Subject: Re: [Asrg] "worm spam" and SPF

From: [email-masked]
Date: Sun, 28 Nov 2004 05:18:01 +0000 (GMT)

>> As everyone probably knows, there is a pretty large outbreak going on 
> right now. According to our mail filters at http://aves.f-prot.com,
> 10.56% of all filtered E-mail contains W32/Sober.J@mm.  In addition,
> there is a significant number of bounces as well.  

> We've reached 1.5 GB an hour of this s**t since Tuesday. Only our AV 
calls it Sober.I@mm.

> I agree, bounces are the very evil of the net itself.

Bouncing "infected" mail makes NO sense.

Most of the time, the mail is bounced to a counterfeit/bogus "from" address 
where it COMPOUNDS the damage done by the worm, either by mailbombing someone 
who is THEMSELVES a victim, or at least their ISP.  I've also had bounces go 
back to Yahoogroups (a major mailer, to say the least) who then disables MY 
E-mail address because "their" mail to me "hard bounced".  :-((

A-V software, AT A MINIMUM, should NEVER bounced "infected" mail for cases where 
the recognized virus/worm in the mail being bounced is KNOWN to use counterfeit 
From: addresses!

> Where I'd have to disagree is here:

>> * Doing SPF checking will block the vast majority of the worms, but it
 >   will not help with the bounces or the filter alerts.

> It may block the vast majority of current worms, but I doubt it would 
stop the tide for long. VX-ers will find other ways of abusing infected 
victims.. they might even send out email using the user's own email account 
and/or email client.

Absolutely, and that's precisely why SPF (like the other equally braindead 
certification/identification schemes) is a non-solution for this problem.  
Virus/worm authors can (literally overnight) shift to using the real E-mail 
address belonging to the person whose machine they've infected, and just as 
quickly all their worm/spam messages will fly through SPF (and similar) 
domain-certification checks.  :-(  So we would have spent YEARS arguing over and 
maybe finally agreeing on and implementing something that literally overnight is 
rendered useless.  (And you know, the spammers love to get the last laugh like 
that, making everyone else look like the clueless idiots they are).

> As long as there are huge drone armies out there, and their likes - I 
don't see how spam solutions today would really work as people hope. 

There is ONE solution that virtually eliminates the worm/virus problem.  And 
that is the simple, effective, fine-grained permissions list... where the 
default is to (by default) not accept messages that:  (1) are bigger than some 
limited size (say 10K-25K), (2) contain attachments, and/or (3) contain HTML. 
unless the trusted sender of those "enhanced" features has been approved to send 
those riskier/bulkier E-mail formats by the individual recipient.

There could be enhancements to make the grain finer, to discriminate based on 
TYPE of attachments and classes of HTML tags.

For most recipients, their default protections (accept executable attachments 
and HTML tags from NOBODY) would shield the recipient from virtually ALL e-mail 
propagation of worms and viruses.  It would also effectively prevent URL 
spoofing, where the link that shows "confirm.citibank.com" actually links unseen 
to some site like "spoof.youmoron.ro" or the like.

We can sit and argue about SPF and other authentication approaches for days, or 
weeks, or months, or even years, but the FACT of the matter is that until we get 
the virus/worm/zombie problem solved (and SPF does NOT do that), SPF (and ALL of 
its ilk) is damned near worthless.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Mon, 29 Nov 2004 05:46:31 +0000 (GMT)

>The reason that various forms of malware started using the tactic of 
>using randomly-found addresses inserted into FROM: headers in the 
>first place was to make it much more difficult to track down the 
>infected user/host and/or shutdown/disconnect the infected machine.  

Well, except that it isn't.  All the headers post-insertion presumably point 
back at the (really) infected machine, or at least to the machine that first 
accepted the bogus mail.

But the traceback, ultimately, isn't all that critical.  The important thing is 
simply that the spam not be delivered to anybody, or that if it IS delivered 
it's simply not effective.

>If malware reversed course in that regard, it would instantly become 
>vastly easier for anyone to locate/shutdown infected machines again - 
>even for tech-illiterate people.  So I think that tactic shift on the 
>part of malware authors would be self-limiting.

I agree to the extent that ultimately the spammers are going to be put on the 
defensive, but meanwhile, SPF and the like is NOT the way to solve the 
spam/worm/virus problem.  Other approaches are FAR more effective, better 
controlled, more targeted, less expensive, faster, and with less deleterious 
side-effects that harm legitimate mail and legitimate senders.

---

From: [email-masked]
Date: Mon, 29 Nov 2004 19:32:19 +0000 (GMT)

>> Or, alternatively, the problem SPF "solves" is NOT the spam
> problem, nor is it the worm problem.

> Yes, that's true, SPF attacks the problem of forged MAIL FROM
addresses and forged HELO domains.  

