Subject: RE: [Asrg] TitanKey and "white lies"... (Faking SMTP hard errors "improves" C/R utility?)

From: "Bob Wyman" <[email-masked]>
Date: Thu, 29 May 2003 17:38:41 -0400

Yakov Shafronovich wrote:
> According to section 4.2.2 of RFC 2821, the "550" error 
> code means the following:... 550 Requested action not 
> taken: mailbox unavailable (e.g., mailbox not found, no 
> access, or command rejected for policy reasons)
	Ok. Perhaps it was a bit strong to say that it was a "lie."
Nonetheless, it would appear that spammer's programs are, in fact,
pretty much helpless in determing whether the "550" was issued due to a
mailbox not existing or because of "policy reasons." They are pretty
much stuck with either removing the address that failed from their
databases or providing legitimate reply-to/From addresses and trying to
deal with the C/R process. If this method propogates, then spammers will
find that their databases of addresses will be getting trimmed... It
would also seem reasonable that other policies could be used to
similarly confuse spammers. For instance, issuing "550" errors when rate
limits are exceeded, when senders are found to be on black-lists, etc.
	This policy of selectively issuing "550" errors seems to
conflict with another practice that has been gaining some acceptance and
that is to *never* issue a "550" even if a mailbox doesn't exist. Some
mail providers have stopped issuing "550's" in an attempt to make it
more difficult for people to do dictionary attacks on their servers.
(i.e. if the server won't tell you what mailboxes are *not* valid, you
can't figure out which ones *are* valid...) So, one group says part of
the solution is to never issue a "550" and another group says that part
of the solution is to issue them more frequently than you might normally
issue them... 

	Off-Topic: I wonder if the fact that issuing a "550" for "policy
reasons" is explicitly mentioned in RFC2821 might call into question the
validity of any patent claims that explicitly use the method defined in
the RFC... One might claim that the RFC's provision of a means to reject
for "policy reasons" did, in fact, anticipate precisely the methods
being discussed here.

		bob wyman

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Thu, 29 May 2003 18:11:27 -0400

I think we first need to deal with this (I'll assert) fantasy that
spammers see a 550 or removed an address from their lists because of
one with any significant frequency.

But otherwise we border on the "tree falls and no one around" problem,
what if the SMTP server lies but no one was listening?

Ok, maybe the general issue of server response codes lying transcends
the particular topic at hand which raised the issue.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 29 May 2003 18:39:35 -0400

At 06:11 PM 5/29/2003 -0400, Barry Shein wrote:

>[..]

Barry,

You have raised a very good point. Does Peter from TitanKey, or anyone else 
for that matter (maybe someone from Brightmail or CipherTrust), have any 
data about this?

Yakov

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 29 May 2003 18:27:01 -0600 (MDT)

> From: Barry Shein <[email-masked]>

> ...

I tried to dump on the idea that spammers "typically" respond to 
a 550 by removing a target address, but it's just as dreamy to
claim that they "typically" don't.

At least some spammers do seem to remove in response to 550's.  Perhaps
some spammers think that's just good housekeeping, but I suspect others
are responding to anti-spam pressure.  Some major spam targets reportedly
including AOL react to "too many" invalid target addresses with an
automatic blacklisting of the sending IP address.

A major problem among people worried about spam not just here but
everywhere is a habit of ignoring the difference between what they
think or hope might be true and what they actually know is true.  As
someone I used to work for was fond of say, "what you don't know can
hurt, but what you know that aint so can kill."

It would be really swell if people proposing or criticising mechanisms
would pay attention to what they know (e.g. there's a lot of spam),
what they strongly suspect (*some* spammers do or do not remove in
response 550's), and what they wish (*most* spammers do or do not
respond to 550's).

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 29 May 2003 21:43:18 -0400

>response 550's), and what they wish (*most* spammers do or do not

Is there anyone out here that has some info on what spammers actually do 
with "550" and other error codes?

Yakov

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 29 May 2003 19:59:35 -0600 (MDT)

> From: Yakov Shafranovich <[email-masked]>

> with "550" and other error codes?

Part of paying attention to what one knows, strongly suspects, and only
wishes ought to be distinguishing what can be known from that which can't.

Only spammers know what they actually do with SMTP error codes, and
they only know what they and their closest colleagues do.  A description
of what "spammers actually do" in this context makes less sense than
the report of the committee of blind men describing the elephant,
because elephants don't change.  Whatever spammers do today, if they
need to, they might switch tomorrow.

What does it mean to talk about "spammers"?  There are only 500-1500
serious spammers today, but they use many different tools.  They often
use their tools quite differently.

Say you found that 87.345% of all spammers today respond to 550's.
You could not conclude (or know) anything about yesterday or tomorrow.

Would you count "spammers" by counting spammer noses or spam email?
What if one of the "leads clubs" manages to recruit 100 new "home
workers"?  (Yes, I'm mixing species of spammers).  Whether you count
noses or spam, your percentage would surely be invalidated by whatever
the new spammers do.

---

From: "Bob Wyman" <[email-masked]>
Date: Fri, 30 May 2003 14:57:29 -0400

The kind of logic and the style of discussion which are shown in
the note below from Vernon Schryver are unfortunately becoming the
standard for this list. The result is, I believe, that the utility of
this list has all but been disipated. No matter what is proposed here,
there always seems to be a flury of comments, typically from the same
small group of high-volume contributors, that are much more focused on
trying to find problems than on helping to craft a solution. The result
is that progress is not being made.
	Basically Vernon's argument below is that "We can't know what
spammers do unless we are they and even if we did know, if we took any
action based on that knowledge, then they would simply work around
whatever we did." If this kind of logic is accepted, then this entire
discussion is a waste of everybody's time.
	I think the problem here is more the style of the discussion
than it is anything inherent to the problem space.

		bob wyman

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Vernon Schryver
Sent: Thursday, May 29, 2003 10:00 PM
To: [email-masked]
Subject: RE: [Asrg] TitanKey and "white lies"... (Faking SMTP hard
errors "improves" C/R utility?)

> >[..]
> >It would be really swell if people proposing or criticising 
> >mechanisms would pay attention to what they know (e.g. there's a lot 
> >of spam), what they strongly suspect (*some* spammers do or do not 
> >remove in response 550's), and what they wish (*most* spammers do or 
> >do not respond to 550's).
>

Part of paying attention to what one knows, strongly suspects, and only
wishes ought to be distinguishing what can be known from that which
can't.

Only spammers know what they actually do with SMTP error codes, and they
only know what they and their closest colleagues do.  A description of
what "spammers actually do" in this context makes less sense than the
report of the committee of blind men describing the elephant, because
elephants don't change.  Whatever spammers do today, if they need to,
they might switch tomorrow.

Say you found that 87.345% of all spammers today respond to 550's. You
could not conclude (or know) anything about yesterday or tomorrow.

Would you count "spammers" by counting spammer noses or spam email? What
if one of the "leads clubs" manages to recruit 100 new "home workers"?
(Yes, I'm mixing species of spammers).  Whether you count noses or spam,
your percentage would surely be invalidated by whatever the new spammers
do.

---

From: Barry Shein <[email-masked]>
Date: Fri, 30 May 2003 18:24:53 -0400

> response 550's), and what they wish (*most* spammers do or do not

Ok, I'll bite, how do you know I don't know this? (tongue slightly in
cheek.)

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Fri, 30 May 2003 18:55:18 -0400

> You could not conclude (or know) anything about yesterday or tomorrow.

David Hume (1711-1776); just because the sun rose this morning offers
no certain proof that it will rise again tomorrow (not a quote, my
summary, his language is kind of dense and archaic.) See:

          http://eserver.org/18th/hume-enquiry.html

At any rate, I wholeheartedly agree that it'd be nice to come to a
meeting of them minds viz spammers' modus operandi.

Since World's mail queues are forever flooded with spam trying to
bounce back, mostly with User Unknowns, and never get anywhere since
the apparent returned host isn't interested my impressions are based
on a little more than hearsay.

-- 
        -Barry Shein

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 30 May 2003 17:30:29 -0600 (MDT)

> meeting of them minds viz spammers' modus operandi.

A difference between spammers and the sun is that we know that spammers
have frequently changed in recent past.  If you look at much of the
spam you've often complained about, you know that every week brings
at least one new spammer trick.  For example, I've recently seen a
new variation of the familiar quoted-printable tactics of obscuring
domain names in bodies.  The change looks like new spamware.  There
was also the use of a dotted hex quad to hide IP addresses which is
new only in the sense that I'd not seen it for many months.

Say that you did find that 87.345% (or whatever) of all spammers today
respond to 550's.  Instead of sarcasm, please say what you would
conclude about next month.  How much money would you bet on your answer?

> on a little more than hearsay.

We all so strongly suspect that *some* spammers don't honor 550s that
we know it.  However, the fact that you see zillions of bounces is
not evidence for our common knowledge.  As stated, your impression is
worse than hearsay, because it does not exclude other obvious explanations.

You are doing something bad by insisting that current knowledge about
something we know spammers could easily change and have changed is
the same sort of knowledge as whether the sun will rise tomorrow.
Worse is your demand for belief in your version of the ephemeris based
only vague references to your enormous experience and authority.
Please don't just mention your mail queues' floods, but say what you
see in a way that can be falsified.

It is a waste to try to stop what you wish spammers would do or what
they once did.  If you want that uselessness, you could write a simple
filter to reject mail with senders considering of a 8-digit username
@aol.com.  I trust you remember when most spam fit that profile.

