Subject: RE: [Asrg] Sendmail CEO Backs Yahoo DK and MS CID

From: "Chris" <[email-masked]>
Date: Mon, 1 Mar 2004 17:48:59 +1030

> >>Trojaned machines - by their nature authenticated
>
> No, not actually. The authentication process is SMTP server to
> server,

No when I say trojaned machine I mean someone places a trojan on my machine
and then sends email on my account

my server will of course authenticate the email as having come from me (and
itself)
the server doesn't know my machine has been compromised.

I didn't send it, some spammer who took over my machine did.

> so unless the trojaned system has access to an open relay which is,
> nevertheless, properly accounted
> for in the SPF/Caller ID DNS entries, the trojan will need to
> have proper SMTP AUTH
> credentials to some server. They don't currently work this way,
> and it seems unlikely
> that an administrator would leave relays open but implement
> domain-level SMTP
> authentication.

just because an ISP upgrades to the latest version of Sendmail does not
automatically make him security wise
many open relays are created by inept or lazy managers, and like spammers
they wont go away.

> >>Open Scripts - Authenticated by the insecure server (sendmail)
>
> See first answer

Same answer as trojaned

If my website had an insecure script on it (formmail) and someone uses it to
send e-mail. again it is authenticated as coming from my account.

sendmail says "yeah I know that guy" so I will authenticate the email.

> but there would still be IP-based blacklisting and the
> fact that would have to
> operate out in the open.

I am personally against blacklists

but at least with server identification blacklists can narrow their targets
to the actual offending server, as opposed to the scattergun approach they
have now.

If "Blocklists" were to become viable in my opinion they would have to be
formalised

and again the argument arises that one mans spam is another mans erectile
enhancer

People actually use spam the same as my wife uses junkmail.

Just because someone personally won't accept any form of spam does not mean
the next person has to bow to their wishes.
this is effectivally censorship which I am totally against.

Regards
Chris

> -----Original Message-----
> From: Larry Seltzer [mailto:[email-masked]]
> Sent: Monday, 1 March 2004 1:07 PM
> To: 'Chris'; 'ASRG'
> Subject: RE: [Asrg] Sendmail CEO Backs Yahoo DK and MS CID
>
>
>
> >>Uncloseted spammers - eg sheck-buy, authenticated cause they don't care
> >>Third world spammers - sender authenticated but legally out of reach
>
> Yes, definitely, and this is why blacklists (or the new PC term
> "blocklists") are
> important in an SMTP authenticated world. Unlike now, such lists
> could be accurate and
> authoritative. It's possible that spammers could buy and use
> large numbers of throwaway
> domains, but there would still be IP-based blacklisting and the
> fact that would have to
> operate out in the open.
>
> >>Open Scripts - Authenticated by the insecure server (sendmail)
>
> See first answer
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> [email-masked]
>
>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Larry Seltzer" <[email-masked]>
Date: Mon, 1 Mar 2004 06:12:09 -0500

>>No when I say trojaned machine I mean someone places a trojan on my machine and then
sends email on my account

None of these trojans work that way, at least not since Melissa or sometime about then.
They all use built-in SMTP code to send mail on behalf of the user. The reason is that
Microsoft closed this hole in Outlook and Outlook Express several years ago, and any
version of either (since Outlook 98) that's been patched since about 2000 or 2001 blocks
external programmatic access and access to the address book without explicit end-user
approval. If you'll read the analyses of how these things work you'll see that they
don't use the MUA, they *are* an MUA. 

If you know of a trojan that does what you claim please give me a specific example, or
tell me how it would work. But they don't bother with the user's credentials because
they don't have to.

Larry Seltzer

---

From: "Larry Seltzer" <[email-masked]>
Date: Mon, 1 Mar 2004 10:49:34 -0500

>>The trojan could always read this data [[address book?]] directly. I don't think they
can block that.

And that's what they do, although the typical pattern is that they read .wab, .htm*,
.txt, maybe .doc files, and scan them for e-mail addresses. Interesting, but not
relevant to the main issue of authentication, except that to the extent that these worms
read these addresses to determine from: addresses for their propagation, they are even
less likely to spread through SMTP authentication.

>>Swen. But I don't think it uses data from Outlook or Outlook Express. It simply pops
up a Window asking the user for his credentials. 

A copy of this dialog box may be found at
http://securityresponse.symantec.com/avcenter/graphics/[email-masked]. I have a
hard time believing. I doubt many people remember their SMTP server credentials offhand,
since they are usually stored by the MUA for automatic use. 

But anyway, if that's the best they can come up with I'm still sure that worm spreading
would be cut dramatically. What they'd really need to do is to find ways to crack the
SMTP AUTH credentials from the various MUAs that might be on a system.

