Subject: RE: [Asrg] DCC and IP checksums

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Mar 2003 10:24:45 -0800

> Reading some of the spams I receive I found that many of them seem
> to be sent with the very same software and address list. There are
> billions of spam, but only a few spamming tools. All it takes is just
> a simple software upgrade to the next version of the tools to defeat
> that hash method. Once spammers learn how to do it, all spammers will
> know how to do it. There is not significant number of "low-hanging
> fruit".

But consider what happens when you use mobile code to describe the 
hash function. You can respond to the circumvention techniques as
the spam senders apply them. 

This is how satelite TV companies keep card piracy at acceptable levels.
PThey don't shut off a pirate card immediately, they let a number
of customers develop then they kill it when doing so does maximum
damage to the pirate's reputation.

Even though the script kiddies do have access to ever better tools
the white hats are almost always ahead.

The apamware companies have a big problem that script writers do not,
they want to make money from their code. So it takes them much longer
to react than the opposition.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 10 Mar 2003 19:57:47 +0100

> damage to the pirate's reputation.

That's exactly the point why it won't work:

TV companies:
   Many attackers, few defenders only. It's like dogs hunting the
   rabbit. The rabbit can react on the moves of the dogs and
   can rapidly change it's way, run zigzag, and so on, because it
   can immediately change it's running direction without discussion.

Spam:
   Few attackers, many defenders. It's like a shark in a cluster
   of fishes. The rabbit's defense method will fail for the fishes.

   That's why adaptive hash techniques requiring the defenders to 
   change their "secret formula" or to upgrade their software
   continuously are doomed to fail. Sorry. 

Hadmut

---

From: "David F. Skoll" <[email-masked]>
Date: Mon, 10 Mar 2003 14:04:57 -0500 (EST)

>    of fishes. The rabbit's defense method will fail for the fishes.

No, not at all.  It works for *most* of the fish.

>    continuously are doomed to fail. Sorry.

It depends what you mean by "fail".  If you mean "never stop much spam",
then I think you're wrong.  If you mean "become ineffective after a certain
period of time", then you're right.

I haven't seen an anti-spam tool or proposal that's (a) practical and
(b) will retain its effectiveness for a long time (let's say more than
a year) without updates, and I'm not holding my breath.

--
David.

---

From: "David F. Skoll" <[email-masked]>
Date: Tue, 11 Mar 2003 16:12:26 -0500 (EST)

On Mon, 10 Mar 2003, Hallam-Baker, Phillip wrote:

> hash function.

Oh, yes, let's consider that.

You have enormous security violations all over the Internet.

"Mobile Code" is a non-starter from a security standpoint.  I don't trust
sandboxes, and I don't think most SMTP server owners do either.

> damage to the pirate's reputation.

They have a closed system and can trust their own mobile code.

> to react than the opposition.

From my observations, a lot of simple anti-spam tricks that worked a
year ago (and are even widely-known, e.g., as part of SpamAssassin), still
work pretty well.  So I think you have a point about the reaction time.