Subject: Re: [Asrg] Spam, defined, and permissions

From: [email-masked]
Date: Thu, 30 Dec 2004 05:33:40 +0000 (GMT)

> My view is that without introducing economics into the picture we're
all just hoping someone comes along and expends enormous time and
energy and resources etc to fix the problem.

If done right, it's NOT expensive or difficult.  It looks that way MOSTLY 
because most people are looking at stupid and ill-conceived 'solutions'.

Or they're dealing with apples and oranges, like the recent post where people 
were talking about long distance telephone calls and package delivery services 
as examples where billing and cost allocation schemes seem to be effective.  
They're totally ignoring the fact that the costs being allocated are like three, 
four, maybe even five orders of magnitude difference in the price of what you're 
accounting for.  If the cost of your accounting processes is on the order of 
pennies per transaction (and credit card transactions, which are highly 
automated and have been tweaked and tuned for years, are at least billed at MUCH 
more than that), that's fine for international package delivery and probably 
even for phone calls, but it's hopelesly out of the ballgame for E-mail 
transmissions.

>> In order for a paid postage system to work, ISPs would need to 
 > block/control all mail transactions on their network.  The logical way 
 > to do this is to block port 25 and monitor and rate limit transactions 
 > through the authorized servers.
 > 
 > But it seems to me that just blocking port 25 and monitoring and rate 
 > limiting transactions through the authorized servers solves at least 90% 
 > of the problem without charging anyone anything.  

If you have 50 million zombies recruited, you can send a billion spam E-mails 
daily by sending 20 E-mails per day per zombie.

>> If the outgoing mail 
 > servers all had anti-virus scanning too, you'd make it very difficult to 
 > spread viruses effectively too.  

ALL worms and viruses are at their MOST prolific and MOST dangerous before they 
are recognized by ANY antivirus software.

What nearly everybody is missing on the antivirus front is the simple fact that 
if clueless, sweet old Aunt Gertrude suddenly starts sending E-mails containing 
an ActiveX or a 180Kb .EXE file or 125Kb .PIF file, or with Javascript-encrypted 
message bodies and obscured URLs, that is SO unlike her typical and familiar 
behavior that it all by itself is 'a priori' evidence that ought to raise at 
least SEVERAL red flags.  You don't HAVE to virus-scan the 125Kb .PIF file to 
determine that it's bogus... the mere fact that it is THERE (and in an E-mail 
from HER) is enough that it ought to be routed straight to the bit bucket (or at 
the VERY least to some kind of quarantine).

Now, some senders ARE legitimate programmers (me, for one) and I might actually 
be EXPECTED to send executable files in E-mail, although even there there are 
clients I'd be likely to send executable attachments to and other friends or 
relatives where I'd be VERY unlikely to send them executables (and in any case, 
I certainly wouldn't need to send them to them without warning them about it in 
advance!).

So the current widespread dependence on antivirus scanning is really sort of 
dumb, because you're racing to lock the doors AFTER the horses have escaped.  It 
doesn't matter all that much how long they've been gone!

On the other hand, if you simply block (or quarantine, or whatever) UNEXPECTED 
executable (or other 'dangerous') attachments based on a sender-recipient pair, 
you can eliminate VIRTUALLY ALL virus/worm E-mail propagation, and without 
requiring constant updating of virus signature files (which, even updated DAILY, 
will always lag new threats enough to allow INCREDIBLY wide malware propagation, 
to tens or hundreds of millions of machines, within a matter of minutes or 
hours).  Even TOTALLY NEW E-mailed viruses and worms don't get a 'free run' 
before they're blocked.

> Adding smtp-auth on top would make it 
 > more difficult still.  

These approaches still generally have the problem that people with personal 
domains (and who are blocked from sending through their domain provider's SMTP 
servers by these port-25 blocks) have problems sending mail through their 
ISP-provided mail servers.  Most ISPs (understandably) seem to want their 
customers to send their E-mails using the E-mail addresses assigned to the 
customer by the ISP.  Customers, of course, have JUST as much reason to NOT want 
to tie themselves that hard to a particular ISP.