---

From: Barry Shein <[email-masked]>
Date: Fri, 30 May 2003 22:50:45 -0400

On May 30, 2003 at 17:30 [email-masked] (Vernon Schryver) wrote:
 > at least one new spammer trick.

I agree 100%, or at least 87.345%.

 > For example, I've recently seen a

I've lately been seeing them rotating case of domains between msgs and
then base64 encoding that,

	<A HREF="http://wWw.HoOp-dirECT.com">

	<A HREF="http://WwW.hOoP-DIrEcT.com">

which makes it harder to just match on the base64 encoding.

 > @aol.com.  I trust you remember when most spam fit that profile.

Don't you have the positive and negative propositions swapped here?

I said I doubt handing spammers 5xx's is going to do much good in the
long run, probably won't do much good now either.

I think it's up to someone asserting that handing them 5xx's will do
some good to support their assertion.

In general it seems more conservative to assume that if there's an
easy way around a "block" (e.g., ignore those 5xx's) a spammer will
take it.

The only exception I see off-hand are gray-area spammers who might be
subject to IP blocking, or those who use spamhauses, or similar, so
are concerned about sites which block IPs when they produce too many
User Unknowns.

Anyhow, an empirical method to see if this approach works at all, not
that I see how it really fits in to the big picture (if you already
know it's spam and thus to respond with 5xx then the problem is solved
already, no?), has been proposed here now.

-- 
        -Barry Shein

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 30 May 2003 21:46:55 -0600 (MDT)

> which makes it harder to just match on the base64 encoding.

I think rotating cases are weeks old for "Bill Zhang/Hu Scott/-
Zhanghailun/Dereck Jonson/et al."  In the last few dozen hours it has
switched to rotating case and quoted-printable or %-encoding.  I think
I've recently seen it in others I thought were not the same spammer.
Base64 encoding was very popular, faded, and has come back a little.
I assume most defenses that were not already decoding base64 have been
changed and perhaps SpamAssassin or some other major filter is now
penalizing base64 like <!--HTML-comments-->.  But this tactical chatter
is not relevant to a strategic research group.

> ...
> I said I doubt handing spammers 5xx's is going to do much good in ...

I don't know about that, but you did support the value of measuring
current 5yz behavior.  The only profits I see in such measurements
are disproving claims that it always happens or can't/never happens,
honing skills and tools for looking at spam, and tweaking defenses for
the next few weeks.  The second might be good training or tool
development.  The last might be relevant in a tactical forum like
SPAM-L or NANAE, but not here.

> easy way around a "block" (e.g., ignore those 5xx's) a spammer will

That's why worrying about current precise 5yz behavior is wrong
without compelling logic showing that it won't change.

Information is neither a baseless prejudice nor a careful measurement
that will be a wrong, baseless prejudice tomorrow.

> already, no?), has been proposed here now.

Knowing how often 5yz's are honored can be good tactical intelligence,
but this is a strategic research group.  The opposites of baseless
assertions are not useless data.  Assuming we agree the real value is
neither 0% nor 100%, good measurements of 5yz behavior are as inapproprate
here as unfounded claims about 5yz behavior.  Good measurements of 5yz
honoring today will be unfounded claims tomorrow.

Good measurements of 5yz behavior is as useless as base64 line lengths.
RFC 1341 and replacements say that they should be at most 70 bytes,
and most legitimate mail and spam use fewer.  However, I've had to
make my code decode base64 lines of several 1000 bytes to handle some
spam.  Does it matter whether those illegal MIME spam are 1% or 0.01%
instead of the 0.1% I estimate?--not here.  It also does not matter
here whether 87% or 8.7% of spammers honor 5yzs.

---

From: [email-masked]
Date: Fri, 30 May 2003 21:38:01 -0700

On Fri, May 30, 2003 at 05:30:29PM -0600, Vernon Schryver wrote:
[...]

> conclude about next month.  How much money would you bet on your answer?

The thread of this discussion, I believe, went as follows: 1) someone
made a claim that most spammers observe 550's and remove the
corresponding addresses from their lists.  2) various people then
responded that in their opinion many/most spammers ignore 550s.  3) if I
understand correctly, you claim that spammers' behavior can't be
presumed to follow any particular rules. 

It seems to me that 3 is completely consistent with 2, and in fact,
almost implies it, and that they both contradict 1: That is, if we
accept your premise that spammers won't follow predictable rules, then
it follows that a substantial percentage of them won't pay attention to
550 responses (otherwise they would be predictabled), and therefore,
point 1 is false. 

The fundamental point is that we can't count on spammers honoring 550s.  

Kent

-- 
Kent Crispin                               "Be good, and you will be
Manager of Technical Operations, ICANN      lonesome."
[email-masked],[email-masked]                    -- Mark Twain
               p: +1 310 823 9358  f: +1 310 823 8649
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg