Subject: [Asrg] Spam detection system proposal

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 09:03:23 -0500 (EST)

Hi,

I've been reading ASRG for a couple of days, and am impressed by the
message volume. :-)

However, we need practical ways to fight spammers.  I think we're spending
too much time trying to define "spam" and not enough on understanind spammers.
Here are some ideas that I believe will have real, practical benefits.

What are the differences between a spammer and a legitimate mass mailer?
How can we exploit these differences?  I see two major differences:

1) Spammers want to send out lots of messages cheaply, and don't
particularly care if any one message gets through.  Legitimate mass
mailers want all of their messages to get through.

2) This is just a hunch, but I bet it's true:  Spammers probably have a
higher proportion of bad addresses on their lists than mass-mailers.  We
can help ensure this by poisoning their lists with web pages of fake
addresses.

The analogy to IDS software is apt here.  Condition (1) can be detected
with a purely local process:  You tempfail mail from unknown senders the
first time.  (Better, tempfail based on sender-recipient pairs).  I already
do this, and it reduces spam by a significant percentage (20-25%) with very
little cost to me.

Condition (2) cannot be detected purely locally, but I have a proposal
that can make it possible to detect (2).  Just as we have central clearing
houses for checksums, we can build a system of central clearing houses
for success/failure counts.

Imagine modifying MTA software so that:

- If a RCPT TO: succeeds, it sends a note saying:  "Sender [email-masked]
  from IP address a.b.c.d sent a successful RCPT TO: command"

- If a RCPT TO: fails, a similar failure note is sent.

- Possibly, we could augment the scheme so that mail to a honeypot address
  is noted and counts for more than a simple failure -- we could weight
  the various addresses.

The clearing house would maintain the success/failure rate over a
sliding window of 24 hours or so.

When your spam filter is deciding whether or not to accept mail, it
consults the clearing house.  Based on criteria you choose, it can add
X points to the spam score if the success rate for the IP or sender is
lower than a certain amount.  For example, if "[email-masked]" has a
15% failure rate with at least 300 samples reported, then you add 3
points to your spam score.

I believe this scheme is pretty easy to implement, is practical, doesn't
lessen privacy too much, and most importantly, requires no changes to
existing Internet protocols or end-user software.  It also uses an objective
measure of spammer behaviour, rather than trying to define the undefinable.

Obviously, the implementation details are important -- we'd want to make
it hard for any one machine to skew the statistics with fake data, etc.
But I don't think this task is any harder than trying to secure DNS :-) and
we all still use and rely on DNS.

Comments welcome. :-)

--
David.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 09:09:33 -0500

> What are the differences between a spammer and a legitimate mass

the percentage of recipients who want to receive the messages.
that's all.

Keith

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 09:26:33 -0500 (EST)

> the percentage of recipients who want to receive the messages.

OK, let me rephrase that:

What are the *detectable* differences between a spammer and a legitimate
mass mailer, assuming we can't read the minds of the recipients?

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 5 Mar 2003 14:42:10 +0000 (GMT)

> the percentage of recipients who want to receive the messages.

Surely "want" is not the right word here.

---

From: Mathias Herberts <[email-masked]>
Date: Wed, 05 Mar 2003 14:50:17 +0000

Hi,

legitimate mass mailer ususally don't spend time setting up garbage in 
their messages so as to defeat checksum based or pattern based spam 
detection mechanisms.

Mathias.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 09:56:11 -0500

On Wed, 5 Mar 2003 14:42:10 +0000 (GMT)

> Surely "want" is not the right word here.

it's what I intended.  if >99% of recipients want to receive the
messages, the sender is in some sense "legitimate".  if <1% want to
receive the message, the sender is a "spammer".  

another way of putting this is that I don't think we're likely to find a
useful definition of "legitimate" vs. "illegitimate" mass mailer.  the
concept of legitimacy is somewhat dubious here.

Keith

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 5 Mar 2003 15:20:03 +0000 (GMT)

> receive the message, the sender is a "spammer".  

This puts the definition of spam in terms of quantity though. So you can 
end up with a targetted spammer sending something to a small number of 
people, all who think its interesting and useful, yet its bulk and 
unsollicited. I don't like legitimising that, and I know I'm not alone in 
that. I stick tightly to the monkeys.com definition of spam.

Matt.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 10:05:29 -0500

> What are the *detectable* differences between a spammer and a
> legitimate mass mailer, assuming we can't read the minds of the
> recipients?

none that are reliable and can be determined by looking at just the
message.  the only intrinsic difference between a spam and a
"legitimate"  piece of mail is that the recipient doesn't want to
receive the spam.

okay, there are a fair number of clues that give a good indication that
a message is probably spam - e.g. if the sender seems to be trying to
hide any indication of where the message was sent from.  but now
that filters exist to recognize these, spammers will soon learn not to
generate messages that do that, so looking at them is only a short
term fix.

it used to be that checking for an invalid From address (via SMTP)
was an almost foolproof way to detect spam.  that doesn't work any
longer.  spammers do learn.

Keith

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 10:08:09 -0500 (EST)

On Wed, 5 Mar 2003, Keith Moore wrote:

> message.

Right.  Are you sure you read my proposal?  If you can be an
omniscient being and see what happens to every message sent in a
bulk-email run, I believe you will see a difference between spamming
and legitimate bulk e-mailing.  My proposal was designed to make us
closer to omniscient.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 10:15:11 -0500

> Right.  Are you sure you read my proposal? 

I assure you that I haven't read every proposal, or yours specifically.
there have been too many messages and documents to keep up with.

> If you can be an
> and legitimate bulk e-mailing.  

only if you can keep track of the complaints that the message produces. 
I don't think it's reasonable to judge 'legitimacy' of a message based
on what happens before delivery.

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 10:17:16 -0500

> if >99% of recipients want to receive the
> This puts the definition of spam in terms of quantity though. So you
> can end up with a targetted spammer sending something to a small
> number of people, all who think its interesting and useful, yet its
> bulk and unsollicited. 

then it doesn't create a problem for anyone, and we shouldn't be trying
to declare that illigitimate.

> I don't like legitimising that, and I know I'm not alone in that. 

you have nothing to say about it - you were not involved.

Keith

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 10:18:42 -0500 (EST)

> their messages so as to defeat checksum based or pattern based spam

Neither do many spammers.  It's my contention that looking at message
content, or a single or a few deliveries, is not sufficient to distinguish
spam behaviour from legitimate mass mailing.  We need a bird's-eye view
of the entire (or a significant portion) of the mail run.

No-one's actually commented on the merits or lack thereof of my
proposal. :-(

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 08:23:59 -0700 (MST)

> From: "David F. Skoll" <[email-masked]>

> mass mailer, assuming we can't read the minds of the recipients?

There are no such differences, detectable or not.  Setting asside
arguments about legal or AUP definitions, spam is fundamentally unwanted
bulk mail.  "Bulk" because isolated abuse is not a problem that needs
attention by the IETF/IRTF and "unwanted" because that's what it is.
Any "legitimate mass mailer" becomes a spammers simply by sending to
people who don't want the stuff.  A spammer becomes legitimate not
sending to people who don't want the stuff.

