Subject: [Asrg] DCC and IP checksums

From: "David F. Skoll" <[email-masked]>
Date: Mon, 10 Mar 2003 11:04:22 -0500 (EST)

From: Hadmut Danisch <[email-masked]>

> In other words: How much can messages differ to still get the same
> hash and what's the minimum difference that guarantees a different
> hash?

It doesn't matter.

ANY checksum scheme can be defeated, and usually very easily (unless
the checksum is useless for practical message distinction.)  It's
trivial to create N messages with arbitrarily-large Hamming (or
"spamming") distance.  Even without knowing the details of the
checksum algorithm, a few simple black-box experiments will probably
reveal its weakness.  If you know the algorithm, it's even easier.

That doesn't mean checksums are useless; on the contrary.  It is a
worthwhile cause to block spam from unsophisticated spammers.  Just
because we know we'll never completely stop determined spammers, it
doesn't mean we should give up on the low-hanging fruit.

The best we can hope for is to increase the hassle of spamming.  Every
extra hoop a spammer has to jump through means a certain percentage of
spammers will simply give up (or else fail because of lack of
hoop-jumping.)

--
David.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 10 Mar 2003 17:34:05 +0100

> doesn't mean we should give up on the low-hanging fruit.

Some years ago, hackers used to be highly sophisticated experts.
Meanwhile, the majority of attacks are driven by silly script kiddies
using high sophisticated tools without understanding what's going on.

Reading some of the spams I receive I found that many of them seem
to be sent with the very same software and address list. There are
billions of spam, but only a few spamming tools. All it takes is just
a simple software upgrade to the next version of the tools to defeat
that hash method. Once spammers learn how to do it, all spammers will
know how to do it. There is not significant number of "low-hanging
fruit".

Hadmut

---

From: wayne <[email-masked]>
Date: 10 Mar 2003 11:02:40 -0600

> know how to do it. There is not significant number of "low-hanging

Are spammers really more likely to upgrade software than people who
run anti-spam software?

-wayne

---

From: "David F. Skoll" <[email-masked]>
Date: Mon, 10 Mar 2003 12:16:18 -0500 (EST)

On Mon, 10 Mar 2003, Hadmut Danisch wrote:

> that hash method.

Right; it's an arms race.  The ways to fight back are:

1) Change your hash method every so often, as recommended on
http://www.rhyolite.com/anti-spam/dcc/

"The fuzzy checksum will need to be changed as spam evolves"

2) Don't all use the same checksum.  As Vernon wrote, you can use
multiple checksum methods making it more painful to defeat them all.

Eventually, you could probably detect efforts at defeating checksums
with other, non-checksum rules.  This might involve grammar-checking
filters that look for anomalous content, or even filters with deeper
understanding that can detect non-sequiturs.  It's not easy, I grant
you.

SpamAssassin's local tests are at heart pretty simple -- they
(more-or-less) just look for regular expressions in the text.  But
they remain very effective, and their effectiveness doesn't drop off
very rapidly with time.

> Once spammers learn how to do it, all spammers will

My experience tells me otherwise.  Dozens of CanIt customers and thousands
of MIMEDefang/SpamAssassin users still find the old, simple methods quite
effective.

I also reject the notion that my domain is only 3 years behind
striker.  Our domains (we have about 10) average a total of around 20
spams a day.  If our spam volume tripled each year, it would still
take us almost 9 years to reach striker levels.  In the mean time,
filtering works pretty well, and I hope that within 9 years, this
group will have found a better solution.  :-)

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 10 Mar 2003 10:37:05 -0700 (MST)

> From: wayne <[email-masked]>

> Are spammers really more likely to upgrade software than people who

Based on my experience in the last couple of years with the DCC, the
answer to that is "yes, most but not all people who run anti-spam
software are less willing to upgrade than spammers."

Perhaps that is because when something is working, spammers as well
as people running anti-spam software perfer to not distrub it.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Anthony Howe <[email-masked]>
Date: Mon, 10 Mar 2003 18:44:35 +0100

> doesn't mean we should give up on the low-hanging fruit.

Yes. I agree. My recent milter-sender is just this sort of spammer 
speed-bump, it aims to catch the unsophisticated and clueless spammer 
early, but fails for the more sophisticated . I would put forward a 
theory that the majority of spammers are the equivalent of adult 
script kiddies, using tools written by a smaller group of more 
determined more and proficient spammers.

> spammers will simply give up (or else fail because of lack of

Yes. I had expressed a similar sentiment on milter.org.

-- 
Anthony C Howe                            +33 6 11 89 73 78
http://www.snert.com/     ICQ: 7116561      AIM: Sir Wumpus
"Will the real email please stand up..."

---

From: [email-masked]
Date: Tue, 11 Mar 2003 03:11:46 -0500

> using high sophisticated tools without understanding what's going on.

As I said on another list recently: "Sometimes, the data makes a lot more
sense if you analyze it thinking 'What if the Three Stooges were hackers?'"

> to be sent with the very same software and address list. There are

I've certainly seen my share of Three Stooges spammers...

One particularly bad day, I had one spammer send me:

CLICK HERE TO VISIT OUR SITE

In a text/plain.  No HTML. No anchors. No http:. Nothing.  Quite obviously
slice-and-miced from another spam and all the anchors lost. Whoops.

About 15 minutes later, I had some spam land in the Listserv postmaster's
mailbox because it was sent to an invalid userid.  The part that made it
pathetic-to-the-point-I-hope-they-dont-reproduce was that they were marketing
a CD with 400 million allegedly verified email addresses....