Subject: Re: [Asrg] Some data on the validity of MAIL FROM addresses

From: "Jon Kyme" <[email-masked]>
Date: Sun, 18 May 2003 19:59:27 +0100

> 
> I realize that there are many on this list who find data collection to
> be pointless, but Kee Hinckley has shown this to be incorrect.  

While it's always nice to see some numbers, I'm not sure what
these figures are actually measuring. For instance, yahoo will give a
positive reply for a random mailbox in RCPT TO, delaying rejection until
after DATA. I think the response after data will indicate if the account
doesn't exist or has been (recently) terminated.

I suspect hotmail will fail an address at RCPT TO even if the address is
associated with a registered account which has become "dormant". (please
correct me if I'm wrong on this one)

I suppose it might be possible to assume that these two biases will cancel
out, but that's quite a large assumption to make.

> Vernon
> Schryver's assertions were useless (even if correct) without hard
> evidence, and Kee's data is insufficient without wider deployment.
> 
> Likewise, Vernon's followup that Kee is analyzing a different statement
> than Vernon asserted is a legitimate concern.  The data analysis
> methodology should be publicly vetted to ensure that it is providing
> meaningful and acurate data.
> 

The primary issue is not deployment. We're not at that stage. One needs to
define what a "valid" address is and how to determine an address is
valid by that definition.
Once that's done, one needs to decide if the data collection is feasible
and useful. Then someone can write and review some scripts to analyse some
logs.
(Incidentally - which MTAs logs are you going to analyse? Sendmail? qmail?
exim? all of them? Standard / non-standard log formats?)

Data collection can indeed be pointless, particularly if the information
content is low.

All the same, it's good of KH to take the trouble to introduce some facts
into this discussion (seriously).

--
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 18 May 2003 18:18:48 -0400

> doesn't exist or has been (recently) terminated.

  Even worse, there is no proven connection between the spam and the
hotmail/yahoo account which is allegedly the sender.  The data are
entirely consistent with spammers using lists of verified email
addresses to forge 'From:' lines.

  This isn't to say that the numbers aren't meaningful, they are.  But
it's difficult to know exactly what they mean.

  Alan DeKok.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 18 May 2003 17:23:08 -0600 (MDT)

> From: "Alan DeKok" <[email-masked]>

> ...

That would be make sense only if the number of hotmail/yahoo spam
sender addresses were proportional to the number of hotmail/yahoo
addresses among all targets of spam.  Unless you think that most spam
targets are at free providers, you must assume that spammers have some
reason for prefering to send as if from free providers.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Michael Rubel <[email-masked]>
Date: Sun, 18 May 2003 18:18:33 -0700 (PDT)

ad> Even worse, there is no proven connection between the spam and the
ad> hotmail/yahoo account which is allegedly the sender.  The data are
ad> entirely consistent with spammers using lists of verified email
ad> addresses to forge 'From:' lines.

vs> That would be make sense only if the number of hotmail/yahoo spam
vs> sender addresses were proportional to the number of hotmail/yahoo
vs> addresses among all targets of spam.

Vernon,

Wouldn't this objection only apply if you assume that spammers are
selecting MAIL FROM: addresses uniformly?  That is, if you assume each
address in their lists is given equal probability?

Do spammers who do forge prefer to send MAIL FROM: big free targets,
no-name targets, or have no preference?  I honestly don't know the
answer to this one, but anecdotally I suspect they prefer to hit the
big-name targets.

Mike

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 18 May 2003 19:52:30 -0600 (MDT)

> From: Michael Rubel <[email-masked]>

> address in their lists is given equal probability?

That's my point.  Spam source addresses are obviously not uniformly
distributed accross domain names.  Unless you make surprising
assumptions about spam target addresses, they are not uniformly
distributed accross those either.

Why is that?  It cannot be because free provider mailboxes are harder
to check for validity.  Many large corporate domain names give no
indication that an invented address is bogus during the SMTP transaction.
(Think about corporate MX servers and firewalls to see not only why
that is but why it must be, at least as SMTP is practised today.)

