getting rid of outbreaks and spam (junk) [WAS: Re: RFC: virus handling]

[Gadi Evron]

There were some good ideas in this thread, so I would do my best not to
repeat any of them and perhaps to look at a couple of points from a
different angle. I will try and be very critical, please do not take it
the wrong way.

This may look like a rant, but it really isn't. Please bare with me?


1.It is clear that as notifications are today, they are *mostly* plain
and simple spam. Why do I believe that?

Since they usually contain information regarding getting a brand new AV,
but not about the virus or how to get cleaned.


2. In a broader view, notifications ARE currently the problem rather
than a solution. I got thousands of Mydoom.A. I also got X10 times that
in AV notifications. Can we truly afford the extra-slowdown to the
Internet when a major outbreak is out? A mini-outbreak can turn into a
massive one due to AV notifications alone.
Doesn't make any sense beyond the marketing idea, and we all see how
malware spoofs email addresses. Hence why I call it spam.


3. I think we look at the whole problem in the wrong way, allow me to
elaborate:

The AV industry is built on reaction rather than prevention. Adding new
signatures is still the #1 tool in the fight against malware.

With spam and mass mailers clogging the tubes, causing us all to waste
money on bigger tubes, as well as our time dealing with the annoyance
(more money), shouldn't the problem be solved there (at the main tubes
themselves) rather than at the end user's desktop?

If backbones filtered the top-10 current outbreaks, with non-intrusive
means such as for example running MD5 checksum checks against
attachments, or whatever other way - wouldn't it be better? True, it may
cause a cry of "the government spies on us, but with the current
economic troubles outbreaks cause, can we really use that excuse
anymore? Doesn't the police regulate speeding?

If I were to take the conspiratorial side, perhaps backbones like it
when people pay for tubes they don't need, which are used to deliver 90%
junk.

There are enough solutions out there for spam and malware, they are
mostly not being implemented for different political and commercial reasons.

Nobody wants to deal with "you are reading my mail!" or with "sorry, now
people will pay for smaller tubes", perhaps even at the ISP level - "why
should I pay for more filtering when it isn't demanded of me?".

They are right, it isn't currently demanded of them.

I would like to refer you to SpamCop (when it comes to spam) or
MessageLabs (for malware), it works. But you need to pay to get (most
of) their services.


4. As far as the IP-ADDRESS@isp goes, it IS a good idea, but not a very
practical one in my opinion. Allow me to explain why.

First, the obvious reason against it would be how easy this will make
spammers' lives.

Second, we need to remember that most of the DDoS attacks happening
these days on the Internet are the cause of Drone Armies. Thousands upon
thousands of machines infected with a Trojan horse that work for
spamming the Internet or conducting cyber-"battles".

Many times we see tens of thousands of infected users, and we try and
clean them remotely (we used to connect directly and remove the
backdoor, but then we realized the legal problems with this approach).

Nowadays we "play" the controllers, find the control commands and
passwords and remove the drone armies from where they echo to, such as
an IRC channel.

The problem with this approach, which is a never-ending fight (you know
how many times a minute you can get scanned on Cable/DSL IP ranges, how
many other people are not protected?) is that the users, although now
"clean", will soon show up with yet another Trojan horse, re-infected
and used as a tool of war against different "groups", for spam or maybe
to blackmail corporations.

Although completely not practical, a way to contact users (or ISP's,
isn't that how it works?) by IP address would help a lot. But that would
be circumventing the real problem which is ISP's not doing much about
ABUSE REPORTS or USER SECURITY.

We all kept talking about anything from spam reporting, to ISP's
preventing their own users from performing illegal activity, the whole
issue of asking ISP's to do anything is simply wrong. It is not
ECONOMICAL for them to do so unless the law dictates it.


5. Drifting a bit from the original subject at hand, we can go on
forever discussing the problems with the net, such as spam, malware or
ISP's not caring. The issue is how do we do one of the following:
- Make ISP's care (enforcing new laws?).
- Employ limited solutions on the backbones (spam filtering? malware
filtering?).
We are reaching a place where 80-90% of the traffic is junk, it may be
economic but do we really want to stay there?

There is no magic cure, and Every possible solution would have problems,
Nothing is perfect. I don't understand why the biggest problems of the
Internet should be commercialized and thus become static, rather than
solved.

Obviously again, solving the problems is not easy, and nothing is
trivial - I just don't see that any solution that may work gets
implemented or tried.