Larry Seltzer

---

From: "Peter J. Holzer" <[email-masked]>
Date: Mon, 1 Mar 2004 18:55:32 +0100

On 2004-03-01 10:49:34 -0500, Larry Seltzer wrote:
> .txt, maybe .doc files, and scan them for e-mail addresses.

Yes, but I was thinking of configuration data and credentials.

> would be cut dramatically.

Before Swen I would have agreed. But Swen spread quite rapidly, so
apparently there are enough people who don't get suspicious if the get
asked to enter their credentials out of the blue, and either remember
them offhand or hunt down that piece of paper they noted it on (or call
their ISP's hotline to find out).

> What they'd really need to do is to find ways to crack the

Which probably isn't that hard for some MUAs. Netscape 4 just stored
them in the preferences file (base64-encoded). Older versions of Eudora
did the same (don't know about current ones). I don't know about Outlook
and Outlook Express, but I would not be surprised if the information was
stored somewhere in an easily decodable format. Mozilla is as good as
you can possibly get: The credentials are stored encrypted (IF the user
entered a "master password") and are only decrypted if needed. But while
the MUA is running, it keeps the master password in memory, so another
process running as the same user could get it and then decrypt the
passwords. (disabling the ptrace system call or its equivalent on
non-unix platforms might help).

	hp

-- 
   _  | Peter J. Holzer    | I think we need two definitions:
|_|_) | Sysadmin WSR       | 1) The problem the *users* want us to solve
| |   | [email-masked]         | 2) The problem our solution addresses.
__/   | http://www.hjp.at/ |    -- Phillip Hallam-Baker on spam

---

From: "Larry Seltzer" <[email-masked]>
Date: Mon, 1 Mar 2004 14:04:47 -0500

>>Yes, but I was thinking of configuration data and credentials.

Right, but this information isn't sitting in plaintext files waiting to be read. It's
not obvious how you'd get it if you were a worm.

>>Before Swen I would have agreed. But Swen spread quite rapidly, so apparently there
are enough people who don't get suspicious if the get asked to enter their credentials
out of the blue, and either remember them offhand or hunt down that piece of paper they
noted it on (or call their ISP's hotline to find out).

Swen doesn't need this information to spread. Apart from sprading through
non-authenticated SMTP servers, it uses network shares, KaZaA, IRC and Usenet. It's not
at all clear a lot of people entered that information.

>>>> What they'd really need to do is to find ways to crack the SMTP AUTH 
>>>> credentials from the various MUAs that might be on a system.
>>Which probably isn't that hard for some MUAs. Netscape 4 just stored them in the
preferences file (base64-encoded). Older versions of Eudora did the same (don't know
about current ones). I don't know about Outlook and Outlook Express, but I would not be
surprised if the information was stored somewhere in an easily decodable format. Mozilla
is as good as you can possibly get: The credentials are stored encrypted (IF the user
entered a "master password") and are only decrypted if needed. But while the MUA is
running, it keeps the master password in memory, so another process running as the same
user could get it and then decrypt the passwords. (disabling the ptrace system call or
its equivalent on non-unix platforms might help).

Both Outlook and OE store the data in the registry in some sort of obscured format. I
don't know the scheme and I doubt they're telling.

Bear in mind, if a worm were to spread itself this way, it would be completely
traceable. This too would help to stop them.

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 1 Mar 2004 10:47:04 -0500 (EST)

"Chris" <[email-masked]> wrote:

> itself) the server doesn't know my machine has been compromised.
>

That depends on your configuration.  I don't store keys or passwords
anywhere Windoze can get hold of them.

Even for those who do, this makes detecting and blocking them easier,
since the ISP can filter its own email servers.

> If "Blocklists" were to become viable in my opinion they would have to be

They are viable: they exist and are used.  They aren't perfect, but
those who use them choose to do so anyway.

> and again the argument arises that one mans spam is another mans erectile

You shouldn't use a blocklist that you don't want to.

> the next person has to bow to their wishes.

The next person doesn't have to use my mailserver, he can buy service
 from someone else or run his own.

> this is effectivally censorship which I am totally against.

My toys, my rules.

Seth

---

From: "Peter J. Holzer" <[email-masked]>
Date: Mon, 1 Mar 2004 15:34:16 +0100

On 2004-03-01 06:12:09 -0500, Larry Seltzer wrote:
> approval.

The trojan could always read this data directly. I don't think they can
block that.

> If you'll read the analyses of how these things work you'll see that they

They are also the MTA.

