Subject: RE: [Asrg] "worm spam" and SPF

From: [email-masked]
Date: Sun, 28 Nov 2004 05:24:01 +0000 (GMT)

> The worm attack on authentication schemes is a particularly bad one. I have 
recently joined the list, so I apologize if this has been discussed previously. 
But consider the following scenario: A new worm come out that uses infected 
machine's designated servers to send out mail. Say these mail servers have a SPF 
or DK record and further they enjoy good reputations on the various reputation 
services (since they mostly send out good mail). The recipient machines
do a SPF/DK check, it passes, they lookup the reputation, which checks out too, 
and deliver the mail bypassing all content-based filtration sub-systems. The 
recipient systems get infected. The smarter users start reporting the worm to 
reputation services, who in turn punish the senders. After a while the senders 
reputation drops so much that they are unable to send out legit mail.

Bingo.

I've been arguing PRECISELY this point for several years, and Wong (et al) still 
forge blindly ahead with SPF and other such equally braindead 
authentication/DNS-based schemes.

> This is bit of an extreme scenario, but a plausable one. Once it happens, 
spammers will adopt it and change the payload (worm + spam). 

Right, and they can do that literally overnight.  SPF and other such schemes 
SIMPLY DO NOT WORK because they DO NOT SOLVE THE PROBLEM.  They only force worms 
to use "real" return addresses and "approved" servers, but that accomplishes 
very, very little.

Meanwhile, the fine-grained permissions-list solutions which WOULD prove 
effective and constitute a MAJOR clampdown on viruses/worms/spam get largely 
ignored.

Go figure.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Frank Ellermann <[email-masked]>
Date: Sun, 28 Nov 2004 07:07:05 +0100

[email-masked] wrote:

> I've been arguing PRECISELY this point for several years,
> and Wong (et al) still forge blindly ahead with SPF

That would be at most two years if you'd count RMX as the
concept, and SPF as its realization.

> SPF and other such schemes SIMPLY DO NOT WORK because they
> DO NOT SOLVE THE PROBLEM.  They only force worms to use
> "real" return addresses and "approved" servers, but that
> accomplishes very, very little.

That's a contradiction.  First you say SPF doesn't solve "THE
PROBLEM", and then you say that SPF exactly does what it's
supposed to do.  Apparently your definition of "THE PROBLEM"
has nothing to do with SPF.  And your "solution" is to get rid
of MIME multipart resp. text/html, and mails bigger than 12 KB.

Your recipe won't help me against hundreds of bounces and other
crap like challenges caused by forged addresses unfortunately.

                            Bye, Frank