarillo         Phone :  +358  9 299 33 71
Oy L M Ericsson Ab        Mobile:  +358 40 702 35 35
Telecom R&D               Fax   :  +358  9 299 30 52
FIN-02420 Jorvas          Email :  [email-masked]
Finland                   http://www.hut.fi/~gonzalo

---

From: "Dean Willis" <[email-masked]>
Date: Tue, 28 Jan 2003 13:07:33 -0600

> spammers using this deliberately.

I didn't look at the message. Here's the notification I got from mailman. It
LOOKS like spam, based on contect and subject.

--------------------
As list administrator, your authorization is requested for the following
mailing list posting:

    List:    [email-masked]
    From:    [email-masked]
    Subject: Eager to see you
    Reason:  Post by non-member to a members-only list

At your convenience, visit:

    https://www1.ietf.org/mailman/admindb/sip
        
to approve or deny the request.
---------------------

Incidentally, I am running a vanilla Spam Assassin configuration on my
inbox. I get about three false positives a week on legitimate SIP, SIPPING,
or sip-implementors posts, usually from real people using email relays on a
black-hole list. I'm filtering off around 300 spams a day, which is about
50% of my mail volume. 

Spammers are getting smarter, and I don't believe that heuristic detection
mechanisms are going to hold up much longer. I KNOW how to break the current
defense mechanisms we use, and that means its only a matter of time before
the spamettes figure it out too.

--
Dean

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Wed, 29 Jan 2003 14:54:57 -0800

>LOOKS like spam, based on contect and subject.

That's a virus, not spam. If you looked in the message, you would 
have seen a 132K executable payload (well, executable on some 
machines...)

--Paul Hoffman, Director
--VPN Consortium

---

From: David Mitton <[email-masked]>
Date: Thu, 30 Jan 2003 09:16:23 -0500

>of IETF mailing lists as a place to grab From: information for their

I'll point out that mailing list archives is just one place.

The RFCs and Drafts themselves also expose your email addresses in the 
Authors sections.

Dave.
---
Yes, it's happened to me too.

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Wed, 29 Jan 2003 15:02:54 -0800

>sections do not apply to us ;o)

This is an absurd argument. The security you are trying to achieve in
3GPP is completely unrelated to spam prevention.

I assume that anyone who is advocating using S/MIME or PGP for
spam-reduction has never used either protocol on a daily basis for
mail filtering. And I say this as one of the strongest public
proponents of those protocols. S/MIME and PGP are used for
authenticating the content of the messages, not for authenticating
the sender. If that doesn't make sense to you, please go read the
protocols: they're all on standards track and have been for many
years. Summaries and links to the RFCs can be found at
<http://www.imc.org/smime-pgpmime.html>.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: "James Kempf" <[email-masked]>
Date: Fri, 31 Jan 2003 09:59:50 -0800

> 3GPP is completely unrelated to spam prevention.

I would more characterize it as a category error.

IMHO, spam reduction has more to do with economics. As long as sending millions
of unsolicited emails is cheap, the arms race between spam filters and spammers
will continue.

As evidence in a similar area, compare the volume of junk mail received by
people in Europe compared to the US. Postal rates in Germany are about 3 to 5
times what they are in the US for the equivalent class and distance. My
brother-in-law, who lives in Nuerenberg, receives almost no junk mail. In
contrast, I was receiving on the average about 10 credit card solicitations a
week last fall, in addition to assorted other garbage. Over the holidays, the
volume of credit card solicitations went to zero, but it has gone back up to 3
this week.

However, I don't think there is a clean technical solution to this problem, like
"use PGP" or "use S/MIME".

                jak