] From: "David F. Skoll" <[email-masked]>

] > 1) a legitimate bulk emailer **should** conform to the general rules
] > regarding bulk email - there are around 8 or so headers that shold
] > be added to bulk email.  However as a number of companies block
] > email that conform to these rules as 'spam', legitimate bulk
] > emailers are no longer confirming. This means that purely from
] > message contents and headers it is difficult to tell the difference.
]
] Exactly. 

"Exactly"?  Who blocks messages simply because they have List-Unsubscribe
and similar headers such as those listed in RFC 2369?

]           Which is why we need a distributed detection system to detect
] spam runs, and I believe the percentage of bad recipient addresses in
] a given run is a pretty reliable measure.

I disagree, because many spammers work hard to remove bad addresses
from their target lists.  Other spammers don't, but still others work
hard to honor "unsubscribes" or "removes."  Generalizations such as
"all spammers have lots of bad addresses in their lists" are as wrong
as "all spammers use open relays" or "spam involves forged headers."

I think the only way to detect spam runs is to examine passing mail bodies
and look for those that are substantially identical and therefore bulk.
However, perhaps I'm biased because that is exactly what the DCC does.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Wed, 5 Mar 2003 10:28:20 -0500

>No-one's actually commented on the merits or lack thereof of my

Well, hello I'm new here but I've been dealing with the spam problem 
for a long time.

I believe the idea of at least a partial top-down view has merit.

I think it can only work with a feedback mechanism so that users who 
receive the first messages can "report" them somewhere.

I think that overall, if you really want to manage spam, the mail 
delivery process has to be slowed down slightly to allow received 
spams at site A to be matched up with spams at B through Z and a 
probability-of-spam set. An invisible white list could help push 
clearly-not-spam messages into inboxes, while the rest are checked 
over.

Two linked issues that arise are maintaining the privacy of the 
original message, and determining that two messages are fundamentally 
the same message, despite slight differences.

A self-reporting system need not be terribly vulnerable to individual 
user error if there are enough users. In any self-reporting system, 
an orchestrated external attack is somewhat feasible against public 
mass mailings (only) - a form of reputation system would be needed to 
quell this.

---

From: [email-masked] (Justin Mason)
Date: Wed, 05 Mar 2003 15:31:45 +0000

> sliding window of 24 hours or so.

This is a very interesting idea.   It does not even need to hook into
the MTA, just tail the log files or log database for that MTA, and report
stats from that.

To avoid this, spammers would have to

  (a) start using valid, non-forged, non-joe-job From: or Errors-To:
  addresses to collect "user unknown" DSNs, so they could clean up their
  lists;

  (b) spend money on inbound SMTP bandwidth to support (a), hence hitting
  their pockets.

A very nice, very simple idea.   It's vaguely related to another idea I've
heard, regarding a lookup database of "addresses that have bounced at my
domain recently", but that idea might provide have a side-effect of
providing more incentive for spammers to joe-job (haven't quite thought it
through).  This one, however, does not.

issues I can see:

- an expiry of 1 day is too short; I would say 3-5 would be better.

- what about randomised sender addresses?  Some spamtools will generate
  a new random From: addr for each recipient.  I fear the relay IP
  address is the only trustworthy source id that can be used...

--j.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 10:42:27 -0500 (EST)

> There are no such differences, detectable or not.

Then this ASRG is a waste of time.

> ] > This means that purely from

> and similar headers such as those listed in RFC 2369?

You misunderstood.  I meant "Exactly -- it's hard to tell the difference
purely from message contents and headers."

> from their target lists.

Really?  Don't you think it's worth a shot to try to gather hard data?
If you're right, then my idea is no good.  If you're wrong, then it is.
Unfortunately, without setting up a system to gather this data, we'll
never know.

> Generalizations such as

I never said that.  I said I believe that many spammers have lots of bad
addresses, simply based on how they obtain addresses in the first place.
Maybe you're right; I don't know.  But we should at least try to find out.

> and look for those that are substantially identical and therefore bulk.

Bulk != Spam.  Any system to detect "similar but not identical"
messages can be thwarted if it uses a checksum scheme, and is too slow
to be practical if it uses more sophisticated message-closeness
measures.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 10:45:40 -0500 (EST)

> receive the first messages can "report" them somewhere.

No, the system is totally automatic.  All it reports is that IP address
x.y.z.w submitted a message with a valid RCPT TO: or invalid RCPT TO:
address.  That's it.

> probability-of-spam set.

My scheme doesn't care about message content.  It merely punishes those
with a large set of invalid recipient addresses on their mailing list.
My intuition tells me spammers are more likely to have bad addresses than
legitimate bulk e-mailers.  We need experiments to see if that's true.

> the same message, despite slight differences.

Again, I don't report or care about message content; only good or
bad RCPT TO: commands.  We don't even report actual recipient addresses.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 10:48:13 -0500 (EST)

On Wed, 5 Mar 2003, Vernon Schryver wrote:

> hard to honor "unsubscribes" or "removes."

In order to remove bad addresses (as Justin Mason pointed out), or honor
unsubscribes, spammers would need to supply either a valid return address
or a Web page somewhere that's trackable.  That's the whole goal of all
the authentication proposals on this scheme.

You can't clean your list unless you can receive bounces, and to receive
bounces, you need to use a valid (and presumably somewhat traceable)
sender address.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 10:50:35 -0500

> My scheme doesn't care about message content.  It merely punishes
> those with a large set of invalid recipient addresses on their mailing
> list. My intuition tells me spammers are more likely to have bad
> addresses than legitimate bulk e-mailers. 

you're probably right.  but that doesn't mean it's reasonable to punish
those who happen to have lots of bad mail addresses.

consider the organization that mails out one announcement per year to
its members. lots of people will change addresses in that year.  is that
organization's mail somehow illegitimate because its addresses bounce?
for that matter, is a spammer's mail any less annoying simply because it
deletes addresses that do bounce?

Keith

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 10:54:37 -0500

> and legitimate bulk e-mailing.

The question is associating the messages to get your counts.

A spammer merely needs to have a big set of open proxies/relays and 
seriously randomize froms, and you can no longer generate counts of
anything because you can't associate report "a" with report "b".

I have some considerable experience with this having built a tool that 
attempts to group "similar" already-blocked spams from multiple IPs 
within a given IP range to send off LARTs.  Based on subject lines, with 
considerable hackery to strip hashbusters, and lump, say, all "horsy" 
spam together, I'm getting about a 40% success rate.  Based on IPs and 
Froms, it'd be no better, and considerably worse once the spammers 
notice and evolve.

Some of the existing distributed methods based upon body checking do a 
better job at this, because it's very hard to make the payload vary that 
much to fool the hash preprocessing and still sell what you want to sell.

---

From: Bill Yerazunis <[email-masked]>
Date: Wed, 5 Mar 2003 10:51:43 -0500

From: [email-masked] (Justin Mason)

   issues I can see:

You're probably correct.

I've seen spammers send from randomized addresses at all of
(known | forged | random) addresses, and also with forged
addresses from others in the same organization.  

I expect this spammer was was hoping to take advantage of a likely
"whitelist" for intra-organization email.

