Subject: [Asrg] A new (?) wrinkle on the spamming problem

From: [email-masked]
Date: Thu, 08 Dec 2005 11:45:21 -0600

This is INDEED a matter of concern... when disreputable folks start signing 
_our_ names to E-mails to politicians and others (who knows, letters to the 
editors, and so forth) in hopes of making it look like WE support THEIR 
causes...!!!!

One has to wonder how many such letters get sent in our names which we don't 
know anything about...!!

I don't recall seeing this specific concern discussed here before (mostly just 
the nuisance/cost issue about spam) but what happens when abusers use these 
kinds of approaches to influence the direction of governmental lawmaking!!??

Even if legislators learn to ignore unverifiable stuff like this, then how do 
legitimate citizens contact their legislators about issues that we really DO 
care passionately about?

<---- Begin Forwarded Message ---->
From: David Farber <[email-masked]>
Subject: [IP] unauthorized mass mailings to politicians...
Date: Thu, 8 Dec 2005 09:06:12 -0500
To: [email-masked]
Reply-To: [email-masked]

Begin forwarded message:

From:
Date: December 8, 2005 2:18:40 AM EST
To: [email-masked]
Subject: unauthorized mass mailings to politicians...

Dave,

Feel free to pass on to the list if you deem the following to be  
relevant to other IP readers (but please remove my actual email address).

Apparently some group or individual has decided to write Legislators  
using information gleaned from an external database to make the letter seem to
be coming from a constituent.  Coincidentally, I had been approached  
by a friend earlier today asking if I knew anything about three emails he had
received.  They purported to be from him, using his normal ISP  
address, to the correct Senators and Representative and urged them to stand 
against S. 406/H.R. 525.  Now I was just cleaning up my mail and see that at
around 20:00 this evening, I also "sent my legislators" the same  
message. 

However, as I almost always create mail aliases to see who's selling any data, 
so it was easy to see this was not from my normal email address, but from 
[email-masked].   This has me wondering how many other 
constituents "wrote their rep" today and how often this type of bogus action is 
occurring to drive the outcome of a particular piece of legislation.

Content of one of the original messages to legislators follows but a  
quick check of the headers show this mail originated from a mailmanager.net
server with a return path address of [email-masked]; both of these
domains are owned & managed by Capitol Advantage (www.CAPITOLADVANTAGE.COM) out 
of Fairfax, VA.

Regards,
--Tim

Return-Path: <[email-masked]>
Received: from outbound.mailmanager.net (outbound.mailmanager.net
[64.14.114.205])
by mail.geekcq.com (8.12.11/8.12.11) with ESMTP id jB811dao004662
for <[email-masked]>; Wed, 7 Dec 2005  
20:01:39 -0500
Received: from localhost.localdomain (bigip1-vlan11 [192.168.11.1])
by outbound.mailmanager.net (Postfix) with ESMTP id 5C81637E48
for <[email-masked]>; Wed, 7 Dec 2005 20:01:29
-0500 (EST)
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: [email-masked]
Cc: [email-masked]
Message-Id: <[email-masked]>
Date: Wed, 7 Dec 2005 20:01:29 -0500 (EST)
X-GeekCQ-AntiSpam-Information: Spam & Virus Filtering by GeekCQ
X-GeekCQ-AntiVirus-Result: Found to be clean
X-GeekCQ-AntiSpam-Results: not spam, SpamAssassin (score=1.352,  
required 7,
MISSING_HEADERS 0.12, MISSING_SUBJECT 1.23, NO_REAL_NAME 0.01)
X-GeekCQ-AntiSpam-Score: s
X-GeekCQ-AntiSpam-From: [email-masked]
Status: RO
X-UID: 40756182
Content-Length: 1356
X-Keywords:

T Lyons
<DELETED Full Address>

December 7, 2005

The Honorable Stephen F. Lynch
House of Representatives
319 Cannon House Office Building
Washington, DC 20515-2109

Re: Federal AHPs: An Open Door to Fraud

Dear Representative Lynch:

Like most Americans, I am concerned about rising healthcare costs and the 
growing number of uninsured Americans. However, I believe that legislation that 
would create federal Association Health Plans (AHPs) – the Small Business Health 
Fairness Act of 2005, S. 406/H.R. 525 – is not the answer to either of these 
challenges.

