Subject: Re: FW: [Asrg] 0. General

From: "denny " <[email-masked]>
Date: Wed, 22 Oct 2003 15:22:01 -0400

---------- Original Message ----------------------------------
From: Brad Knowles <[email-masked]>
Date:  Thu, 23 Oct 2003 01:39:42 +0700

>At 2:25 PM -0400 2003/10/21, Denny Figuerres wrote:
>
>>  Anonimity:  as far as I am concerned if someone wants me to recive a
>>  message they should be willing to identify them selves.
>>  This does not mean you can not recive an email from an "unknown" party,
>>  but it does mean that I should be able to read a valid
>>  Email header that is not lying to me.
>
>	There are human rights workers around the world that have their 
>lives literally depending upon being able to send anonymous e-mail. 
>You will literally be responsible for the murder of tens, hundreds, 
>thousands, maybe millions of people, if you do not account for this 
>issue.
>
>	Regardless of whatever else we may do, we must find a way to 
>preserve the ability to send e-mail anonymously for the people who 
>need this feature.  Otherwise, we may never find out about SARS II, 
>or the next Tutsi-Hutu massacre until it is too late.
>
>-- 
>Brad Knowles, <[email-masked]>

Well in part I will say that I have never sent an "Anon" email and I would like to know just how "Anon" it is *unless* you have some kind of "Man-in-the-middle" who changes the email headers to hide the sender.

and in my view that can still be done and keep enough of a trail for spam handling / traffic accounting.

UA.o --> [ANON_SMTP_MANGLER] ---> DEST.MTA
where [ANON_SMTP_MANGLER] is a "Black box" to the reciver end but has an address and can be found, may be more than one server, may use more than one IP / server to do it's work.

also while we are talking about this:  spam filters read and clasify email, they track senders and log stuff....
IMHO thats a *LOT* of data and code that could be used by the wrong folks to trap the very email we want to get thru.
so don't the senders of this email need to masq the content with say PGP at the start??

--
=============================================
Denny Figuerres
[email-masked]
---------------------------------------------
Twenty billion junk e-mail messages sent per day may
potentially take 20 billion seconds to delete. A human life is a
mere two billion seconds long. In effect, spammers kill ten
people each day.

--

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: David Maxwell <[email-masked]>
Date: Thu, 23 Oct 2003 12:08:43 -0400

On Thu, Oct 23, 2003 at 07:22:26PM +0700, Brad Knowles wrote:
> At 3:22 PM -0400 2003/10/22, denny  wrote:
> 
> > Well in part I will say that I have never sent an "Anon" email and
> > I would like to know just how "Anon" it is *unless* you have some kind
> > of "Man-in-the-middle" who changes the email headers to hide the sender.
> 
> 	Okay, so for all the pieces of spam you have ever received, tell 
> me precisely who sent each and every one of them.  Hell, just tell me 
> who sent a random 1% sampling.

The headers certainly contain the IP of the first host that made an SMTP
connection to send the mail.

On the one hand, you're arguing that mapping that IP back to a user is
hard to do - and for me to coerce an ISP to give up that userid, is
difficult.

On the other hand, you're arguing that governments who are persecuting
people won't be able to apprehend them, because of the difficultly in
this mapping.

I believe the government in question has _far more_ leverage on the ISP
than I do as an individual. It seems to me that this means spammers can
use the difficulty of this mapping to hide from me, and activists can't
use it to hide from governments.

-- 
David Maxwell, [email-masked][email-masked] -->
Any sufficiently advanced Common Sense will seem like magic... 
					      - me

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 23 Oct 2003 20:39:55 +0200

> connection to send the mail.

Which is worthless if it was injected via an open relay. It's estiamted
that there a more than a half million of them currently.

> use it to hide from governments.

The problem is that there are laws that touch the area of spam.
But nobody really cares if the damage is around 1 Cent.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: David Maxwell <[email-masked]>
Date: Fri, 24 Oct 2003 01:20:33 -0400

> that there a more than a half million of them currently.

No, you haven't thought that statement through.

Every decent SMTP MTA adds a 'Received-by:' header, which includes the
IP of the host that made the SMTP connection. Even open relay MTAs add
this, so you'll still have the IP of the sender of the email.

If you want to talk about open Proxy servers, or owned machines, that's
a different discussion, but in any case, if someone chooses to support
DRIP/RMX/whatever for their domain, and they list their open-relay MTA
as a server for their domain, then you'll probably want to blacklist
them ;-)

> But nobody really cares if the damage is around 1 Cent.

We weren't discussing that aspect of government, we were talking about
governments abusing power to harass (etc) activists. The governments in
question, Brad explained, really do care about these activists, so we
can certainly expect that they'll apply their leverage.

							David

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 24 Oct 2003 10:55:39 +0200

> No, you haven't thought that statement through.

Sure I have.

> this, so you'll still have the IP of the sender of the email.

No, you have the IP of the host that injected it to the first MTA that
recorded Received: headers.
This may be the host that injected the message. This may be 127.0.0.1 or
this may be the IP of an open proxy that made the connection to the
SMTP port.

> as a server for their domain, then you'll probably want to blacklist

About 95% of the spam we receive is from open proxy servers. Take a look at
    http://darkwing.uoregon.edu/~joe/total-open-proxies.gif
They had 450000 already back in July.
So this is not a different discussion, it is /the/ discussion.

