Subject: RE: [Asrg] How to defeat spam that uses encryption?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 31 Mar 2003 08:46:01 -0800

> If I were a spammer (I am not) I'd start encrypting messages 
> to throw off
> content filtering. Public keys are easily obtainable and are readily
> associated with good email addresses.

We have not seen this to date but it is certainly a possibility,
one that cannot be fully addressed within the straghtjacket
of pretending SMTP is an end-to-end architecture.

The purpose of S/MIME encryption is to provide strong end-to-end
encryption. There are actually a large number of customers who
can't use that and so it is not unusual to see configurations
where a mail proxy either has the private decryption key or 
checks to see whether all encrypted mail is encrypted under an
escrowed key.

Stock brokers cannot by law use end-to-end encryption for reasons
that become clear during the Enron and dotCom bubble market
investigations. In the military any use of encryption has to
be controlled. You don't want people sending classified info
to the enemy.

These are edge cases however, in many cases you really do want 
true end-to-end. For example in a lawyers or doctor's office.

A non edge case is a device that does not have end to end
capability like my Rim pager. Here the problem is the 
combination of constrained bandwidth and processing power. 
On the other hand the protocols employed in this case are
highly customized and don't require standards.

There are two issues here:

1) The need to block DoS levels of spam at the perimeter

2) The need to use client side information to block spam

What is needed is a richer communication channel between
the MUA and MTA. In particular the client needs to be able to
send feedback to the mail server 'this is spam' or 'this is
needed'. Then the mail gateway can respond differently to
floods of mail from the same IP which in some cases may be
legitimate and in others may not.

For example, Congress changes it's mail server IP address.
Suddenly the Whitehouse gets a deluge of email from a new 
source. Ham or Spam?

This is a very tricky one because once that pornography has
got onto the mail server it is part of the record and deleting
it is a criminal offense that can lead to a congressional
witch hunt.

> Also, but not quite as complex:
> A few years ago, I 'invented*' a way to encode a whole web 
> page as a long
> string. This string is a variable in JavaScript. 

No active code of any sort should ever be run unless it is
from an authenticated source. HTTP pull constitutes a weak form
of authentication, SMTP push does not.

In practice though these schemes leave a signal that is far
more distinct than the appearance of certain words, in the 
same way that F-R-E-E is far more likely to indicate a spam
than free.

> Just a thought of what's to come...

That sort of thing is already happening.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric D. Williams" <[email-masked]>
Date: Mon, 31 Mar 2003 13:55:34 -0500

I would be interested in reading more on this proposal.  It may present some 
valuable information.  Don't know but I'll give you another set of eyes to look 
at it.  Thanks.

-e

On Monday, March 31, 2003 12:37 PM, Jason Hihn [SMTP:[email-masked]] 
wrote:
8<...>8
> I came up with (what I thought was) the most important piece of a system to
> ending spam and I got baulked at. It was not hard to implement, but no one
> seemed to think it important.
>
> (It was a mail protocol negotiation proxy, so the internet could use
> multiple mail protocols, each protocol can easily be replaced, or upgraded.
> If the preferred supposed spam-unfriendly protocol was not used, there would
> be some 'penalty' (delay, filtering, tar proxy) imposed. This would allow
> protocols to compete, with the bonus of weaking spam techniques, because
> hopefully, the same technique won't work on all protocols.)
>
>
>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 31 Mar 2003 13:34:04 -0800

Eric, 

i agree with your points, and yes I think some form of BCP,
possibly an architectural guide might be appropriate.

Actually in this case though I do not have the words on 
paper and although I am persuing other initiatives in
other forums this is the type of initiative where I 
would come to the IETF, in the first instance at least.