> If you know of a trojan that does what you claim please give me a
> specific example, or tell me how it would work.

Swen. But I don't think it uses data from Outlook or Outlook Express. It
simply pops up a Window asking the user for his credentials. 

> But they don't bother with the user's credentials because
> they don't have to.

They don't have to, currently. But if LMAP, MTA-Mark or blocking of port
25 becomes widespread, they will have to. 

	hp

---

From: "Sami Suomalainen" <[email-masked]>
Date: Mon, 1 Mar 2004 20:24:26 +1000

> this is effectivally censorship which I am totally against.

This is one thing I have been thinking lately. We want to get rid of
spam - sure - but surely there is a place for legitimate advertising on
the net. I am wholeheartedly for increased authentication so that we
know at least better than now who has sent each email. That way we can
start better targeting the worst spammers.

As you can guess from the above comment, my background is in marketing.
However, I am totally against Martha Siegel type of spammers who care
about nothing else but themselves and money, who cares if you clog the
whole net in the process?? That's how these guys think. I believe there
is a place for marketing on the net, even via email, and I believe we
could make it more acceptable too. A simple solution would be to add a
'marketing tag' (and possibly other tags showing what kind of product is
offered) into emails so that these emails could be bounced back to the
sender automatically if the recipient has indicated that s/he doesn't
want that kind of advertising. Idealistic? Perhaps.

In addition, I believe marketing messages should be made at the same
time subject to charges, and these charges would be used for getting
better stuff for users, similarly to TV advertising bringing better
programmes.

I know this is idealistic but I just wanted to bring a responsible
marketing view into this discussion (most of the people here are
probably more technical?). I believe all of the above would be great for
both users and marketers if it could be implemented. There is a minority
of marketers who would ever even consider spamming, but unfortunately
those few who do make the whole industry's reputation bad.

Cheers
Sami

---

From: "Larry Seltzer" <[email-masked]>
Date: Mon, 1 Mar 2004 17:17:49 -0500

>>...responsible marketing view ...

Nothing in SPF, CID or DK would stop a legitimate marketer from sending e-mail that
authenticates properly. Actually, nothing stops them from sending it unsolicited either,
but since the addresses would be verifiable users would be able to block them
effectively. If they didn't block you, they would get your mail.

Larry Seltzer

---

From: Bill Cole <[email-masked]>
Date: Mon, 1 Mar 2004 17:52:15 -0500

At 10:49 AM -0500 3/1/04, Larry Seltzer wrote:
>Interesting, but not

Are you unfamiliar with Swen?

Since 9/19/03 I have received 3621 copies of Swen from over 1700 
unique IP addresses carrying 1651 unique envelope senders, and that 
only counts the ones aimed at my 'main' account. That number of held 
down by the fact that mail to that account has a very draconian 
SMTP-level blacklist in front of it as well as router-level 
protections which together shun mail from most of Asia and large 
pieces of the rest of the world, and I also use a number of the more 
conservative public blacklists. It is a rare day when I do not see a 
handful of new Swen sources. At one point the rate of Swen coming out 
of Charter's mailservers was so high  that my only defense to keep my 
mail server usable for anything I wanted was to block that part of 
their network at the router level. It took less than2 days for their 
user population to reach that level of infection from the initial 
sightings of Swen.

Swen arrives with the real address of the infected user in the SMTP 
envelope and a bogus address that often claims to be from Microsoft 
in the From header. It arrives NOT from the actually infected 
machine, but from the normal outbound mailserver of that user's ISP 
or employer (or wherever they normally pass their mail.) That dialog 
you saw, as incredible as it may seem to you, demonstrably does its 
job quite well. The only other explanation would be that Swen is 
instead managing to dig credentials out of wherever Outlook Express 
stores them OR that it is using some programmatic means of getting 
the OS to send mail for it using the OE config and saved credentials, 
and that it is only presenting the dialog as a bit of misdirection 
for anti-virus folks. Unless a couple of ISP's have been lying to me 
without prompting (both volunteered that they require SMTP AUTH in 
asking me to stop blocking their servers,) Swen does indeed get 
through machines that require SMTP authentication.

Swen and more recent worms have provided rather solid proof that the 
most vulnerable attack point is between the keyboard and the chair.

-- 
Bill Cole
[email-masked]

---

From: "Chris" <[email-masked]>
Date: Tue, 2 Mar 2004 09:37:40 +1030

Hi Guys

thanks for all the input

But bogged down in detail here!!!!!

the point of my email is Spammers don't give up and die (die die die)

they mutate into something else

if the world is about to adopt yahoo and M$ authentication systems I say
great.

