Subject: [Asrg] 0. General - List will be unavailable due to Hurricane Isabel

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Sep 2003 12:40:51 -0400

To: ietf-announce: ;
Subject: Hurricane Isabel and ietf.org
From: [email-masked]
Date: Thu, 18 Sep 2003 11:55:30 -0400 (EDT)
Sender: [email-masked]

The machines that serve the IETF are located in the track of Hurricane
Isabel, which is expected to impact the East Coast of the United States
on Thursday.  There are currently two servers:

www1.ietf.org (in Reston, Virginia)
www2.ietf.org (in Natick, Massachusetts)

The Reston site hosts the mail server, all of the Web pages, and the Web
site search engine.  The Natick Web server is a mirror of the Reston Web
server, except for the Web archives of the mail. The address
www.ietf.org points to both servers.

As a protective measure several servers in the Reston office will be
powered off between 1400 and 1430 EDT.  Mail to ietf.org will not be
processed until the servers are brought back on-line.  If the Reston
office has a powerfailure, the Web archives of the mail, and the Web
search engine will not be available.  If the Web server you are pointing
to is not responding, then please attempt to use the direct addresses of
both servers to access the pages.

Please be sure that the technical team will be working to restore these
services as quickly as possible.

Thank you in advance for your understanding in this matter.

The IETF Secretariat

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Liam Meany" <[email-masked]>
Date: Thu, 18 Sep 2003 18:36:21 +0100

Hello all,

Sorry for changing the subject but I was wondering if anyone knows if there
is an offical definition from the ASRG on what spam actually is? I had a
look at the IETF website but could not find one.

regards,

Liam

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Sep 2003 13:54:40 -0400

> look at the IETF website but could not find one.

Hi Liam,

First of all just a reminder to follow the posting guidelines
(http://www.irtf.org/asrg/asrg_mailing_list_information.htm). I changed
the subject of the message to comply with the guidelines.

To answer your question - we all agree that we disagree. We do not have
an official definition and are not seeking for one. Rather, we want to
leave the definiation of spam to be defined by each end-user and ISP as
they want, with the ASRG defining and evaluating different tools to make
it happen. This is reflected in the ASRG charter
(http://www.irtf.org/charters/asrg.html):

"The definition of spam messages is not clear and is not consistent
across different individuals or organizations. Therefore, we generalize
the problem into "consent-based communication". This means that an
individual or organization should be able to express consent or lack of
consent for certain communication and have the architecture support
those desires."

 From the consent framework
(http://www.solidmatrix.com/research/asrg/asrg-consent-framework.html):

"This model does not concern itself with defining what spam is – one
person's spam message may be another's freedom of speech. Thus, we only
seek to define a consent framework – everything else is left to the
implementors and the users themselves."

 From the technical considerations document
(http://www.ietf.org/internet-drafts/draft-crocker-spam-techconsider-02.txt):

<snip>
      Internet mail has operated as an open and unfettered
      channel between originator and recipient.  It has
      always suffered from some degree of abuse, in which
      originators impose on recipients inappropriately.  In
      recent years, a version of this abuse has grown
      substantially.  Called spam, its definition varies from
      "unsolicited commercial email" to "any email the
      recipient does not want".  Often there are no technical
      differences between spam and "acceptable" email. Their
      format, content and even aggregate traffic patterns may
      be identical. Hence spam is a problem for fundamentally
      non-technical reasons, yet the Internet technical
      community must pursue technical responses to it.  The
      lack of strong community consensus on a single, precise
      definition makes this particularly challenging.

      For most working discussions, the term "Unsolicited
      Bulk Email" is sufficient.  The salient point that it
      is a mass-mailing ensures that discussion covers the
      broadest concern of the user and provider
      communities. Mail that is not in some real sense "bulk"
      cannot flood networks or mailboxes. Essentially all
      mail that people object to, as "spam", is bulk. For
      example practically all objectionable advertising mail
      is also bulk, although modern techniques for targeted
      advertising can permit extensive content or address
      tailoring. "Bulk" is usually very difficult for an
      individual recipient to prove, but almost always easy
      to recognize in practice.

      More detailed discussion must, of course, be precise in
      the definition of "unsolicited" and usually must
      distinguish between different types of mail, such as
      commercial, religious, political or personal.
<snip>

---

From: "Liam Meany" <[email-masked]>
Date: Thu, 18 Sep 2003 20:27:59 +0100

Hello Yakov,

Many thanks for the detailed reply. Point taken on the "subject" guidelines.
Apologies to all.

A bit on my background
I'm currently working on a dissertation regarding spam - where it comes
from. To this end I've seeded 398 email addresses in various places on the
web including web pages, mailing lists and newsgroups. The honeypot is in
operation for about 3 months now and so far I have only received about 300
actual spam messages.

The major finding so far is that 80% of the spam comes from email addresses
posted to newsgroups and only 10% from web pages, despite trying to
advertise them as much as possible with the search engines. I seems that it
takes longer for the spammers to get email addresses from web pages or least
that low traffic websites are not their target.

