Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al)

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Sun, 18 Apr 2004 14:54:47 -0400

Violently snipped; see interleaved comments

On Sun, 18 Apr 2004 10:49:02 -0500, [email-masked] wrote:
>I'm going to combine my comments regarding several related posts on this thread.
>snip
>Once you identify the "real" machine where the transmission occurred, more 
>likely than not it will turn out to be a zombie-infected spambot.  So you get to 
>throw bricks at a fellow victim. 

No, not a fellow victim; a negligent abuse-enabler

>snip
>Perhaps it is, although it's hard to define "a bulk email event".  

This discussion on-point

>
>Rather than making mail filters poll a central site (these have in the past been 
>victimized by DDOS attacks), maybe one approach here might be to set up a 
>Yahoogroup that could be used to rapidly distribute these "disreputable domain 
>names" and IP addresses along with a utility which would add them to the 
>recipients' HOSTS files (and from there, to their incoming mail filters).
>
>> Just today, I was at a friends office and my outgoing email was blocked 
>because cliff.concentric.net is now on a spam list.
>
>Yes, and that's one of the problems with SPF, "authenticated users", 
>certificates and other such schemes.  Ultimately it's not very helpful to throw 
>rocks at fellow victims.
>
>[snip]
>
>>>   I mail-server I use regularly (Indiana University) has taken, in 
>>>response to worms and other malware useing .pif. zip, exe, etc 
>>>attachments to spread their damage, has taken the (IMO) rather drastic 
>>>step of blocking almost *all* attachments ...
>
>That's sort of the approach of Microsoft's new version of Outlook, where they 
>allow blocking by attachment extension.  That's better than nothing, but it 
>needs to be SOMEWHAT finer:  it needs to allow the recipient to enable specific 
>attachment types (and certain classes of HTML markup) to be received from 
>specific approved-and-trusted senders.
>
>>>  Coincidentally, another list I'm on had a post from the admin of a
>>local university, talking about spam.  Here's what he said.
>>
>>(quote)
>>   I don't support any Windows systems, yet I seem to spend a huge amount
>>of time dealing with problems relating to Windows non-security.  During the
>>fall/winter term we had to deal with
>>
>>   1) When students returned to Residence in September, at least half of
>>      their machines were infected.
>
>One of my colleagues recently dealt with a client whose system was "having 
>assorted problems".  Upon installing Spybot-Search-and-Destroy over TWO HUNDRED 
>instances of spyware were found on the unwitting user's computer.  There were 
>additional Spyware programs that SPYBOT S&D did NOT find, besides.

You have to use Bazooka and Adaware besides.>One of the things that has been 
SINGULARLY unhelpful toward addressing the 
>problem of overloaded mail servers is this plague of HTML-burdened "alternative" 
>copies of E-mail messages.  It is rare indeed that these provide genuinely 
>valuable additional content;  instead they usually are loaded with gratuitous 
>graphic gizmos, Web bugs, possibly malicious scripting, misrepresented clickable 
>links, and text-as-image designed to evade content filters.  While I'll accept 
>that some folks can argue that their needs for HTML-burdened E-mail is 
>legitimate, certainly a lot of it is not.  Mail with HTML-burdened attachments 
>is typically 3x-5x larger than it would be as plain ASCII text.
>
>If HTML-burdened attachments were removed from non-whitelisted senders' E-mail 
>(and this would catch at least most of today's spam) then such mail would be 
>70-85% smaller in volume than it is today.  

This is all documented.  It needs to be a new standard.  Feel free to
point offenders to <http://www.camblab.com/nugget/htmlmail.pdf>
(or send it to them)

>
>I don't want to see any solutions that result in some "authority" deciding what 
>one can and cannot send. 

Right, only community consensus should be applied.   It is doable.

The whole discussion needs to be recast from "make the victims pay by
coming up with solutions (filtering etc)" to "make the offenders pay".
The only way to do that is to refuse mail from spam-enablers.  It fixes
the problem immediately.  Again: <http://www.camblab.com/misc/univ_std.txt).

Spam would stop worldwide within DAYS if most of us, instead of whining
and coming up with impractical technical or legal 'solutions', would 
agree to do on the Internet what society does in every other field 
of human activity: ensure that actions have consequences.  It is THAT
SIMPLE.  (Any parent knows.)

Jeffrey Race

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Devdas Bhagat <[email-masked]>
Date: Mon, 19 Apr 2004 01:04:59 +0530

On 18/04/04 14:54 -0400, Dr. Jeffrey Race wrote:
<snip>
> >recipients' HOSTS files (and from there, to their incoming mail filters).

This approach has been proposed previously on net.admin.net-abuse.email.
You will need a way to verify that the data is correct. Suggestions were
PGP/GPG signing the message.
Quite a few DNSBLs already allow access to the raw zonefiles via rsync.
It should be fairly easy to convert that data into a format usable by
the local DNS server.