BUT

Spammers will persist. if we are one step ahead it makes their life a lot
harder

So we should look at what spammers will be doing post authentication.

the examples I included were just that examples. They may not have been all
that accurate.

Regards
Chris

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Bill
> Cole
> Sent: Tuesday, 2 March 2004 9:22 AM
> To: [email-masked]
> >http://securityresponse.symantec.com/avcenter/graphics/w32.swen.a
> @mm.5.gif.
> >I have a

---

From: "Chris" <[email-masked]>
Date: Tue, 2 Mar 2004 09:58:13 +1030

> under a restricted access account, chances are he will be running
> Windows with administrative access and Outlook or Outlook Express.
> Nothing against Microsoft, but statistically most desktops in the world
> run Windows. Chances are that the use is stupid enough to click on the
> MyDoom virus in his inbox. At this point the virus has full
> administrative access to his machine.

Micro$ofts security model is so badly broken that it is nigh impossible for
a regular user to set up his machine in anything other than Administrative
access

If you don't registry access is blocked to most programs and they die, often
horribly.

I gave up securing a M$2000 machine because all her programs broke.

I now regularly clean the machine from virus's and I hope I have convinced
her to stop using Kazaa

trojans are here to stay!

It would also be fair to say that we could solve spam overnight by outlawing
Micro$oft bloatware (TIC)

Regards
Chris

OT

Microsofts biggest problem is the registry. A great idea that went horribly
wrong. They have invested so much into it they won't change it.

> From: Yakov Shafranovich [mailto:[email-masked]]
> Sent: Tuesday, 2 March 2004 9:41 AM
> To: Larry Seltzer
> Cc: 'Chris'; 'ASRG'
> Subject: 2a .BCP - Handling Trojaned machines
>
>
> Larry Seltzer wrote:
> server, so unless the
> > trojaned system has access to an open relay which is,
> One of the big ISPs I spoke to claims that 80% over their incoming
> traffic is coming from other ISPs' MTAs, which are used by trojaned
> machines to send mail, NOT by trojaned machines sending mail directly.
> No SMTP AUTH is used - the mail is send directly to the ISP's MTA and
> the ISP trusts the incoming connection because they know they our IPs.
> The question is why aren't they doing rate limiting, and I will
> get to that.
>
> But you should step back for a second. There is a basic principle in
> security - if you have physical access to the machine, then you cannot
> secure it. Unless the user is running some old copy of MS-DOS or Linux
> under a restricted access account, chances are he will be running
> Windows with administrative access and Outlook or Outlook Express.
> Nothing against Microsoft, but statistically most desktops in the world
> run Windows. Chances are that the use is stupid enough to click on the
> MyDoom virus in his inbox. At this point the virus has full
> administrative access to his machine. If the virus writer is smart
> enough, he might even make it a root kit, so the virus will have full
> access to all layers of the operating system.
>
> Now the user  will be using some form of authentication method be it
> SMTP AUTH with passwords, Verisign's or RSA's hardware tokens, smart
> cards, etc. Now we assume that the user does not have to do the
> authentication process every time he does his email, but rather his
> client or OS caches the password. The virus having full control of the
> machine, can very easily "piggy back" on that authentication process and
> send spam via the user's regular account.
>
> LMAP proposals do stop trojaned machines from sending email to other
> machines and claiming to be from someone else's domain. That's all they
> do - they do not stop spammers from using their own domains, or relaying
> via user's credentials. Granted this narrows down the playing field, but
> we still need to look at ways to be able to detect a malicious machine
> relaying email via a throwaway domain or via the user's own account. At
> this point all of the LMAP proposals are going to be discussed at the
> BoF, and if the IETF creates a WG for them after this week's meeting,
> than it will be out of scope for the ASRG.
>
> Now going back, how do you detect malicious machines relaying mail for
> throwaway domains or via the user's account. One way is via MTA MARK
> which does cause problems for users who want to run their own MTAs. But
> the argument is - if you want to run your own MTA, you must take
> responsibility for it. Another way is via reputation/accrediation
> schemes, but it remains to be seen if they will be administrated
> properly and fair unlike many of today's blacklists.
>
> However, we must not lose the sight of the fact that the one known fact
> about spam coming from the hijacked machine is the IP. The network
> hosting the IP should also be responsible for implementing some kind of
> scheme to deal with trojaned machines. One way to approach this issue is
> to detect large spikes in email traffic and queue the mail temporarily
> alerting the user. In regards to this specific method, we are currently
> looking for volunteers to write a BCP on this and other methods of
> dealing with hijacked machines from the originating network's point of
> view.
>
> Yakov
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 01 Mar 2004 18:11:12 -0500

Larry Seltzer wrote:
> No, not actually. The authentication process is SMTP server to server, so unless the
> trojaned system has access to an open relay which is, nevertheless, properly accounted
> for in the SPF/Caller ID DNS entries, the trojan will need to have proper SMTP AUTH
> credentials to some server. They don't currently work this way, and it seems unlikely
> that an administrator would leave relays open but implement domain-level SMTP
> authentication.