If anyone else in the group is investigating  similarly, or has any views, I
would be happy to hear from them.

many thanks,

Liam

----- Original Message -----
From: "Yakov Shafranovich" <[email-masked]>
To: "Liam Meany" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, September 18, 2003 6:54 PM
Subject: 2. Analysis - Spam Definition (was Re: [Asrg] Spam definition!)

Hi Liam,

 From the technical considerations document
(http://www.ietf.org/internet-drafts/draft-crocker-spam-techconsider-02.txt)
:

<snip>

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Sep 2003 22:00:31 -0400

Terry Sullivan is involved in the analysis area and can provide some 
statistical input on this.

---

From: "Peter J. Holzer" <[email-masked]>
Date: Mon, 22 Sep 2003 15:12:39 +0200

On 2003-09-22 10:40:53 +0200, Jose Marcio Martins da Cruz wrote:
> Less than four hours later, we begun to receive spam on the honeypot.
> 
> Now, there are 2067 messages inside. I've just looked to it and I noted
> that there are two kind of messages in : spams and virus. I've not
> really counted, but it seems to me that 1/4 or something like that are
> virus. Amusing ! What does this means ?

Some Viruses and Worms scan pages in the browser cache for email
adresses. So they would find your honeypot adress if somebody who
happens to be infected views your page.

> Also, if I compare, for some time period, which gateways are sending
> spam to and and which gateways are sending virus to us, the intersection
> is allways not empty, but has many common entries (sometimes more than
> half one set)...

Two possible explanations:

1) People who are infected by viruses and worms are careless. Thus, they
are much more likely to install proxies, mail-relays, formmailers and
other programs without considering the consequences or even bothering to
configure them correctly.

2) Some viruses install trojans which act as open proxies.

	hp

-- 
   _  | Peter J. Holzer    | We have failed our own creation and given
|_|_) | Sysadmin WSR       | birth something truly awful. We're just too
| |   | [email-masked]         | busy cooing over the pram to notice.
__/   | http://www.hjp.at/ |       -- http://www.internetisshit.org

---

From: "Liam Meany" <[email-masked]>
Date: Mon, 22 Sep 2003 18:18:36 +0100

Hello Jose,

I also get mostly hoax upgrades and viruses. It's very interesting that you
got your first spam within four hours where it took me about two months!

Any data would be appreciated.

regards,

Liam

----- Original Message -----
From: "Jose Marcio Martins da Cruz" <[email-masked]>
To: "Yakov Shafranovich" <[email-masked]>
Cc: "Liam Meany" <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Monday, September 22, 2003 9:40 AM
Subject: Re: [Asrg] Re: 2.a. Analysis - Honeypot!

>
>
> Hello,
>
> Yakov Shafranovich wrote:
> >
> I'm not on that group, but I have some (imho) interesting data.
>
> >
> > Liam Meany wrote:
> >
> > > Hello Yakov,
> > >
> On april (five months ago), I created a honeypot on our webserver : a
> false e-mail address inserted in a comment at the main page of our
> webserver.
>
> Regards,
> Jose-Marcio
>  ---------------------------------------------------------------
>  Jose Marcio MARTINS DA CRUZ           Tel. :(33) 01.40.51.93.41
>  Ecole des Mines de Paris              http://j-chkmail.ensmp.fr
>  60, bd Saint Michel                http://www.ensmp.fr/~martins
>  75272 - PARIS CEDEX 06      mailto:[email-masked]

---

From: Jose Marcio Martins da Cruz <[email-masked]>
Date: Wed, 24 Sep 2003 11:07:25 +0200

Hi,

Not really this. 

What I'd like to say is that a significant number of connections sending
spam to us come from end users of domains client.attbi.net, or
verizon.net, rr.com, mindspring.net, interbusiness.it, .br, and so...

At the same time, a significative number of virus are coming from
endusers from the same domains.

As a french education/research institution, we have very few reasons (in
fact, no reason) to receive connections directly from end-users of these
domains.

What I was trying to figure out is : are most spammers infected by
virus, or virus are being sent conciously...

This amazes me.

At the same time, as our filtering does dynamic blacklisting, we receive
spam coming from many, many clients. The same spam comes from many
clients, and each client does very few connections a day (one or two).
The very most spam we receive comes from end-users of these domains, not
from open-relays.

I suspect some spam proposing you to work at home are, in fact,
proposals to let your computer available to distribute spam. Some sort
of a "network of workers". The same kind of structure such as
Tupperware, or others...

"Peter J. Holzer" wrote:
>   ------------------------------------------------------------------------
>    Part 1.2Type: application/pgp-signature

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 24 Sep 2003 08:48:31 -0400

>The very most spam we receive comes from end-users of these domains, not

More likely is that spammers are using the proxies that have been 
installed by the virus.  And these aren't necessarily detectable 
proxies.  They require certain triggers to get them to open up and 
forward spam.
-- 
Kee Hinckley
http://www.messagefire.com/         Next Generation Spam Defense
http://commons.somewhere.com/buzz/  Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.