Subject: RE: [Asrg] How to defeat spam that uses encryption?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 31 Mar 2003 11:41:50 -0800

> > >Well, if you were a spammer and you did that, you'd soon be out of
> > >business.  I would estimate that fewer than one in 100 e-mail users
> > >use PGP or GnuPG at all, and even fewer than that have a 
> public key.
> > >So you'd drastically limit your audience.

PGP is irrelevant, every major email client with the exception of
Eudora has supported S/MIME for 5 years now. There are half a billion
S/MIME clients out there.

The problem is that few clients are currently configured to use
encryption. This is going to change in future, in part because of
spam and in part because its the right thing to do.

> > >In fact, widespread use of GPG-style encryption could help defeat
> > >spammers.  If most people only accepted encrypted messages (except
> > >from whitelisted mailing lists and such), it would become very
> > >expensive to spam.  (Yes, I know this will never happen -- don't
> > >bother replying.)

Unfortunately not, there are SSL accelerators that do thousands of RSA
operations a second. They are unfortunately not FIPS approved in general
but spam senders don't care about that.

> It was only an example. But I do wonder.. any encrypted PGP 
> or GnuPG message
> would have higher social credibility for me...
> 
> But imagine this in a message:
> --- start---
> [javascript]
> $cypher_text="dsfjhsjdfhsdfjksdhfskjfhsd.."
> function decrypt(key, cypher_text){
> /* do description */
> document.writeln($plain_text)
> }
> [/javascript]
> 
> [body onload=decrypt("aasc", $cypher_text)]
> --- finish ---
> Now all your filters, Bayesian or not, will only work on the 
> actual text
> seen between start and finish.

Not necessarily, run the code in a sandbox, if you can't trust
the code enough to do that then certainly don't forward it to
the user, discard it like any other virus.

> No filtering will be done of 
> the "message" -
> what the user sees.  Furthermore, variable and function names 
> are infinitely
> variable, and what is not variable is standard html/js stuff and has
> significant legit use.

First I don't believe there is any legit function for Javascript
and absolutely not in email. Filter all active code at the firewall
unless it comes from an authenticated and trusted source.

This goes for attachments too, filter out all the word and excell
documents with macros unless the sender is trusted. There must be 
code readilly available to detect macros in these files.

Second renaming the variables does not affect the ability of
recognizers to detect it, this was demonstrated by some anti-cheat
software that was developed at Southampton University in the 
1980s. Code can be identified by the structure very easily.
Virus checkers use the same techniques.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jason Hihn <[email-masked]>
Date: Mon, 31 Mar 2003 15:12:50 -0500

> unless it comes from an authenticated and trusted source.

Mailed HTML forms, with javascript validation. As I understand it, this is
the only reason why this stuff is put up with today. I think we can do away
with it though. I've never used it and working around it (send a link, and
not the page) is done easily enough. (I am all for this!)

> code readilly available to detect macros in these files.

You'd think so, but those are proprietary formats, my friend. And to my
knowledge, non-proprietary formats (Open Office) aren't stupid enough to
have macros (at least the auto-open ones) (the last time I checked).
Furthermore, trusting the sender is not enough, as we usually infect the
ones we love (those in our address books) when it's outlook virus time!

> Virus checkers use the same techniques.

Indeed you are correct, but I was referring to a word-type filter, and not a
structure-based one.

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 31 Mar 2003 22:29:50 +0200

> S/MIME clients out there.

Could we please stop that marketing bullshit? Even more as I get the
impression that it's driven by the fact that your employer is making
money with S/MIME certs.

    "TV is irrelevant 'cause there are half a billion MPEG capable
     Windows Media Players out there".

Whether a client is capable of anything doesn't rate the anything relevant.
Numbers of use do rate relevance and I get about a factor of 100 more
PGP/GPG signed mails than S/MIME.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 31 Mar 2003 12:53:21 -0800

On Monday, March 31, 2003, at 12:29  PM, Markus Stumpf wrote:

> Could we please stop that marketing bullshit?

I think the correct phrasing here would be "there are half a billion 
clients capable of using s/mime, if only someone would write software 
that wasn't a pain in the neck to use for geeks, impossible to use by 
anyone else, and could convince people that it actually was worth the 
time and energy to use, and if we had an infrastructure capable of 
handling and passing around half a billion public keys reliably, which 
we don't"

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 1 Apr 2003 00:10:10 +0200

> that wasn't a pain in the neck to use for geeks, impossible to use by 

What do you expect. They don't even manage to have the clients add References:
or In-Reply-To: headers. Wouldn't it be nice if threading weren't always
broken each time one of those 1/2 billion clients takes part in the
discussion?
But this seems to be rocket science ...
And they want us to believe they get S/MIME right ...

	\Maex

---

From: J C Lawrence <[email-masked]>
Date: Mon, 31 Mar 2003 17:57:24 -0800

On Mon, 31 Mar 2003 11:41:50 -0800 
Phillip Hallam-Baker <Hallam-Baker> wrote:

> encryption. This is going to change in future, in part because of spam
> and in part because its the right thing to do.

That day when AOL and Hotmail support authoring crypted mail from a
default install will be a very strange day.

-- 
J C Lawrence                
---------(*)                Satan, oscillate my metallic sonatas. 
[email-masked]               He lived as a devil, eh?		  
http://www.kanga.nu/~claw/  Evil is a name of a foeman, as I live.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg