Subject: RE: [Asrg] Whitelisting on Message-ID (Was Turing Test ...) honey pot plug

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 7 Apr 2003 08:32:59 -0700

I think that there are two levels that we could look at this for the purpose
of stopping spam

1) Approximate percentage, to nearest 10%
	[Discussions as to whether the true figure 
	is 83% or 85% are irrelevant]

2) Degree of necessity
	Can the spam senders work a different way? What advantage are they
gaining here?

The second is the important one for me. Some people talk as if all we have
to do to end spam is close the open relays. I am not so sure this is the
case.

		Phill

> -----Original Message-----
> From: Brad Spencer [mailto:[email-masked]]
> Sent: Monday, April 07, 2003 11:27 AM
> To: [email-masked]
> Subject: RE: [Asrg] Whitelisting on Message-ID (Was Turing Test ...)
> honeypot plug
> 
> 
> At 08:12 AM 4/7/2003 -0700, you wrote:
> 
> >Question - how much of the spam is sent through open relays 
> and how much is
> >sent direct?
> 
> Good questions.
> 
> Add to that "How much is sent through open proxies?"
> 
> Michael Tokarev has also reported a spam-forwarding Trojan Horse:
> 
> http://groups.google.com/groups?selm=aqhj96%2429tp%241%40FreeB
SD.csie.NCTU.edu.tw&output=gplain

http://groups.google.com/groups?selm=b2pcqh%24i9j%241%40FreeBSD.csie.NCTU.ed
u.tw&output=gplain

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Spencer <[email-masked]>
Date: Wed, 09 Apr 2003 07:07:17 -0500

At 12:48 PM 4/9/2003 +0100, Matt Sergeant wrote:
>On Wednesday, Apr 9, 2003, at 12:25 Europe/London, Brad Spencer wrote:
>
>>At 12:17 PM 4/9/2003 +0100, Matt Sergeant wrote:
>>
>>>This is a bogus assumption. It's much easier to test an open proxy by
>>>testing it can connect somewhere you own, not check that you can
>>>relay mail through it. I have no idea why a spammer would try the
>>>latter since it's much *much* slower. Or you'd even test it can
>>>access a known web site, like google.
>>
>>
>>I logged the tests.  How is that bogus? The idiot did exactly what I
>>said, using my honeypot.
>>
>><http://groups.google.com/ 
>>groups?selm=3D7E48C6.25D6ACF7%40mail.tds.net&output=gplain>, for
>>example.
>
>It's bogus because it means you cannot create an open proxy honeypot.
>You can only create an open relay honeypot. The assumption that
>spammers probing for open relays by trying to relay a test email
>through them is bogus because there's no way to ensure that the spammer

No way?  I think the purpose of ASRG is to find ways to do things, is it 
not?  I'd guess that right now spammer usage of open proxies is done so 
simply and stupidly that if all proxy use were directed to the same IP, 
controlled by the operator of the open proxy, most spammers wouldn't notice 
as long as the results looked good to them.  I could be wrong in my guess - 
the problem is that guessing is needed because there are few 
facts.  Neither you nor I know.

>(or hacker) doesn't use your open proxy honeypot for other means.
>
>Matt.

---

From: Brad Spencer <[email-masked]>
Date: Wed, 09 Apr 2003 08:44:32 -0500

At 02:35 PM 4/9/2003 +0100, Matt Sergeant wrote:

>I guess what I'm trying to say though is that you can't know what they'd 
>do with a genuine open proxy unless you have a genuine open proxy. You can 
>see what they're trying to achieve up to an extent, but you can't go all 
>the way without having a proper full blown open proxy. And I don't imagine 
>you really want one of those ;-)

Personally no, I don't.  I don't even advocate them.    But there is a 
point to be made: whether or not i do have an open proxy makes absolutely 
no difference as far as the amount of spam that is delivered.  There are so 
many open proxies that my having one would not influence the abuse done 
through open proxies in the slightest.  (Having an open proxy honeypot may 
slightly reduce the amount of abuse.)

If I had my choice it would be for some, many, most, or all of the open 
proxies already being abused, say in the telesp.br space, to be changed to 
open proxy honeypots.  The spammers use them, trust them.  It would be easy 
to deceive the spammers by changing them over.

---

From: Paul Judge <[email-masked]>
Date: Wed, 9 Apr 2003 14:05:06 -0400

We will not disregard this proposal of honeypots. In general, the criticism
of ideas before they are allowed to be fully developed will get us nowhere.
Brad is working on a more detailed explanation of this proposal. It does not
claim to be a silver bullet, but one tool to prevent and detect spam. If
someone would like to develop a list of countermeasures to honeypots, then
that is a meaningful exercise, but randomly throwing out one countermeasure
and claiming that we should abandon this line of thinking is absurd.

Yes, you came up with a countermeasure. This does not mean that we throw the
solution away. That means that we come up with all the countermeasures that
we can imagine. We then work on all the countercountermeasures that we can
conceive. We decide what vulnerabilites are left. We then analyze the
effectiveness of the approach given the risk associated with the remaining
vulnerabilities. The probablility or risk of a certain countermeasure
depends on the costs, effort, and time required of the attacker. This allows
us to evaluate the usefulness of the approach based on the cost of deploying
it.

Unless someone has done this analysis, then they should not shoot down
another idea on this list.

This is a research group. You do not get points for throwing stones at other
people's ideas. Every idea or approach needs a champion, if people attack
every idea then folks will be reluctant to propose their thoughts. People
that continue to make such unconstructive criticism will be asked to not
participate in this group.

> From: Chuq Von Rospach [mailto:[email-masked]] 
> Sent: Wednesday, April 09, 2003 1:59 PM
> To: Kee Hinckley
> Cc: Brad Spencer; [email-masked]
> Subject: Re: [Asrg] Whitelisting on Message-ID (Was Turing 
> Test ...) honey pot plug
> 
> 
> 
> On Wednesday, April 9, 2003, at 09:38  AM, Kee Hinckley wrote:
> 
> >
> 
> > That's the major flaw with the honeypot solution.  It deals very
> > poorly with evasion.  As soon as honeypots become a 
> problem, spammers 
> > will begin to write more sophisticated tests that try and detect 
> > honeypots.
> 
> I posted an easy way to get around honeypots the other day -- regular 
> tests. Easy to do using a small array of captive accounts, hard to 
> catch.
> 
> Any solution that's so easy *I* can pull a way to isolate it off the 
> top of my head is something not worth spending energy implementing, 
> because it's a solution that works only because spammers haven't had 
> enough hassle from it to work around it. That's not even an 
> arms race, 
> that's throwing snowballs at a tank. It'd take us a lot more time and 
> energy to build up a honeypot system annoying enough to amek them 
> notice than it'll take for them to build a system to make 
> that honeypot 
> system useful only against stupid spammers.
> 
> So IMHO, it's a bad place to spend our energy, but it won't even slow 
> down the smart spammers, and we don't need sophisticated 
> tools to catch 
> stupid ones.
>