The question is why aren't they doing rate limiting, and I will get to that.

Yakov

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 01 Mar 2004 21:53:05 -0500

Bill Cole <[email-masked]> wrote:
> .. Swen does indeed get 

  Yup.  But look at it from this point of view:

  a) You now have a small number of MTAs to block, versus a large
     number of MUAs (if the virus had it's own SMTP engine)
  b) the MTA owners who care fix the problem, and it stops.
  c) The MTA owners who don't care are either blocked, or spend
     thousands of dollars upgrading their system to handle the load.
     So they're being punished for being idiots.  Nice.
  d) If they don't spend the money to upgrade their MTAs, then *their*
     MTA goes down when a new virus comes out, and *mine* doesn't.

  Everybody wins.

  As for the issue that spammers can register more domains, and
publish LMAP information:

  a) it costs them money
  b) the domains have to be relatively long-lived to be useful, and
     long-lived domains can be discovered, and blocked
  c) If they register a huge number of domains, it's incentive to
     block *all* domains which are hosted on a particular DNS server
     (IP or network).

  It's also possible to use rDNS to grab LMAP-style information for an
IP.  One useful piece of information is a list of domains (or DNS
servers) whic are allowed to publish LMAP information for that IP.  If
LAMP for a domain in the SMTP envelope says "This IP is OK to send
messages!", and the rDNS owner says "I don't know who the heck that
domain is", the recipient can treat the message with great suspicion.

  That concept negates a lot of the objections to LMAP.

  Of course, it requires cooperating parties.  But if no one agrees to
cooperate to fight spam, then we'll never address the problem.

  Alan DeKok.

---

From: "Tom Thomson" <[email-masked]>
Date: Tue, 2 Mar 2004 10:53:45 -0000

> A copy of this dialog box may be found at
http://securityresponse.symantec.com/avcenter/graphics/[email-masked].
I have a
> since they are usually stored by the MUA for automatic use.

I don't agree with you.  People don't bother to remember credentials for
machines behind adequate firewalls, having no publicly meaningful IP
address, with anti-virus and anti-intrusion stuff mounted on the Exchange
server (or non-MS equivalent), and good anti-virus stuff running on the
desktop.  In less secure environments, a lot of people do remember
credentials (and most people I know have desktops in both secure and
insecure environments, and let the MUA store credentials in one and not in
the other).

It is even possible to set up Outlook Express so that it CAN'T remember
credentials even if you ask it to (I did this on some machines, and can't
remember how to turn it off to allow the MUA to remember credentials - which
is a pity as some of those machines are now in clean envirenments).

---

From: "George Ou" <[email-masked]>
Date: Tue, 2 Mar 2004 12:18:10 -0800

> insecure environments, and let the MUA store credentials in one and not in

Although I definitely agree with the security precautions that you take, I
think it is extremely unlikely that the average user will be as
knowledgeable and diligent as you and computer savvy friends.  The average
person is clueless that they even need a firewall at all.  The average
person stores their credentials on anything.  The average person is clueless
about security and that won't ever change.  The solution to any of these
problems is to attack the problem at the gateway, server, and standards
level.

I can't believe in 2004 we're still even talking about email viruses when
anti-virus gateway technology has been available for many years.  It's
amazing that people are still under the illusion that somehow if they scream
enough that they'll be able to convince the average user to not open
attachments when it's impossible for the computer masses to comply.  I've
not seen a single virus in any of my user's mail boxes in nearly 4 years
because of anti-virus gateway and server measures we took, yet people still
spend all their time attacking the problem from the end user's perspective.
It's about time all mail gateways and servers scan for viruses inbound and
outbound.  That is the only way to eliminate the virus problem.  I know MSN
and Yahoo already do this, and I never see viruses in my MSN account.

As for worm propagation, hopefully XP Service Pack 2 with it's simple
stateful firewall turned on by default will be implemented across all
Windows XP machines soon.  It will go a long ways to eliminate the DDoS
threat if 80% of the world's computers block all inbound traffic by default,
just like any of these SMTP authentication schemes if adopted will help in
the battle against SPAM.  At this point, I don't even care who's standard
wins, just as long as some kind of authentication scheme is standardized and
adopted by a critical mass.

Sorry for being slightly off topic.

George Ou