Subject: RE: [Asrg] My Opinion regarding ietf asrg session (it went badly! )

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 20 Mar 2003 22:03:59 -0800

> None was big help at this point and 
> none (except 
> verisign, though presentation was still one-sided towards 
> S/MIME) tried to 
> see what else similar is available that may not be commercial 
> and may do 
> the same. 

Actually if I had had a little more time it would probably have been rather
clearer that I was proposing a range of authentication options, starting
with the free ones albiet with certain possible counter-strategies.

S/MIME is clearly an authentication option and the most flexible for this
particular application (PGP is a close second but there is a conflict in
that the PGP security model is strictly endpoint based and hence does not
immediately map to a service MTA gateway deployment unless a validation
service like XKMS is interjected). However S/MIME is also the most expensive
to deploy - whether you issue your own certificates or pay a CA since you
need a cert for every end user which is expensive to manage, far more
expensive than an SSL cert.

The only "authentication" strategy I think is bogus is using the reverse
DNS. This will at best demonstrate that the address block the IP is in has
been legitimately allocated. This is actually a modest spam indicator, it is
certainly not foolproof and is certainly not an accept/deny criteria. Lots
of legitimate IP addresses do not have reverse DNS configured. There are
definitely instances where garbage creators (high volume spam senders) have
hijacked unallocated IP ranges and advertised routes for them.

The problem is that it is almost as easy for the garbage creator to hijack a
legit IP address range by advertising a false route. So all things being
equal I would rather not create incentives for garbage creators to move to
strategies that are far more destructive.

	Phill 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Fri, 21 Mar 2003 00:35:15 -0800 (PST)

Being ISP owner and network engineer who manages not only my company network
(two /19 blocks, ASN, peers, transits) but also networks for couple other 
companies, all with multiple transit providers, I have to disagree with this. 
All transit providers amd large networks employ filtering at bgp advertisment
level and you would only be able to send them routes that you have previously
told them about and where they were able to confirm you're the owner of 
the ip block.

The only way I could see how somebody would advertise false route is if 
they tell their upstream that they have such as and such customer as 
downstream and their upstream is stupid enough not to verify it - at 
some size level upstream would trust its downstream ISP, i.e. if I 
tell that this network is for my customer, I would not get questions, 
but spammers usually do not have network and only use blocks received 
from theeir upstream, almost nobody would trust such company on their word 
to advertise another block without proof and advertising false block can 
also put tier-1 network into legal problems it may also cost them as far 
as peering contracts.

And as far as I can remember (and I'v been on both spam-related 
lists and even more network-engineering lists) there was only one or two 
examples and all two years ago or more. Besides that I'm also expert in 
ip whois and run free public whois referral server at completewhois.com 
(similar to geektools but all my own code and algorithms and dare say its 
lot more capable - both on domains and ip info) so I have statistics on 
what users are requesting and high amounts of spam are easy to see as 
increase in whois queries on certain ips, sometimes I check this myself 
and I did not see any clear hijacking.

But this is all completely off-topic and really not relevent to the 
list so I apologize for the rant and will be on topic in next emails.

---

From: [email-masked]
Date: Fri, 21 Mar 2003 00:47:14 -0800 (PST)

Little more on topic now:

  There is common misconception that hijaking ip block implies being able 
to do reverse dns for it. This is entirely false, one is ip routing issue 
another is ip allocation deligated by RIR so to be able to do reverse dns 
you would need to have record change with RIR (ARIN, APNIC, RIPE, LACNIC) 
and they would know who the real ip owner is and would report hijacking.
  But it is true that in some situations with smaller networks, they have 
their reverse dns servers in the same ip as their block from the RIR, then 
you could potentially setup your servers on the same ip. But lately that 
is enough either as RIRs have changed to do in-addr deligation by domain 
name and not ip, so you need to also hijack domain of the provider who you 
are hijacking ip block from. As you can see it gets way too complex for a 
spammer and can put him in way too much legal trouble if he's traced.

  But I entirely agree that reverse dns check is no substitute for
authentication or verification. If you look at it carefully you'll find 
that it fails on my complex mail path example both on the roaming user 
part and on intermediate remailer. But checking reverse ip can be used for 
the actual verification of individual server-server communication, I'll 
mention difference in next email.

---

From: [email-masked]
Date: Fri, 21 Mar 2003 11:32:42 -0500

> told them about and where they were able to confirm you're the owner of 

Ah yes.  Wander over to NANOG and hear the complaints about swamp /24's
being filtered, and 69/8 issues, and... ;)

(For the non-NANOG crew - BGP filtering is something that *should* be done,
and everybody *claims* they do, but I'd estimate that less than 5% of
the routers actually do it right).

For bonus points - did the BGP announcement come in over an MD5-auth'ed
BGP session? (Another fine idea that doesn't work in practice when you need
to have a separate shared-secret for each AS that you're peering with).

> some size level upstream would trust its downstream ISP, i.e. if I 

AS7007.  How far did THAT propagate?  (for the non-NANOG people, AS7007 was
one of the more famous/spectacular routing meltdowns, where basically ALL
the routes got accidentally misrouted).

This morning's CIDR-Report shows AS701 (UUNET) advertises 1,555 routes. AS7018
(ATT Worldnet) has 1,353. AS1221 (Telstra) has 1,104. I'm willing to bet that
if you could inject a route to one of those, the rest of the net would bite.
And you don't even need to advertise it everywhere - you pick (say) a /20 at an
AS that looks vulnerable, inject a /24 for your spam-net, let the victim route
that /24 internally, the rest of the net never sees anything more than the /20.

---

From: Wes Peters <[email-masked]>
Date: Tue, 25 Mar 2003 18:24:02 -0800

On Thursday 20 March 2003 22:03, Hallam-Baker, Phillip wrote:
> Actually if I had had a little more time it would probably have been
> rather clearer that I was proposing a range of authentication
> options, starting with the free ones albiet with certain possible
> counter-strategies.
>
> S/MIME is clearly an authentication option and the most flexible for
> this particular application (PGP is a close second but there is a
> conflict in that the PGP security model is strictly endpoint based
> and hence does not immediately map to a service MTA gateway
> deployment unless a validation service like XKMS is interjected).
> However S/MIME is also the most expensive to deploy - whether you
> issue your own certificates or pay a CA since you need a cert for
> every end user which is expensive to manage, far more expensive than
> an SSL cert.

No, you don't.  All you need is a promise from the "sumitting" MTA (the 
MTA that speaks to the senders MUA) that it has used SOME form of 
authentication to verif the user is who he says he is.

This has been the crux of the problem all along, and one of the reasons 
why I am completely unsympathetic to the cries of the large ISPs that 
they are being inundated by spam.  The spam problem is caused by ISPs 
who allow mail to enter the network without sender authentication.  If 
all ISPs required sender authentication, we wouldn't have this problem.

So here's the simplified version: the submitting MTA "signs" the message 
in some way verifying that it can and will, at the very least, disable 
the end user account associated with the sender if that sender abuses 
the network.  This signature is verifiable and has an abuse coordinator 
associated with it.

The final MTA (the MTA that communicates with the recipients MUA) 
decides if the recipient will receive mail from the verified sender.  

> The only "authentication" strategy I think is bogus is using the
> reverse DNS.

Agreed, it's not strong enough to be useful.

-- 
         "Where am I, and what am I doing in this handbasket?"

Wes Peters                                         Sr. Software Engineer
[email-masked]                               St. Bernard Software

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 26 Mar 2003 00:13:40 -0500

>all ISPs required sender authentication, we wouldn't have this problem.

Do we really believe this is true?  As far as I've been able to tell, 
spammer accounts get closed ASAP, as soon as they are reported. 
Having your account closed within hours of sending spam is just a 
cost of business for a spammer.  That's why ISPs have had to resort 
to blocking port 25.

Another question for the survey I suppose.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 25 Mar 2003 23:24:39 -0700 (MST)

> From: Wes Peters <[email-masked]>

> ...
> ...

That seems to be based on the common but quite mistaken notion that all
email involves "submitting" MTAs run by a few big ISPs.  In fact SMTP
is and should be a point to point protocol as much as the "file sharing"
protocols.  Many outfits run their own MTAs that talk to "submitting" MTAs.
Essentally all big outfits do this, as well as many smaller organizations
that don't trust the competence of the big ISPs.  Many long time IETF
and IRTF contributors as well as the IETF itself are in this boat.
All of us authenticate and authorize all of the mail our "submitting"
MTAs submit to our MTAs, whether it is spam or not.