My opinion: there are only two things that can be trusted:

   the IP address of the machine on the other end of the TCP 
   connection that hit your firewall, and

   the meaningless pattern of bits in the message, which only has
   significance in a statistical (rather than a formatted) sense.

You can't trust anything else in the message, in particular, you
must _not_ trust any of the information that's in headers you 
recieved from the far end, as spammers have become particularly
adroit at forging _everything_.

	-Bill Yerazunis ( CRM114 author, I'll post an intro later)
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Wed, 5 Mar 2003 10:51:26 -0500

>bounces, you need to use a valid (and presumably somewhat traceable)

I don't see that "intent" of the sender is really a factor one way or another.

It's the net outcome that is at issue with spam.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 10:53:39 -0500 (EST)

On Wed, 5 Mar 2003, Keith Moore wrote:

> > My intuition tells me spammers are more likely to have bad

> those who happen to have lots of bad mail addresses.

Well, any anti-spam scheme will have its side effects.  This is a pretty
mild side-effect, I think

> organization's mail somehow illegitimate because its addresses bounce?

No.  That's a side-effect, and such organizations will need to work harder
to keep their lists clean.  (Do any organizations *really* mail out that
infrequently?)

> deletes addresses that do bounce?

In order to delete addresses that bounce, the spammer must be able to receive
bounce notifications, and therefore becomes more traceable -- the #1 goal
of many other proposals on this forum.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 10:54:24 -0500

> In order to remove bad addresses (as Justin Mason pointed out), or
> honor unsubscribes, spammers would need to supply either a valid
> return address or a Web page somewhere that's trackable.

yes, but they don't have to use the same return address or web address
for subsequent spam.  thus the value of this identifier in blacklisting
them is near zero.

Keith

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 10:54:58 -0500 (EST)

> for subsequent spam.  thus the value of this identifier in blacklisting

Which is higher than zero -- the current state of affairs.

---

From: [email-masked] (Justin Mason)
Date: Wed, 05 Mar 2003 15:58:22 +0000

> legitimate bulk e-mailers.  We need experiments to see if that's true.

There are some legit bulk mailers with bad list hygiene, and large numbers
of bad addresses.

However, I would hazard a guess that there's a *huge* margin of difference
between their bounce ratio and a spammer's, and it will be easy to
differentiate.

--j.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 10:59:05 -0500 (EST)

> for subsequent spam.  thus the value of this identifier in blacklisting

Consider:  To receive DSN notifications, the spammer can expect to receive
between 10-20% of all the mail he sends out.  Sending 1,000,000 messages to
different addresses is cheap.  Receiving 100,000 to 200,000 copies of that
same message to a single address (or even a few addresses) is not.

If the spammer doesn't want to receive the message body in the DSN's, he
or she will have to use a bulk precedence header. :-)  To reduce his own
costs, the spammer is forced to play nicely.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 11:01:23 -0500

> Then this ASRG is a waste of time.

Depends on the level you take the "no ... differences".  Clearly there 
is no definitive simple test from a header or body whether it's spam. 
Nor is there a single test that works for everyone.

But there are many clues, some of which need external consultation (eg: 
DCC or blacklists), and some which don't, that can lead to heuristics 
that are within your comfort zone.

If there weren't, I wouldn't be doing what I'm doing.

> messages can be thwarted if it uses a checksum scheme,

Unsolicited bulk == Spam.  Everything else is just quibbling about 
thresholds.

That's a dangerous assertion to make to the person who invented DCC. 
Because he can prove otherwise.  As can Razor or Cloudmark.

Not perfect, but they _do_ work quite well.

> and is too slow

You'd be surprised.  There's a lot of techniques that we use routinely 
with considerable success that people swear up and down are totally 
impractical.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 11:08:08 -0500

> > consider the organization that mails out one announcement per year
> > to its members. lots of people will change addresses in that year. 
> > is that organization's mail somehow illegitimate because its
> > addresses bounce?
> 
> No.  That's a side-effect, and such organizations will need to work
> harder to keep their lists clean.  (Do any organizations *really* mail
> out that infrequently?)

yes, damnit.  I work with several organizations that have a once-a-year
social event, and send out one bulk email per year.

> > for that matter, is a spammer's mail any less annoying simply
> > because it deletes addresses that do bounce?
> 
> In order to delete addresses that bounce, the spammer must be able to
> receive bounce notifications, and therefore becomes more traceable --

nope.  not in any useful sense.

Keith

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 11:12:55 -0500

> or a Web page somewhere that's trackable.

Sorry, wrong.  All bad address removal requires is spamware that 
understands SMTP error codes.  No reverse channel of any kind required.

> You can't clean your list unless you can receive bounces,

Wrong as per above.

Most spammers don't care about rejects.  They really don't.

Really.  Truly.

2 years ago we decommissioned (de-MX'd out of DNS) several domains we no 
longer used, but were getting 50,000 spams/day.  After 18 months of 
solid failures, I reenabled the domains to see what's happening.

500,000-700,000 spams/day.  Plus a big chunk of bounces from ISPs from 
spam forged in these old domains.

Or, see http://striker.ottawa.on.ca for a situation that's even worse. 
A domain is so badly hit with spamming attempts for addresses that 
_never_ existed, that he can no longer afford the SYN packets to reject 
inbounds at the TCP layer.

Hell, even some legitimate emailers don't notice rejects and never clean 
bogus addresses.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:13:07 -0500 (EST)

> The question is associating the messages to get your counts.

No, you just associate IP address to count.  You can't possibly
associate to the message, because failed RCPT TO: commands never
get to the DATA phase.

> anything because you can't associate report "a" with report "b".

It is quite expensive to gather a large set of open relays.  If you're
sending out 500K messages, and you want to limit it to 1,000
messages/IP, you need to find 500 open relays.

Also, a lot of spammers are pretty unsophisticated and send from DSL
or cable-modem lines.  This scheme would get them pretty fast.

> Based on IPs and Froms, it'd be no better, and considerably worse
> once the spammers notice and evolve.

We need experiments to tell for sure.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 11:08:42 -0500

> > yes, but they don't have to use the same return address or web
> > address for subsequent spam.  thus the value of this identifier in
> > blacklisting them is near zero.
> 

marginal gain in response to signifcant harm sounds like a losing idea
to me.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:09:19 -0500 (EST)

> social event, and send out one bulk email per year.

What's the bounce rate, and how many addresses are on the list?  You'd
only want to start using this info to block spammers once you get at least
a few hundred or 1,000 samples or so, and only if the bounce rate is fairly
high.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 09:15:24 -0700 (MST)

> bounces, you need to use a valid (and presumably somewhat traceable)

That is even more deeply confused than the authentication proposals.
The authentication proposals cannot force spammers to process bounces.
They can only force spammers to have sender addresses that are
authenticated.  On the other hand, that many spammers now use valid
return addresses and process bounces without authentication shows that
authentication is indpendent of clean lists.

The authentication proposals are confused about the nature of
authentication.  They imagine that it would ever be possible (not to
mention desirable) to force all mail to be inextricably linked to a
human identity such as a U.S. social security number (or EIN for
corporations).  As long as it is possible to phone an ISP and get a
new account within minutes, or to sign up for an accout on-line, the
notion of authenticating all mail senders to mail recipients is crazy.

