RE: Article Announcement: Can Microsoft End Spam?

Reply marked with ---> in text

-----Original Message-----
From: support@courseware.ca [mailto:support@courseware.ca] Sent: dinsdag 8 juli 2003 18:07
To: focus-virus@securityfocus.com
Subject: RE: Article Announcement: Can Microsoft End Spam?

The answer to this "how to stop spam" debate seems to have a modestly simple answer, or at least an answer that will make the process easier to identify spammers and deal with them. Can smtp servers not be designed to test an e-mail's point of origin, and if the point of origin is within the smtp server's realm of control, validate the e-mail address before passing it on?

--> No. Spoofing is much too commmon a practice and hard to fight. From experience i know spamming is though, really tough to trace when spoofing applies. Since return adresses are not even that important and legal foldings are there for both protection and abuse but no viable workaround seems possible. (Worked on abuse-mail at one of the major providers)

I know this then leads to the area of IP spoofing, but servers should be able
to test for valid IP addresses too. While hackers, virus writers and other malicious users can write malware, spyware, internet attack tools, etc, eventually control must pass from the offensive software to an impartial server. It should be the responsibility of the first server in the chain to validate that the traffic is valid, and pass this validation on to other servers in a manner that is verifiable.

---> See above. Spoofing will probably end when ipv6 is introduced but i
wouldn't say hurray to soon. IMHO Ipv6 = world domination or at least a major global control mechanism. Let's see if we like that better then the liberty's of IPv4 wich only needs some good client-side and server-side solutions to end most of the anoyments. Also, IP is just a layer to provide many services. In between layers and services a lot of 'the ball masquee' is going on. Pretty tough to see through to start with. Malware ... this post shows the first scanner-proof trojans are starting to emerge. While corresponding with a major Avirus company some three years ago they have predicted this undetectable virus/trojan allready. It's a matter of equations and methods of detection that can be eliminated by clever programming. The only backup they're counting on is operating system support for virus-defense. Haha, what a gas. Returning to the spam issue. I'd like to have some comments (not necessarily to the list) on a previous mail of mine.

If a method to prevent IP and e-mail address spoofing can be found, and more and more networking companies build this intelligence into their hardware and
software, then hackers and spammers will have a much harder time hiding behind
spoofed anonymity.

---> Naah, not any time soon, that would take a LOT of work and resources
out of the providers and man i've seen things while working there you wouldn't believe. At least not from the pretty much 'ignorant' person i was back then. Let's not forget though that some anti-spoofing measures are possible at the server-side of the connection. Basically any provider has the liberty to implement or not. Create a subnet (provider) on the internet without any spoofing protection and the lid is off again. In short, just one or two IP's are enough to cause trouble.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

I welcome all flames and comments to the above,

Daniel Bragg

my apologies for the strange reply marking method

Best Regards,

Joris