Subject: RE: How would SPF or Sender Id caught this one?

From: "Gordon Fecyk" <[email-masked]>
Date: Fri, 30 Jul 2004 21:55:29 -0500

> Last weekend a phishing attack took place against US Bank.  
> The phisher
> spoofed and connected with the appropriate IP for US Bank,
> 170.135.72.63.  How would SPF or Sender ID have managed to catch that
> attack?

You mean this thing?  A client of mine had a few of these and they didn't
originate from 170.whatever.

-- 
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>

Received: from mail75.messagelabs.com ([216.82.255.83]) by [deleted] with
Microsoft SMTPSVC(5.0.2195.6713);
	 Fri, 30 Jul 2004 18:55:37 -0500
From: "U.S. Bank" <[email-masked]>
Reply-To: "U.S. Bank" <[email-masked]>
To: [deleted]
Subject: New U.S. Bank Security Standards
Date: Sat, 31 Jul 2004 03:53:32 +0300
FILETIME=[B60DC360:01C47690]

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 31 Jul 2004 09:59:26 -0700

> If, however, the MARID proposals proceed, I understand that 
> the SMTP protocal
> will have to be enhanced (to support SUBMITTER), so the 
> change I have in mind
> could be added at the same time.
> 
> Stop-press: - Meng has just (Sat, 31 Jul 2004 11:51:46 -0400) 
> posted the same
> solution as I was about to propose: a pseudo-random ECHO.

I suggest that we work on the MARID problem and raise the issue
in SAAG as a knock on effect.

I have absolutely no problem causing security problems in other 
parts of the Internet to become visible. We have to start somewhere
and if not in this forum the work will take place somewhere else.

MARID also has implications for BGP routing security, DNS security
as well as IP level security. This is stuff that has to be fixed 
anyway.