The Congressional Budget Office estimates that AHPs would actually result in 
higher premiums for 80 percent of participants. Experts also predict that AHPs 
would result in even more uninsured Americans.

Equally troubling, AHPs would be exempt from important state laws, patient
protections, and other safeguards – increasing the risk for fraud and abuse. In 
the last year alone, I've read that failures of association-type health plans 
have left more than 100,000 participants with over $85 million in unpaid medical 
bills.

I believe that AHPs would hurt, not help improve, our nation's healthcare
system. I urge you to oppose federal AHP legislation like S. 406/H.R. 525.

I look forward to your response on this important issue.

Sincerely,

T Lyons

-------------------------------------
Archives at: http://www.interesting-people.org/archives/interesting-people/

<----  End Forwarded Message  ---->

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Peter J. Holzer" <[email-masked]>
Date: Fri, 9 Dec 2005 11:06:47 +0100

> One has to wonder how many such letters get sent in our names which we don't 

If you ignore the specifics, that is something that virus/worm writers
have done for quite some time: Take both the recipient and the fake
sender from the same addressbook in the hope that the recipient will
know and trust the fake sender.

> kinds of approaches to influence the direction of governmental lawmaking!!??

I don't think this is specific to spam, but the general problem of
proving identity has been discussed in connection with reputation
systems a few times on this list.

> legitimate citizens contact their legislators about issues that we really DO 

For the citizens: Sign your messages. Use PGP or S/MIME. Both have been
around for about a decade.

For the politicians: Treat all unsigned messages as anonymous letters.
Learn to use PGP or S/MIME to verify signed messages (or get your staff
to do it).

For the authors of e-mail software: Make it easier to sign messages and
verify signatures, so that more people do it.

	hp

-- 
   _  | Peter J. Holzer    | Ich sehe nun ein, dass Computer wenig
|_|_) | Sysadmin WSR       | geeignet sind, um sich was zu merken.
| |   | [email-masked]         |
__/   | http://www.hjp.at/ |	-- Holger Lembke in dan-am
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: Fri, 09 Dec 2005 13:29:34 -0600

> editors, and so forth) in hopes of making it look like WE support THEIR 

As Peter mentioned, this is not really new.  This is the kind of thing
that SPF is designed to help with.  Domain owners can choose to
publish SPF records saying how they wish their domain names to be used
and email receivers can choose to listen to what the domain owners
say.

See http://www.openspf.org/

It is not clear to me if DKIM (the merged DomainKeys and IIM system)
will allow you to repudiate this kind of abuse of your domain name.
Instead it looks like they may be able to just give positive
assertions that the email did come from who it says it is  It may not
be able to say that the email didn't come from who it says it is. 
Similarly, things like S/MIME and PGP give much strong positive
assertions than SPF and DKIM, but you can't tell if an unsigned email
is valid or not.

-wayne

---

From: Douglas Otis <[email-masked]>
Date: Fri, 9 Dec 2005 12:17:18 -0800

On Dec 9, 2005, at 11:29 AM, wayne wrote:
>
> As Peter mentioned, this is not really new.  This is the kind of  
> thing that SPF is designed to help with.  Domain owners can choose  
> to publish SPF records saying how they wish their domain names to  
> be used and email receivers can choose to listen to what the domain  
> owners say.
>

How will checking the return-path of a message prove effective  
against misuse of an email-address within the From header?

> It is not clear to me if DKIM (the merged DomainKeys and IIM  
> system) will allow you to repudiate this kind of abuse of your  
> domain name. Instead it looks like they may be able to just give  
> positive assertions that the email did come from who it says it is   
> It may not be able to say that the email didn't come from who it  
> says it is. Similarly, things like S/MIME and PGP give much strong  
> positive assertions than SPF and DKIM, but you can't tell if an  
> unsigned email is valid or not.

Unless the sender owns an S/MIME certificate they can't write?  Many  
politicians utilize web based messaging rather than email.  Not that  
this prevents spoofing, but the entry forms ask for your district and  
physical address, and your email-address to send their news-letters.   
This information can be compared against public voter registrations.   
Should everyone be asked for the last 4 digits of the driver's license?

-Doug