My 2K bucks.

Gadi Evron.

[Georg Schwarz]

> 2. In a broader view, notifications ARE currently the problem rather
> than a solution.

agreed, for the following reason: it is absolutely trivial to automatically
detect any MS Windows/DOS executable or script in an attachment to an
email (that is what a large number of virii are made of). Simply deleting all
such mail greatly reduces the number of of unwanted emails in times of
new virus outbreaks (and we are definitely to see quite a few of them in
the months ahead... it is apparently so easy to fool many people into
executing such programs on their PCs). I find it hard to think of a legitimate
reason to have such attachments anyway, so throwing away such mail will not
be a loss to many if not most users (your milage my vary of course).

This however leaves open three types of virus-related emails:

- bounces of virus-sent emails that used your email address as a fake sender
address.

- notifications of email scanners as a result of virii using your email address
either as a sender or as a recipient address.

- virus-infected (or rather -generated) email which on some intermediate host
was scanned and stripped of the viral attachment (so the above-mentioned
detection no longer catches it). Such mail has become "harmless" but annoying
spam.

I do not know whether there is anything in general to do about the first type
of mails.
For the second one it is clear that nowadays notifications do much
more harm that good, so I hope email scanning software authors and users
will disable that feature (probably most people that employ such software are
unaware or ignorant about the effects of that feature :-(). You can start
filtering such messages, but it is hard because there is not a really simple
criterion to automatically detect them. Any suggestions?
For the third type of emails more or less the same is true. Such filters that
remove the virus but let pass the remaining "spam" body parts also do more
harm than good. Today it is save to assume that virus-infected mail is
virus-generated mail and thus can and should be killed off altogether.

Since I am pesimistic regarding a change in email scanners' behavior I
would welcome any suggestion for better filtering these types of unwanted
emails.

>
> The AV industry is built on reaction rather than prevention. Adding new
> signatures is still the #1 tool in the fight against malware.

yes, and it is a loosing battle (for the user, not for that industry that
is, of course).


> With spam and mass mailers clogging the tubes, causing us all to waste
> money on bigger tubes, as well as our time dealing with the annoyance
> (more money), shouldn't the problem be solved there (at the main tubes
> themselves) rather than at the end user's desktop?

since the problem after all is at the end user's desktop desktop, I think
it is only there where it can be solved. Anything else is just mitigating the
symptoms (which can of course improve the situation).

>
> If backbones filtered the top-10 current outbreaks, with non-intrusive
> means such as for example running MD5 checksum checks against
> attachments, or whatever other way - wouldn't it be better? True, it may
> cause a cry of "the government spies on us, but with the current
> economic troubles outbreaks cause, can we really use that excuse
> anymore? Doesn't the police regulate speeding?

the true problem is that malware authors apparently are able to execute
arbitary code on (many) other people's systems and can thus use that for
all kind of criminal business. Filtering, whether done on servers or in
backbones, will not stop that. Such filters will easily be circumvented.
I am sure once such scanners are out clever programmers will find a way
to produce viral code that passes them undetected. Just as with today's
scanners they can only react to known incidents. So I think it would not
make a real difference where scanning occurs.

> - Make ISP's care (enforcing new laws?).

I would rather say: make users care. I know it is a rather weak analogon,
but if anyone commits a crime using your car, your weapon, your whatsover
and it turns out that you have made this possible by grossly neglecting
secure deposit of that device I am sure that in many coutries you can be
held liable to some degree. This should put pressure from consumers on
device (PC) vendors to take security of their products more serious.

> We are reaching a place where 80-90% of the traffic is junk, it may be
> economic but do we really want to stay there?

since it in fact is an economic problem only economic (monetary) meassures
will lead to a solution, which here means being held liable for damage
caused by hooking up (or one step further, selling) systems that grossly
undermine network security.
Computer virii are no god-given thing (although the mere term might make
many people think so), they are a result of neglected security in a networked
world both with respect to device/software design and user behavior.


--
Georg Schwarz http://home.pages.de/~schwarz/
geos@epost.de +49 177 8811442

[der Mouse]

OK, I guess I'll brave the storm of incompetently-run "out of the
office" autoresponders and boneheaded C/R systems yet again.

> 1.It is clear that as notifications are today, they are *mostly*
> plain and simple spam.

I agree with you. They are unsolicited, bulk, and email; ergo, spam.

