Subject: RE: Forging (was Re: Differences between CSV and Sender-ID )

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 8 Jul 2004 10:23:48 -0700

> >>  Spammers have proved to be astonishingly and quickly adaptable
> AD>   In some situations.  In others, they are astonishingly idiotic.
> AD> Once again, the behavior is situational.
> 
> the folks who command estimated millions of compromised machines, with
> a 3- or 4-tier control hierarchy, do not count as idiotic.
> 
> let's design mechanisms that deal with those guys. the rest are
> irritating but they are mere noise.

Alan is right in pointing out that we should not overestimate
these guys.

Sure it is very clever to set up 3-tier botnets. Our intervention
center discovers a lot of very clever stuff.

But no, these guys are not half as smart as they think they are.
These guys can do stuff that is amazingly complex one minute and
then something really really stupid the next. Like the guys who
tried to phish VeriSign on three separate occasions and used the
exact same ISP in every attack.

The whole theory of the type of intervention we do is that you 
put pressure on the attacker, the more pressure you put on them
the more they are forced to react, the more likely they are to
make a mistake.

If you look at the first attack on the WTC, the perpetrators were
captured because one of them went off to claim their deposit from
the truck rental company. Ever wondered why Al Qaeda uses suicide
bombers in attacks that don't need them? The guys who you can get
to do that sort of stuff are not the sharpest knives in the drawer.
Having them commit suicide during the attack means that the 
leadership don't have to worry about them getting caught.

>    Effort on a global standard that deals with a transient symptom is
>    certain to have minimal, transient benefit, if any, but with very
>    large opportunity and on-going costs.

Everyone accepts the fact that there is a forwarding hole in SenderID.
Fortunately Sender-ID is the first move, not the last.

With Sender-ID you can always authenticate the party that purports to
be the last link in the chain. Therefore I expect the deployment of
Sender-ID to follow something like the following patterm:

Phase-1: Senders are required to issue Sender-ID records.

Phase-2: Forwarding specialists are required to provide either
	an accreditation proof or a proof of consent.

Phase-3: All Senders are required to provide accreditation proofs.

By 'required' I mean, that if you want to reliably send your mail 
to one of the major ISPs (and many smaller ones) you are going to
have to comply. 

Over time I expect that AOL and MSN will be wanting to power down
the huge server farms they currently run for the sole purpose of 
running spam filtering schemes. If you want to send email you are 
going to have to comply.

Sure this is going to be unpopular in Boca Raton, Florida, and 
possibly other places. But at the end of the day insecure email
has failed and the only choice left is a transition to secure 
email.

> Please show me a successful, global standard that has been 
> designed to respond to
> one set of symptoms, when the source of those symptoms is constantly
> adapting, guaranteeing that the symptoms will become irrelevant as
> soon as the response begins to take effect.

Please show me a successful IETF security standard. Every attempt
to develop end to end solutions has been a miserable failure. The
only security protocol that has been successful is SSL which was
successful independently.

> no, computer science.
> 
> the difference between accreditation, versus authentication and
> authorization, is basic.

Yes, and the MARId group continue to insist on calling a record that
contains an authentication credential an authorization record. But
this does not actually matter much, it just leads to fuzzy thinking.

Accreditation is actually a new term introduced to describe what
we used to call third party attribute assertions.

> no, that's not quibbling.  it goes to the difference between
> authorization and accreditation.

Yes, I certainly agree here. There has to be an accreditation 
component.

> AD>  That's the basic concept behind MARID.  Having domains
> AD> maintain BL's about others is expensive and pointless.
> 
> pointless?  so spamhaus and all those other lists are pointless?

There is a big, big problem with the blackists. If you only 
list negative reputation you end up having to measure the 
whole world against a set of criteria that is imposed 
unilaterally.

Allowing the sender to nominate the accreditation services that 
are relevant allows the search for positive reputation data from
a source trusted by the recipient can be narrowed.

This means that the market for accreditation services can contain
both the 500,000 domain VDL that we publish and smaller lists from
other providers with a few hundred entries.

		Phill

---

From: Meng Weng Wong <[email-masked]>
Date: Thu, 8 Jul 2004 17:14:46 -0400

On Thu, Jul 08, 2004 at 10:23:48AM -0700, Hallam-Baker, Phillip wrote:
| 
| Yes, and the MARId group continue to insist on calling a record that
| contains an authentication credential an authorization record. But
| this does not actually matter much, it just leads to fuzzy thinking.

Perhaps it depends on point of view.

From the sender's point of view, the record authorizes MTAs
to use the sender's name.

From the receiver's point of view, the record authenticates
MTAs as being permitted by the sender.

If you have been thinking in terms of one of those points of
view, try turning the chessboard around and put yourself in
the other person's shoes.

Whether the receiver then wants to authorize further
delivery is a policy matter dependent on reputation which
depends on (you guessed it) accreditation.

In the simplest case, if a receiver chooses to trust all
accreditors, their reputation system component is
essentially a "| cat |".

