Re: [Asrg] Re: SPF abused by spammers

[David Maxwell <david at crlf.net>]

On Tue, 14 Sep 2004, Barry Shein wrote:
> On September 15, 2004 at 00:20 hjp-asrg at hjp.at (Peter J. Holzer) wrote:
>  > Why should they? No legitimate user would want to send mail as
>  > johndoe at ABordeaux-251-2-10-162.w82-125.abo.wanadoo.fr, because he will
>  > never be able receive an answer (assuming that this is an address in a
>  > dynamic address pool). The legitimate user will send want to send mail
>  > as johndoe at wanadoo.fr, or maybe johndoe at bordeaux.wanadoo.fr.
> 
> Well, of course that's sensible, but the point really is that there is
> little difference between hijacking your PC and just breaking into
> your house and sitting down at your PC, as far as detectability of
> intent goes.
> 
> So, if the ISP allows your PC to do direct delivery and will ACK your
> SPF (however one might say that) then a zombie program on that PC will
> be ACKed also.
[...]
> The point is, if wanadoo.fr's servers will ACK for that PC when the PC
> tries to send from johndoe at wanadoo.fr then it'll ACK for a zombie
> program running on that PC also.
> 
> AND, I contend, there'll be millions of such PCs (infected or not.)

If the ISP requires all mail to go through their servers, it's trivial
to detect an upsurge in number of emails from a particular sender. This
change (in concert with SPF, or other RMX method) would limit the number
of spam message sent to the number of legitimate emails sent. I know
many users who receive a 20:1 or higher spam ratio, so this would be a
significant reduction.

If the ISP doesn't require all mail to go through their servers, the
same limiting could be accomplished by having routers count outgoing
SMTP SYNs.

Current routers aren't optimized to do that, so requiring use of the ISP
mail servers is easier - but either way is possible.

-- 
David Maxwell, david at vex.net|david at maxwell.net -->
If you don't spend energy getting what you want,
	You'll have to spend it dealing with what you get.
					      - Unknown


_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg