Re: [Fwd: [Asrg] Re: Documents for LMAP BOF]

Philip Miller wrote:
> Hadmut Danisch wrote:
> 
>> On Sun, Feb 08, 2004 at 05:45:19PM -0500, Yakov Shafranovich wrote:
....
>> Because a malicous admin (spammer's admins are malicous by definition)
>> could still send tons of mail with forged sender addresses. If you tie
>> it with a domain, the malicous admin is forced to use the own domain 
>> name as the sender address. Unfortunately, the spam is still spam.
> 
> 
> This is all that LMAP was really meant to solve. The early discussion 
> drafts simply said 'we want to prevent joe jobs. Unfortunately, it gets 
> extended and extended, until it's not good at anything.
> 
>> But it is a good protection in case the admin is not malicious. It
>> stops those tons of worm and virus messages with forged sender
>> addresses. 
> 
> 
> This is also a good, and more importantly cheap and easy, goal to 
> implement.
> 
> I think that any LMAP draft should handle these cases first and 
> foremost, and anything further is icing on the cake.
> 

The current draft 
(http://asrg.kavi.com/apps/group_public/download.php/31/draft-irtf-asrg-lmap-discussion-00.txt) 
addresses four cases of forgery (section 2.1):
1.  Senders of junk email (the largest category of spam), often 
forges return addresses.
2. In account fraud, also known as ``phishing'', a sender poses as a 
person or organization with whom the recipient has a business 
relationship, or would like to have a business relationship.
3. In a ``joe job,'' a sender sends out abusive mail and forges the 
address of an unrelated party.
4. Viruses, trojans, worms, and related automated malware use forged 
return addresses to trick recipients into accepting or opening messages 
with hostile active content.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"And this too shall come to pass"
-------