Subject: Spam to WG Lists

From: Brian Haberman <[email-masked]>
Date: Tue, 28 Mar 2006 10:04:31 -0500

I know I am re-opening discussions that we have had before, but I have
seen several cases now where spam has been sent to WG mailing lists
forged from one of the chairs e-mail address.  Most likely, the 
perpetrator
culled both the list address and the chair's address off the WG web page
(or the e-mail archive).  This had led to having to put the chair's 
address
in moderate mode in Mailman.

Have we reached the point where we need to look at augmenting Mailman
with the ability to process digitally signed e-mails (at least from 
those addresses
that appear prominently within the WG)?  Can we move towards PGP
signature checks on list posts?  It seems like a small price to pay to 
stay
ahead of the problem.

Go ahead, flame away. :)

Brian

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Tue, 28 Mar 2006 10:39:59 -0500

So far Megaco has been relatively free of this. My co-administrator put 
in controls to catch a specific mailer years ago, but I'm not clear on 
the details. I have a moderate bit on subscribers from Upperside, 
because they are constantly advertising conferences that have nothing to 
do with Megaco. I did the same thing to the one or two recruiters who 
joined the list, but they were hit-and-run cases and eventually 
unsubscribed.

Brian Haberman wrote:
> forged from one of the chairs e-mail address.  Most likely, the perpetrator
> (or the e-mail archive).  This had led to having to put the chair's address
> signature checks on list posts?  It seems like a small price to pay to stay
> ahead of the problem.
> 
> Go ahead, flame away. :)
> 
> Brian

---

From: Fred Baker <[email-masked]>
Date: Tue, 28 Mar 2006 08:16:48 -0800

I'd actually suggest that we use the technology under development in  
DKIM. You'll note that this note is signed. What is required is that  
either the MUA or the first MTA sign the message saying "I know who  
my user is", and for receiving systems to check for the signature.  
Lack of a signature doesn't mean "it's a bad guy", but it can be  
interpreted to trigger a policy. As *our* rule, we could have the  
IETF machine check the signatures and moderate messages that don't  
carry them - and perhaps drop messages that have bad ones.

On Mar 28, 2006, at 7:04 AM, Brian Haberman wrote:
> I know I am re-opening discussions that we have had before, but I  
> have seen several cases now where spam has been sent to WG mailing  
> lists forged from one of the chairs e-mail address.  Most likely,  
> the perpetrator culled both the list address and the chair's  
> address off the WG web page (or the e-mail archive).  This had led  
> to having to put the chair's address in moderate mode in Mailman.
>
> Have we reached the point where we need to look at augmenting  
> Mailman with the ability to process digitally signed e-mails (at  
> least from those addresses that appear prominently within the WG)?   
> Can we move towards PGP signature checks on list posts?  It seems  
> like a small price to pay to stay ahead of the problem.
>
> Go ahead, flame away. :)
>
> Brian

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 28 Mar 2006 09:41:56 -0800

>carry them - and perhaps drop messages that have bad ones.

We might want to wait until DKIM is a standard; there is still a lot 
of argument about what the various semantics mean, particularly with 
respect to mailing lists.

--Paul Hoffman, Director
--VPN Consortium

---

From: Brian Haberman <[email-masked]>
Date: Tue, 28 Mar 2006 14:40:04 -0500

> respect to mailing lists.

If DKIM needs to work out these semantics, is it worth asking the tools 
team to look into augmenting Mailman with some PGP capabilities?

Regards,
Brian

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 28 Mar 2006 12:01:55 -0800

> forged from one of the chairs e-mail address.  

As a workaround to that specific problem, could we require that 
posts from certain subscribers (such as chairs) have a magic cookie 
in the first line of the message or in the subject?  That cookie 
could be stripped off prior to submission.  Failing to include the
cookie would cause the post to be held by mailman using mailman's
normal you-aren't-subscribed-to-the-list behavior.  Just a 
thought.

-d

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 28 Mar 2006 12:01:57 -0800

> respect to mailing lists.

The policy requiring a DKIM signature would be checked prior to 
posting the message to the mailing list.  So even if DKIM was 
completely messed up about mailing lists, I don't see the harm
in creating a policy that "all messages arriving into IETF lists
must be DKIM signed".  While I am fully aware that DKIM intends
on preserving such signatures, it's reasonable for us to strip
them when the messages are posted to get around the immediate
problem that has been reported.

-d

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 28 Mar 2006 15:10:43 -0500

> problem that has been reported.
I suspect we need to wait until more MUAs or MTAs support DKIM.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 28 Mar 2006 12:59:56 -0800

> I suspect we need to wait until more MUAs or MTAs support DKIM.

There's always gmail and yahoo.com which both appear interested
in supporting it quickly.  If nothing else, it would help 
authenticate posts from WG chairs, which is a useful first 
step for IETF mailing lists.

-d

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 28 Mar 2006 16:12:57 -0500

> step for IETF mailing lists.

Some of us have *major* objections to those two services.  Just why is
off-topic, but it isn't reasonable to require WG participants or chairs
to subscribe to them.

I suspect that for now, a plaintext magic cookie *in the body of the
message, to avoid MUA issues* will suffice.  I don't think that the
IETF lists are being targeted specifically by the spammers.

---

From: Ignacio Goyret <[email-masked]>
Date: Tue, 28 Mar 2006 13:18:15 -0800

>IETF lists are being targeted specifically by the spammers.

