Subject: RE: How would SPF or Sender Id caught this one?

From: "Daryl Odnert" <[email-masked]>
Date: Fri, 30 Jul 2004 16:44:28 -0700

> How would SPF or Sender ID have managed to catch that attack?

I think the answer is: they cannot.  If the phisher successfully
spoofed the an SMTP over TCP session, there is nothing that SPF
or Sender ID can do about that.

You might want to look at section 6.2 of draft-ietf-marid-core-02.txt.

Regards,
Daryl Odnert
Tumbleweed Communications
Redwood City, California

---

From: "Bill McInnis" <[email-masked]>
Date: Fri, 30 Jul 2004 19:49:55 -0400

Thanks for the reply,
 
I read that and that was my understanding as well.  So does this make it
a solution that works fine for mailing lists, but not for financial
institutions, online retailers, and pretty much anyone transacting
dollars online?  
 
The example was not made up.  We are seeing that scenario more and more
where I am sitting.    

Bill McInnis
MessageLevel.com
 
 -----Original Message-----
From: Daryl Odnert [mailto:[email-masked]] 
Sent: Friday, July 30, 2004 7:44 PM
To: Bill Mcinnis; IETF MARID WG
Subject: RE: How would SPF or Sender Id caught this one?

Regards, 
Daryl Odnert

---

From: "Harold A'Hole" <[email-masked]>
Date: Fri, 30 Jul 2004 17:12:18 -0700

Message> The example was not made up.  We are seeing that scenario more and
more where I am sitting.
> MessageLevel.com

How are they carrying on a TCP comm session with a spoofed IP address -- or
did they hack the legit sending SMTP server with that IP address?

Harry