Re: Realisticness of header rearrangement

   From: Laird Breyer <[email protected]>

   > I'm still puzzled.  It seems to me that the simple solution is to 
   > work on the assumption that the spammer _CAN_ forge any header;
   > they just can't remove headers that are already present.

   That's the most basic assumption. The assumption some of us have got
   going in this thread is that filters which live behind the company
   SMTP server are fully trustable, because we've installed them. The
   natural question is, can a filter prove it's living behind the SMTP server?

It's worse than that.

Say a smart spammer sends an email that carries no spam payload, so it's
otherwise acceptable.  This email actually _has_ a valid 
Errors-to: address; the message also has an intentionally defective
routing so that it bounces after acceptance.

Now the spammer has an example of an email header set that carries
all of the "I am good" fingerprints. 

You need reasonably strong crypto to not be breakable easily at that point.

   > In that case, the obvious solution is to have all prefilters either
   > say nothing, or say "spam" (and perhaps some quantification of that).
   > 
   > With that doctrine, a spammer -cannot- forge a useful header; they
   > can only hurt themselves.

   > Is there any reason (beyond the fact that it means a filter can't say
   > anything good) that this doctrine has been ignored?

   It hasn't been ignored, we just haven't discussed it much, yet ;-)
   As far as I'm concerned, it's a worthwhile doctrine.
   It's nowhere written that we can't have several partial solutions. 

   The obvious issue with it is, as you point out, that filters must
   either say "spam" or say nothing. I'd extend this a bit and say that
   filters also aren't allowed to indicate degrees of spamminess.

   Otherwise, for example, a spammer might try to spoof a tag saying
   "spam/unsure", on the assumption that the "unsure" might shunt the 
   email into a special folder which is looked at more often than the
   junk folder. 

Good point.

   Similarly, if a well known filter writes a spamminess score between 0 and 1,
   with 0 being close to ham, then the spammer might prefer to spoof
   "spam score 0.1" instead of "spam score 0.9". Maybe this will again
   trigger a safety system to let the mail through.

   The other obvious issue is that the doctrine is not really suitable
   for taggers which have several categories, eg popfile. That's going
   slightly outside of spam filtering, but it's a natural direction even
   for spam filtering. 

   For example, think of a spam filter which distinguishes several types
   of spam (pr0n, nigerian, etc). A spoofing campaign could have the goal
   of blurring the distinction between the categories, ie poisoning the filter.

Good points.

'Say nothing but bad' does not scale to degree of bad, nor to 
different category of bad.

That's a valid criticism... maybe not a showstopper, but worth knowing.

       -Bill Yerazunis