Subject: Re: [Asrg] Re: 6. Proposals - Pull System (revisited)

From: "Dag Kihlman" <[email-masked]>
Date: Sun, 30 Nov 2003 12:26:24 +0100

"Alan DeKok" <[email-masked]> wrote:

>"Dag Kihlman" <[email-masked]> wrote:
>> The failing of SMTP is that it allows the sender to cheat or lie. Any
>> authentication in SMTP is just authentication in an academic sense. In
>> reality spammers will hack even more than today and send using fully
>> authenticated mail servers.

>  Pull systems do not change this behaviour.  See recent spammer
>behaviour of hosting web sites on trojaned machines.  They could just
>as easily host mail for a "pull" system on the trojaned machine.

>  The benefits of a pull system are different.  It allows recipients
>to do things like wait 12 hours to pick up mail from unknown senders,
>at which point the trojaned machine probably has a different IP, and
>thus can't send the spam.

Why on earth should computers with dynamic IP addresses be allowed to host
mail in a pull system??? My suggestion was that all traffic to the pull
server ports are forbidden to dynamic IP addresses. The ISP:s must enforce
this rule or they will be cut off too.

>at which point the trojaned machine probably has a different IP
No, no, no!!! Do not trust on that! In theory I have a dynamic IP-address.
In reality it has not changed for three months. Several of my friends
experience the same thing. Your suggestion makes mine and tens of thousands
similar cable modem machines honey pots for spammers. With my suggestion
they are uninteresting. The fewer the honey pots are the more costly it will
be to find them and the fewer the spammers will be.

If I want to install a pull server I ought to subscribe to a static IP
address and pay some fee for having the ports opened. (The market will make
this fee reasonable)

When I say spammers can not lie in a pull system I mean they must be honest
about their IP-address. Any other honesty is unfortunately not possible on
the Internet.

/DK

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Philip Miller <[email-masked]>
Date: Sun, 30 Nov 2003 11:13:55 -0500

> be to find them and the fewer the spammers will be.

I too have, in theory, a dynamic IP address. Mine hasn't changed in even 
longer. I also host a legitimate email server for a domain. However, my MTA 
doesn't make direct connections to recipient MTAs, but instead use Comcast's 
'smart host', which relays any mail for anyone on their network, because 
many large providers (notably AOL) subscribe to the DSBL and other similar 
lists.
How does this setup relate to pull systems? Would I now be responsible for 
my own pull server? Or would major service providers still have to block 
supposedly dynamic addresses because the ISPs hosting them aren't following 
the rules you stated? My point is, in order for this idea of pull servers 
only being hosted on machines that should be hosting them, you need complete 
buyin from ISPs, who have little motivation not to get their netblocks 
blacklisted, because that's actually less administrative work for them than 
maintaining their own blocks. The only way to push them towards compliance 
is to use the tactics used by the MAPS blacklist, which intentionally caused 
collateral damage to get attention.

> address and pay some fee for having the ports opened. (The market will make

If I want to install a legitimate MTA, I can do it for free, right now. 
Nothing prevents me from sending mail using whatever email address I 
legitimately have except for hackneyed blocking measures in place across the 
Internet. If I own a domain, I can set up A and MX records for my server, 
but those don't tell the recipient that my server is authorized to send mail 
for the domain. LMAP and MTAMark together achieve this, without a fee, and 
without bringing in the worse-than-useless ISP 'support' staff.

> about their IP-address. Any other honesty is unfortunately not possible on

Under your pull system, there is no benefit to receivers until every ISP 
turns on your blocking or gets blacklisted. Until then, there will be quite 
a mess. There will always be non-compliant sites and service providers. Your 
proposal doesn't deal with that issue any better than SMTP does currently.

--
Philip Miller

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 30 Nov 2003 12:06:13 -0500

"Dag Kihlman" <[email-masked]> wrote:
> mail in a pull system???

  Ah.  You're not just advocating a pull system, you're advocating a
bunch of other changes to messaging deployment and use.  That makes it
significantly harder to convince anyone to use any new system.

  For the record, minor changes to SMTP deployment can also deny
messages which come from a dynamic IP.  See DUL lists.  There's no
need for a pull system to implement such restrictions.

  I'd advise you to take your list of restrictions, and see how they
can be applied to SMTP, before advocating a pull system.  You'll
probably see that a pull system isn't necessary.

> Your suggestion makes mine and tens of thousands similar cable modem
> machines honey pots for spammers. With my suggestion they are
> uninteresting.

  Huh?  I suggested no such thing.  And I don't see how the recipient
can tell that the message is from a machine with a dynamic IP, unless
it's told somehow.  That information can then also be applied to SMTP,
making a pull system irrelevant.

> address and pay some fee for having the ports opened. (The market will make

  Ah... so you're not advocating a technical change, then.  You're
advocating some kind of social/legal solution, and you see technical
changes as the best way of making that social/legal solution more
applicable to the real world.

  Alan DeKok.

---

From: "Dag Kihlman" <[email-masked]>
Date: Sun, 30 Nov 2003 18:50:52 +0100

----- Original Message ----- 
From: "Philip Miller" <[email-masked]>
To: "Dag Kihlman" <[email-masked]>
Cc: <[email-masked]>
Sent: Sunday, November 30, 2003 5:13 PM
Subject: Re: [Asrg] Re: 6. Proposals - Pull System (revisited)

> proposal doesn't deal with that issue any better than SMTP does currently.
I would say the mess is here today. Filters remove perfectly honest mails
and let spam pass. As long as anyone can hack someone else's computer any
verification system can be put out of business.