		Phill

> Although I think this already exists in one form or another 
> [RFC2635 - "DON'T 
> SPEW..."].  Has anyone considered drafting a preliminary or 
> running list of MTA 
> configuration best current practices for reducing 'spam'?  
> Phill, from your 
> posting I perceive that may be something that you could begin 
> to work on (with 
> others or not). Certainly any work product could be improved, 
> evaluated and 
> substantiated by the group.
> 
> All: A question is the discussion of end-user MUA technology 
> uses of encryption 
> something people want to address as a 'spam' control 
> solution?  This is just a 
> question.
>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 31 Mar 2003 17:33:27 -0800

> > From: "Eric D. Williams" <[email-masked]>
> 
> > ...
> > All: A question is the discussion of end-user MUA 
> technology uses of encryption 
> > something people want to address as a 'spam' control solution? 
> 
> It's a complete non-starter and waste of time, because it suffers
> the threshold problem in the worst way.  Early adopters get no
> benefit and many hassles.  Despite decades of work, the mechanisms
> to distribute keys are practically useless.  The user interfaces
> are coming along, but they're still poor and sometimes just 
> don't work.

The mechanisms designed to distribute keys are fine. The problem
is the attempts to use X.500 and LDAP for this purpose which are
longstanding abject failures.

The problem with encryption is that encrypting a message says 
NOTHING about its authenticity. I can send you an encrypted
message that purports to be from anyone I choose. To get any
statement about authenticity you need a signature.

> You can sometimes justify the practical hassles of encryption for
> keeping your communications private, but that avoids the threshold
> problem.  Many of us have used at least PGP for professional reasons,
> but that's a whole other world.

Don't project your experiences of PGP onto PKI. PGP has a very 
specific design which is fine for its intended purpose but that
is not to provide a PKI.

> Encryption, whether signing by senders or decrypting by receivers, is
> useless against spam until almost all of your correspondents use it.

It is useless against spam at any time.

Authentication is useful as a means of bypassing spam filters and
avoiding false positives even if relatively few people use it.

		Phill

---

From: "Eric D. Williams" <[email-masked]>
Date: Mon, 31 Mar 2003 21:30:53 -0500

Thanks all;

I too agree that encryption should not be considered a primary solution for 
spam as it constitutes a prohibitive threshold before any significant results 
could be realized.  Thanks for all of the input. (Remember I am working on 
'Requirements' -- I am attempting to cull the chatter [which has significantly 
reduced ;-], right now, for 'non-starter' solutions).  I know you probably have 
gone through many of these before and if there is a list I would appreciate a 
pointer.

-e

On Monday, March 31, 2003 7:30 PM, Vernon Schryver 
[SMTP:[email-masked]] wrote:
> > All: A question is the discussion of end-user MUA technology uses of
> > encryption
> are coming along, but they're still poor and sometimes just don't work.
>
> If you receive mail from a representative sample of strangers on the
> Internet, that implies that encryption will be useless to help your
> spam problem until almost everyone on the Internet uses it.
>
> Whitelists are snake oil in this context.  If you can whitelist everyone
> who sends mail to you because they won't be using encryption at first,
> then you can just whitelist them and forget about the encryption.
>
>
> Vernon Schryver    [email-masked]

---

From: Art Pollard <[email-masked]>
Date: Mon, 31 Mar 2003 20:41:15 -0700

At 10:49 AM 3/31/2003 -0500, you wrote:
>If I were a spammer (I am not) I'd start encrypting messages to throw off

Well, I recently started getting a pot-load of spam that does this.  (I 
think it is coming in from a newsgroup I moderate.  I just delete it and so 
I am not sure about this.)

Anyway, what they do is misspell words.  They use < and > to make "se><"
for example, 1's for l's 0's (zeros) for o's, etc.  It is of course harder 
to read but the message is still quite understandable.  What is more, it 
makes it virtually impossible for a filtering mechanism to catch it unless 
the various tricks such as this were programmed into it directly.

Of course, the other thing that has been happening more lately is simply a 
chunk of innocuous text in a HTML mail that won't trip up a filter but the 
HTML mail also has an image embedded in it that has the contents of the 
actual spam.

I suspect that Baysian and other similar techniques will have only a 
limited life span as techniques such as this become more prevalent.

-Art
-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.