Re: Realisticness of header rearrangement

Hi all,

I meant to produce a few scenarios illustrating tag spoofing issues,
but didn't quite get around to it. Here's one we can start with
at least, hopefully it could be helpful in the current discussion.


A Scenario to illustrate tag spoofing:

A spammer S wants to send a message M for delivery to user U. The
message M has a header H and a body B. He fires up his SMTP client
and connects to U's SMTP server Q.  Message M is passed along from Q
to filter F1 and filter F2, then delivered to U.

S: M -> Q -> F1 -> F2 -> U, where M = HB

Being a smart spammer, S has written a specialized SMTP client
which can do the following: when passing the messsage M over to Q,
the time of that transaction is noted, and a new header T is prepended
to M on the fly, forming the message THB.

In our scenario, it is Wed, 31 March 10:30:00 when Q accepts a connection
from the spammer SMTP client, and is given following message:

Tagged: bogofilter says not spam; filtered at time = Wed, 31 Mar 10:31:45
(original header H)
(newline)
(original body B)

The spammer software has picked the timestamp randomly in the time interval
10:30:00 and 10:35:00.

Now Q passes the following message to the first filter F1:

Received: from niceperson by Q with ESMTP for U; Wed, 31 Mar 10:30:02
Tagged: bogofilter says not spam; filtered at time = Wed, 31 Mar 10:31:45
(original header H)
(newline)
(original body B)

The first filter F1 likes to place its tag T underneath the latest Received:
line, so after it is through, the following message is passed to F2:

Received: from niceperson by Q with ESMTP for U; Wed, 31 Mar 10:30:02
Tagged: spamassassin says spam; filtered at time = Wed, 31 Mar 10:30:27
Tagged: bogofilter says not spam; filtered at time = 10:31:45
(original header H)
(newline)
(original body B)

Next, the second filter F2 likes to place its tag T above the latest
Received:
line, so after it is through, the following message is passed to the user U:

Tagged: superfilter says not spam; filtered at time = Wed, 31 Mar 10:30:29
Received: from niceperson by Q with ESMTP for U; Wed, 31 Mar 10:30:02
Tagged: spamassassin says spam; filtered at time = Wed, 31 Mar 10:30:27
Tagged: bogofilter says not spam; filtered at time = Wed, 31 Mar 10:31:45
(original header H)
(newline)
(original body B)

Now U has received the message, and it sits in the inbox.
U fires his/her MUA at 12:21:00, and the MUA is about
to display the message.

Questions:
1) what is the spam status the MUA should show?
2) which of the two Tagged: headers can be used by filter F2 as extra hints
   for its own decision?
3) is there any transport consistency heuristic that can identify the
   spoofed header (ie something in the path that indicates something fishy?)


--
Laird Breyer.