<snip>
[reformatted line wrap]
> You have to use Bazooka and Adaware besides.
> > One of the things that has been SINGULARLY unhelpful toward addressing the 
> > problem of overloaded mail servers is this plague of HTML-burdened 
> > "alternative" copies of E-mail messages.  It is rare indeed that these 
> > provide genuinely valuable additional content;  instead they usually are
> > loaded with gratuitous graphic gizmos, Web bugs, possibly malicious 
> > scripting, misrepresented clickable links, and text-as-image designed 
> > to evade content filters.  While I'll accept that some folks can argue
> > that their needs for HTML-burdened E-mail is legitimate, certainly a
> > lot of it is not.  Mail with HTML-burdened attachments 
> > If HTML-burdened attachments were removed from non-whitelisted senders' 
> > E-mail (and this would catch at least most of today's spam) then such
> > mail would be 70-85% smaller in volume than it is today.  
Isn't modifying mail in transit bad?

> > I don't want to see any solutions that result in some "authority" deciding
> > what one can and cannot send. 
> 
I do agree with this point. However, the business community does not
want to agree to that standard. They would rather pay for a lot of spam
rather than possibly lose a single email. And until businesses
understand that blocking the spam enablers makes sense, this is not
going to happen.

> SIMPLE.  (Any parent knows.)
Consequences to whom? Sender identification methods attempt to identify
the sender so that appropriate measures can be taken against the sender.
Blocking based on DNSBLs stops supposedly spam supporting senders.

For most users, the need is to stop the spam without blocking legitimate
mail from the same host. This is what drives the concept of filtering
over using a DNSBL.

Devdas Bhagat

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 19 Apr 2004 12:40:23 -0400

> It should be fairly easy to convert that data into a format usable by

There has been talk about many DNSBL operators about a P2P distribution 
system or perhaps even using an existing P2P system such as FreeNet. 
Lack of commong protocols is a bit of a problem.

> mail from the same host. This is what drives the concept of filtering

Collateral damage is an issue. Another issue is the fact that blocking 
is not communicated to the sender in many cases but the messages are 
swallowed silently. As for community-based systems, rule of the mob is 
not always good.

I am not saying this approach is bad, rather it has issues that must be 
worked out. If all of these issues are taken into account, such system 
may very well do a lot of good.

For example, if there are standards for communications among ISPs and 
networks for both blocking and abuse reporting, this can improve things 
a lot. If the issue of colleteral damage is taken into account, it can 
help. If DNSBLs are run properly and accountable to the community, it 
will increase their accuracy. If community based systems can account for 
a possibility of someone subverting the system ("rule of the mob") they 
can become more widespread.

At this time it seems that senders and receivers will be asked to 
exchange credentials when sending email and matched against their 
reputation in third party databases. This can benefit from standards.

Yakov

---

From: "Chris" <[email-masked]>
Date: Tue, 20 Apr 2004 13:37:30 +0930

> No, not a fellow victim; a negligent abuse-enabler

No Not "a negligent abuse-enabler"

Simply a user of Microsoft windows

But don't be fooled if M$ fixes their game, nix derivatives will fall foul
of such problems. spammers and hackers always take the path of least
resistance which is currently windows.

Regards
Chris

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Dr.
> Jeffrey Race
> Sent: Monday, 19 April 2004 4:25 AM
> To: [email-masked]
> Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments
> for SMTP? (Lane Sharman et al)
>
>
> the problem immediately.  Again:
> <http://www.camblab.com/misc/univ_std.txt).
>

---

From: der Mouse <[email-masked]>
Date: Tue, 20 Apr 2004 07:28:37 -0400 (EDT)

> Simply a user of Microsoft windows

What's the difference?

That's rather flip, but I'm basically serious: except for a very few
people who are good enough to lock down their Windows - so few as to be
statistically ignorable - I see the second set as a subset of the
first.  Running software from a company with a long history of
producing grossly insecure software, in a security-critical function
(like the operating system!), on a known-hostile net, _is_ being a
negligent abuse-enabler.

> But don't be fooled if M$ fixes their game, nix derivatives will fall
> foul of such problems.

Less so, I believe.  It is significantly harder, if onjly because the
Unix world is much less monocultural.

> spammers and hackers always take the path of least resistance which
> is currently windows.

Spammers generally do, yes.  Hackers often don't; it's fairly common
for a hacker faced with an uninteresting problem to generalize it
enough to make it interesting, solve the new (and significantly harder)
problem, and thereby solve the original problem as a special case.
This is hardly the path of least resistance.  Also, many hackers have a
rather compelling sense of aesthetics, and want a solution that they
consider aesthetic, even if it is a good deal more work.  For example,
this is why I'm writing my own ssh implementation.  (This aspect of the
hacker personality may be somewhat off-topic, though, as its only
relevance to spam I can see involves building anti-spam software.)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B