Subject: [Asrg] inventory of problems

From: Liudvikas Bukys <[email-masked]>
Date: Mon, 10 Mar 2003 13:35:04 -0500

Along the way to writing my inventory of solutions,
I wrote up an inventory of problems.  I see these as
the antecedents of the solutions, and also a useful
checklist anticipating the counter-counter-measures
of the spammers.

Evading accountability
	- forging envelope sender
	- forging From header

Exploitation of weak systems
	- exploit open smtp relay
	- exploit insecure web services (cgi formmail)
	- exploit open proxies (HTTP CONNECT, HTTP)

Aggressive database generation
	- directory harvesting (web, LDAP)
	- name guessing & probing
	- name guessing without probing [selling bogus data to others]
	- inappropriate database sharing/selling

Inadequate opt-in
	- no actual opt-in
	- deceptive opt-in
	- single opt-in without confirmation

Inadequate opt-out
	- opt-out not implemented
	- opt-out ineffective (pro forma removal from one list not all)
	- opt-out untimely
	- opt-out difficult to execute
	- opt-out hostile (used only for address verification & enrollment in even more databases)

Evasion of automated filters
	- content randomization
	- eyespace transformation
		- misspelling
		- punctuation and spacing
		- substitution of visually similar characters
		- html coding tricks
			- slice&dice tables
			- javascript-generated content
			- font size/color/background
	- mime multipart encoding
	- inclusion of non-spam chaff (visible or invisible)
	- content in images, not text
	- content in other external links

Evasion of human caution
	- fake DSN
	- fake content resembling common cgi-to-mail
	- "returned your call", "your account has a credit", etc

Not a real business
	- spam as chain letter/pyramid, selling software and bogus data to the naive
	- spam as DoS attack, no real solicitation in content

False claims
	- false claims regarding opt-in

Fraud & Crime
	- Nigerian 419
	- eBay password/credit card theft
	- payPal password/credit card theft
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 10 Mar 2003 12:47:21 -0700 (MST)

> From: Liudvikas Bukys <[email-masked]>

> ...

Such checklists are invaluable resources to spammers.  Most spammers
are not technically proficient, and judging from the spam I've seen,
no significant spammer is technically competent enough to produce that
checklist.  If this mailing list were shut down today, it would have
proven quite harmful to the good guys because of that checklist.

I don't intend to say that it should not have been posted, but to urge
caution.  This is a public list whose archives will soon be indexed
by the search engines.  It would be a shame if the only results from
this effort are a lot of noise and some cookbooks and checklists for
spammers.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jason Hihn <[email-masked]>
Date: Mon, 10 Mar 2003 16:13:42 -0500

Any real solution would work regardless of the attackers knowledge of the
system. Remember security class?

We have to make them play by our rules - completely plausible and doable.
Then when they do, we can fight them there. That's what my previous thread
was about. In order for a message to be delivered, it has to abide by our
rules, and pass our checks. Those rules require them to give
up/modify/announce their true behavior.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Vernon Schryver
Sent: Monday, March 10, 2003 2:47 PM
To: [email-masked]
Subject: Re: [Asrg] inventory of problems