Collateral Damage: Consequences of Spam and Virus Filtering for the E-Mail System

Collateral DamageConsequences of Spam and Virus Filtering for the E-MailSystemPeter Eisentrautcredativ GmbH22C3Peter Eisentrautcredativ GmbHCollateral DamageIntroduction12 years of spam. . .24 years of SMTP. . .Things have changed:SMTP is no longer enough.Spam filters, virus filters are part of the systemBut they are not standardized, verified, or predictable.Getting e-mail through is a challenge.Peter Eisentrautcredativ GmbHCollateral DamageFiltering TechniquesExamples of questionale defense mechanisms:DNS blackhole listsBounce messagesGreylistingSPFBlocking port 25Challenge/response systemsInventing your ownPeter Eisentrautcredativ GmbHCollateral DamageDNS Blackhole Lists: ConceptPublish list of “problem” hosts via DNSEvery mail server can query the listsFirst DNSBL MAPS did manual inspectionsCurrent DNSBLs are mostly automaticPeter Eisentrautcredativ GmbHCollateral DamageDNS Blackhole Lists: DiscussionIndiscriminate treatment of temporary problemsLarge ISPs often blockedUseless against dial-up accountsLow correlation with spam occurrenceDNS is insecureOnly usable as part of scoring system (SpamAssassin)Peter Eisentrautcredativ GmbHCollateral DamageBounce Messages: ConceptOriginal concept:1. Host A sends message to host B.2. Host B checks the message.3. Host B accepts or rejects the message.Problem: Checking took too long, host A timed out.New concept:1. Host A sends message to host B.2. Host B accepts the message.3. Host B checks the message and sends rejection messageto the sender.How to find the sender?Peter Eisentrautcredativ GmbHCollateral DamageBounce Messages: DiscussionJunk e-mail fakes sender addresses.Rejection messages go to innocent users.Users now reject rejection messages.Alternatives: discard messages, quarantineBetter: fix MTA time-outs, spam filter performance, go backto original conceptPeter Eisentrautcredativ GmbHCollateral DamageGreylisting: ConceptMail server sends temporary error on first contactNormal client tries againSpamming software, zombies doesn’t try againExtremely effectiveSpammers could react easily, but don’t. . . (?)Peter Eisentrautcredativ GmbHCollateral DamageGreylisting: DiscussionFull of configuration pitfalls:Poorly implemented softwareSender-side server poolsRecipient-side load balancingBroken MTAs that don’t retryMailing list software with variable sender addressesTime-critical e-mails (eBay)Multistage relaysVery hard to get right with diverse user populationsPeter Eisentrautcredativ GmbHCollateral DamageSPF: ConceptSender Policy Framework:Domain owner publishes SPF record via DNS, identifyingvalid outgoing mail serversMail recipient checks SPF records, rejects mail from invalidmail serversSPF checks envelope sender, Sender ID checks senderaddress in mail contentPeter Eisentrautcredativ GmbHCollateral Damage