> Why do I believe that?

> Since they usually contain information regarding getting a brand new
> AV, but not about the virus or how to get cleaned.

Adding information about the virus or how to disinfect would not help
one bit. I do not have the virus, I cannot have the virus, I have no
use save academic interest in details about the virus or about how
people who have it might get rid of it; adding such information to the
already-useless notifications I get will make them no more useful (and
in fact less so because it will make them bigger).

Also, it will not make them any less unsolicited, any less bulk, or any
less email; they will still be spam.

> 2. In a broader view, notifications ARE currently the problem rather
> than a solution.

Agreed.

> The AV industry is built on reaction rather than prevention. Adding
> new signatures is still the #1 tool in the fight against malware.
[...]
> If backbones filtered the top-10 current outbreaks,

I suggest you talk to a backbone network engineer before making such
suggestions. The backbones do not handle email as such; they handle
packets that, taken together, make up email sessions (and many other
things). The difference is immense. In particular, the backbones
cannot associate one packet in an SMTP session with the next in the
same session; while in theory they could be made to, in practice it
would be far, far too resource-intensive, especially given how close to
the line they are running as it is.

> with non-intrusive means such as for example running MD5 checksum
> checks against attachments,

Can't be done. Some of the reasons why:

- Knitting packets together into TCP data streams (necessary to
identify attachment boundaries) demands orders of magnitude more
resources (both cycles to inspect the packets and memory to store
them) than are available.

- Knitting packets together into TCP data streams demands that all
packets making up the stream follow the same path. Anyone who thinks
the core routing tables are that stable needs a reality check.
(Granted, 50% success would be better than nothing, but not much,
especially in view of the cost in the form of half-completed state
sitting around waiting for packets that went another way.)

- MD5 is a relatively expensive checksum to compute, thus even further
overdrawing the cpu-cycle budget; since many MD5s will have to be in
progress at any one time, this also exacerbates the memory lack.

- Slight randomizations in virus payload have been a standard tactic
for years; if this is done, it will simply become universal (since
then each viral payload will have a different MD5).

- Even if somehow all the above went away, by the time the attachment
ends and the MD5 is computed, it's too late; it's already been sent.
All that can be done at that point is to disrupt the SMTP connection,
such as by RSTing it rather than sending the closing dot, and even
that will simply make the sender retry repeatedly, thus replicating
the waste many times. (If it's a smarthost's MTA, that is. It will
stop viral SMTP engines that don't bother retrying, but again, such
measures will simply make smarthost-using viruses even mroe
ubiquitous than they already are.)

- People won't stand for it. I know I certainly wouldn't.

> True, it may cause a cry of "the government spies on us, but with the
> current economic troubles outbreaks cause, can we really use that
> excuse anymore? Doesn't the police regulate speeding?

Roads are a shared public resource. The backbones you are making so
free with are privately owned. If you want the various national
governments (yes, plural) to expropriate them all as a first step, you
should at least be upfront about it - and you will get a _lot_ more
resistance to your plan.

> There are enough solutions out there for spam and malware, they are
> mostly not being implemented for different political and commercial
> reasons.

Sure. Many of the solutions I've seen are akin to killing off a tumor
by cremating the patient: they'll work but are excessive. The others
won't work. There may be something that avoids both those problems,
but I've yet to see it.

> 4. As far as the IP-ADDRESS@isp goes, it IS a good idea, but not a
> very practical one in my opinion. Allow me to explain why.

You've explained why it's not practical. How about explaining why you
think it's a good idea? (I think it's a terrible idea; it has endless
downsides and, as far as I can see, no real upside at all - suppose I
get hit from 12.34.56.78. So I send to 12.34.56.78@...where? If I'm
going to look it up in ARIN/RIPE/etc, I might as well just use the
abuse contact listed there anyway. Furthermore, if it's a dynamic
dialup, it could easily have been used by a dozen different users
during the time between the offense occuring and my sending a report;
which one gets it? What if my computer's clock is 47 minutes wrong?)

> [...] the real problem which is ISP's not doing much about ABUSE
> REPORTS or USER SECURITY.

Right. But what can be done about it? You mention "the law"; what do
you think "the law" (as if there were a single "the law" on the net)
should, or even could, dictate?

> I don't understand why the biggest problems of the Internet should be
> commercialized and thus become static, rather than solved.

Because nobody's managed to solve them yet.

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B