Subject: [Asrg] Re: SPF Abused by Spammers

From: Joshua Baer <[email-masked]>
Date: Sat, 11 Sep 2004 19:57:39 -0500

> <>On Fri, 10 Sep 2004, Markus Stumpf wrote:
>
> I don't mean to defend authentication as a means of spam reduction, as I
> don't think in the end it will be helpful. But I don't think proponents
> are stupid, it does have possibilities and might contribute to the
> solution. It rather depends on what institutions develope in response.
> Will reasonably large whitelists become available? I don't know. 

There is a considerable amount of momentum and money behind both 
commercial and open reputation services now in development. The current 
market leader is IronPort's Bonded Sender, which boasts adoption by tens 
of thousands of receiving domains and hundreds of senders. Participation 
in the program involves a detailed mail sending practices investigation 
by TRUSTe, privacy policy review, and posting of a financial bond 
against abuse (more symbolic than anything else - this is not a way to 
"pay for complaints" - bad senders are not allowed to stay in the 
program). Being bonded results in your mail being sent directly to the 
inbox (for the most part) and in the future will be a factor that causes 
images or links in the email to be displayed normally when other 
non-bonded messages will have their images and links munged by deafult.

Habeas has had their whitelist for quite some time and rumor has it that 
with new management and direction we can expect new options from them in 
the future. Goodmail has announced plans for a "postage" style model but 
has not launched the service yet. Cloudmark and MailFrontier and others 
have recently announced reputation services and newsletter registration 
services. Projects such as GOSSIP have sprung up from the open-source 
community. And there are a number of other projects in the works that 
have not been announced yet.

In my opinion, we are about to see a paradigm shift in mail filtering - 
from trying desperately to identify all the fraudulent mail and bad 
senders to spending much less time and energy keeping track of the good 
senders (who aren't trying to hide in the first place and will step 
forward to certify their practices and be held accountable). Reliable, 
well-maintained whitelists with detailed certification processes and 
transparent dispute resolution procedures will bring a much-needed 
dependability back to email deliverability.

This isn't an all or nothing approach. To start, having a good 
reputation will result in your mail going to the inbox and a bad one to 
the spam folder. Senders with no reputation will still be subject to all 
the spam filtering techniques that they are today. Over time, as more 
and more mail senders are authenticated and develop reputations, mail 
receivers will be able to "turn up the crank" on spam filtering for mail 
arriving in any volume or apply greylisting to senders without a known 
reputation. That's immediately useful because it allows legitimate mail 
with a good reputation to be reliably delivered (even in bulk) but makes 
it very hard to deliver any mail in bulk without a good reputation. I 
won't go into the zombie situation here, but I think that will be 
largely addressed by sender authentication and outbound port blocking.

If and when we reach a critical mass with sender authentication and 
widespread reputation, receivers will be able to take it a step further 
and subject non-authenticated mail to extreme spam filtering (or even 
outright rejection) and quarantine mail from senders with no reputation.

I really don't think domain hopping will get you anywhere in the short 
term or the long term. In the short term, it will just be one more tool 
in identifying bad senders more quickly (no worse than without 
authentication). In the long term, it could become a way to reject a 
large quantity of suspect mail with a lower false positive rate than we 
see now.

~Josh

---
Joshua Baer
SKYLIST, Inc.
Founder & CEO

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 13 Sep 2004 22:13:38 +0200

> ><>On Fri, 10 Sep 2004, Markus Stumpf wrote:

Please get your citation correct.
No I didn't, it was Daniel Feenberg

> non-bonded messages will have their images and links munged by deafult.

Wow. What a marketing concept. This is something even Microsoft can learn
from. Either pay us or we will destroy your email.

> have not been announced yet.

Yeah ... after 30 minutes of querying tons of whitelists, blacklists,
reputation systems, acceditation systems, burning tons of CPU cycles
calculating hashs, signatures and verifying grocery bills that will be
used in C/R systems your mail will be eventually accepted if you didn't
miss to upgrade all 456876 systems to the new protocol versions.
SCNR.

> dependability back to email deliverability.

This is there for ages, it is called PGP and S/MIME. Write an intelligent
MDA/MUA that helps you manage your personal accreditation and deploy the
use of PGP and S/MIME and you have a perfect criteria for your filters.
Ah, I remember, there was a problem we need intelligent MDAs/MUAs, but
all we get is
    http://weblog.infoworld.com/udell/2004/03/23.html
And we need some non broken software that stops mangling messages and
destroying signatures, by adding e.g. braindead trailers (in a not MIME
conform way).
But I agree, it is so much easier to write new broken software than to
fix existing broken software. I don't want to insult all programmers of
those new tools, but a good portion of the new tools will be broken.
That's simple statistics.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: Florian Weimer <[email-masked]>
Date: Tue, 14 Sep 2004 14:35:54 +0200

* Joshua Baer:

> commercial and open reputation services now in development. The
> current market leader is IronPort's Bonded Sender, which boasts
> adoption by tens of thousands of receiving domains and hundreds of
> senders.

