Subject: Re: [Asrg] 6. Proposals - DNS-Based - LMAP]

From: Fridrik Skulason <[email-masked]>
Date: Thu, 13 Nov 2003 09:58:23 +0000

> The answer is that it will eliminate the worst types of spam, impersonation
> spam.

One point to consider: Anything that will eliminate impersonation spam will
also have a drastic effect on computer worms.  It might be easier to push
a solution that will not only help with one problem (spam) but another
(worms) as well.  It will not eliminate either problem of course, but it
will help with both.

The reason this would work against worms is as follows: Many worms use
the same methods as spamming software to forge the sender's identity,
making it sometimes look to the recipient as if the sender is someone
he already knows, this making it more likely he will believe the message
and open/execute the attachment, activating the worm.

The "worst" mail-borne worm incident was without any doubt the one
involving W32/Sobig.F@mm.  That problem got "solved" on its own, because the
author included code to make the worm turn itself off globally on a 
specific date.

What if the next worm author is not equally "considerate"?

If the worm would not have been able to forge the identity of the sender,
one can assume that fewer people would have fallen for it and fewer
machines been infected and the problem would not have been as bad.

Therefore my suggestion is that anyone arguing for the implementation
of LMAP should not only point out the benefit with regard to spam, but
also the beneficial effects regarding worms.  This might for example
make it easier to convince companies like Microsoft to endorse the
proposal.

--
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email-masked]       fax:   +354-540-7401

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 17 Nov 2003 16:28:18 -0500

> (worms) as well.  It will not eliminate either problem of course, but it

  Exactly.

  Further, once the worms are forced to (ab)-use local MTA's to
propogate, their propogation rate will go down significantly.  The
experience we had locally before installing filtering software was
that 1-2 machines sending worms through the corporate MTA would
effectively DoS the MTA, and prevent further spread.

  LMAP can also be known as "making your local network screw-ups
affect you more than it affects me."

  Alan DeKok.