Subject: RE: [Asrg] Is there anything good enough? - Spoofing stats

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 7 May 2003 14:58:24 -0700

We have very similar statistics, spoofing is very common.

The reason the spam senders do it is that they do not want to
leave a trail.

Quite why it is worthwhile to send out huge volumes of spam
without any means of contacting the purported vendor cannot
be said with certainty at this point. I have theories but
I prefer to share them with law enforcement.

		Phill

> -----Original Message-----
> From: David Walker [mailto:[email-masked]]
> Sent: Wednesday, May 07, 2003 11:59 AM
> To: Barry Shein; Alan DeKok
> Cc: [email-masked]
> Subject: Re: [Asrg] Is there anything good enough? - Spoofing stats
> 
> 
> With regards to spoofing being a minor problem.
> Out of 3130 denied messages 
> (to accounts I had to stop because they were receiving 100% spam)
>  @juno.com                                        |    36
>  @netscape.com                                    |    38
>  @email.com                                       |    40
>  @excite.com                                      |    50
>  @lycos.com                                       |    50
>  @earthlink.net                                   |    71
>  @msn.com                                         |    72
>  @yemenmail.com                                   |    93
>  @hotmail.com                                     |   241
>  @aol.com                                         |   298
>  @yahoo.com                                       |   311
> Total | 1300
> 
> 1300 out of 3130 = 41% of all my denies are very high 
> likelyhood spoofs from 
> the popular domains
> 1050 out of 3130 = 34% are guaranteed spoofs (The helo name 
> is not remotely 
> associated with the spoofed domain) from the popular domains.
> (These numbers do not represent all spoofing I receive but 
> rather just the 
> spoofing to popular domains)
> 
> So it doesn't look like a minor problem to me.  Sure it is 
> easy to avoid by
> 1. switching to domains that have not implemented RMX yet
> 2. by setting up your own domains
> but in the first case the DNS admin would have a tool to 
> fight them (he can 
> configure his RMX records) and with the second there is a 
> cost involved.
> 
> Assuming just the 11 domains and I implement RMX it becomes 
> useful as I could 
> receive messages from my friends and family that use those services.
> 
> On Tuesday 06 May 2003 05:26 pm, Barry Shein wrote:
> > No, the problem is that this spoofing is a minor problem and any
> > solution is easily evaded by spammers.
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Scott Nelson <[email-masked]>
Date: Thu, 08 May 2003 10:42:47 -0700

At 09:05 AM 5/8/03 -0600, Vernon Schryver wrote:
>No, you are falling for the intentional misrepresentation or lie that
>is labelling mail that comes from one domain with another domain as
>sender as "forgery."  That lie is intended to cause you to misunderstand
>what is being abused and by whom.
>

I think that when I write "[email-masked]" in the mail envelope 
and/or message headers it is not forgery,
regardless of what IP I send through when I do it.
But if a spammer (or anyone else) wrote "[email-masked]" in the 
mail envelope and/or message headers then it would be.

More abstractly;
Putting "[email-masked]" in a message implies that you are able 
to receive email sent to "[email-masked]" and that if you are
not, then your are in fact, forging "[email-masked]"

Normally, I'd say the best approach to detecting forgery 
would be the direct approach.
I.e. if you want to know if the sender can read email sent to
"[email-masked]", then you should send an email to
"[email-masked]" and ask.
(Most challenge response systems are based on this exact idea.)
However, the cost of that is much larger than it appears on
the surface.

RMX and the related DS proposes a method with a much lower cost.
They are not as good as other systems, but the theory is that they
do not cost as much to implement, so they might be a reasonable
in terms of cost/performance.

If we limit the cost by refusing to change existing practices, 
then they can not distinguish forgery from the standard practice
of using an arbitrary IP to inject email.  (They also can not distinguish 
forgery from the standard practice of forwarding email, and mailing lists,
but there are some low cost methods of dealing with those.)

In that context, I will now repeat something I said earlier;
If the IP of the sender matches an RMX record of the domain,
then it's a good bet the message is not a forgery.
If the IP of the sender does not match an RMX record of the domain,
or there is no RMX record, then all bets are off.

If, on the other hand, we assume that we are going to impose changes
in existing standard practices, then RMX/DS are no longer low cost
proposals.  Depending on what sort of changes we propose, the
ability to detect forgery can be quite good, but I claim the cost 
spirals out of control rapidly.

Scott Nelson <[email-masked]>