IronPort has repeatedly blocked the outgoing mail servers major German
mail providers (even though they appear to have a handle on their
abuse situation).  At the same time, IronPort licenses its technology
to competitors of said mail providers.  Do you really think this is
going to work in the long run?

These reputation-based systems have two significant problems: Its
participants can suddenly start sending vast amounts of spam, and it
hasn't to be their fault, really.  Maybe a hard-to-fix weakness in the
account generation procedure is exploited, or a software company has
distributed software with an easily exploited defect to a lot of
customers.  I'm not sure if you want to penalize such incidents, and
how you can still kick out the real non-compliers.

The other problem is that Internet technology as a whole is not
resistant to competent, organized crime.  Right now, spammers can
achieve their goals by targeting end systems.  Suppose we magically
take all those consumer Windows machines out of the equation.  How
likely is it that spammers target something else instead, for example
global Internet routing?  Currently, spam is a in the more popular
areas of the Internet, but it doesn't have a profound impact on its
core yet because spammers can get conduct their business with less
drastic measures.  I really don't like the implications of an arms
race.  And don't say that there are safeguards that would prevent
this.  There aren't.  BGP hijacking is already a problem, and there
are some indications that spammers already experiment with it.

Of course, some spam fighters want exactly that: total escalation and
annihilation.  But such a catastrophe will only take us technicians
out of the loop because we have proven that we can't cope with the
problem.

In short, I'm not sure if technology-based spam fighting is a terribly
good idea.

---

From: "Tim Bedding" <[email-masked]>
Date: Fri, 17 Sep 2004 17:21:22 +0100

Florian

> how you can still kick out the real non-compliers.

Surely, it is not beyond the wit of man to design a system that
monitors email sending and triggers a suspension when something
suspicious occurs. Then an ISP or other body could be in good
standing.

The problem of things like IronPort is the lack of uptake at the
moment. Hopefully, that will change with time.

Regards
Tim

Crusade - Patterns of the Soul
Gideon: There's a benefit in knowing people in
  high places.

---

From: "Mark C. Langston" <[email-masked]>
Date: Fri, 17 Sep 2004 10:18:58 -0700

> suspicious occurs. Then an ISP or other body could be in good

Sounds like time for a plug. ;)

I've been very quiet lately, because I've been killing myself trying to
finish an initial release of GOSSiP.  GOSSiP does more-or-less exactly
this:  It observes behavior, it rates behavior, it shares ratings with
others, it obtains ratings from others, and it also observes the
behavior of those sharing ratings.

Unlike commercial solutions, it's free (as in speech).  It's also free
as in beer for use -- no money changes hands, so there's no motivation
to bias results.  Even if results are biased, the checks and balances
built into the project allow those trying to cheat to be detected
quickly and marginalized.

I made the mistake the other day of mentioning a specific date for a
specific release event, which -- as always happens with such things --
came and went without the release event occurring.  However, I'm close
to a first release.  There's a working Postfix policy agent, written in
C, that communicates with a GOSSiP node via SSL.  There's a working
GOSSiP node, sans the peer communication code, which I'll be adding just
as soon as I finish hacking around an OpenSSL limitation I'm dealing
with.  There's a working feedback agent that automatically forwards the
spam rating from SpamAssassin to a GOSSiP node, also via SSL.

The main delay at this point is trying to add non-SSL functionality in
such a way that it won't require a major code rewrite, nor a major
architectural change.

As it now stands, it's an excellent standalone tool for tracking
reputation for incoming email; I've quickly built a database of several
tens of thousands of unique identities (in GOSSiP, an identity is the
connecting IP plus the RHS of the RFC2821 MAIL FROM: address), with a
history of spam/ham behavior, and a reputation score based on a
sigmoidal function.  The system also currently aggregates identities
when SPF is advertised for the domain part of the ID, allowing for
a single reputation across all senders associated with the SPF record
(which has come in surprisingly useful for catching spammers).

The URL's in my signature, and I could really use some active
programming contributions, if anyone's interested.
-- 
Mark C. Langston            GOSSiP Project          Sr. Unix SysAdmin
[email-masked]   http://sufficiently-advanced.net    [email-masked]
Systems & Network Admin      Distributed               SETI Institute
http://bitshift.org       E-mail Reputation       http://www.seti.org