> And instead of fining those that are spewing 
 > viruses, you could just count each failed virus sent as an email attempt 
 > and cut off their email at something like 500 messages as going over 
 > their quota.  

So dear aunt Gertrude suddenly finds she can't send legitimate E-mails anymore. 
So what does she do?  She either gets frustrated and confused and just gets off 
the net, or else she calls her ISP and burns through cu$tomer $upport time while 
they try to help her.  Neither way is a happy solution, and both cost real money 
to somebody.

> That gives the users an incentive to clean up, while still 
 > allowing the ISP a content-neutral mechanism for cutting off the bad apples.

What's wrong with it NOT being content-neutral?

What's wrong with having a filter which blocks strange/inhabitual mail sent by 
Gertrude's machine, but lets her own normal E-mails through just fine?  To me, 
*that* is an intelligent filter... or at least, more of one.

This isn't unlike the active audio noise filter schemes that were popular in 
stereo equipment some years back... (since then these have largely become 
irrelevant in digital audio...) rather than a brute-force "hiss filter" which 
just cuts the high end (and leaving a muddy low-fi mess), it makes more sense to 
look at what ELSE is there, opening the gates (and closing them!) dynamically 
based on what you EXPECT to (maybe!) be there, while actively blocking 
unexpected, random stuff which is almost certain to be only just unwanted noise. 
 High frequency material is most likely to be the result of overtones of 
fundamental (or other overtone) sounds one octave lower.  If the accompanying 
stuff isn't there, then the overtones probably shouldn't be there either.

>> So why aren't the advocates of email postage at least recommending this 
 > as a first step?

Maybe because charge-per-email schemes (even with these "well, the first 
'however many' will be free" (which in practice never seems to last once the 
camel's nose is in the tent) are repugnant and offensive to most users, who've 
been deceived by such BS too many times already? 

>> (Just to be clear, I would only advocate mandatory port 25 blocking on 
 > consumer-level accounts.)

Consumers have almost as much reason to want permanent, portable personal domain 
names as anybody else.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: James Lick <[email-masked]>
Date: Thu, 30 Dec 2004 16:37:40 +0800

[email-masked] wrote:

> If you have 50 million zombies recruited, you can send a billion spam 
> E-mails daily by sending 20 E-mails per day per zombie.
>
>  
>

The figures I've heard are that there are somewhere around 5 million 
zombie hosts out there, and any one group has at most 500,000 hosts they 
control.  That's still a lot, but an order of magnitude or two below 
your scenario.

> ALL worms and viruses are at their MOST prolific and MOST dangerous 
> before they are recognized by ANY antivirus software.
>
>  
>

If most of them have to go through an authorized ISP's server that 
limits each machine to a certain number of emails, then viruses will 
become much less capable of spreading.  In addition, it is easier to 
install anti-virus software that is updated frequently on a small number 
of mail servers than on every individual computer.  I've seen reports 
that as many as half of the end-user computers have no or outdated virus 
protection.  Server anti-virus software can be updated hourly or even 
more frequently while end-user software is at best updated daily.  Most 
viruses continue to spread wildly even days after anti-virus updates are 
available.  It won't solve the problem entirely, but it will reduce the 
magnitude of the problem significantly.

>least SEVERAL red flags.

Ah, but the most logical place to determine what Aunt Gertrude usually 
sends is by forcing her to use her ISP's mail server and to analyze it 
there.  You could also set it so that the limit of executable content is 
lower than other types of emails.  This still does not account for the 
fact that e.g. JPEGs, MP3s, Word DOCs and various other types of content 
can have security exploits in them. 

>doesn't matter all that much how long they've been gone!

Despite not being perfect, anti-virus scanning is effective in reducing 
the problem.  Putting up more roadblocks will only reduce the problem 
further.  Just because some of the horses have escaped doesn't mean you 
leave the door open for the rest to get out.

>hours).  Even TOTALLY NEW E-mailed viruses and worms don't get a 'free run' 

OK, do that TOO then.  The more impediments the better.  Note that even 
this proposal is not perfect, because you can't quarantine every JPEG, 
MP3, or Word DOC file because the average user would crucify whoever 
blocked some time-critical document or product sample photo because it 
might be dangerous.  And who knows what other file types we think of as 
innocuous turn out to be exploitable?  Still, there are certain emails 
that can probably be quarantined without most people complaining.  If 
that helps reduce the problem, let's give it a try.  But again, where's 
the best place to do this?  At the sender's ISP, before it gets out further.

>ISP-provided mail servers.
>

Mail submission protocol, VPN, ssh tunneling, buying premium service 
with fixed ip and no filtering, and a variety of other possibilities 
exist.  Yes, it sucks that it is more difficult to send mail, but it 
sucked when we had to close down open relays too.  The vast majority of 
people have no desire to do what you want, and those that do should be 
able to figure out how to accomplish it.

>they try to help her.  Neither way is a happy solution, and both cost real money 

Well that's just too bad.  I'd rather have Aunt Gertrude pay the price 
of getting infected than for me to pay the price of dealing with 
receiving the sewage her computer is spewing.  ISPs can reduce such 
costs tremendously by doing agressive virus filtering both in and out.  
ISPs don't need to do anything more than tell Aunt Gertrude to get her 
computer cleaned of viruses and could either refer her to such a service 
or offer a paid service of their own.

>What's wrong with it NOT being content-neutral?

I only mentioned that because others had mentioned that filtering by 
content would be a problematic in terms of customer relations or 
legally.  I don't completely share that concern, but it is much less 
subjective and much harder to argue over something content-neutral.

>*that* is an intelligent filter... or at least, more of one.

Sounds like a good idea.  Would work pretty well if you did that 
analysis and filtering at her ISP.  Let us know when you have it working.

>Consumers have almost as much reason to want permanent, portable personal domain 

More than 99% of consumers have absolutely no desire for that, and those 
that do have many options of how to achieve that even in the face of 
port 25 filtering by default.  Experience has shown that every time a 
consumer level ISP has implemented port 25 filtering has seen spam and 
virus propagation from their networks drop dramatically.  Experience has 
shown that mail servers employing agressive, well-updated anti-virus 
filtering see greatly reduced virus propagation in their mail clients.  
It's not perfect, but it works much better than without it.  If most 
consumer ISPs did it, the problem would be reduced even further.

-- 
James Lick -- 黎建溥 -- [email-masked] -- http://jameslick.com/

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 30 Dec 2004 09:48:33 -0500

-----BEGIN PGP SIGNED MESSAGE-----

James Lick wrote:
|
| [email-masked] wrote:
|
|> If you have 50 million zombies recruited, you can send a billion spam
|> E-mails daily by sending 20 E-mails per day per zombie.
|>
|>
|>
|
| The figures I've heard are that there are somewhere around 5 million
| zombie hosts out there, and any one group has at most 500,000 hosts they
| control.  That's still a lot, but an order of magnitude or two below
| your scenario.

That estimate is way to low.  The CBL alone was listing almost four
million of them at one point - and that's with an apparently relatively
short timeout, and only detecting certain flavours hitting specific traps.

| More than 99% of consumers have absolutely no desire for that, and those
| that do have many options of how to achieve that even in the face of
| port 25 filtering by default.  Experience has shown that every time a
| consumer level ISP has implemented port 25 filtering has seen spam and
| virus propagation from their networks drop dramatically.  Experience has
| shown that mail servers employing agressive, well-updated anti-virus
| filtering see greatly reduced virus propagation in their mail clients.
| It's not perfect, but it works much better than without it.  If most
| consumer ISPs did it, the problem would be reduced even further.

Absolutely.  ISPs have reported that implementing port 25 blocking has
virtually eliminated the emission of viruses. And spam too.