Particularly if each person can configure its own cookie (aka password)

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 28 Mar 2006 13:25:22 -0800

> off-topic, but it isn't reasonable to require WG participants 
> or chairs to subscribe to them.

Understood.  I expect that I share many of those objections.

-d

---

From: Fred Baker <[email-masked]>
Date: Tue, 28 Mar 2006 13:48:17 -0800

It hasn't been particularly hard for us to put into the (I believe  
linux-based) MTA that we use. Aren't you proposing a chicken/egg  
thing - we can't deploy it to test it by eating our own dogfood  
because nobody else has deployed it, and they won't deploy it  
because...?

---

From: Tony Hansen <[email-masked]>
Date: Tue, 28 Mar 2006 17:11:23 -0500

Unfortunately, the dkim spec *is* in a state of flux. There are several
issues to be decided still, as well as how much backwards compatibility
will be preserved with pre-WG work, what the Authentication-Results
header looks like and how it is to be used, and recommendations in how
mailing lists should work with the signatures. I'd wait at least one
more rev of the base dkim spec before starting to use it seriously.

Once we do, then it can definitely be used to vet the authenticated
sending domains against the list of subscribers' domains.

	Tony Hansen
	[email-masked]

Fred Baker wrote:
> linux-based) MTA that we use. Aren't you proposing a chicken/egg thing -
> we can't deploy it to test it by eating our own dogfood because nobody
> else has deployed it, and they won't deploy it because...?
>

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 28 Mar 2006 17:13:50 -0500

> because nobody else has deployed it, and they won't deploy it  
I could probably add it to my environment, too.  I'm also atypical,
since I run my own machines, use open source software, and know how to
do such things.  Most people can't do those things, or they work for an
organization that isn't willing to tinker with their mailer to install
anything not vendor-supported.

I think experimentation is great.  I wouldn't mind at all something
that checked a DKIM signature and used it to bypass the subscriber-only
rules for our mailing lists.  But I don't think it reasonable to
require compliance to something that isn't even an RFC to be able to
participate in the IETF.

---

From: Ted Hardie <[email-masked]>
Date: Tue, 28 Mar 2006 14:56:05 -0800

>sending domains against the list of subscribers' domains.

I think a better first use here is for us to publish our records, so
that folks who see our mailing list traffic can see if it helps
distinguish IETF ham from purported-IETF spam.  I would want
much more work to go in before we go to using DKIM to reject
domains sending *us* mail.  As it stands, we have a strong commitment
to openness that can easily get tangled into that--we cannot now require
that DKIM records be present before we accept mail (as many folks
who may have technical things to say to us have no say in their mail
infrastructure).    Flagging it to list administrators is, of course, an
interim step which may be useful in advance of that.
			regards,
				Ted Hardie

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 28 Mar 2006 15:47:14 -0800

I don't believe anyone has suggested blocking posts from anybody.  Rather,
it's a matter of deciding which posts are posted immediately and which are
moderated.  Most IETF lists are configured to allow subscribers to post
without moderation, and non-subscribers are moderated.  DKIM or the magic
cookie wouldn't change this, they would just provide additional
authentication beyond the From: address matching that is done with today's
mailman.

Regarding the magic cookie:  I looked more at Mailman documentation.  IETF
is running Mailman 2.1.5, which already supports an "Approved:" header as
well as "Approved:" on the first line of  a message.  This would contain the
list's administrative password.  This seems about as useful as web-based
moderation; the risk is that if a chair does a reply-all and inserts
"Approved: <password>" as the first line of their message, it'll be stripped
by mailman but of course the other recipients of the message will now know
the administrative password for that mailing list.

-d

> -----Original Message-----
> From: Ted Hardie [mailto:[email-masked]] 
> Sent: Tuesday, March 28, 2006 2:56 PM
> To: Tony Hansen; Working Group Chairs
> Subject: Re: Spam to WG Lists
>

---

From: Tony Hansen <[email-masked]>
Date: Tue, 28 Mar 2006 18:52:39 -0500

Having a DKIM signature will not, in and of itself, let you bypass the
subscriber-only rules for mailing lists. It's a building block that
provides *strong* verification of the identity of the sending system.

Case #1: Gmail is adding a DomainKeys signature (the DKIM predecessor)
to mail sent by any of its subscribers today. At some point they will
convert to using DKIM-Signature headers. Anyone can get a gmail account,
including spammers. Are you going to let mail into the mailing list from
a gmail user just because it has a signature?

Case #2: Spammers can and do spoof From: headers. Right now, anyone can
send email to [email-masked] by spoofing my email address. DKIM can
and will help prevent that. But it still must be combined with the
subscriber list or some other sort of list to do that.

	Tony Hansen
	[email-masked]

---

From: Fred Baker <[email-masked]>
Date: Tue, 28 Mar 2006 16:27:38 -0800

On Mar 28, 2006, at 2:13 PM, Steven M. Bellovin wrote:

> I wouldn't mind at all something

That's what I was suggesting.

---

From: Peter Koch <[email-masked]>
Date: Wed, 29 Mar 2006 00:08:50 +0200

> because nobody else has deployed it, and they won't deploy it  

the wg has some decisions to make. Eating the dog food is good, but we'd
have to choose the cup and that might be premature either way.

-Peter

---

From: Dean Willis <[email-masked]>
Date: Wed, 29 Mar 2006 12:06:49 -0600

> in moderate mode in Mailman.

I actually unsubscribed from the sip-implementors list because of the  
large volume of spam forging my source identity.

> signature checks on list posts?  It seems like a small price to pay  

I've been advocating such an approach for years.

--
Dean