Subject: Buckets of spam coming through IETF lists

From: "John R. Levine" <[email-masked]>
Date: 1 Apr 2011 16:28:55 -0400

Some clever spambot seems to have scraped a bunch of addresses out of the 
archives and is sending spam with multiple addresses on the From: line 
through IETF and IRTF mailing lists.  Surely I'm not the only one who's 
seeing it.

Given the amount of legitimate mail with multiple From: addresses (none, 
in practice) a quick shim in front of Mailman should deal with it until 
someone can go fix the underlying code.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---------- Forwarded message ----------
Date: Thu, 31 Mar 2011 14:47:22 -0700 (PDT)
From: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked],
     [email-masked], [email-masked], [email-masked], [email-masked],
     [email-masked], [email-masked], [email-masked], [email-masked],
     [email-masked], [email-masked], [email-masked], [email-masked],
     [email-masked], [email-masked]
To: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked],
     [email-masked], [email-masked], [email-masked], [email-masked],
     [email-masked], [email-masked], [email-masked], [email-masked],
     [email-masked], [email-masked], [email-masked], [email-masked],
     [email-masked], [email-masked]
Subject: [IRSG] An offer you can't refuse

---

From: John C Klensin <[email-masked]>
Date: Fri, 01 Apr 2011 18:35:41 -0400

--On Friday, April 01, 2011 16:28 -0400 "John R. Levine"
<[email-masked]> wrote:

> Some clever spambot seems to have scraped a bunch of addresses
> out of the archives and is sending spam with multiple
> addresses on the From: line through IETF and IRTF mailing
> lists.  Surely I'm not the only one who's seeing it.

Wouldn't that be ironic.  :-(

> Given the amount of legitimate mail with multiple From:
> addresses (none, in practice) a quick shim in front of Mailman
> should deal with it until someone can go fix the underlying
> code.

Yeah, although I find it really sad when the IETF concludes that
it needs to be non-conformant to its own standards.

    john

---

From: Mykyta Yevstifeyev <[email-masked]>
Date: Sat, 02 Apr 2011 06:54:09 +0300

01.04.2011 23:28, John R. Levine wrote:
> Some clever spambot seems to have scraped a bunch of addresses out of 
> the archives and is sending spam with multiple addresses on the From: 
> line through IETF and IRTF mailing lists.  Surely I'm not the only one 
> who's seeing it.
>
> Given the amount of legitimate mail with multiple From: addresses 
> (none, in practice) a quick shim in front of Mailman should deal with 
> it until someone can go fix the underlying code.
>
> Regards,
Such messages are not the only problem.  RFC-i list receives messages 
"from" internal Mailman addresses (*-bounces@... and *-request@...), 
that is impossible.  See, eg. this one:

> Message: 6
> Date: Fri,  1 Apr 2011 06:25:12 -0700 (PDT)
> From:<[email-masked]>,<[email-masked]>,
> 	<[email-masked]>,<[email-masked]>,
> 	<[email-masked]>,<[email-masked]>,
> 	<[email-masked]>,<[email-masked]>
> To:<[email-masked]>,<[email-masked]>,
> 	<[email-masked]>,<[email-masked]>,
> 	<[email-masked]>,<[email-masked]>,
> 	<[email-masked]>,<[email-masked]>
> Subject: [rfc-i] Last call for the money makers
Even provided this is the Fool Day's joke, those who dared to send 
surely has not very healthy sense of humor.

--Mykyta
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Fred Baker <[email-masked]>
Date: Sat, 2 Apr 2011 06:08:37 +0200

On Apr 1, 2011, at 10:28 PM, John R. Levine wrote:

> Some clever spambot seems to have scraped a bunch of addresses out of the archives and is sending spam with multiple addresses on the From: line through IETF and IRTF mailing lists.  Surely I'm not the only one who's seeing it.

DKIM is directly designed to address this... What do we need to do to put it in play?