It also cannot be because free provider addresses are good sender
addresses for spam, because a noticable albeit small minority of
organizations are like Rhyolite Software and reject all mail
apparently from strangers at free providers.  If you're going to
pick a random domain name, it would be better to pick any of the
Fortune 1000 not associated with a free provider.

This issue seems like a minor nit until you notice how many proposed
spam defenses are based on the assumption that most spam is forged,
so that spammers cannot receive DSNs and spammers are not authorized
to use the sender addresses or SMTP clients they use.  For example,
if 90% of spam is forged, then RMX, C/R, and authentication schemes
could do a lot against spam (modulo their other problems).  If only
10% of spam is forged, then those schemes are limited to affecting
that 10% fringe, albeit a very irritating fringe.

Here if not elsewhere, circular reasoning is inadmissible.

---

From: Michael Rubel <[email-masked]>
Date: Sun, 18 May 2003 19:11:42 -0700 (PDT)

> to use the sender addresses or SMTP clients they use.

Fortunately, some of the proposals are not too disruptive and have other,
stronger benefits as well.

Mike

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 19 May 2003 08:51:31 -0400

Vernon Schryver <[email-masked]> wrote:
> addresses among all targets of spam.

  I disagree.  You're assuming that the spammers will distribute the
'from' addresses evenly among email addresses they have.  I see no
reason why that's true.  I used to receive waves of bounces &
notifications about spam allegedly "from" my domain.  I did *not*
receive a steady trickly of such bounces.

>  Unless you think that most spam targets are at free providers, you
> must assume that spammers have some reason for prefering to send as
> if from free providers.

  Spammers do it, therefore they believe it's useful.  Our ignorance
as to *why* they believe it's useful isn't an argument disproving
their behaviour.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 19 May 2003 09:02:20 -0400

> spam defenses are based on the assumption that most spam is forged,

  I've seen few defenses which make that assumption explicitely, or
even implicitely.

> to use the sender addresses or SMTP clients they use.

  Which brings us back to the charter.  Here "authorized" == "consent".

  Q: How does the recipient of an email determine that the domain
     owner of the alleged "From:" consented to send that email?

>  For example, if 90% of spam is forged, then RMX, C/R, and
> authentication schemes could do a lot against spam (modulo their
> other problems).  If only 10% of spam is forged, then those schemes
> are limited to affecting that 10% fringe, albeit a very irritating
> fringe.

  These systems establish a consent framework for communication.  In
my opinion, explicite consent-based frameworks will be the only methods
by which the spam problem is solved.

  And until a better system is presented, it looks like attacking even
only 10% of the problem is the best option we have right now.

  Or do you have a better system you'd like to propose?  If so, I'm
all for dumping RMX, C/R, etc.

  Alan DeKok.

---

From: "Eric Dean" <[email-masked]>
Date: Mon, 19 May 2003 16:37:46 -0400

> > other problems).

It's not a large step to estimate that 90% of spam is forged.
1) However, much of that spam can be filtered using simple sender domain
checks.  Many spammers use bogus domains and maybe 5-10% of spam is dropped
accordingly.
2) The next value is to do a HELO hostname check..about 10-20% is dropped as
well.  However, there are casualities for very large companies...such as
bellsouth and verizon whereby I have to punch holes in my filters.
3) Then I could be more aggressive and apply a reverse-dns check on the
initiating source IP.  Doing so is also effective, however, all DSL and
carrier Dial networks in-addr their IP pools...yet many mail admins don't.
I have aout another 5-10% of my spam come from unresolved IPs..but instantly
the phones light up..cost me money..and I'm out of business.  The tough-love
approach is suicidal stupidity.
4) Then OK, so now we go with RBL, to identify the pools..that'll
work..costs non-trivial money..but it works for that flavor of spam..maybe
5%.

Then I get plenty of spam from valid random domains, with valid senders (at
least reply with SMTP OK), random IPs, reverse-DNS mappings (maybe
overseas), valid HELO..everything marries up..and I still get 1-2
spams/second.