Right, but if that's the ONLY thing it does then it shouldn't be talked about as 
a cure for spam, since spam DOES NOT HAVE TO USE forged From addresses or forged 
HELO domains.

> ...It's indirectly related to spam and worms at the moment, like open relays 
were related to the spam problem some years ago.

"Indirectly related" is fine, as long as we recognize it ONLY as such.  (And as 
such, I think it gets WAY more discussion and attention than it deserves.)

>> as long as authenticated machines can be infected and
> recruited to send "authenticated" worm/spam messages, SPF
> and similar schemes do very little to prevent such things

> It allows to find the relevant abuse desk fast, not too shabby.

There are already IP-based ways to do that (at least to the upstream node(s)) 
based on the Received: headers, along with Traceroutes.  The From: address is 
NOT needed.

Especially for "vanity" domains, there's no point in complaining to 
[email-masked] anyhow.  The spammer knows what they're doing.  
The place to apply pressure is the upstream node(s).

> All these weird challenges / out-of-office / vacation mails
won't hit innocent bystanders, if many receivers support SPF.

I don't see SPF as the solution for almost ANY questions.

> "Many" is good enough, spammers and worm authors won't waste
their time with something not working at say AOL or behind SA.

The idea of creating a confusing patchwork lattice mesh that the spam would have 
to work its way through is fine.  But SPF is not at all difficult to defeat... 
you just send the mail using the infected victim's authorizations.

>> undoing the DAMAGE that SPF has done

> There's no "damage", if you don't like it just don't publish a
sender policy.

Again, you're ignoring things like discussion group/mailing lists, message 
digests, and so forth.  Anybody who makes the mistake of supporting SPF later 
finds that they can't send mail using their business E-mail address when they 
are (say) on a cruise ship vacation or at an Internet cafe in some other 
country.  

>>> your "solution" is to get rid of MIME multipart resp.
>> text/html, and mails bigger than 12 KB.

>> No, not at all.

> You said so in <[email-masked]> :

Please don't misread or misrepresent what I said.

>| default is to (by default) not accept messages that:  
| (1) are are bigger than some limited size (say 10K-25K),
| (2) contain attachments, and/or (3) contain HTML

> 12,000 bytes is a limit in my own "popstop" script, but it's
within your size limits.

Fine, it matters relatively little what value you set the limit to.  The point 
is that there's little reason to accept "large" messages from people you've 
never gotten mail from before.  Once they've established contact, you can (if 
you wish) allow them to send you bulkier stuff.

>> Once the contact has been made, and the recipient trusts the
> sender, *if* there is going to be an extended correspondence,
> then the recipient can enable ONLY JUST the type of
> bulkier/riskier content that they agree

> Okay, in fact I have "special" addresses (not nobody@xyzzy)
where I don't limit the size, and don't look for any TV or UE
starting a base64 attachment (poor man's AV, credits to John)

Sure, but of course an HTML tag that invokes an ActiveX could be just as bad.

> But the UBE still sits there in my POP3 mailbox waiting for an
over quota or my script.  

In my case, I pull and process all incoming mail from my POP3 mailboxes every 60 
seconds or so.  Agreed that network bandwidth would be optimized by doing the 
blocking higher upstream, but as an ordinary user that's tilting at windmills.  
Better to just fix the problem for me, and let others come along when they're 
ready (if ever).  (I re-stage the processed mail in a local POP3 server on one 
of my server machines here, where mailbox space is only limited by the available 
space on that hard drive).

> And many of the bounces and all other crap caused by forged addresses were 
relatively small.

It can cause MAJOR problems if "hard bounces" instigated by spoofed From: 
addresses interacting with braindead antivirus software cause ALL your 
Yahoogroups to stop forwarding your mail.  :-(((

>> With widespread adoption

> That's the problem of all FUSSPs.  As you see I have no problem
to mix different ideas, as far as that's possible for a normal
POP3 user without the root password for the MX of his provider.

The point about my permissions list approach is that *I* benefit fine, EVEN 
WITHOUT widespread adoption.

Widespread adoption (such that spammers simply stop trying to send HTML-burdened 
E-mail, or attachments, knowing that the likelihood it will get through is 
miniscule) both reduces spam byte volume by something like 70-85% *and* makes it 
far harder for them to get their spam past content filters, since it denies 
spammers most of their most helpful tricks.

But starting from Day One of a permissions list, the permissions list in 
conjunction with a good antivirus filter should eliminate (in E-mail, at least):

   1)  virtually all viruses and worms;
   2)  spams using text-as-image;
   3)  encrypted spams using Java decryption;
   4)  obscured and spoofed URLs;
   5)  malicious scripting;
   6)  malicious ActiveX;
   7)  malicious attachments.

It's simple, inexpensive, readily implementable, effective, and nearly 
impossible to evade by technical means.