Re: limitations of reputation, was Spam sent from compromised

On 25 Mar 2013, at 18:06, Steve Atkins <[email protected]> wrote:

> 
> On Mar 25, 2013, at 10:58 AM, Barry Shein <[email protected]> wrote:
> 
>> 
>> On March 24, 2013 at 10:07 [email protected] (Neil Schwartzman) wrote:
>>> 
>>> SPF and DKIM can DMARC solve the problem of people purloining from domains and sending phish/malware etc.
>>> 
>>> They are completely ineffective, of course, for look-alike domains, which are 80-90% of the problem.

So, you need to combine them with a reputation system. paypal.com is probably going to have a better reputation than paypa1.com (note the digit 1), for example. 

And, if you have a list of high volume (gmail.com) domains, or sensitive (eg banking) domains, then you can measure the Levenshtein* distance between the unknown domain and each domain on your list. There's a php function for it, for example, see http://www.php.net/manual/en/function.levenshtein.php. For a distance of one or two, you might want to treat the message as suspect. Of course, YMAIL.COM could yield a false positive here! And, you probably want to ignore the TLD, because for example levenshtein("bbc.com","bbc.co.uk") = 3, but then a problem arises with multiple domain registrations. Because "bbc" is registered by the British Broadcasting Corporation in more than one TLD, one can't guess whether BBC.CO belongs to them or not. I don't suppose whois results are usable here, are they?

* the minimal number of characters you have to replace, insert or delete to transform str1 into str2

>> 
>> Look-alike domains are 80-90% of the problem?
> 
> If they're not now, they will be once malware / phish authors notice DMARC deployment.
> 
>> I'm not sure what they even are, do you mean like bankoamerica.com
>> (note missing 'f')?
> 
> Yes, that.
> 
>> Definition please.
> 
> A domain that is not byte-identical to the protected domain, but which could
> conceivably be accepted as a legitimate domain owned by the same owner.
> 
> Typo-style, as you suggest, is one type.
> 
> Related word is another - e.g. paypalbilling.com
> 
> Spot the TLD is another - e.g. paypal.com.http0.ru
> 
> Homographs are another - e.g. paypa1.com (or the much trickier unicode variants).
> 
> Punycode-encoded ascii could be another approach, but I've never seen a registry that'll let you get away with that.
> 
> Cheers,
>  Steve
> 
> -
> This is the asrg mailing list.  To change your subscription settings, see
> http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org

-- 
Ian Eiloart
Postmaster, University of Sussex
+44 (0) 1273 87-3148

-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org