Subject: Re: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: "william(at)elan.net" <[email-masked]>
Date: Wed, 1 Jun 2005 01:12:38 -0700 (PDT)

On Tue, 31 May 2005, Seth Breidbart wrote:

> If your computer is infected, wouldn't it be easier to have the
> malware drop the spam (not SPAM, that's Hormel's product) directly
> into your inbox without worrying about any filters (such as your
> ISP's)?  For that matter, why bother with mail at all; why not just
> show it to you via popups?
>
> Oh, some malware does that already.
>
> Admittedly, your address book is a list of victims who likely have
> _you_ whitelisted; but again, having the malware send directly from
> your computer works even better, because then the spam's headers all
> match the real mail you send.

If all malware messages were sent only from people on which computer
the malware is installed to the people on their whitelist, this would
greatly improve the odds that such malware would be noticed and removed 
reasonably fast since people who enjoy letting rats run wild in their
house for long rarely have friends they can communicate with and invite
to their home [i.e. their friends would remove the address from their 
whitelist as they would no longer wish to communicate with such person] 
and would also face problems with pest-control agency [i.e. some global 
blocklist] and would get ticketed [warning from ISP] and ultimately house 
is condemned [i.e. account disconnected by ISP].

-- 
William Leibzon
Elan Networks
[email-masked]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Laird Breyer <[email-masked]>
Date: Wed, 1 Jun 2005 22:06:14 +1000

> is condemned [i.e. account disconnected by ISP].

I think that oversimplifies the problem somewhat. Different people and
organizations have a wide range of behaviours and a wide range of
individual tolerances. Overall, it's safe to say that some people will
act immediately against infected people on their whitelist, others
won't or might not realize what to do or how.

So any one infected computer will be cleaned up after sending spam
only with some probability. 

In that sort of scenario, whether an infection can spread becomes a
percolation problem. Such problems are notoriously difficult to
analyse, but one can generally expect that if the cleanup probabilities
are high enough, then spread is blocked, while if they are low enough,
spread is not hindered. And this argument goes for a scenario where
all malware are sent exclusively by infected computers. Extra 
vectors should likely help. 

-- 
Laird Breyer.