Subject: Re: [Asrg] How to defeat spam that uses encryption?

From: "David F. Skoll" <[email-masked]>
Date: Mon, 31 Mar 2003 12:25:12 -0500 (EST)

> From: Jason Hihn <[email-masked]>
> To: Asrg <[email-masked]>
> Subject: [Asrg] How to defeat spam that uses encryption?

> If I were a spammer (I am not) I'd start encrypting messages to throw off
> content filtering. Public keys are easily obtainable and are readily
> associated with good email addresses.

Well, if you were a spammer and you did that, you'd soon be out of
business.  I would estimate that fewer than one in 100 e-mail users
use PGP or GnuPG at all, and even fewer than that have a public key.
So you'd drastically limit your audience.

In fact, widespread use of GPG-style encryption could help defeat
spammers.  If most people only accepted encrypted messages (except
from whitelisted mailing lists and such), it would become very
expensive to spam.  (Yes, I know this will never happen -- don't
bother replying.)

> Also, but not quite as complex:
> A few years ago, I 'invented*' a way to encode a whole web page as a long
> string. This string is a variable in JavaScript. When it's opened, a
> function is applied to the string where it's decoded contents are written to
> the browser. Imagine a simple ROT13 decoder. What's more is Bayesian
> filtering would fail because the spammer can invent pads, and ROT bases,
> thereby inventing new 'words' in the dictionary all the time.

You're assuming that most people have JavaScript-enabled mail readers.
There are simpler ways to defeat filtering, checksums and such without
depending on client-side software.

> Just a thought of what's to come...

Indeed.  Nevertheless, forcing tricks like that on spammers forces
them to use detectable behavior.  For those who reject any solutions
that simply perpetuate an "arms race", I think you'd better get over
it.  For the medium-term (5-10 years), "arms race" tools will be the
only practical anti-spam tools.

--
David.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jim Youll <[email-masked]>
Date: Mon, 31 Mar 2003 12:35:00 -0500

>expensive to spam.  (Yes, I know this will never happen -- don't

Why is this? If they've got my e-mail address they can get my public key.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jason Hihn <[email-masked]>
Date: Mon, 31 Mar 2003 12:57:23 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Jim
> Youll
> Sent: Monday, March 31, 2003 12:35 PM
> To: David F. Skoll; [email-masked]
> Subject: Re: [Asrg] How to defeat spam that uses encryption?
>
>

It was only an example. But I do wonder.. any encrypted PGP or GnuPG message
would have higher social credibility for me...

But imagine this in a message:
--- start---
[javascript]
$cypher_text="dsfjhsjdfhsdfjksdhfskjfhsd.."
function decrypt(key, cypher_text){
/* do description */
document.writeln($plain_text)
}
[/javascript]

[body onload=decrypt("aasc", $cypher_text)]
--- finish ---
Now all your filters, Bayesian or not, will only work on the actual text
seen between start and finish. No filtering will be done of the "message" -
what the user sees.  Furthermore, variable and function names are infinitely
variable, and what is not variable is standard html/js stuff and has
significant legit use.

-J

---

From: "David F. Skoll" <[email-masked]>
Date: Mon, 31 Mar 2003 13:02:37 -0500 (EST)

> [body onload=decrypt("aasc", $cypher_text)]

That is fascinating.  I read my mail with Pine.

> seen between start and finish.

Here's a simple rule:

	IF body contains "javascript THEN bounce.

If that's too draconian, then:

	IF body contains "onload=" THEN bounce.

> No filtering will be done of the "message" -

Not according to me, at least not in e-mail.  My mail filters already
strip HTML from incoming mail.  I can't say for sure, because I never
actually see HTML mail, but I don't believe anyone has ever sent me a
legitimate e-mail with javascript code in it.

If spammers start abusing this, then we'll have the happy result that
more people will start filtering out HTML mail, and we'll go back to
plain-text e-mail. :-)

---

From: "David F. Skoll" <[email-masked]>
Date: Mon, 31 Mar 2003 13:04:16 -0500 (EST)

> would have higher social credibility for me...

Ah, yes.  Opportunistically encrypting messages for recipients who do
have public keys would be a nasty, if somewhat expensive, way to get
past spam filters.  But actually, you can just "pretend" to be a
GPG-signed message to evade some of the more popular content filters.

---

From: Jason Hihn <[email-masked]>
Date: Mon, 31 Mar 2003 13:25:00 -0500

> That is fascinating.  I read my mail with Pine.

