Subject: Re: [Asrg] 6. Proposals - DNS-Based - LMAP]

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 13 Nov 2003 10:05:14 -0500

Hi,

The following has some relevant information to this topic:

http://www.elan.net/~william/asrg-emailpathverification-presentation.pdf

Hallam-Baker, Phillip wrote:
> What I could do which might help move us forward is to write a whitepaper
> that has a table that lists the various incremental types of authentication
> and accreditation that are possible in this space, the advantages and costs
> associated with each.
> 
> 
> 
> 
>>-----Original Message-----
>>From: Fridrik Skulason [mailto:[email-masked]]
>>Sent: Thursday, November 13, 2003 4:58 AM
>>To: [email-masked]
>>Subject: Re: [Asrg] 6. Proposals - DNS-Based - LMAP]
>>
>>
>>
>>>The answer is that it will eliminate the worst types of 
>>
>>spam, impersonation
>>
>>>spam.
>>
>>One point to consider: Anything that will eliminate 
>>impersonation spam will
>>also have a drastic effect on computer worms.  It might be 
>>easier to push
>>a solution that will not only help with one problem (spam) but another
>>(worms) as well.  It will not eliminate either problem of 
>>course, but it
>>will help with both.
>>
>>The reason this would work against worms is as follows: Many worms use
>>the same methods as spamming software to forge the sender's identity,
>>making it sometimes look to the recipient as if the sender is someone
>>he already knows, this making it more likely he will believe 
>>the message
>>and open/execute the attachment, activating the worm.
>>
>>The "worst" mail-borne worm incident was without any doubt the one
>>involving W32/Sobig.F@mm.  That problem got "solved" on its 
>>own, because the
>>author included code to make the worm turn itself off globally on a 
>>specific date.
>>
>>What if the next worm author is not equally "considerate"?
>>
>>If the worm would not have been able to forge the identity of 
>>the sender,
>>one can assume that fewer people would have fallen for it and fewer
>>machines been infected and the problem would not have been as bad.
>>
>>Therefore my suggestion is that anyone arguing for the implementation
>>of LMAP should not only point out the benefit with regard to spam, but
>>also the beneficial effects regarding worms.  This might for example
>>make it easier to convince companies like Microsoft to endorse the
>>proposal.
>>
>>--
>>Fridrik Skulason   Frisk Software International   phone: +354-540-7400
>>Author of F-PROT   E-mail: [email-masked]       fax:   +354-540-7401
>>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Paul Judge <[email-masked]>
Date: Thu, 13 Nov 2003 10:02:20 -0500

Phillip also gave a relevant presenation at the  ASRG meeting in March:
http://www.ietf.org/proceedings/03mar/slides/asrg-7/index.html

> From: Yakov Shafranovich [mailto:[email-masked]] 
> Sent: Thursday, November 13, 2003 10:05 AM
> To: Hallam-Baker, Phillip
> Cc: 'Fridrik Skulason'; [email-masked]
> > What I could do which might help move us forward is to write a 
> > whitepaper that has a table that lists the various 
> incremental types 
> > of authentication and accreditation that are possible in 
> this space, 
> > the advantages and costs associated with each.
> > 
> > 
> > 
> > 
> >>he already knows, this making it more likely he will believe the 
> >>message and open/execute the attachment, activating the worm.
> >>
> >>involving W32/Sobig.F@mm.  That problem got "solved" on its own, 
> >>because the author included code to make the worm turn itself off 
> >>globally on a specific date.
> >>