> Given the amount of legitimate mail with multiple From: addresses (none, in practice) a quick shim in front of Mailman should deal with it until someone can go fix the underlying code.
> 
> Regards,

---

From: "John R. Levine" <[email-masked]>
Date: 2 Apr 2011 00:36:21 -0400

> DKIM is directly designed to address this... What do we need to do to put it in play?

Probably more than you want to try to do in a hurry.

It seems to me there are two separate problems.  One is that a bad guy is 
sending spam with fake IETF and IRTF return addresses, something that DKIM 
can mitigate.  The other is that the mailing list software is getting 
confused by multiple From line addresses, which is probably buggy code 
that wasn't written to handle them.

For the former, first you adjust the IETF's mail servers to put DKIM 
signatures on all the outgoing mail.  Once that works, you adjust the 
incoming spam filters so that mail that purports to be from the IETF or 
IRTF and doesn't have a signature is treated as spam.  (Spamassassin can 
easily be tuned to do that.)  You don't want to do that in a hurry, 
because there always turn out to be considerably more outgoing mail paths 
than you thought, and finding and securing them all is tedious.

It's not immediately apparent to me why Mailman is letting that mail 
through, since the addresses on the From: line aren't all subscribed to 
the various lists.  As a band-aid, it's straightforward to add a Mailman 
spam filter like

   from: .*<.*>.*,

which will catch any multiple from lines and either hold or discard them.

Regards,

---

From: Bob Hinden <[email-masked]>
Date: Sat, 2 Apr 2011 16:56:53 +0200

John,

If you want to report a SPAM problem with an IETF mailing list, please report it to <[email-masked]>.  It will get prompt response.  

From the email you forwarded, it looks like a problem with lists hosted at ISI.EDU (that is, not at ietf.org).  

Bob

p.s. Or should I have taken the date you sent this more seriously?

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 06 Apr 2011 07:01:07 -0700

> DKIM is directly designed to address this... What do we need to do to put it

Unfortunately, DKIM is /not/ design to address this.  DKIM is designed to 
provide a reliable, accurate identifier upon which reputation data can be developed.

That's a fundamentally different task from detected invalid From: field contents.

ADSP, and add-on to DKIM, is felt by its promoters to be useful for detecting 
invalid From: fields, but it does not work through mailing lists.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 06 Apr 2011 17:49:09 +0200

On 06/Apr/11 16:01, Dave CROCKER wrote:
> Unfortunately, DKIM is /not/ designed to address this.  DKIM is designed
> to provide a reliable, accurate identifier upon which reputation data
> can be developed.

Yet, as the MLM-draft documents:

  MLMs typically attempt to authenticate messages posted through them.
  They usually do this through the trivial (and insecure) means of
  verifying the RFC5322.From field email address (or, less frequently,
  the RFC5321.MailFrom parameter) against a list registry.  DKIM
  enables a stronger form of authentication, although this is not yet
  formally documented: It can require that messages using a given
  RFC5322.From address also have a DKIM signature with a corresponding
  "d=" domain.  This feature would be somewhat similar to using ADSP,
  except that the requirement for it would be imposed by the MLM and
  not the author's organization.
               http://tools.ietf.org/html/draft-ietf-dkim-mailinglists

It would be interesting to implement such authentication for IETF
lists, e.g. as part of some IETF Code Sprint.  It will alleviate
moderation, although it will require some maintenance for itself.

> That's a fundamentally different task from detected invalid From:

Likewise, DKIM hardly supports non-repudiation of content, if at all.

> ADSP, and add-on to DKIM, is felt by its promoters to be useful for
> detecting invalid From: fields, but it does not work through
> mailing lists.

The "somewhat similar feature" described in the MLM-draft assumes that
(some) posters consistently use submission servers that DKIM-sign
relayed mail.  Thus, the MLM can automatically reject posts claiming
to be from such posters, if they are not validly signed.