On the other hand, all mail senders are already sufficient authenticated
to ISPs for ISPs to prevent spam if they care.  ISPs that demand credit
card numbers and impose significant financial penalties for bad behavior
do not have spam problems.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:16:59 -0500 (EST)

> > messages can be thwarted if it uses a checksum scheme,

[...]
> Because he can prove otherwise.

I'd like to see that proof.

It's very easy to prove that any (useful) checksum algorithm can be
thwarted.  Any useful checksum algorithm must produce different
results for "substantially different" messages.  Furthermore, you can
examine the algorithm to see what it considers "substantially
different", and write a generator to make substantially-different
messages.  You can do this (for example) by taking your archive of
received mail from the last 5 years and adding random paragraphs from
legitimate mail messages to your spam.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 11:17:08 -0500

> Consider:  To receive DSN notifications, the spammer can expect to
> receive between 10-20% of all the mail he sends out.  Sending
> 1,000,000 messages to different addresses is cheap.  Receiving 100,000
> to 200,000 copies of that same message to a single address (or even a
> few addresses) is not.

so the spammer pays that price once to clean up his list, and after
that, he only gets a few bounces back each time.

> If the spammer doesn't want to receive the message body in the DSN's,
> he or she will have to use a bulk precedence header. :-) 

which is not an indication of spam, and shouldn't be treated as such.

Keith

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:18:07 -0500 (EST)

> I don't see that "intent" of the sender is really a factor one way

It's a huge factor, because the motivation of the sender produces
detectable differences in the way he/she gathers recipient addresses
and sends mail.  This is empirically proven, today, with my simple
"tempfail-first-time" heuristic.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 11:23:25 -0500

> > yes, damnit.  I work with several organizations that have a
> > once-a-year social event, and send out one bulk email per year.
> 
> What's the bounce rate, and how many addresses are on the list?  

don't know about the bounce rate for email - for one group the snail
mail bounce rate was on the order of 15% (yes, that many people had
moved in meatspace during the year).  I suspect the email bounce rate
was comperable.  lots of people change email addresses periodically to
try to escape spammers.

Keith

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:25:06 -0500 (EST)

> that, he only gets a few bounces back each time.

I believe that even that one-time price is sufficiently high to deter
a lot of spammers.

Furthermore, the system can be tuned.  For example, it might be
possible to send to the clearing house the SHA1 hash of each recipient
address (hash to preserve privacy) as well as the success/failure
notification.  The next time the spammer spams, if you notice a lot of
recipient addresses that were the same as a previously-detected spam
run, you can use that as an indication of spam.  Again, my intuition
tells me that the exact address lists used by spammers are very
different from legitimate mailing lists.

This enhancement would be pretty expensive to implement, but is
doable.  It means that anyone who cleans a list with a lot of bad
addresses will find his remaining list of good addresses is marked as
suspect.

This does, as you say, hurt infrequent mailers.  That's an unavoidable
side-effect.

> which is not an indication of spam, and shouldn't be treated as such.

That's true, but forcing any kind of detectable behaviour onto spammers
is a good thing.  Even apart from detecting spam, the bandwidth
saved by not bouncing bodies is good for everyone.

---

From: Jim Youll <[email-masked]>
Date: Wed, 5 Mar 2003 11:28:23 -0500

>I believe that even that one-time price is sufficiently high to deter

200K messages is a few hours of processing on even a slow machine with a
slow connection. Surely anyone who can generate a million messages
can deal with what comes back.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 11:33:22 -0500

> I believe that even that one-time price is sufficiently high to deter

forgive me if I'm skeptical.

> Furthermore, the system can be tuned.  

you're still trying to evaluate messages based on some criteria that
have nothing to do with whether the recipient wants it or not.

> This does, as you say, hurt infrequent mailers.  That's an unavoidable

we can certainly avoid it by not using this scheme.

> > > If the spammer doesn't want to receive the message body in the
> > > DSN's, he or she will have to use a bulk precedence header. :-)
> 
> That's true, but forcing any kind of detectable behaviour onto
> spammers is a good thing. 

not if it's a waste of effort.

Keith

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 11:36:24 -0500

> messages/IP, you need to find 500 open relays.

Which isn't hard.  If you refuse to get your fingers dirty, you just 
have to download one of the open relay/proxy blacklists...  But if you 
don't mind getting your fingers dirty, just point a scanner at Brazil. 
Thousands within a few hours.

> or cable-modem lines.  This scheme would get them pretty fast.

You're seeing the open relays and proxies, not the spammers themselves.

> We need experiments to tell for sure.

We can already see the spammers doing this.  My autobitch bot routinely 
shows me specific spams that have been sent from several hundred or even 
a thousand different IPs in one day.  And this is the viewpoint from 
just _one_ MTA...

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 11:49:35 -0500

[resend - sorry, I hit the wrong button last time]

> Fine.  What do you suggest instead?  People already use a lot more
> brute-force approaches with a lot worse side-effects, so I think you
> are simply being disagreeable.

you're probably right :)

I don't think there's a simple answer.  I think we need a combination of

- a way to find out whether a message is sent by someone who has
  a history of spamming, a history of not spamming, or no history

- an automatic way of handling spam complaints, in order to accumulate
  that history

- a way for recipients to indicate that mail meeting certain criteria
  that they specify should not be sent to them (because it will get
  bounced or discarded anyway) 

Keith

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 09:47:21 -0700 (MST)

> "tempfail-first-time" heuristic.

No, by your own numbers, that's empirically suggested for only 20% of spam.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:47:57 -0500 (EST)

> understands SMTP error codes.  No reverse channel of any kind required.

Unless your recipient is running MS Exchange:

http://support.microsoft.com/default.aspx?scid=kb;en-us;304897

or happens to have a Yahoo or AOL account (Yahoo and AOL do not fail
bad addresses at RCPT time.)  I'd imagine this would cover a large
class of spam victims.

My additional proposal (for making the remaining good addresses on
a spam list suspect) will handle the case of more intelligent spamware.

> Wrong as per above.

See URL.

> Most spammers don't care about rejects.  They really don't.

Good!  Then they won't bother cleaning their lists, and my scheme will work.

> Hell, even some legitimate emailers don't notice rejects and never clean

Then this punishes them too -- good.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:39:50 -0500 (EST)

> forgive me if I'm skeptical.

You're forgiven.  But it's worth a shot.

> have nothing to do with whether the recipient wants it or not.

Well, it is *impossible* to tell if the recipient wants a message or
not.  So if that's the only measure we can use, we might as well quit
right now.  I don't know if I want a message or not until I've read it,
and by then it's too late.  And even if I didn't want it, it doesn't
mean the other recipients didn't either.

> not if it's a waste of effort.

It's not a waste of effort even if it only reduces bandwidth from
bounced message bodies.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 11:42:06 -0500

> Fine.  What do you suggest instead?  