In the next simplest case, a receiver chooses to trust only
certain accreditors of good repute, their reputation system
is essentially a "| egrep 'acc1|acc2|acc3...' |"

| There is a big, big problem with the blackists. If you only 
| list negative reputation you end up having to measure the 
| whole world against a set of criteria that is imposed 
| unilaterally.
| 
| Allowing the sender to nominate the accreditation services that 
| are relevant allows the search for positive reputation data from
| a source trusted by the recipient can be narrowed.
| 
| This means that the market for accreditation services can contain
| both the 500,000 domain VDL that we publish and smaller lists from
| other providers with a few hundred entries.

Yes, selective whitelisting based on whatever inputs you
have is better in an AGUPI world than attempts to
whack-a-mole using blacklists.

---

From: Dave Crocker <[email-masked]>
Date: Fri, 9 Jul 2004 14:01:22 +0700

Meng,

MWW> Perhaps it depends on point of view.
MWW>From the sender's point of view, the record authorizes MTAs
MWW> to use the sender's name.
MWW>From the receiver's point of view, the record authenticates
MWW> MTAs as being permitted by the sender.

Here is a really revolutionary idea. Why do we not, instead, start
using standard technical terms in their standard technical way?

This groups needs to stop re-defining well-established security
terminology, especially when the primary effect of those redefinitions
is to make everything less consistent and precise, not more.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: John Leslie <[email-masked]>
Date: Fri, 9 Jul 2004 10:30:28 -0400

> is to make everything less consistent and precise, not more.

   I've been trying to hunt down useful definitions in common use;
I can supply links if anyone's a glutton for punishment.

   The only source I feel able to recommend for our use is RFC 2828:
"Internet Security Glossary", May 2000. It lists several categories
of entries:

- "I" identifies a RECOMMENDED Internet definition.
- "N" identifies a RECOMMENDED non-Internet definition.
- "O" identifies a definition that is not recommended as the first choice
      for Internet documents but is something that authors of Internet
      documents need to know.
- "D" identifies a term or definition that SHOULD NOT be used in Internet
      documents.
- "C" identifies commentary or additional usage guidance.

   From RFC 2828, I extract:

] accreditation
]   (I) An administrative declaration by a designated authority that
]       an information system is approved to operate in a particular
]       security configuration with a prescribed set of safeguards.
]       [FP102] (See: certification.)
]   (C) An accreditation is usually based on a technical certification
]       of the system's security mechanisms. The terms "certification"
]       and "accreditation" are used more in the U.S. Department of
]       Defense and other government agencies than in commercial
]       organizations. However, the concepts apply any place where
]       managers are required to deal with and accept responsibility
]       for security risks. The American Bar Association is developing
]       accreditation criteria for CAs.
] 
] authentication
]   (I) The process of verifying an identity claimed by or for a
]       system entity. (See: authenticate, authentication exchange,
]       authentication information, credential, data origin
]       authentication, peer entity authentication.)
]   (C) An authentication process consists of two steps:
]       1. Identification step: Presenting an identifier to the
]          security system. (Identifiers should be assigned carefully,
]          because authenticated identities are the basis for other
]          security services, such as access control service.)
]       2. Verification step: Presenting or generating authentication
]          information that corroborates the binding between the entity
]          and the identifier. (See: verification.)
]   (C) See: ("relationship between data integrity service and
]       authentication services" under) data integrity service.
] 
] authorization
]   (I) (1.) An "authorization" is a right or a permission that is
]            granted to a system entity to access a system resource. 
] 	(2.) An "authorization process" is a procedure for granting
]            such rights.
] 	(3.) To "authorize" means to grant such a right or permission.
]       (See: privilege.)

   Since only the (I) items are "recommended", is there any reason we
can't live with:

" Accreditation is an administrative declaration by a designated authority
"   that an information system is approved to operate in a particular 
"   security configuration with a prescribed set of safeguards. 

" Authentication is the process of verifying an identity claimed by or
"   for a system entity.

" Authorization is a right or a permission that is granted to a system
"   entity to access a system resource.

--
John Leslie <[email-masked]>

---

From: Greg Connor <[email-masked]>
Date: Fri, 9 Jul 2004 14:26:20 -0700 (PDT)

I object to the condescending tone used here.

It's OK to be frustrated and it's also OK to say you're frustrated at 
something.  But emotional outbursts like this one aren't professional 
behavior.

gregc

-- 
--
Greg Connor
[email-masked]

Everyone says that having power is a great responsibility.  This is a lot
of bunk.  Responsibility is when someone can blame you if something goes
wrong.  When you have power you are surrounded by people whose job it is
to take the blame for your mistakes.  If they're smart, that is. 
                -- Cerebus, "On Governing"

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 14 Jul 2004 11:33:52 -0400

> But no, these guys are not half as smart as they think they are.

  It's a common fallacy to "romanticise" criminal activities.  News
programs describe "daring robberies", and "skilled attacks".  Movies
have exciting teams of interesting people working closely together in
a well-coordinated and professional manner.

  In reality, criminals aren't as professional or exciting as the
popular media portrays.  They're often losers who can muster up the
gumption to stick a gun in someones face, or break a window, but they
can't hold down a steady job, or interact well with others.

  We shouldn't make the same mistake when describing spammers.  The
skills required to set up a spam operation cannot compare to the
skills required to operate and maintain an ISP, or other legitimate
business.

> then something really really stupid the next.

  They make these mistakes for the same reason they chose to engage in
criminal behavior: certain psychological characteristics.  Few
non-criminals, or non-spammers share those characteristics.

  Alan DeKok.