Re: new spam functionality added

[prj@po.cwru.edu (Paul Jarc)]

Scott A Crosby <scrosby@cs.rice.edu> wrote:
>    Mailing list maintance functions (including initial requests to
>    subscribe, or confirmation requests from web-maintance.) either get
>    accepted automatically, (direct route for spam!), or force the
>    mailing list admin to deal with the automated 'please reply to me'
>    messages..

A well-behaved subscriber would add the MLM address to their whitelist
before subscribing.  List admins can feel free to drop confirmation
requests from poorly-behaved subscribers.

>    Mailing list messages... Post to a mailing list the first time and
>    potentially get tens, hundreds, even thousands of 'please reply to
>    me' messages.

I'm fairly certain that's false.  TMDA sends its confirmation requests
to the envelope sender, not From:, I think.  MLMs rewrite the envelope
sender.

>    Now, imagine there's a daemon that autoreplies to such 'please
>    reply to me' messages..

Actually, the replies can be automated, even safely, if the
confirmation request includes the entire original message, or a
checksum of it, so the autoconfirmer can verify that the user really
sent the original message.

>    Well, just forge the spam to appear to come from a legitimate
>    user, and guess what, the bounces go to them, and their client
>    helpfully 'authenticates' the spam..

That's why there shouldn't be badly implemented autoconfirmers.  But
are there any?  Anyway, this is not an argument against TMDA itself.

>    (The daemon can't be configured to record every email sent and
>    only autoreply to autoreplies to emails the user actually sent.

Sure it can.  But recording entire emails themselves wouldn't be the
best way to do it.

>    Many times people will use many systems and email servers, but
>    only one email address.)

A checksum scheme could still work in such situations.

>    For more fun, you may even get mail loops of 'please reply to me'
>    messages.

If the confirmation request is sent from a dated address which does
not itself require confirmation, there is no loop.

Of course, if everyone starts using TMDA, spammers will quickly start
guessing dated addresses.  But then dated addresses will just evolve
to be a hash of the date and a secret instead of just the date.

>    Under the assumption that there *will* be misconfigured clients,
>    they'll have to deal with mailing lists that they don't know
>    about. either by spamming posters to the list (unacceptable), or
>    filtering them out into a seperate folder that the user will have
>    to manually check.

I'm not sure what you mean.

>    Of course the other option here is to spam from legitimate hosts
>    that have been cracked by today's IIS/outlook worm. (Or one of the
>    30,000 *STILL* infected code-red machines.) The cracked systems run
>    email servers and reply automatically.

Cracked systems can be abused even without TMDA in the picture.

>    TMDA and any other scheme that requires such automated response to
>    all sent emails is tragedy of the commons.

TMDA doesn't require that unless you configure it that way.


paul