I suggest we stop trying to decide which scheme to use, and try to
confine our immediate activitiy to 

 People already use a lot more

-- 
"Of course the people don't want war.  But after all it is the leaders
of the country who determine the policy, and it is always a simple 
matter to drag the people along.  All you have to do is tell them they
are being attacked, and denounce the pacifists for lack of patriotism
and exposing the country to danger... It works the same way in any
country."

- Hermann Goering, Nuremburg, 1947.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:54:24 -0500 (EST)

On Wed, 5 Mar 2003, Keith Moore wrote:

> I don't think there's a simple answer.

Of course not.  I don't think there's any answer at all, if by
"answer" we mean something automatic that stops almost all spam with
almost no bad side effects.

>  I think we need a combination of

>   a history of spamming, a history of not spamming, or no history

That would be nice.  I have no idea how to do this.  As you said,
it's easy to change sender address, Web address, etc.  How do you
know who to attach the history to?

[...]

>   bounced or discarded anyway)

But this requires cooperation from the sender, or else a level of AI
to analyze messages that I think is simply impossible.  It's safe to
assume that spammers will go out of their way to be uncooperative.  I
think schemes that can detect this kind of wilful lack of cooperation
are good candidates for partial solutions.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 12:03:05 -0500

> bad addresses at RCPT time.)  I'd imagine this would cover a large

But no means all, nor, can we guarantee that they will always be that 
way.  Given evidence of our spamtrap, it appears to be MSN that's the 
only bouncer that "stands out".  Have seen few, if any, AOL blowback in 
our spamtrap.

> Good!  Then they won't bother cleaning their lists, and my scheme will work.

Except for the difficulty of associating From: x@y, IP: 1.2.3.4 with the 
same spam from a@b, IP: 4.3.2.1.

 >> Hell, even some legitimate emailers don't notice rejects and never
 >> clean bogus addresses.

 > Then this punishes them too -- good.

Iffen you can make the associations (which you can't) it'll still get 
you into trouble.

Case in point: us. Anyone sending, say, a mailing list to our users, 
with a 6 month gap, will see a 40-60% bounce rate. :-(

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 10:02:59 -0700 (MST)

> I'd like to see that proof.

See http://www.dcc-servers.net/dcc/graphs/  
There are outfits pushing lots of msgs through DCC clients.
The network is seeing nearly 20 M msgs/day.  The major costs are disk
bandwidth and memory for the DCC servers, not CPU cycles on any modern CPU.

> thwarted.

In theory, yes.  In practice, that has not been true since I started
compute spam checksums to prove that that is right and Paul Vixie was
wrong half a dozen years ago.  Instead I proved that he is right in
practice.

>            Any useful checksum algorithm must produce different

That last sentence is not necessarily true, depending on the nature of
the fuzzy checksum.

However, please let's not talk about ways to defeat specific checksum
systems, unless you are a spammer, and in that case I trust you'll be
unsubscribed by the management.  There's no profit in making more work
for those of us who tweak our checksums to counter the new tactics of
spammers.  For example, as those who've been watching spam know, a
recent cycle of that involves <!--HTML comments-->.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 12:05:34 -0500

> know who to attach the history to?

sigh.   I really think we need to be talking more in generalities at
this point, rather than reviewing detailed proposals.  and since the
details are important, I don't think this can be evaluated without
supplying the details.  

also, I think we need to get to the point that we can look at the
variety of ideas and brainstorm about how to combine them effectively,
and we can't do that as long as people are trying to champion their
proposals.  (I suppose shooting them down doesn't help either, though.)

> But this requires cooperation from the sender, 

no it just requires cooperation from upstream mail servers.  ISPs don't
want to pay for bandwidth or server cycles that won't be used.  if they
can find out that lots of recipients don't want from [email-masked],
(or some other criteria, this is just a handy example)
they probably won't mind not delivering that mail to those recipients.

Keith

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 09:53:33 -0700 (MST)

> From: "Chris Lewis" <[email-masked]>

> ...
> ...

Certainly "many" spammers don't care about rejects, but "most" is
not supported by the evidence.  It's possible that most spammer
don't care about rejects, but unless you have numbers, let's please
limit the over generalizations.

In line with your point about computing "false positive," how do you
define "most spammers"?  By messages transmitted?  Warm spammer bodies?
Domain names?  Obvious aliases but that you've not yet related to other
obvious aliases?  Spam in your personal mailbox?   

As I keep saying, there are only a few serious spammers, but they
are quite varied.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 11:58:48 -0500 (EST)

> Thousands within a few hours.

OK.

> a thousand different IPs in one day.  And this is the viewpoint from

I see that ocasionally also (not several hundred, though!).
Nevertheless, I think my scheme is worth doing.  Anything that forces
a certain kind of behavior on spammers is good.  If they're forced to
use open relays and proxies to send spam to avoid being marked as a
person with a bad list, then it makes RBL's that blacklist open
relays, proxies, and dial-up blocks more valuable.

We need a broad-spectrum multi-faceted approach.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 12:12:19 -0500

> We need a broad-spectrum multi-faceted approach.

I agree.  When presented in that manner as being part of an overall 
technique, it's worth a try.  But I don't have my hopes up, except in 
the case of static spammers (eg: Marin/Lauderdale.net) which you should 
blackhole via SBL or local blacklist anyway.

However, do realize that open relays/proxies/socks/dialup-block RBLs 
have difficulties of their own.  Perhaps the most important being that 
the first three generally lag closure by quite a bit, and are thus 
subject to problems about staleness of information.

I raise the latter, not because it's necessarily a show stopper (it 
isn't for us), but the factor _is_ there.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 12:18:44 -0500 (EST)

On Wed, 5 Mar 2003, Keith Moore wrote:

> this point, rather than reviewing detailed proposals.

OK.

Then I think it is useful to research ways to follow and summarize the
flow of mail on the entire Internet.  We need to figure out how to
collect statistics from a large proportion of MTA's in a way that
doesn't grind the system to a halt.  We need to work out what
statistics we want to collect, and (most important) whether or not any
of these statistics can be analyzed to distinguish spam runs from
legitimate bulk mailings.

It would be a bonus if the collected statistics preserved privacy of
senders and recipients as much as possible, and didn't require
disclosure of message bodies.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 12:31:24 -0500 (EST)

On Wed, 5 Mar 2003, Kee Hinckley wrote:

> I have had technical support people at bulk mailer providers tell me
> that they are not allowed to prune bounces out of lists because
> marketing doesn't want to tell the customer that the list just shrank

Well, they *deserve* to be punished, IMO.

> Oh please.  Not poisoning.  Just what we wanted.  More bandwidth use.

> Every  one of those poisoned message gets an attempted delivery.
> Every one generates a bounce.

Not necessarily; see Chris Lewis's post earlier.

> Every bounce tries to go somewhere else.  Have you ever been the
> return address on a spam mailing?

Yes.  It's not fun.  But I do not think poisoning address lists will
make all that much difference.

> You  want to see your mail server go to its knees?

It's a risk I face whether we poison lists or not.

> Poisoning spam lists is just contributing to the spam-as-DoS problem.

I don't think it makes that much difference; people change e-mail
addresses all the time.

> And God-forbid your poisoner uses an address that is
> fake today, but real tomorrow.

