Subject: RE: [Asrg] Willfull and intentional misunderstandings

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 08 May 2003 23:00:49 -0400

>From: Eric Brunner-Williams in Portland Maine <[email-masked]>
>
> > Spoofed spam is harder to trace, and thus harder to shut down.
>
>This assumes a few things I don't know:
>
>         o what does "harder to trace" refer to, what is the technical
>           capability of the entity performing the tracing function?
>         o what does "trace" actually mean?

I personally use the SpamCop reporting service and by trace I will be using 
the example of what SpamCop does - parse the headers and the message in 
order to ascertain:
1. The path of transmission including the originator's IP address, and the 
IP addresses of any of the MTA or gateways in between.
2. The IP addresses of the sites and email accounts mentioned in the message.
3. Finding out who the owner of those IPs is, or if that fails their 
upstream provider, or their upstream provider, etc.

By "trace" I mean finding out who the entities responsible for the IP 
addresses are. This is accomplished using WHOIS lookups on domain name 
records and IP blocks, as well as tracert commands. This also includes 
maintaining the contact information for different ISPs like SpamCop and 
abuse.net do.

The "entity" doing this process would either be an actual human being like 
a law enforcement agent or an ISP admin, or it maybe an automatic software 
system like SpamCop.

"Harder to trace" means that it is impossible to do tracert or WHOIS looks 
when the "From" and "Received" headers are false. As the result the 
"tracing entity" ends up reporting and accusing the wrong people.This 
accomplishes two things:
1. It throws off the ISPs and law authorities that are trying to find out 
the sender by leading them down the wrong path.
2. It causes ISPs to ignore spam reports since so many are triggered by 
false information.

An additional benefit to spammers also is the fact that the spam filters 
will have a harder job detecting them.

>         o what does "harder to shut down" refer to
>         o what is actually being "shut down"?
>and finally, if it were easier and well-defined and easier and well-defined

It means getting in touch with their ISP and make the ISP shut down their 
site or email address. It also means alerting the admins of the hacked 
computers and open relays to fix their problems. It also means getting the 
FTC or FBI to prosecute them. And under the slowly increasing number of 
spam laws, it means having the ability for the recipients to sue the 
senders directly.

>         o would it matter?

If every spam message sent would be easily traced or come directly from 
[email-masked] then ISPs can easily sue the senders, the LAE 
can easier prosecute "Nigerian" scam people, and spam filters can easily 
block spam.

>Isn't every overt source an expendable asset with a finite TTL and a finite
>delivery queue?

There is a famous quote from an old NY Times article: "On the Internet no 
one knows if you are a dog". But in reality, every single spam message has 
a physical person behind it who is sending it. Everything is logged 
somewhere even if for a limited time. Even though they might be switching 
from site to site, and from domain to domain, if we can get to the ISP logs 
in time before they are deleted even though the original domain name or 
site might no longer be there, the information gathered can still help us 
somewhat.

But then of course, all the spammers can move to China or some other 
country where the ISPs will not care about the spam issues. If that happens 
I wonder how long will it take until the country's uplink is shut off?

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 00:34:45 -0400

technical capability:

> ... an actual human being ... or it maybe an automatic software 
> system like <example>.

trace:
> ... parse the headers and the message ...

shut down:
> ... ISP shut down their site or email address ...

How can this be useful for the mode Barry described:

> One of the major sources of spam right now seems to be zombie robot
> hosts, hosts who have had a virus injected into them which turns them
> into unwitting spam slaves*.
> 
> So the spam is being delivered by 123-456-789-123-dsl-pool.telco.com
> and guess what it seems to be from [email-masked]
> who assures you that anything from (don't make me type it again)
> is indeed from (I'm just not going to type it again.)
> 
> Now what do you know?

I'm still where Berry left off. I don't see anything in humans, or pseudo
humans, headers and eventual administrative DoS that solves for "virally
acquired spam slave servers".

What I see would be useful for pursuing some advertizing network operator,
based upon some property of the cookies they play, as advertizing networks
don't (presently) utilize (and discard) "virally acquired" assets -- they
have to hang around for days, even weeks, so "unlawful twinkling" isn't a
win for them. I wrote a draft on that [1], it eventually became the cookie
processing mechanism in IE5.5 et seq, and in Mozilla 0.9 et seq. Trala.

The claim that you make after the reference to a famous cartoon [1] seems
to be to be one of forensics value -- you've posited logs, possibly quite
a lot of them, and how they are discovered, clustered, and reconcilled is
TBD, before they are deleted. That's hours, even days, after the local
event ended.

> country where the ISPs will not care about the spam issues.

When I worked with CNNIC in the Summer and Fall of '01, one of the biggest
issues they had was overseas bandwidth cost arising from two bugs in one
product, and a business model involving two businesses and their partnership
which enhanced the bugs in the deployed product. It surprises me to hear of
the PRC and overseas-bandwidth cost insensitivity in one sentence. Knowing
the PRC legal system, and the seven or so primary operators, this is another
surprise. Deregulation, WTO entry, and Governmental policy of Convergence,
to the confusion of several Ministries, all make for non-determinism, but
North America is and has been pretty zooy for several years.

In sum, I see the use case offered being "the slow moving spammer", who is
already not among the "quick", and may as well be dead. The use case does
not "scale" as the spammer is allowed to be more agile.

Good solutions scale, not merely in the size of the system, but the temporal
properties of the system.

I think I've made myself as clear as I can, and I don't see anyone running
around with a checkbook looking for basic research on, or even simulating,
agile, hostile systems. Fortunately, we've got a large testbed network to
observe while it is exercised by ... agile, hostile systems.

Eric

[1] draft-jaye-http-trust-state-mgt-01.txt (expired)
[2] http://www.unc.edu/depts/jomc/academics/dri/idog.html
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg