Subject: Re: [Asrg] Re: "worm spam" and SPF

From: [email-masked]
Date: Fri, 3 Dec 2004 13:03:23 +0530 (IST)

>>> Or, alternatively, the problem SPF "solves" is NOT the spam
>> problem, nor is it the worm problem.
>
>> Yes, that's true, SPF attacks the problem of forged MAIL FROM
> addresses and forged HELO domains.
>
> Right, but if that's the ONLY thing it does then it shouldn't be talked
> about as
> a cure for spam, since spam DOES NOT HAVE TO USE forged From addresses or
> forged
> HELO domains.

It was never meant to be a cure for spam. It is just an anti forgery thing.
But still in a way it is related to the spam problem because there are
spams blocked by checking SPF records.

>> ...It's indirectly related to spam and worms at the moment, like open
>> relays
> were related to the spam problem some years ago.
>
> "Indirectly related" is fine, as long as we recognize it ONLY as such.
> (And as
> such, I think it gets WAY more discussion and attention than it deserves.)
>

> I don't see SPF as the solution for almost ANY questions.
>
>> "Many" is good enough, spammers and worm authors won't waste
> their time with something not working at say AOL or behind SA.
>
> The idea of creating a confusing patchwork lattice mesh that the spam
> would have
> to work its way through is fine.  But SPF is not at all difficult to
> defeat...
> you just send the mail using the infected victim's authorizations.

Tell me one spmmer who has the time and patience to first email a worm +
sniffer to a victim and then wait for the sniffer to sniff the victims
username pwd and other user name pwd. and then start using those ID/pwd
for sending out mails, worst if the network is switched , then wasting
time in arp spoofing and waiting to sniff.
 There are still open relays , return path forgeries etc used by spammers
because most ppl rely only on Anti spam wonder products and they don't
want to take any initiative on their own or just don't know about things
they can do to prevent spam.

>>> undoing the DAMAGE that SPF has done
>
>> There's no "damage", if you don't like it just don't publish a
> sender policy.
>
> Again, you're ignoring things like discussion group/mailing lists, message
> digests, and so forth.  Anybody who makes the mistake of supporting SPF
> later
> finds that they can't send mail using their business E-mail address when
> they
> are (say) on a cruise ship vacation or at an Internet cafe in some other
> country.

SMTP AUTH is a simple and effective way.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Peter J. Holzer" <[email-masked]>
Date: Fri, 3 Dec 2004 12:58:55 +0100

On 2004-12-03 13:03:23 +0530, [email-masked] wrote:
> > The idea of creating a confusing patchwork lattice mesh that the
> > spam would have to work its way through is fine.  But SPF is not at
> > all difficult to defeat...  you just send the mail using the
> > infected victim's authorizations.
> 
> for sending out mails,

Spammers are already sending out worms to their victims. Currently these
worms install zombies which then send out mails using random sender
addresses directly to the target MX. If that stops working, these
zombies will start using the credentials and SMTP server found by
reading the registry, tricking the user or sniffing traffic. Sure, that
is a bit more difficult than what they do now, but what they do now is a
lot more difficult than what they did a few years before, so you can
expect that they will do it if they have to.

> worst if the network is switched , then wasting time in arp spoofing
> and waiting to sniff.

Doesn't make much difference. They only need the traffic for the local PC. 

> they can do to prevent spam.

Spammers will use whatever method works for them. If there are still
open relays, at least some spammers will use them.

> > Again, you're ignoring things like discussion group/mailing lists,
> > message digests, and so forth.  Anybody who makes the mistake of
> > supporting SPF later finds that they can't send mail using their
> > business E-mail address when they are (say) on a cruise ship
> > vacation or at an Internet cafe in some other country.
> 

SMTP AUTH works only between parties which know each other. I can use
SMTP AUTH to authenticate myself against our SMTP server. But when our
SMTP server forwards the mail to the target MX, it cannot use SMTP auth
to prove that it is authorized to send mail on my behalf. To the target
MX, our SMTP server is indistinguishable from some zombie sending spam
with my address. SPF, MTAmark etc. try to fix that by marking "official"
SMTP servers. Blocking port 25 outbound on dynamic ranges would be
accomplish about the same thing (only in a more drastic and effective
way).

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Gadi Evron <[email-masked]>
Date: Fri, 03 Dec 2004 17:59:57 +0200

> expect that they will do it if they have to.

Absolutely right, and as the guy who raised this point against blocking 
port 25, allow me to say this:

If spammers send out spam from (usually) just one email address per 
compromised PC, spam will drop to tens or hundreds of messages a day per 
person, instead of hundreds or thousands.

Still, there are enough drone out there to make up for it, but it is a 
step in the right direction.

Unlike what was said here, using techniques that will force spammers to 
learn and adapt is not always a bad thing, when pressing them to the corner.

	Gadi.

---

From: Bill Cole <[email-masked]>
Date: Fri, 3 Dec 2004 19:57:18 -0500

At 5:59 PM +0200 12/3/04, Gadi Evron  imposed structure on a stream 
of electrons, yielding:
>Unlike what was said here, using techniques that will force spammers 
>to learn and adapt is not always a bad thing, when pressing them to 
>the corner.

That's all that CAN be done.

If all spammers were like those at Amazon and Verisign and Digital 
Impact and eDialog and Responsys, dealing with spam would not be a 
big deal. Even the borderline semi-legit cases like OptInBig and 
over-the-borderline cases like Atriks can be dealt with because they 
try to look like the 'legitimate' entities that acquire addresses 
without real permission and mail them without end: they all make true 
(if at times deceptive) assertions of their identity in SMTP and in 
the mail headers and usually the message body of their spam. The more 
spammers can be boxed into saying "Hi, I'm, Spammer X" in their spam 
and the more worms can be boxed into "Hi, I'm Joe Idiot's infected 
machine", the easier it becomes to not hand either sort of mail to 
users. It also makes it swifter and easier to drive the business 
model of spamming into hopelessness and to identify the users who 
need to be walled in behind in loco parentis firewalls.

-- 
Bill Cole                                  
[email-masked]

---

From: [email-masked]
Date: Sat, 4 Dec 2004 15:52:50 +0530 (IST)

> accomplish about the same thing (only in a more drastic and effective

I meant SMTP AUTH for Sender only no the target SMTP server. It was
from the user point of view. And yes SPFand other techniques do help in MTA
to MTA transaction.

>> > vacation or at an Internet cafe in some other country.

mobileSender@myDomain--AUTH--> myDomain SMTP--SPF,MTAMark etc---target SMTP
|__________________________________________|

Regards,
@