Re: Moving forward ...

>
> I'm not talking about counter-attacks, I'm talking about jumping into
> the middle of the conversation.  Example:
>
>
> MALBOT: HELO attacker.com
> VICTIM:    250 Hi there!  Attack at will!
> MALBOT to network: MAIL FROM:
> <piuadcouaowecuiboiubowyieboysdbcoywbfoqyweefboqqywbcobsod [at this
> point SUPERIDS kicks in]
> MALBOT [now talking to IDS redirect]:
> [email protected]>
> SUPERIDS to VICTIM: MAIL FROM: <[email protected]>
> VICTIM: 250 Ok
> SUPERIDS to MALBOT: 250 Ok
> MALBOT: RCPT TO: <[email protected]>
> SUPERIDS to MALBOT: 250 Do your worst you miserable attacker
> SUPERIDS to VICTIM: RCPT TO: <[email protected]>
> VICTIM: 250 Ok
> MALBOT: DATA <some plausible-looking msg>
> SUPERIDS to MALBOT: 250 Ok [or tempfail, or whatever]
> SUPERIDS to VICTIM: DATA <original message munged/defanged as
> necessary>
> VICTIM: 250 Ok.  Thanks for the the protection
>
>
> There's nothing malicious going back to MALBOT -- as far as MALBOT
> knows, it's still talking to the original SMTP server.  And as far as
> VICTIM knows it's still talking to MALBOT.  There's other
> places in the
> conversation there where SUPERIDS could kick in too.  But
> it'd still be
> nice to have some kind of way for SUPERIDS to signal to VICTIM (or
> downstream filters/MUAs/users) that something had happened.

I think you're discussing an implementation of a protection scheme.
Generally this would be logged, or some sort of audit flag would be
raised for an admin.  I wouldn't see an email with a filtering header as
this flag though.

Am I not grokking your point here?

> C
>
> On Feb 26, 2004, at 2:24 PM, David Nicol wrote:
>
> > Craig Hughes wrote:
> >
> >>   hijacking "bad" network connections to either shut them
> down, or do
> >> something else with them.
> >
> >
> > Reminscent of the suggested "attack handler" directives for web
> > servers: when your web
> > server gets probed with a known IIS worm, instead of just
> redirecting
> > them to an error page,
> > one replies with a command, designed to exploit the
> weakness known to
> > be exploited by the
> > worm that is known to issue the probe in question, which will shut
> > down the server that
> > is issuing the probe.
> >
> > The down side is, whereas the worm was living as a parasite that was
> > letting the host-machine
> > continue its operations, the proactive response of shooting
> infected
> > patients on sight is
> > not, as I recall, legal in California.
> >
> > I don't remember who sued whom to get who to stop, but
> someone got in
> > trouble for
> > shutting down vulnerable and machines , and this was
> roundly regarded
> > on slashdot as
> > a perfect example of judicial miscarriage.
> >
> > --
> > [email protected].
> > Include phrase "cat and buttered toast" to get through my filter
> >
> >
>
>