	\Maex

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 24 Oct 2003 14:42:28 +0100

> Take a look
> at

And that was back in July 1900 

--

---

From: "Mark E. Mallett" <[email-masked]>
Date: Fri, 24 Oct 2003 10:40:51 -0400

> this may be the IP of an open proxy that made the connection to the

You may have such a Received line, but you can only believe the one
that is inserted by a mail server you operate or trust.  There's no
guarantee that any of the Received lines that appear in the header
received by such a trusted server (i.e., the Received lines after that
one) are legitimate.

You can tell what IP address gave it to your trusted server (and if you
know you can trust that one, you can follow one more level, and so forth).
But you can't tell anything beyond that.

mm

---

From: David Maxwell <[email-masked]>
Date: Fri, 24 Oct 2003 14:12:35 -0400

> this may be the IP of an open proxy that made the connection to the

In your original message, Message-ID: <[email-masked]>
you said:
> Which is worthless if it was injected via an open relay.
                                               ----------
I replied about open relays, and even said (included below) that if you
want to talk about open _proxy servers_ that that is a different
discussion, and that I agree that it's a problem.

> So this is not a different discussion, it is /the/ discussion.

Open relays and open proxies are different discussions with regard to
whether a 'useful' IP address will have been included in message
headers. For relays, it will, for proxies, it won't.

							David

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 24 Oct 2003 16:19:43 -0400

I have been bedridden for a few days with a sickness and was not able to 
follow the list, so I was a bit suprised to find such a large volume of 
messages today, many under the same subject. Please keep in mind the 
mailing list guidelines at:

http://www.irtf.org/asrg/asrg_mailing_list_information.htm

It would be very helpful if you can change the subject of the thread 
when a message starts treading away to some other topic. Otherwise, 
reading something with the subject of "General" is hard to fugure out 
before opening it.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 24 Oct 2003 16:31:14 -0400

> But you can't tell anything beyond that.

Add to that mix various trojans and viruses, and that makes this 
statement even more true.

---

From: Brad Knowles <[email-masked]>
Date: Fri, 24 Oct 2003 01:18:07 +0700

At 12:08 PM -0400 2003/10/23, David Maxwell wrote:

>  than I do as an individual.

	That's assuming that the ISP in question is local.  That's not 
necessarily a valid assumption.  Moreover, with header faking, it can 
be difficult to determine which IP addresses are real and which ones 
aren't.

	Governments can't bug every single ISP in the world.  They could 
reasonably bug every single known anonymous remailer.

>                              It seems to me that this means spammers can

	I disagree.  I think there are techniques that are used by 
spammers that could also help activists further hide the source of 
their connections.

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 26 Oct 2003 01:03:18 -0500

[Subject changed inline with guidelines. Mod.]

Brad Knowles wrote:
> necessarily a valid assumption.  Moreover, with header faking, it can be 
> difficult to determine which IP addresses are real and which ones aren't.
> 
>     I disagree.  I think there are techniques that are used by spammers 
> that could also help activists further hide the source of their 
> connections.
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 26 Oct 2003 01:05:27 -0500

[Spelling mistake, subject changed again, sorry. Mod.]

---

From: David Maxwell <[email-masked]>
Date: Mon, 27 Oct 2003 17:33:53 -0500

> At 1:20 AM -0400 2003/10/24, David Maxwell wrote:
> 
> 	How many "decent" MTAs are open relays?  Not many.  Most "decent" 
> MTAs these days will refuse to be an open relay unless explicitly 
> configured that way.
> 
> 	How many spammers use open relays anymore?  Not many.  Most use 
> open proxies now.

Ahh. I see the problem now. (I really hate when I have to reverse-infer
someone's issue with one of my statements, because it couldn't simply be
raised as an issue.)

"so you'll still have the IP of the sender of the email."

should read:

"so you'll still have the IP of the host which made the TCP connection
to the MTA."

That host is either the spammer's MUA, an open-relay, or an open-proxy.
All of which are complicit in the sending of spam, so you do have
information you can use to prevent further spam from being delivered to
you in the same way.

							David

P.S. And before someone jumps in - please remember that this isn't a
general discussion of tracking spam via headers, but specifically of
the degree of anonymity available to senders today, against a strongly
enabled and determined corrupt authority.

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 27 Oct 2003 23:45:31 +0100

I have adjusted the Subject.

> > Which is worthless if it was injected via an open relay.

What you didn't took into account is that spammers even use open proxy
servers to feed open relays.
We had a customer that had a machine with a wrongly configured Apache
proxy. One could clearly see that the attacker first scanned the /24
subnet where the Webserver was in for open SMTP ports. Next the attacker
scanned all of our mailservers to check whether the machine was
whitelisted for relaying and he found the machine and had time to inject
about 1000 messages before our watchdogs notified us and we cut it off.

So the two problems are related

> headers. For relays, it will, for proxies, it won't.

Even for relayed messages they won't, see above.
But I get your point and we could now start a lengthy discussion about
slightly different definitions of relay open mailservers. The problem
however remains the same:
   You can trust at maximum one hop further to the source of the spam
   as the last mailserver under your control. And you definitely cannot
   travel back to the origin and put full trust into "this is the source"
   just from the information in the mail header. Never (unless it's your
   own message of course, but you probably won't see this just from the
   header either).

	\Maex

---

From: Brad Knowles <[email-masked]>
Date: Wed, 29 Oct 2003 13:35:51 +0100

>  That host is either the spammer's MUA, an open-relay, or an open-proxy.

	The only IP address information you can trust is that which is 
put on the message by your own MTA, and even that might be suspect 
(if there is a security hole in the MTA which could effect the 
recording of this information).

>  information you can use to prevent further spam from being delivered to

	Maybe.  If that machine also sends you a lot of legitimate 
e-mail, are you willing to cut your nose off to spite your face, 
based solely on the IP address information?