You sir, are both unlucky and lucky. I was a long-time pine user, but the
20th century has come and gone. ;-)

The vast majority of people are using Outlook. Outlook users know nothing,
and we can thank BillG for the lovely lack of security and common sense in
his products due to his monopoly. No one knows how to turn all that ActiveX,
Javascript, and document macros off. (Well we do, but Joe Blow doesn't, nor
do they know why they should care) They don't even know that Outlook is bad!
It's there, so they use it. Companies are worse, they blow money patching
and recovering from the infections that Outlook makes possible.

I use Mozilla, with Javascript turned off and 'Bayesian' filtering. It's
quite nice, and as filtering becomes more common place, spam will be more
tolerable. I just look at the 100s of messages I get a day and laugh now.
What do I care anymore? Filters are good enough. I get 1 sneaking through
every 4-6 days now. Eventually, I think that the net ops people will be the
only ones objecting. Better act fast and use the public's hatred of spam
before the problem disappears behind a filter! Then you'll have nothing to
leverage!

> 	IF body contains "javascript THEN bounce.

Then sir, you'd have never gotten my message.

> 	IF body contains "onload=" THEN bounce.

Again, you'd never have gotten my message, even though my use was only
illustrative, and quite legit.

---

From: [email-masked] (Justin Mason)
Date: Mon, 31 Mar 2003 10:31:46 -0800

> variable, and what is not variable is standard html/js stuff and has

This exists -- I think a search for SBL will throw up one spammer
(Merlin?) who writes this kind of polymorphic-style spam.

In SpamAssassin's ruleset, the use of a body onload attribute, or
Javascript decryptors, is an incredibly strong spam-sign -- because *no*
legit mail ever does this. 

I think this may be one reason I haven't seen 1 spam that does this, since
about a year ago. ;)

--j.

---

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 31 Mar 2003 11:18:12 -0800

On Monday, March 31, 2003, at 10:25  AM, Jason Hihn wrote:

> The vast majority of people are using Outlook.

This, I think, is a potential issue in this group: how many of the 
people attempting to build these policies know what Joe User really 
does, think and wants. I've seen a number of approaches and comments 
that lead me to think some folks see the net as "everyone does it the 
way I do it" -- there seem to be some serious blind spots, or perhaps, 
tunnel vision, in the discussions. I'm not sure what can be done about 
it, though, but it's an issue that needs to be kept in mind: whatever 
gets built needs to be built so Joe User can use it and will use it and 
does what he wants..

> Companies are worse, they blow money patching

companies are increasingly looking for alternatives, but when you have 
an existing company-wide system with a large user population and you 
can't just take the system down for a week to revamp things, moving to 
a new environment takes a lot of time, energy and money. Especially 
since e-mail is by all measures a corporate critical function almost 
everywhere now. Sometimes, the work needed to make a switch simply 
overwhelms an organization's ability to do it.

---

From: Jason Hihn <[email-masked]>
Date: Mon, 31 Mar 2003 14:28:28 -0500

> From: Chuq Von Rospach [mailto:[email-masked]]
> Sent: Monday, March 31, 2003 2:18 PM
> To: Jason Hihn
> Cc: David F. Skoll; Jim Youll; [email-masked]

It shouldn't matter what the reader is. I belive there is at least the one
consensus that infratructure upgrades need to be done. Once that is done, it
should (again) no longer matter who uses what to read mail because it will
never get to them anyway.

> overwhelms an organization's ability to do it.

And the solution to this may lay in that proposal of mine that wasn't well
received. I will work on cleaning it up. (I'm not the best writer.) Maybe
then I can get more people enthusuastic about it. I think if we got some
talent to code it, we'd have something to play with at the end of a day. I
could almost do it myself, but I have no good experience writing scalable
socket-driven apps. (Threading, I/O completion ports, etc) But I could
prototype it in some scripting language...

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 31 Mar 2003 12:59:50 -0700 (MST)

> From: "David F. Skoll" <[email-masked]>
> To: Jason Hihn <[email-masked]>

> ...
> ...

> That is fascinating.  I read my mail with Pine.

Other, more common MUAs are either configured by default to ignore
javascript in mail or can be easily set to ignore scripts (e.g. Netscape 7).
(I use BSD `mail,` which is even older and less common than Pine.)

Turning off scripts in mail seems like obvious precaution for anyone
using a Microsoft operating system.

> > seen between start and finish.