All of this is irrelevant to the spam problem.  ISPs don't need to be
involved in signing or authenticating our mail to ensure we are not
sending spam.  Whether we buy raw IP bandwidth to run our own submitting
MTAs or we use the submitting MTAs of our ISPs, our ISPs know who we
are and could terminate our accounts if we send spam.  The problem is
that many ISPs can't be bothered or don't want to lose our business.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (Justin Mason)
Date: Tue, 25 Mar 2003 22:27:56 -0800

> cost of business for a spammer.  That's why ISPs have had to resort 

Also, if all ISPs required sender auth, spammers would masquerade as ISPs.
And who provides authorization for all ISPs?

--j.

---

From: Brad Templeton <[email-masked]>
Date: Tue, 25 Mar 2003 23:18:48 -0800

> And who provides authorization for all ISPs?

As was noted (I believe here a few weeks ago) spammers are already resorting
to hacking into insecure boxes to send spam.   Another recent trick is finding
web servers and CGI scripts that can be tricked into sending mail to any
address.  Such tricks will continue, though it still can be worthwhile to
make spammers jump through more and more hoops to thin their numbers.

Authentication does present problems for anonymous mail.  Anonymous mail
is not a problem on the net when it is sent in low volumes (ie. single
messages) and should not be interfered with, I would hope.

I mean, we had a guy sending literal explosive bombs through the USPS not
long ago, and anthrax as well, and while they did put a requirement that you
can't send a stamped package over one pound any more, they still haven't
gone so far as to remove the ability to send paper mail anonymously.

I mean spam is a royal pain, but it's about 5 orders of magnitude less pain
than anthrax and letter-bombs.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 26 Mar 2003 11:11:20 -0500

> than anthrax and letter-bombs.

We get a lot more than 5 orders of magnitude more spam than we get 
anthrax or letter bombs.

---

From: [email-masked]
Date: Wed, 26 Mar 2003 06:28:33 -0800 (PST)

Please stop making comparisons like that in actual values. Whatever the 
amount of spam I receive its not worth one human life.

---

From: Wes Peters <[email-masked]>
Date: Wed, 26 Mar 2003 09:41:22 -0800

On Tuesday 25 March 2003 21:13, Kee Hinckley wrote:
> >This has been the crux of the problem all along, and one of the
> > reasons why I am completely unsympathetic to the cries of the large
> > ISPs that they are being inundated by spam.  The spam problem is
> > caused by ISPs who allow mail to enter the network without sender
> > authentication.  If all ISPs required sender authentication, we
> > wouldn't have this problem.
>

I'm certain this is true for most ISPs.  I'm not certain at all it's 
true of the 2 or 3 biggest national ISPs in the USA, especially those 
who service thousands of new cable/dsl accounts per day.

> cost of business for a spammer.  That's why ISPs have had to resort

We've recently been regaled with a description of the network 
architecture of a top tier national ISP in the USA that not only 
doesn't block port 25 outbound, it actually traps port 25 outbound to 
any IP address to their own SMTP servers.  This same ISP is touting 
their efforts at blocking a billion incoming spams per day to anyone 
who will listen, not mentioning that it actually assists in sending 
outbound spam and does nothing to block spam between its own 
subscribers.

> Another question for the survey I suppose.

Yup, I guess so.

---

From: Brad Templeton <[email-masked]>
Date: Wed, 26 Mar 2003 10:52:52 -0800

> amount of spam I receive its not worth one human life.

I agree.  Actually, that was my point.  We have not put in a certificate
requirement or other autentication on postal mail, even though it can kill
you, so that diminishes the case that spam makes it worth requiring
authentication to send e-mail.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 26 Mar 2003 15:14:32 -0500

> I agree.  Actually, that was my point.

But you've both missed mine.  Spam costs everyone in real dollars, and 
indirectly jobs, and the growth of the Internet.

If you're going to make analogies, you need to compare the whole thing. 
Both from the "damage per incident" and the "frequency of incidents" 
perspectives.

> We have not put in a certificate
> requirement or other autentication on postal mail,

But we certainly have for riding on airplanes, haven't we?