Ah, no; a responsible poisoner only releases poisoned addresses under
a domain he/she owns.  You have a point there.

---

From: "Mark Delany" <[email-masked]>
Date: 5 Mar 2003 17:47:39 +0000

> We need experiments to tell for sure.

No we don't. Plenty of people on this list, such as myself, are on the
end of systems that routinely get hit by thousands of Open Proxies per
day. (Open Relays btw are currently rarely used by spammers in
comparison).

I can tell you as a fact that spammers do have large OP lists and
routinely use them. There are companies/people that make a living out
of making these lists and selling s/w that uses them. send-safe.com is
just one very public example of that. All the spammer does is pay the
bucks to send-safe and he gets a regular feed of fresh OPs from the
send-safe mothership.

(Talk about dynamic. Send-safe were dumped by their Russian hosters
earlier this week and now they pop up in the UK).

Regards.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 11:51:27 -0500

> It's the net outcome that is at issue with spam.

The intent of the sender is what determines it to be spam - unsolicited 
bulk email.  Spamming is a behaviour, not a content or an origin.

The net outcome of a spammer's actions is why spam is bad and this 
mailing list exists.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 13:00:28 -0500

>understands SMTP error codes.  No reverse channel of any kind 

You are assuming that the connection is directly to the validating 
mail server.  That is certainly not the case with a secondary MX, and 
it's often not the case with large systems.

-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 13:01:53 -0500

>messages/IP, you need to find 500 open relays.

I know an ISP which has blocked over 10,000 IP addresses that have 
sent test probes against his server.  This in a matter of just a few 
months.  As soon as he blocks one, the spammer starts using a 
different one.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 5 Mar 2003 12:22:40 -0500 (EST)

> that, he only gets a few bounces back each time.

If the spammer is using an open relay, the relay pays the price. Actually,
I think that is good, it will encourage them to close the relay.

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 5 Mar 2003 17:34:08 +0000 (GMT)

> understands SMTP error codes.  No reverse channel of any kind required.

Not all mail goes direct to a server that can issue a 5xx if its an 
invalid user. If it goes through a service like MessageLabs' it gets 
through the first connection just fine. You may get a bounce from us 
though at delivery time.

Matt.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 12:21:18 -0500

>mailers want all of their messages to get through.

Actually that is different in theory than in practice.

I have had technical support people at bulk mailer providers tell me 
that they are not allowed to prune bounces out of lists because 
marketing doesn't want to tell the customer that the list just shrank 
25% (Not to mention that they are charging per-address, not 
per-delivered-message.)  If they do that, the customer will take 
their business elsewhere, because they don't want to tell *their* 
boss that they don't have nearly as many contacts as they thought. 
They avoid confirmed opt-in for the same reason.

If there were a substantial cost of delivery, or a legal cost for 
screwing up, this would change.  Currently the cost of cleaning a 
list is greater than the cost of sending undeliverable mail or 
quietly unwanted mail; even for legitimate mailers.

Oh please.  Not poisoning.  Just what we wanted.  More bandwidth use. 
Every  one of those poisoned message gets an attempted delivery. 
Every one generates a bounce.  Every bounce tries to go somewhere 
else.  Have you ever been the return address on a spam mailing?  You 
want to see your mail server go to its knees?

Poisoning spam lists is just contributing to the spam-as-DoS problem. 
Please don't.  And God-forbid your poisoner uses an address that is 
fake today, but real tomorrow.  I don't trust anybody's idea of what 
kind of address is "fake".  Why do you think somewhere.com bounced 
ten million messages last year?
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Mark Delany" <[email-masked]>
Date: 5 Mar 2003 17:27:42 +0000

On Wed, Mar 05, 2003 at 11:47:57AM -0500, David F. Skoll allegedly wrote:

> bad addresses at RCPT time.)

Really, did you check?

telnet mailin-01.mx.aol.com smtp
Trying 64.12.136.57...
Connected to mailin-01.mx.aol.com.
Escape character is '^]'.
220-rly-xa03.mx.aol.com ESMTP mail_relay_in-xa3.3; Wed, 05 Mar 2003 12:15:05 -0500
220-America Online (AOL) and its affiliated companies do not
220-     authorize the use of its proprietary computers and computer
220-     networks to accept, transmit, or distribute unsolicited bulk
220      e-mail sent from the internet.
helo example.com
250 rly-xa03.mx.aol.com OK
mail from: <[email-masked]>
250 OK
rcpt to: <[email-masked]>
550 MAILBOX NOT FOUND

Not quite at RCPT time, but certainly at SMTP time, which is the same
effect as far as this discussion is concerned:

telnet mx1.mail.yahoo.com smtp
Trying 64.157.4.82...
Connected to mx1.mail.yahoo.com.
Escape character is '^]'.
220 YSmtp mta418.mail.yahoo.com ESMTP service ready
mail from: <[email-masked]>
250 sender <[email-masked]> ok
rcpt to: <[email-masked]>
250 recipient <[email-masked]> ok
data
354 go ahead
subject: reject me
.
554 delivery error: dd This user doesn't have a yahoo.com account ([email-masked]) [0] - mta418.mail.yahoo.com

Besides, low frequency list checking is already routinely done these
days. So low that it can, does, and will keep smart spammers out of
any radar detection you want to set up. It's also so low that they can
deal with bounces. Eg, my vanity domain gets address probes about
twice a day, every day.

It's not enough to say how do we stop spam today, it has to be how do
we stop the evolution of smart, viral, motivated spammers. Your
suggestion makes them evolve to do more list-cleaning. Doesn't sound
like an insurmountable hurdle to me.

Regards.

---

From: [email-masked] (Justin Mason)
Date: Wed, 05 Mar 2003 18:57:51 +0000

David F. Skoll said:
> A cheap test that stops 20% of spam is good.

Yes.  *Very* few tests supported by SpamAssassin get rates that high with
few FPs.

--j.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 14:15:46 -0500

> Really, did you check?

That's what I thought too.

MSN doesn't check.  Unless they've changed in the past week or two...

I have the spam blowback to prove it.  So does Steve Linford ;-)

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 14:17:55 -0500

> You are assuming that the connection is directly to the validating mail 
> server.  That is certainly not the case with a secondary MX,

It is with ours.

> and it's often not the case with large systems.

Like AOL or Yahoo or us?  Nope.

---

From: Brad Templeton <[email-masked]>
Date: Wed, 5 Mar 2003 11:31:02 -0800

> Then this ASRG is a waste of time.

Even though I am a coder at heart, sometimes I realize the real world
has something to offer when it comes to dealing with abusers.

The real world doesn't usually do security with physical security.
It punishes after the fact and uses that as deterrence.

Thus the proposal I sent in my opening message.  The difference between
spammers and legit bulk mailers is that legit bulk mailers are willing
to be accountable if they abuse bulk mail.   Spammers, of course,
are not.

Very few of the world's low level security problems are solved by
putting up a clever high fence.  You notice that there is nobody
checking your bags as you leave the Sears store.

That's how we like it.  We don't want to close up open societies and
open protocols for a bit more security against abuse.

There are tricks you can use to detect patterns between spammers and
legit bulk mails.  One trick is the spam-trap, which is what BrightMail
does.   If a mail came to a spam trap, especially if it's checked
by a human being, you have a fully reliable identification of a
spam attack.

The number of bad addresses is another test, but not nearly so
reliable.   Spamasassin style filters are another test, possibly of
some use.

In the end, though, if we can get most of the legit bulk mailers to
do something -- anything -- to let us know they are accountable for
abuse, I think we can lick this thing.

Some of the things that they can do to show accountability are:

	a) Sign a contract
	b) Offer money / hashcash / post a bond
	c) Be vouched for by somebody else who is accountable
	d) Simply have a good reputation, have a well known established
	   mailing list found in any of the existing databases of
	   mailing lists.
	e) Live in a legal jurisdiction which punishes spammers
	   _effectively_.  (ie. not any of the current U.S. state
	   spam laws which do more harm than good.)
	f) Be a member of an association reliably pledged to not
	   abuse bulk mail.  This could include, I kid you not
	   the DMA, or BBB or similar.  Or Habeus if it is shown to work.
	g) Host your list with somebody who meets the above criteria
	   as a host, like Topica, Yahoo eGroups, etc.

There are a lot of choices and there can be more.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 14:40:03 -0500 (EST)

> It punishes after the fact and uses that as deterrence.

Right.  But you need a way to detect the problem before you can
punish it.  A distributed mechanism for detecting anomalous
SMTP behavior is like an alarm sytem.  And alarm systems are
pretty common in the real world.

> checking your bags as you leave the Sears store.

It depends where in the world you live. :-)  Lots of stores I've
been in demand you leave parcels at the front, and if you walk through
with a bag, you will be searched.

In North America, this isn't so common, of course.

> reliable.

Well, isn't it?  I don't know, and I don't think you know either.  Some
posters have complained how their systems are stressed from bounce
messages during spam attacks.  This suggests to me that a large number
of invalid addresses is a good indicator of a spam attack.  Unfortunately,
it's not necessarily the case that a spam attack always yields a large
number of bad addresses; there probably are spammers out there who keep
their lists clean.

> abuse, I think we can lick this thing.

That would help, but it requires buy-in from a lot of different groups
with a lot of different vested interests.  And I'm not sure that
non-technical solutions fall within the charter of the IETF, although
it certainly should consider them and recommend them to legislators.

I don't advocate distributed statistics-gathering and analysis as a
panacea.  But I do believe it could be one more effective detection
tool in our arsenal.

---

From: "Deven T. Corzine" <[email-masked]>
Date: Wed, 5 Mar 2003 14:44:51 -0500 (EST)

> recent cycle of that involves <!--HTML comments-->.

There's a Catch-22 here.  We don't want to aid spammers, but we want to be 
able to combat them effectively.  It's the same problem computer security 
researchers deal with daily.  We probably need to adopt a similar strategy 
of open peer review, to establish faith in a technique by having many smart 
people try to break it, with full knowledge of the technique.

To avoid discussions of how to defeat any particular technique may provide 
some temporary security through obscurity, but it could backfire.  We might 
spend a lot of time and effort on a technique that turns out to be easily 
subverted.  It might work well as a niche effort, but if it ever becomes 
mainstream, the spammers will take notice and work on countermeasures.

Security through obscurity is more effective for those who are agile enough 
to change direction when that obscurity is pierced.  The Internet email 
infrastructure, as a whole, has the least agility of all.  If we want to 
find a way to save the world from spam, we need a solution that can be 
entrenched, and that will take time.  Spammers have the benefit of agility, 
so obscurity plays to their advantage.

I believe we need to find a solution that can withstand intense scrutiny, 
even if it imperils the current effectiveness of niche solutions.  We need 
a mainstream solution, and to know it will work, we need to try to think 
like a spammer and look for every sneaky way to subvert the system.  That's 
the only realistic route to a long-term solution.

Personally, I believe an effective solution will probably require a massive 
change in the email infrastructure.  SMTP is just too easily abused, in its 
current form.  I'm thinking ESMTP extensions coupled with a PGP-style web 
of trust (between servers and/or users) has real possibilities...

Deven

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 14:46:40 -0500 (EST)

> Really, did you check?

Yes.

But I typed in a random received name, which (alas) must have been
legitimate. :-(

> we stop the evolution of smart, viral, motivated spammers.

You cannot stop that.  It's an arms race, and just because there are a
few smart, viral, motivated spammers doesn't mean we shouldn't take
measures to stop the less smart ones.

The only way to stop smart, viral, motivated spammers is to change the
nature of e-mail so that strangers cannot communicate with you.  That's
a solution that's worse than the problem.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 09:05:04 -0700 (MST)

> Then this ASRG is a waste of time.

I think this ASRG less about distinguishing spammers and legitimate
mass mailers than spam from legitimate mail.

> Unfortunately, without setting up a system to gather this data, we'll

If you look at a few 1000 spam, you'll find hard data proving that
many spammers do care about removing bad addresses.  Notice the whines
in spam about how wrong it is to complain to ISPs hosting remove
addresses.  Notice how many envelope Mail_From values are valid
addresses owned by the spammer at free ISPs.  Notice the spammers
using bulk mail packages (not spamware) that do automatic removal of
bad addresses using synthetic Mail_From values encoding the target
address. If spammers didn't want bounces or "removes", they would not
continually sign up for and use new free-provider drop-boxes.

Consider also reports that big ISPs automatically blacklist IP addresses
after they've sent to "too many" bad addresses.  This provides a strong
incentive for clean target lists.

Of course, there are plenty of other spammers who do not care how
dirty their target lists are.

> Maybe you're right; I don't know.  But we should at least try to find out.

"Finding out" seems to be based on the false notion that all spammers
do one or the other.  There are only about 1500 current serious spammers,
but their tactics and goals are quite varied.

> Bulk != Spam.  

of course "spam" != "bulk", but "bulk" is a lot closer to "spam" than
"mentions viagra" or "was sent to a (temporarily) bad address."

>                Any system to detect "similar but not identical"

You are quite wrong about that.  Simplistic checksum schemes are easily
thwarted, but the DCC and other checksum schemes including Cloudmark are
not simplistic checksums.  I've been computing what I call fuzzy checksums
since about 1997, and not yet had serious problems detecting bulk mail.
(In 1997 it was at a Fortune 500's corporate gateway.  Today it's the DCC.)

You are also quite wrong about the speed of checksumming with modern
cheap CPUS.  There are ISPs and others that are pushing a lot of
messages per day through DCC clients.  The significant costs are in
disk and network bandwidth, not CPU cycles.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 5 Mar 2003 08:49:01 -0700 (MST)

[clearinghouse of sources of mail sent to bad addresses]

>   address is the only trustworthy source id that can be used...

Not only do some spammers forge random source addresses (now often
from their target lists), but they also use open proxies and relays
so that the IP address varies and is not a reliable mark of evil.

Worse, looking for delivery failures is still looking for side issues.
A batch of bulk mail sent to 1000 bad addresses is not necessarily
spam any more than a batch of bulk mail that mentions Viagra.

What happens if a big ISP accidentally messes up its user database
for a few hours and so bounces a bunch of copies of mail from list.
Does that make messages from this list spam?

"Spam" is unwanted mail, with "unwanted" determined by individual
targets.  One person's spam is another person's important newsletter,
regardless of whether 1000 other copies bounce, whether the messages
came through an SMTP relay or TCP proxy, or it mentions Viagra.

Again, if you are going to do distributed spam detection (as opposed
to the things this mailing list is charted to consider), I think you must
look at mail bodies.  Besides the DCC, there are Pyzor and Cloudmark,
and even SpamAssassin if you squint at the updates to the default
rules right.   The DCC is currently looking at approaching 20 million
messages per day and finding that about 60% of them are extremely bulky.
See http://www.dcc-servers.net/dcc/graphs/

---

From: "Deven T. Corzine" <[email-masked]>
Date: Wed, 5 Mar 2003 14:59:58 -0500 (EST)

> a solution that's worse than the problem.

That's one way, and unfortunately it's gaining ground -- it seems to be 
increasing common for people to eschew email (or the Internet) entirely 
rather than suffer spam, while some are going whitelist-only.  Meanwhile, 
most Internet users are scared to death of having their true email address 
accidently revealed in public where the spammers will harvest it...

Another way to stop smart spammers is to change it so that strangers CAN
still communicate with you easily, while ensuring that they somehow remain 
accountable for their actions.  For example, if a spammer could be forced 
to pay a fine (in real money) if the recipient felt abused, there would be 
little incentive to spam people...

Of course, enforcement is another issue, but that's where pervasive changes 
to the email infrastructure would probably come into play.

Deven

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 15:13:03 -0500 (EST)

> not simplistic checksums.

Any checksum scheme that can be made to produce different values
for different messages that I select can be thwarted.

Any checksum scheme that cannot be made to produce different values
for different messages that I select is useless for distinguishing
spam from non-spam.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 15:24:42 -0500 (EST)

On Wed, 5 Mar 2003, Vernon Schryver wrote:

> look at mail bodies.

You're right.  But I took a look at the DCC checksum.  It's
very easy to fool.  Add a few words here or there in the body and
DCC is toast.  However, that doesn't mean DCC is useless; on the
contrary, it's extremely valuable to catch the spammers who don't
evade it.

Adding a clearing-house for bounced messages is simply one more indicator.
You can integrate it into your SpamAssassin rule set with a score that
makes you comfortable, just as right now SpamAssassin can use DCC, Razor,
etc.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 12:15:22 -0500 (EST)

If you're looking for a single approach that stops most spam, forget
it.

We are facing a tough battle that will take lots of tools and techniques,
each of which stops a bit of spam.  With luck, in concert, we'll be able
to stop "most" spam, where "most" means enough that it's worth doing.

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 01:16:42 -0500

> limit the over generalizations.

Okay: Over a 18 month period of which a domain was completely de-MXed, 
and 100% failures, the amount of spam going to it went from 20,000/day 
to 800,000/day.  A 40 fold increase.  While that doesn't necessarily say 
  whether it's "most" rather than "many", a 40-fold increase suggests 
that if it's not "most", it's a whole heck of a lot.

"Millions CDs" tend not to remember NDRs too well.

> As I keep saying, there are only a few serious spammers, but they

I agree with you on that point.  In fact, considerably fewer "serious 
spammers" than you mentioned in another email.

---

From: Nate W <[email-masked]>
Date: Thu, 6 Mar 2003 23:44:16 -0800 (PST)

> "Millions CDs" tend not to remember NDRs too well.

If they did, they would be "Thousands CDs" and wouldn't sell as well.

-- 

Nate Waddoups
Redmond WA USA
http://www.natew.com

---

From: "David F. Skoll" <[email-masked]>
Date: Fri, 7 Mar 2003 09:26:15 -0500 (EST)

> See http://www.dcc-servers.net/dcc/graphs/

Those graphs are interesting, but hardly constitute proof that
a checksum scheme can't be defeated.

> wrong half a dozen years ago.

Only because not enough people use DCC to make it a problem for spammers.
It's the usual situation that a tool that works well now, stops working
well once lots of people use it.  Catch-22. :-)

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 7 Mar 2003 13:01:32 -0500

At 8:53 AM -0500 3/7/03, Bill Yerazunis wrote:
>When the fraction I/P for any SMTP sender exceeds the administrative
>parameter P, the offending IP host may be automatically subjected by
>the MTA software to the following sanctions:

I know of at least one ISP (and I'm sure there are others) that do 
this.  He blocks based on bounces.  As soon as he blocks an IP, 
another one starts sending him the spam.  This goes on for thousands 
of IPs.

I seriously wonder if there isn't some rather sophisticated 
distributed server spam software running out there on rooted servers, 
and we just haven't figured it out yet.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 07 Mar 2003 08:40:52 -0500

> another one starts sending him the spam.  This goes on for thousands 

  I spent a few days last year blocking IP's based on bounces.  It
went as follows:

  <block 100's of IP's>
  <wait 10 minutes>
  <repeat>

  No end in sight,

> and we just haven't figured it out yet.

  That would fit the data I'm seeing.

  Of course, 10,000 clueless small-scale spammers would also fit the
data, but I think that's less likely.

  Alan DeKok.

---

From: "Mark Delany" <[email-masked]>
Date: 7 Mar 2003 19:27:41 +0000

> data, but I think that's less likely.

You might want to look at the DHS Club and their strategy of recruiting
people and then aiming them at ratware like send-safe.com.

There might only be a smallish number of ratware authors but they do
rather like selling their product to as large a contingent of clueless
small-scale spammers as possible.

http://www.theclubbuiltonspam.com/ is a good place to get an interesting
view on just one set of spammers.

I think it's safe to say that there are "X" categories of spammers,
for all values of "X".

Regards.

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 16:38:00 -0500

>   That would fit the data I'm seeing.

Both the analysis I've done on your spamtrap, and the analysis I've done 
on ours, would indicate that you don't need to go to these lengths to 
"fit the data".

The simpler answer is "Millions CDs and LOTS of open proxies/relays".

I've generally not seen IPs _notice_ that we're rejecting email. It's 
simply that certain spam variants are sent from literally thousands of 
different IPs.  Ie: debt consolidation, viagra, HGH.

Some of this is certainly orchestrated from central points (eg: Ralsky's 
operations), but I don't see anything to indicate that even Ralsky makes 
use of the rejection information to "drive" his forwarders differentially.

> data, but I think that's less likely.

A few Millions CD/open proxy/socks ratware owners would explain it too.

Spot checks of both your and our data showed a high correlation between 
source IPs and IPs already blacklisted by BOPM, Monkeys, OSIRUS 
proxy/socks et al.

Note also that if they're using open relays, with the usual forged MAIL 
FROM (which is a pretty high percentage of spam), the spammer _CANNOT_ 
see the rejects or bounces.

However, I have seen reports of stealth spamware trojans from ISP abuse 
desks.  This is where somehow a piece of software got installed onto a 
user's machine, that instead of listening for inbound connects (like an 
open proxy), periodically calls _out_ to the spammer, and retrieves 
instructions on what to do.  No details or forensics seen yet.

These are truly nasty, because you can't scan for them.