So, I stopped looking at the logs because it depresses me..and I do
something stupid like try to blacklist someone..or scan  my bounce queue for
http://  links or HREFs to indicate that there was some sort of
solicitation.  Trying to identify a pattern for spam is like writing an
equation for the Niagra Falls.  John Forbes Nash Jr was more successful than
I was in identifying textual patterns.

My lesson in futility was that the only successful anti-spam method is a
distributed one.

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 19 May 2003 15:49:34 -0600 (MDT)

> From: "Eric Dean" <[email-masked]>

> It's not a large step to estimate that 90% of spam is forged.

What justifies that step?  The available numbers and simple logic seem
to say that something quite different.

> checks.  Many spammers use bogus domains and maybe 5-10% of spam is dropped

That's not what I see.  About 192 or 0.6% of the last 27,972 spam
caught by my traps had bogus sender domain names.  Since modern
versions of sendmail and other MTAs usually require that the sender
domain exist, the surprise is that even that small amount of spam
has bogus sender domains.

> work..costs non-trivial money..but it works for that flavor of spam..maybe

Are those numbers based on measurements or intuition?

> My lesson in futility was that the only successful anti-spam method is a

I like the word "distributed," but I don't understand that reasoning.

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 19 May 2003 22:46:24 -0400

>work..costs non-trivial money..but it works for that flavor of spam..maybe

Well, actually I collected some of this data as well.  But without 
corresponding data on non-spam, it's not very useful.  Certainly each 
of the steps you outline includes an increased number of false 
positives.

There were 7376 unique senders.
4298 had some "problem" with the HELO or DNS information.

10	No A record for the HELO domain
702	The hostname for the HELO doesn't resolve
1330	Unqualified domain in the HELO
2030	Sender domain does not match the HELO
76	DNS Failed or timed out
1000	No DNS A data (not sure how this differs from the first)
8	Bad DNS Q Data Format (?)
101	Pipelined

(Pipelining was detected by spotting cases where an error was 
returned which should have terminated the transaction, but they kept 
sending commands, up to and including the content of the message.)

Obviously those all overlapped a good deal.  Your immediate reaction 
might be to make sure that the sender domain matches the HELO.  After 
all, it would nail half the spam right there.  But then again, it 
would also block most of the mail coming from my domain and many 
others.  My mail server always uses the primary domain name in the 
HELO, no matter which domain it sends for.  That's probably true of 
most servers.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric Dean" <[email-masked]>
Date: Mon, 19 May 2003 23:08:49 -0400

> HELO, no matter which domain it sends for.  That's probably true of

Yes, we host 300 domains...trying to do RFC checking is a miserable
experience when many mail admins don't even perform reverse-DNS registration
or forward registration of the HELO host.

---

From: "Eric Dean" <[email-masked]>
Date: Tue, 20 May 2003 09:30:12 -0400

> 10	No A record for the HELO domain

Helo hostname

> 1000	No DNS A data (not sure how this differs from the first)

Sender domain..but you'd think that would say no A or MX record

---

From: "Tom Thomson" <[email-masked]>
Date: Tue, 20 May 2003 20:38:39 +0100

> 10	No A record for the HELO domain

Is <domain> equivalent to <host> or was there a reason for that particular
change between RFC788 and RFC821?  For example did RFC822 legitimize HELO
EXAMPLE.COM from the host MAILSENDER42.EXAMPLE.COM?  If the change was
meaningful, you should not expect thee to be an A record.

> 702	The hostname for the HELO doesn't resolve

There isn't a hostname to resolve, is there?  So why should this imaginary
thing resolve?

> 2030	Sender domain does not match the HELO

What does "match" mean?  Does A.B.COM match B.COM?  Does B.COM match
A.B.COM? (Is "match" symmetric?).  If these don't match, expect false
positives from people whose mailservers use a host (rfc788) in helo, as the
transmitting MUA may not run on that machine.

<snip>
> HELO, no matter which domain it sends for.  That's probably true of

Quite so.  That's why RMX records or some other scheme to achieve the same
effect may be useful.

Tom