Subject: Exposing the security holes in all existing anti-spam techniques (was Re: You Might...)

From: Shelby Moore <[email-masked]>
Date: Fri, 12 Sep 2003 07:34:55 +0800

Still trying to get this posted to the list...apparently the sys admin has
blocked me from sending, even I am contining to receive email from the list and
others are able to continue trolling the thread below...

I think I have a fair right to have the important factual data posted on the
list!  I have not posted for > 24 hours per the sys admin's suggestion, and
this my final post on this list!  I asked the sys admin to make a fair
resolution and this is not fair to let others post unfactual statements and
block only one person.

Vernon promised not to troll on this thread any more and he went ahead.  He is
not blocked and I am.  What is up with that????  Is the philosophy of this list
that ignorance is bliss????

Do I have to post this rebuttal on another list and point out that IETF is
censoring factual data???

I first tried to post this without these statements of exasperation above with
no success.  What kind of unprofessional list is Harald running here??  Harald
(sys admin) must be a friend of Vernon.  Very professional.  The IETF is
composed of friends who play favors of censorship.  Nice.

>> Iljitsch van Beijnum wrote:
>> declaring the spam problem unsolvable. I don't think it's a good idea 
>> to lend credibility to this sentiment by publishing it as an RFC. 
>> 
>> How hard is it to agree that: 
>> 
>> a) there will always be (some) spam 
>> b) there is no need for it to be 50% of all mail 

> Vernon Schryver responded:
>That last sentiment is on my list.
>
>There are several currently available, independent sets of mechanisms
> that will keep more than 90% of all spam out of your mailbox with fewer
> than 0.1% false positives. If your mailbox receives on average more than
> 1 spam/day and you care, then fire your current ISP and hire one that
> offers reasonable spam defenses. If you care to invest your own time and
> effort maintaining filters or if you can tolerate more than 0.1% false
positives,
> your mailbox can be practically spam free.

Consider my response a new thread, "Why all existing anti-spam will fail
miserably or are otherwise indequate".

Or consider this response, "Exposing the security holes in all existing
anti-spam techniques", similar to the benefits of exposing the security holes
in operating systems before they are exploited.  There is no sense in relying
on something and making an ever increasing investment in that thing, if it is
going to fail miserably at some point and force you to start over.

Vernon, misses some *very* important details in his *simplistic* analysis
above, which I am confident after all of you read the following, you will agree
could not be left as an unchallenged statement *pretending* to be factual.

1. The DCC (Vernon's business) and all current practical anti-spam which can
generate the 90% + < 0.1% that Vernon claims, rely heavily on whitelisting,
which is both inherently subvertable and more importantly which has a great
cost to (usually not transportable) investment in maintenance, which may in
many cases outweigh the *current* cost of spam:

http://www.ietf.org/proceedings/03mar/slides/asrg-1/sld12.htm

2. Not all people can use those existing anti-spam tools.  For example, I am
capable of using BrightMail on my Earthlink account but not on my hosted
accounts.  In order words, those existing tools don't scale every where.

3. And here is the kicker.  ALL existing anti-spam methods, can be (and thus
will eventually be) easily subverted.  This is already in public domain else
where.  All someone need do is create a virus which both spreads sometimes via
email and the rest of time sends large quantities of highly randomized spam. 
The seed would need to be truely random (e.g. cpu clock modulo milliseconds)
and randomize all headers (To, From, Subject, etc) and content, using lookup
tables of common domains, and normal words people use in email.  Vernon's DCC,
Paul Graham's Bayesian filters, reply opt-in whitelisting, etc.. would all fail
miserably.  Additionally imagine all the bounced traffic (from randomized
address) and especially the case where two reply opt-in whitelisting entities
get caught in infinite loop (randomized From/ Reply-To addresses).  Also this
would probably overload the DCC servers with too many unique flooded
checksums.  Some "script kiddie" could become famous by turning all anti-spam
from 90% in 1% effectiveness in days, not to mention probably overloading
internet email to the point where no one could find their legitimate email.

If #3 happens, those of you here at the IETF who attempted to ridule me
(unsuccessfully obviously), will be realizing that my warnings of dire
architectual problem are real.

Lastly I have done the full background search at ASRG (IRTF), and I did not
find prior art for either the proposal I made to legitimize bulk email by
moving it to "pull", nor the prior art for our soon to be patent-pending
anti-spam algorithm.