Since the sender never can be 100% verified in a push system I suggest a
pull system where the sending server is always 100% verified. It is not
authenticated, it is not certified, it is not blessed by the pope but if the
mail body is not on that server the spammer is really really stupid.

On top of this 100% verification of the sending server you can add
blacklists, whitelists, classifications. Probably people will blacklist like
mad but that is really up to the individual. ICQ is a system where the user
can blacklist everyone else but the persons on the contactlist. This does
not mean ICQ does not work. It works splendidly. People are able to
communicate and maintain a blacklist at the same time. They can do it and
they will do it better than automated servers.

Sure you can have blacklists in push as well, but allowing spammers to push
is really making them a service: they are able to hit and run leaving
virtually no trace on the hacked machine. In my system I will see if
spammers or viruses are using my credentials to send mail and I am able to
stop them. If my ISP has not blocked the ports to a pull server on my
machine some blacklists will discover that a lot of spam is comming from my
ISP and block everything from the ISP. Sure this is causing damage but to
quote Rambo: they made first blood! ;-)

/DK

---

From: Philip Miller <[email-masked]>
Date: Sun, 30 Nov 2003 15:17:36 -0500

Dag Kihlman wrote:
[snip]
> mail body is not on that server the spammer is really really stupid.

This '100% verification you're offering is the same that we get today: we 
know what IP address is connecting to us.

> they will do it better than automated servers.

We can do black/white/category lists by connecting IP with the current 
system. What are MAPS, SPEWS, ORBS, DSBL, DUL, etc?
As a side note, ICQ is normally an opt-in whitelist, which is something 
quite extraordinary for MTAs outside a single organization.

> quote Rambo: they made first blood! ;-)

Again, if you create blacklists of pull servers, spammers can still use them 
to look up vulnerable hosts, and those hosts are just as useful as they are 
now, because not many people actually use IP-based blacklists as blacklists.
With the LMAP proposal, you will not have to see spammers or viruses using 
your credentials, because it will be completely impossible!
And citing Rambo for support in a serious discussion is probably about as 
helpful to your cause as citing Hitler.

Philip Miller

---

From: "Chris" <[email-masked]>
Date: Mon, 1 Dec 2003 10:40:37 +1030

> address and pay some fee for having the ports opened. (The market will
make

You would have to enact a law that states fees must be charged.
That would only be valid in the country where the law is enforced.

no ISP is going to start charging for a service he now provides essentially
free. not if he wants to stay in business.

and where does this fee get applied ?

the ISP. his provider?, backbone providers?

I could see this fee very quickly concentrating into a few hands, and then
we have a monopolisation occuring.

how would it be charged ?

per port?, per email?

> >as easily host mail for a "pull" system on the trojaned machine.

Trojaned machines are a major setback to any anti spam e-mail system.
regardless of type because they run with the parent machines permissions.

I have personally been IP blacklisted because my mail system was on the same
shared machine as a vulnerable formmail script
(exactly the same effect as a trojan)

This problem is not confined to owners of windows desktop machines. ISP's
have it as well no matter what they run.

I don't see how any technical sender verification system can overcome this.
please feel free to enlighten me if one comes to mind.
(most I can think of would rely on forcing the ISP to play our way not
theirs)

A big legal stick may force ISP's to be more careful about allowing users
access to formmail etc. or smtp but thats not a technological solution, and
again only applicable where the law is enforced.

At least one benefit of a pull system is that the sender can't be dummied
even by a trojan. it may take over the the resources but incoming bounces
"message denied" etc.. will make it abundantly clear to the user that his
machine has been trojaned.

as it stands a trojan can take over a machine quietly send out e-mails,
return address them to no-one or some other joe and no one is the wiser. not
even the user unless his resource are exhausted by the trojan.

Regards
Chris

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Dag
> Kihlman
> Sent: Sunday, November 30, 2003 9:56 PM
> To: [email-masked]

---

From: "Chris" <[email-masked]>
Date: Mon, 1 Dec 2003 11:08:22 +1030

Chris said...

> machine has been trojaned.

and Chris responded

A smart trojan of course would handle incoming mail and dispose of the
telltale signs.

And this is an example of how we fight a losing battle....

Not that I say give up. heck no.

but the solution is not ours alone

all areas of the internet must be tightened to minimise the impact of such
attacks.

Most (not all) spammers are laymen, they rely on other peoples software to
do the job for them.

If anyone think spammers will move en masse to trojan systems to continue
their habit I believe they are sadly mistaken.

They spam currently because they can. but if it means becoming technically
savy, and deliberately hacking into other peoples machines. I doubt many
will follow this path.

And how many trojan writers will advertise their wares on a commercial
basis?

Some I am sure. but not enough to return the Internet to the bad old days
err... today!

Regards
Chris

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Chris
> Sent: Monday, December 01, 2003 10:41 AM
> To: Dag Kihlman; [email-masked]
> Subject: RE: [Asrg] Re: 6. Proposals - Pull System (revisited)
>
>
>