Subject: Re: Quizzic: Spam equivalent to EICAR test virus proposal.

From: Bart Schaefer <[email-masked]>
Date: Wed, 2 Jul 2003 03:50:41 +0000

Just for comparison:

SpamAssassin defines what's called the Generic Test for Unsolicited Bulk
Email (GTUBE).  It's defined as a string matching the regular expression

XJS\*C4JDBQADN1\.NSBN3\*2IDNEN\*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL\*C\.34X

appearing anywhere in the message body, after decoding and HTML rendering.

(I write the regular expression rather than the string itself so that any
of you running spamassassin won't score this message at 1000 points.)

---

From: "Matthew Elvey (FM)" <[email-masked]>
Date: Wed, 02 Jul 2003 08:20:35 -0700

>of you running spamassassin won't score this message at 1000 points.)
Thanks! So a start has been made. 

http://spamassassin.planetmirror.com/dist/t/data/spam/gtube.eml - a sample.

Matt Sergeant of SpamAssassin posted very relevantly to the ASRG about 
GTUBE in March:
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01527.html+gtube

There were a couple replies that are meritless from Vernon Schryver and 
Kee Hinckley
A valid complaint was  what about antispam systems that aren't content 
filters?

Enhancement to my scheme to more fully address it:
A pseudo-open relay could be established (run by who?)  that would 
(attempt to) relay only Quizzic-compliant messages.  It would be listed 
in all blacklists.  The From would be specified to be that of a 
specified domain, which would go in all domain-based blacklists. 
([email-masked], as previously suggested).
It would not 2xx OK the SMTP DATA command, but rather send a 4xx/5xx 
error (the same one it encountered) if the attempt to relay failed.

Matt posted this helpful reply:
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01625.html
not realizing that there was a solution to his item 1 w/o spoofing.

Sounds like the effort is still needed and  the need is there.

---

From: Kjetil Torgrim Homme <[email-masked]>
Date: Thu, 03 Jul 2003 15:33:40 +0200

[Matthew Elvey (FM)]:
>   There were a couple replies that are meritless from Vernon
>   Schryver and Kee Hinckley.  A valid complaint was what about
>   antispam systems that aren't content filters?

that's a bit harsh on Vernon Schryver, his idea of setting up an
auto-responder from a fixed IP-address is exactly what you propose.

>   Enhancement to my scheme to more fully address it: A pseudo-open
>   relay could be established (run by who?)

probably someone academic, for stability topologywise, and also for
IPv6 support.  the problem is that willfully getting your host listed
in RBL is scary.  you never know what people will jump to conclusions
and blacklist your entire B-net.  (perhaps MIT could run it in its own
B-net ;-)

>   that would (attempt to) relay only Quizzic-compliant messages.

might as well leave SMTP out of it.  connect to a port, enter a
recipient address, and the server will connect to the MX of the source
IP.  (make sure the reverse and forward lookup match.)  the message
will be fixed, and therefore not attractive to abuse by spammers.
rate limiting per source IP (no more than 10 messages a day?) will
stop the people trying to use it to DOS.

>   Sounds like the effort is still needed and  the need is there.

it seems to me that asrg is the proper forum, though.

-- 
Kjetil T.			|  read and make up your own mind
				|  http://www.cactus48.com/truth.html

---

From: "Matthew Elvey (FM)" <[email-masked]>
Date: Thu, 03 Jul 2003 10:56:06 -0700

>>  https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01527.html+gtube
Correction: (take off the +gtube - the URL stopped working with that)

https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01527.html

>auto-responder from a fixed IP-address is exactly what you propose.
Great. I haven't seen him propose that. I guess I missed it. He's got 
lots of good ideas, just not on that thread, as far as I saw.
Tact and collegiality were missing. My intent was to make others' 
reading of the thread go quicker by echoing what's said at
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg01678.html 
- he seemed to have misunderstood the purpose. 

>and blacklist your entire B-net.  (perhaps MIT could run it in its own
ICANN ISOC IESG IETF IANA... so many I*s but none with this falling 
within their charter AFAIK.

>recipient address, 
Whatever is easier to implement and use.  A web form would work too.

But I think SMTP is probably best.  For example, say you want to test a 
system that scans for spam on the way OUT.
You'd set your client's (outoging) smtp server to QuizzicServer.MIT.edu 
or whatever.  If there's an SMTP proxy run by your system or ISP, this 
gives it a chance to be shown to work.  I also think it's simplest to 
implement with existing software.

>and the server will connect to the MX of the source
>IP.  (make sure the reverse and forward lookup match.) 
>
Can you explain this more? I'm not clear on what you're trying to do 
here or why.  Is this test something that would make Quizzic hard for 
joe user to use?
I guess if we're sticking with SMTP, if joe user's SMTP server doesn't 
have matching lookups, tough-a lot of servers are rejecting his mail; 
(this is the least of his problems, and the shortcoming might help joe 
user become aware of it), but if he's suposed to telnet from his windoze 
PC, expecting matching lookups is a bit unreasonable.

> the message
I'm trying to allow flexibility that may be useful while still not 
making it attractive to spammers.
At least, I'd like to have the email address of the (purported) sender 
be available.  The source IP would be in the mail header; SpamCop and 
workalikes would  be configured to trust the system and consider the 
source IP as the source of spam, and, by default at least, not report 
Quizzic reports as spam at all.

>stop the people trying to use it to DOS. 
Rate limiting makes sense. 

>it seems to me that asrg is the proper forum, though.
The noise is deafening and the (admittedly oft-ignored) charter - 
http://www.irtf.org/asrg/ doesn't seem to admit this topic, so I'm 
reluctant to go there.
Anyone else want/not want the discussion here?

---

From: Kjetil Torgrim Homme <[email-masked]>
Date: Thu, 03 Jul 2003 23:49:44 +0200

[Matthew Elvey (FM)]:
>   But I think SMTP is probably best.

I'm just worried about the service being abused by spammers.

>   For example, say you want to test a system that scans for spam on
>   the way OUT.

interesting point.

>   You'd set your client's (outoging) smtp server to
>   QuizzicServer.MIT.edu or whatever.  If there's an SMTP proxy run
>   by your system or ISP, this gives it a chance to be shown to work.

running transparent SMTP proxies is not very common, is it?  in any
case, you could use _any_ other e-mail address on the Internet to test
outbound.

>   I also think it's simplest to implement with existing software.

this is where I disagree strongly :-)

>   > and the server will connect to the MX of the source IP.  (make
>   > sure the reverse and forward lookup match.)
>
>   here or why.

say I connect from 129.240.68.200.  reverse lookup gives
vingodur.ifi.uio.no.  the MX for vingodur is pat.uio.no.  so the reply
will be sent to pat.  since pat is relay proof, I must provide a valid
address at the University of Oslo for the e-mail to be accepted.

now, if I want to fool the quizzic server into harrassing you, I'd
change the reverse lookup of 129.240.68.200 to elvey.fastmail.fm,
whose MX is smtp.us.messagingengine.com, and so you'll receive the
message.  it is therefore essential that a forward lookup of
elvey.fastmail.fm is done to see if the IP address(es) match.

>   Is this test something that would make Quizzic hard for
>   joe user to use?

only if Joe User's network administrator is incompetent. :-)