The closest prior art I found was "spam is any bulk email from someone you
don't know" essay, and "time-domain analysis" idea (with no details).  I am
indeed working on novel anti-spam, and I do not appreciate the unprofessional
suggestion (borderline libel) otherwise.

If any one would like the full set of links to my research ("literature
review") at the ASRG, email me and I will send them to you privately.

This is the last I have to say on this matter in public.  I am extremely
confident in the expertise of my assertions.  The rest will be said with my
actions and other naturally occurring events.

Shelby Moore
http://AntiViotic.com

---

From: Shelby Moore <[email-masked]>
Date: Fri, 12 Sep 2003 15:12:02 +0800

Sending this again, since Harald claims here:

http://www1.ietf.org/mail-archive/ietf/Current/msg22200.html

That he is not censoring me, yet my 3rd post on this thread:

http://www1.ietf.org/mail-archive/ietf/Current/msg22198.html

Has already appeared (thank you Harald) while after some hours, the 2nd post I
made (this email) has not.

I will also be emailing Harald privately to find out why my repeated attempts
in last few hours to unsubscribe (so I would not be provoked by new posts) are
not being recognized by Majordomo (still receiving email from list).

>Already been done, and better - Consider a virus that installs an open proxy
>for spammers to use.  Do the lit review yourself if you can't name which
one(s)
>did this (yes, more than one has).l

Valdis what you describe is not the same as what I described.  The virus must
run autonomously in order to have the effect at the scale I described.  Such a
virus would want to be on the order of > 1 million computers sending > 10,000
random spams per day (or any combinations of the same product, e.g. 100,000
sending 100,000).  If you assume that 10 billion spams are sent per day now,
and that DCC, Bayesian, etc catch 90% of them, then 10 billion undetected spams
would give inversion of performance (from 90% detected to 10% detected).

>Do the lit review for which famous viruses created havoc by sending around
>other attachment at random off a person's disk.

Viral attachments are easily to block, so you would not want an attachment in
the outgoing spam.  Reread what I wrote last post about the potential virus
could spread itself orthogonally to it's spam function.

>However, keep in mind that the spam can't be TOO randomized and still
>convey a message

Conveying a message wasn't what I suggested a the virus could do.  I proposed
it would simply disrupt antispam systems and wreck havoc on the email system. 
It is a macho thing, such as the "ILOVEU" virus from the Philippines.  I should
disclose that I am currently visiting the Philippines for a conference (field
research) on this (check my IP address).  With a truely random content (except
normal words and normal word distribution, "normal" in uniform statistical
distribution sense), and with a huge volume, you need not care if any one reads
it.  The only point would be to get past the antispam systems and users who
were formerly getting 90% antispam would be seeing more like 10% (missing a
zero in my previous post) antispam and 90% spam.

I wonder how actual field research other "experts" actually do on virus/spam
havens.

>Already being done:  Consider the following obfuscations seen in today's spam

No I meant truely random ordering of *normal* words.  I usually mean what I
write.  The *normal* words are needed to avoid Bayesian filters.

>We're quite aware of the architectural problems.  We're also aware of exactly
>what it would take to deploy a solution....

Nice boast but imo you have proven otherwise in the way you handled my posts,
which is going to be quite clear to independent (outside) observers, when/if
the "mega spam virus" I described herein hits the world.

>Your search was incomplete, and here's some prior art.

The one you quoted is referring to "RSS" which is not entirely correlated with
what I proposed.  I proposed using POP (or what ever the receiptient prefers)
which does not require a "complete overhaul of email clients" as quoted as one
of the complaints in thread you mention.  I have long ago in the this list
readily admitted that message pull has existed for a long time, such as our
past discussion of usenet.  Also the one you quoted does not discuss the
benefits I proposed, such as the ability to define spam at other nodes in the
channel than the pyschology of "unsolicited" and the benefits that follow such
a logic.

BTW, I noticed there were no reasonable objections in the thread you quoted
regarding overall concept of email pull.

>  Make sure that the
>claims on your patent don't cover anything in this message, as that would
>of course be a big no-no.

You are confusing 2 different things.  Please read my posts more carefully. 
The proposal I made here has nothing to do with the antispam algorithm we
developed.  I stated "time-domain analysis" (idea only, no details found) as the
closest thing found at ASRG, but not substantial or correlated (just an idea,
no details) enough to be prior art, as Vernon and you claim.

Shelby Moore
http://AntiViotic.com