No, that is wrong.  A filter can decode the SMTP body exactly as it
will be decoded by the MUA.  If the MUA can decode the message enough
to present it to the user, then so can the filter.  The filter and
the MUA can share common code to do the decoding.  If the filter cannot
decode the message, then neither can the MUA.  There is no magic.
Computer programs are deterministic.  They do the same thing given
the same input.  They do not care if a human or some other program is
looking at their outputs.

Again, as I said before, it is now fairly common for spam body filters
to do at least rudimetary HTML decoding, so that they base their filter
decisions on something close to what the user will see.  It turns out
to be fairly easy to decode a lot of HTML, which is why the leading
edge of spam has stopped using <!--HTML comments--> and switched to
URLs pointing to the content.

This sort of HTML and script decoding can be done as part of the processing
of the SMTP DATA command so that an appropriate SMTP status code can be
given.  This sort of thing is the purpose of sendmail milter filters.  I
don't know of any sendmail milters that decode (i.e. execute) Javascript,
but there is no technical reason preventing it.  Common SMTP client
timeouts are long enough to let an SMTP filter follow links in HTML
messages and use whatever they produce to affect filtering.

> ...

Which would be a good thing.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Tony Preston" <[email-masked]>
Date: Mon, 31 Mar 2003 15:24:48 -0500

> From: Kee Hinckley <[email-masked]>
> Subject: Re: [Asrg] Fwd: Returned mail: see transcript for details
>
> At 11:59 PM -0700 3/30/03, Vernon Schryver wrote:
> >This little drama is related to the spam problem.  There is a
component
> >of human nature that hates purposefully not being heard.  Senders of
> >bulk advertising are often irrationally upset about being filtered.
>
> You skipped from "humans" to "senders of bulk advertising" very
> nicely there.  You weren't cutting off a sender of bulk advertising.
> You've also missed the other side of that obvious
> statement--purposefully not hearing someone is considered socially
> rude.  I've had people do that to me more than once--typically after
> accusing me of spamming or some other activity that I didn't do.
> Someone else on the list put that behavior in exactly the context it
> belongs.  "Nah, nah... I can't hear you!"  Typically with fingers in
> ears and tongue sticking out.  The word you are looking for is
> "juvenile."
>
> This whole conversation has been very educational.
>
> Several times now we have seen people using tools meant for stopping
> spammers, as a way of stopping normal human conversation.  And they
> are doing so without even the common courtesy of notifying their
> correspondent.  In the real world you would say, "I'm sorry, I don't
> want to talk about this any more," or "This will be my last message
> on this subject."  If the correspondent continues to respond, then
> you ignore them.  But somewhere along the line the hardcore spam
> fighters have gotten so used to blocking messages that they believe
> it's socially acceptable to just bounce people's email when they feel
> like it.  They have a hammer, and they've decided to use it on
> anything that looks like a nail.
>
> If this is going to be typical of people's use of anti-spam tools
> then I think we should give some serious thought to the UI of such
> tools.
I find this attitude hard to believe!  If I am subject to unsolicited
email,
I have the perfect right to block future attempts to continue this
practice.

I liken this to someone being invited into my home to sell me on selling
Amway....  I invited them (Opt-In), and I can uninvited them(Opt-Out).
I do not however, have to accept them continuously returning to my
home after I have uninvited them (Opt-Out) or to show up unsolicited.

I feel the same way about lying or stealing (forged FROM:, Misleading
subject),
or Fraud (here, you can opt-out, but I will sell your email to
others)...  I
should not have to respond to what I consider a criminal act in some
cases
with "common courtesy".

How would you react to me calling you collect to sell you my collection
of bottle caps and match books?   After all, you did visit my web
site...

I wish I had a hammer to hit back at the spammers, instead I have only
a few wet noodles at my disposal.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 31 Mar 2003 15:36:32 -0500

>depending on client-side software.

The percentage is high enough that spammers don't care about those 
that don't.  I've seen more than a few Javascript encoded email 
messages.  It seems to be most common for illegal scams (like 
attempts to get your credit card) where they want to keep a web site 
running for long enough to collect some cards.  The encryption 
presumably means that it takes longer before someone technical enough 
to deal with the message can find the actual web site.

I actually went so far at one point as to build a fake IE DOM in a PD 
Javascript interpreter so that I could automatically decrypt the 
messages.

>	IF body contains "javascript THEN bounce.

Unfortunately there are a number of commercial companies out there 
selling "active email" products.  Basically these are services that 
let you, for instance, send out a party invitation where you don't 
have to go to the web site to respond.  The list of who has 
subscribed, and the forms to subscribe are all in your email, and 
change dynamically each time you read it.  Those products include 
javascript in the email.  The usual content-filter problem.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg