Subject: [Asrg] Re: On the need for reliable, objective data

From: "David F. Skoll" <[email-masked]>
Date: Fri, 7 Mar 2003 12:31:00 -0500 (EST)

[List volume too high; I've switched to digest mode]

From: "Gary Feldman" <[email-masked]>

> I've seen a number of posts containing statements of the
> form "most spam does X", "most spammers do X", "most of
> the cost is X", "many users need X", etc.

> Does the ASRG have a need for more reliable data to
> either confirm or refute statements of this sort?

Yes!

> If so, there are at least two tactical questions:

> How should such data be managed, stored, reviewed,
> made available to the public, etc?

I think a mechanism similar to DCC could be good.  We need a way for
lots of sensors to dump information into the collection network.  We
need a way to decide what summaries of the data are useful.  And we need
a way to extract the data without compromising privacy.  (e.g., report
SHA1 hashes of addresses rather than addresses themselves.)

> What data is needed and how should it be collected?

I think some useful data would be the following:

- Number of RCPT commands from a given IP
- Number of RCPT commands from a given IP that fail due to unknown recipient
- Number of DSN's that bounce, correlated with originating IP.  It might
  be dangerous to put too much stock in this statistic, as others have
  pointed out.
- Number of IP addresses from which a "substantially similar" message is
  received within the last x hours.  (Getting the same message from a
  lot of different IP's might be an indication of spam.)  Collecting
  this data should be a simple modification of Razor or DCC.

We have to look at what we, the recipients, control, and only trust that.

The spammer controls:

- The sender address, so that's worthless as a filtering tool.
- The message headers and body, so checksum schemes can be defeated
  relatively easily, as can most content-filtering techniques.  (Sorry,
  guys; them's the breaks.)
- The originating IP address.  This is pretty difficult to fake.
- The reverse-DNS of the originating IP address.  Depending on the situation,
  this might be very easy or a little expensive to fake.  If you're spamming
  through thousands of open-proxies, it's probably more trouble than it's
  worth to try to fake the rDNS entries for them all.  If you're sending from
  your box, it might be worth your time to get it to look like
  smtp-out.yahoo.com.

We control, or can conceivably control:

- The response from our SMTP servers.
- Our own e-mail addresses.
- To some extent, the spammer's mailing list, via responsible poisoning.

<soapbox>
I think any scheme that relies on things beyond our control is doomed.
My proposals (1) to look at bounce ratios across a wide proportion of the
Internet, (2) to implement a simple way to generate and use disposable
e-mail addresses, and (3) to use responsible list-poisoning, are, I think,
useful because they actually do things that are expensive for spammers to
sidestep.
</soapbox>

--
David.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 7 Mar 2003 13:08:59 -0700 (MST)

> From: "David F. Skoll" <[email-masked]>

> ...
> ...

I think I'm qualified to comment on that idea.  The short version of
my take is "great in theory but nearly hopeless in practice."

The hopeless part is that in practice it is extremely difficult to
build a network large enough to collect enough data to be other than
a muddy pile of annecdotes.  The DCC is more than 2 years old, but it
still sees at most single-digit percentages of all mail in the network
and perhaps less.  (I suspect there are more than 1 but probably fewer
than 10 Billion mail messages/day today.  The DCC sees perhaps 20
M/day.) The DCC has been deployed by only some classes of outfits.
For example, it has not be and probably will not be used by the largest
organizations that prefer to roll their own solutions.

Even in the skewed population that does use the DCC, there is evidence
that making generalizations is very hard.  There is 3X difference in
spam load per user depending on organization type judging from
http://www.dcc-servers.net/dcc/graphs/comp-rates

There are reasons of self-interest for outfits to install the DCC,
but few or at best weak reasons for installing monitoring software
that would report to outsiders.  There are strong reasons for many
outfits to flatly refuse to install such software; that's why the DCC
is designed to not collect a lot of the information that one would want.

DCC clients can report and DCC servers can collect hashes of addresses,
but that's dangerous unless (or even if) you think carefully about what
the servers will do with the data.  Consider the dangers of being able to
ask whether the system has seen a message with a sender of the hash of
"Bill Gates" and at recipeint of the hash of "Steve Jobs" today.

(By default, DCC servers do not collect anything but body hashes for
several reasons, starting with the limited usefulness of those hashes.)

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg