Subject: [Sipping] Spoof email

From: "Mark Watson" <[email-masked]>
Date: Mon, 24 Mar 2003 17:30:49 -0000

All,

Just to make it clear that, whatever it was, the email appearing to be from
me on Saturday did not come from me at all. According to the headers it did
not come from anywhere in Nortel either.

Regards...Mark

---

From: "Dean Willis" <[email-masked]>
Date: Mon, 24 Mar 2003 13:54:54 -0800

Mark said:
> All, 
> Just to make it clear that, whatever it was, the email appearing to be 
> from me on Saturday did not come from me at all. According to the 
> headers it did not come from anywhere in Nortel either.
> Regards...Mark 

Yep. This is the infamous klez worm-- if you run a suscepitble email program
(TM) and execute the  worm payload, it will replicate itself by sending
copies to people in your address book, apparently from OTHER people in your
address book . . . It also does other rude things.

When it first started circulating, some of the people I know were collecting
"celeberity Klez" -- emailed viruses pretending to be from well-known
people. I'm sure there's some measure of connectedness that could be made by
looking at klez patterns -- "the three degress of klez" or somesuch.

There's a good article on the worm at:

http://www.wired.com/news/technology/0,1282,52174,00.html

So, what can we, as implementors of the next-most-likely-to-klez protocol
learn from this?

1) You can't trust From: lines. Trusting intermediates is not an answer.
Cryptographic verification of identity as expressed within the context of a
message is mandatory. 

2) Executable payloads in messages are a Bad Idea. This has been known for a
long time (see the references below). But people keep trying . . .

GOLDBERG, Y., SAFRAN, M. and SHAPIRO, E. 1992. Active Mail - A framework for
implementing groupware. In Proceedings of the ACM Conference on
Computer-Supported Cooperative Work (CSCW '92), Toronto, Canada, 75-83.

BORENSTEIN, N. S. 1992. Computational mail as network infrastructure for
computer-supported cooperative work. In Proceedings of the ACM 1992
Conference on Computer-Supported Cooperative Work (CSCW 92), Toronto,
Canada, 67-74

3) technicalities notwithstanding, the politics of secure communications are
mind-boggling. Otherwise, why wouldn't the IETF use S/MIME (which is
REQUIRED in SIP implementations and built into lots of email clients) for
protecting the IETF mailing lists?

--
Dean

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP