From: "Charles Anthony" <canthony@info-nation.com>
Date: Wed, 23 Apr 1997 05:52:19 -0700 (PDT)
To: cypherpunks@toad.com
Subject: The Risks of Automatic Spam Filtering/Deadbolt
Message-ID: <199704231252.HAA23219@bitstream.net>
MIME-Version: 1.0
Content-Type: text/plain


An item from Risks-Forum Digest forwarded through the Red Rock Eater 
News Service- 

--C



Date: Thu, 27 Mar 1997 11:31:55 -0800 (PST)
From: risks@csl.sri.com
Subject: RISKS DIGEST 18.94

RISKS-LIST: Risks-Forum Digest  Thursday 27 March 1997  Volume 18 : Issue 94

----------------------------------------------------------------------

Date: Wed, 26 Mar 1997 09:25:38 -0600 (CST)
From: Prentiss Riddle <riddle@is.rice.edu>
Subject: Risks of automatic spam blockers

Forwarded from Edupage, 25 March 1997:
| SPAM BLOCK
| A California software engineer [Ron Guilmette] takes the annoyance
| caused by unsolicited e-mail messages seriously, and has developed an
| anti-spam weapon he plans to unveil next month.  Dead Bolt allows
| online users to share their "blacklists" of spam purveyors so that they
| can more effectively filter offending e-mail.  "The problem now is that
| everyone who is filtering is keeping their own blacklists and they're
| not working together to tie their lists together in a meaningful way,"
| says Dead Bolt's creator.  "What I hope my package will do is allow
| people to work together over the Net and filter all this stuff out and
| finally put these people out of business....The problem is that it
| costs the sender virtually zero dollars to send out a million messages,
| and even if the response rate is minuscule by all standards -- say .001
| percent -- they've made money.  So from an economic selfish point of
| view, it's in their interest to annoy the other 99.99 percent of the
| people." (Miami Herald 24 Mar 97)

The full Miami Herald article is available at:

   http://www.herald.com/archive/cyber/techdocs/056735.htm

Some of the risks of automatic spam filtering which Deadbolt will have
to overcome in order to be successful include:

   -- The risk of false and malicious blacklisting of non-spammers. 

   -- The risk of harm to innocent bystanders who happen to share
      hostnames, ISPs, or other characteristics with targeted spammers.

   -- The possibility that spam messages will avoid detection by
      varying return addresses and other signatures in each copy of
      a message.

I find the first two particularly troubling -- were an imperfect spam
filtering system in wide use, then triggering it against an innocent
party could become a handy form of denial-of-service attack.

Published details of Deadbolt are sketchy, but a Deja News or Alta
Vista search of Usenet for "Ron Guilmette" reveals some of its
designer's thinking on the subject.  So far, I don't see enough to
convince me that he will be successful.

Prentiss Riddle  riddle@rice.edu

------------------------------

End of RISKS-FORUM Digest 18.94 
************************




Date: Tue, 1 Apr 1997 17:01:10 -0800 (PST)
From: risks@csl.sri.com

RISKS-LIST: Risks-Forum Digest  Wednesday 02 April 1997  Volume 19 : Issue 02

----------------------------------------------------------------------

Date: Thu, 27 Mar 97 13:44:07 PST
From: zerkle@cs.ucdavis.edu (Dan Zerkle)
Subject: Re: Risks of automatic spam blockers (Riddle, RISKS-18.94)

> Dead Bolt allows online users to share their "blacklists" of spam 
> purveyors so that they can more effectively filter offending e-mail.

Something like this has, unfortunately, become necessary.  It will happen
someday.  Stopping spam is a topic near and dear to me, and I've already
considered the risks mentioned.

> The risk of false and malicious blacklisting of non-spammers. 

This is a serious problem.  A step towards solving it would be a secure
clearing house of data on spammers.  It would need to be distributed via a
technique like PGP-signed Usenet messages or a on online database
downloadable through some secure transfer medium.

Whoever maintained the database would need to somehow decide what went into
it and what didn't.  The entries would have to be classified by reliability
level so that the users could decide which data to use and which to ignore.

Unfortunately, doing this would subject whoever did it to a suit by spammers
who didn't want to be blocked.  I haven't figured out a way to avoid this
particular risk short of establishing the operation in a country without
spammers.

> The risk of harm to innocent bystanders who happen to share hostnames,
> ISPs, or other characteristics with targeted spammers.

This is not a risk.  This is a benefit.  If users at an ISP get blocked
because the other users at that ISP are spamming, they will take their
business elsewhere.  ISP's will either take measures to avoid harboring
spammers, or they will lose their customers and go out of business.  Either
way, spammers will have one less place to hide.

> The possibility that spam messages will avoid detection by varying return
> addresses and other signatures in each copy of a message.

If the source of a spam can be discovered, this is not a problem.  The
original spamming host is going to show up somewhere in the Received: line,
even if only as an IP number.  Poorly configured sendmails on intermediate
(relay) hosts might not properly include the Received: information.  If this
is the case, the defective site should be blocked until its owners fix it.

------------------------------

Date: Fri, 28 Mar 1997 10:57:47 -0500
From: Wayne Mesard <wmesard@sgi.com>
Subject: Spam-proofed "From:" lines

A recent trend in the war against spam is to munge the "From:" line in
outgoing Usenet and e-mail messages (e.g., by adding asterisks or
exclamation points to the beginning or end of the userid).  

These messages are typically accompanied by a terse note at the bottom
of the message instructing respondents to "Remove asterisks [or
whatever] from my address if you would like to reply."

I see several risks with this technique:

- False security: Most mail and news agents will dutifully add a
  "Sender:" line containing the "actual" e-mail address, if the
  user-supplied "From:" line doesn't look right.

  Since many spammers already gather addresses from the "Sender:" line,
  munging the "From:" line provides only limited protection.

- Inconsideration: In that a munged "From:" line reduces the spam
  received, it reduces the amount of work the munger has to do.  

  So instead of having to press one key to delete a junk e-mail message,
  everyone that wants to reply to one of his messages has to (a) notice
  that the address is bogus (b) press many keys to fix it.  (Indeed, some
  mail readers make it quite tedious to edit the headers in replies.)

  In other words, it hasn't eliminated the problem; it's merely shifted
  the work from the sender to his correspondents.

- Lost messages: a non-scientific survey of some novice-user friends
  indicated that a large number of them had no idea what the "remove
  asterisks..." directive meant, how to perform this task, or what to do
  with the bounced messages that will result from the failure to do so.

- False security 2: In the ever-escalating spam arms race, it won't be
  long before spammers' address-gathering software is modified to
  unmunged munged "From:" lines.  (I can think of two obvious techniques,
  which I won't describe here so as to avoid providing aid and comfort
  to the enemy.)

Wayne

------------------------------

End of RISKS-FORUM Digest 19.02 
************************


Date: Fri, 4 Apr 1997 17:04:13 -0800 (PST)
From: risks@csl.sri.com

RISKS-LIST: Risks-Forum Digest  Friday 4 April 1997  Volume 19 : Issue 04

----------------------------------------------------------------------

Date: Tue, 1 Apr 1997 18:35:54 -0800 (PST)
From: C Matthew Curtin <cmcurtin@research.megasoft.com>
Subject: Re: Risks of automatic spam blockers (Zerkle, RISKS-19.02)

>> The risk of false and malicious blacklisting of non-spammers.  (Riddle)
Dan> This is a serious problem.  A step towards solving it would be [...]

This is unnecessarily complex.  The NoCeM effort (see http://www.cm.org/ for
details) has simply, and effectively, dealt with the spam problem for
usenet.  Efforts are underway to adapt this to e-mail.

NoCeM works this way:
 * Someone takes it upon himself to watch for spam in a newsgroup (or groups).
 * When spam does appear, that someone posts a "NoCeM" message to
   news:alt.nocem.misc and/or news:news.admin.net-abuse.misc, PGP signed.
 * Users who want to benefit from the filters have clients that, when
   they grab news, look in news:alt.nocem.misc (and potentially other
   places) for NoCeM messages.  The client verifies the signatures,
   and if it's signed by someone the client agrees to listen to, the
   message won't be shown to the user at all.
 * Clients are also available to work with news servers, to NoCeM
   messages on a site-wide basis.  (I believe that these actually
   cancel the NoCeM'd messages on the site.)

This is nice, because it uses what's already there (news), and allows the
user (or admin, depending on the model) to select which users' NoCeMs he
honors.  Either you trust someone's judgement and honor their NoCeMs, or you
don't, and they're completely ignored.

Dan> Unfortunately, doing this would subject whoever did it to a suit
Dan> by spammers who didn't want to be blocked.

Superfluous lawsuits are threatened all the time... few have the resources
of CyberPromo to actually be stupid enough to try any of this.  (It's
another thing about NoCeM...it doesn't kill the messages, it just is another
post, that certain clients deal with behind the scenes. :-)

Matt Curtin  Chief Scientist  Megasoft, Inc.  cmcurtin@research.megasoft.com
http://www.research.megasoft.com/people/cmcurtin/ 

------------------------------

Date: Wed, 2 Apr 1997 11:57:49 -0800 (PST)
From: Ted Wong <tmw5@cornell.edu>
Subject: Re: Risks of automatic spam blockers (Zerkle, RISKS-19.02)

Instead of having a central repository of spam, why not use a
distributed spam-control system analogous to NoCeMs for Usenet news?
Anyone could then issue digitally-signed spam-block notifications, but
an individual user would configure their system to only apply notices
that came from cancellers they trusted. An Alpha version of NoCeM for
e-mail already exists, at <http://www.novia.net/~doumakes/abuse/>.

Some advantages of this system are:

o It thwarts malicious individuals or organizations attempting to
systematically censor e-mail. Unless the user lists them as trusted
cancellers, their notices will be ignored.

o A 'spotcheck' mode would allow users to occasionally receive an otherwise
cancelled e-mail, to ensure that an otherwise trusted canceller hasn't
stepped over the line between spam-blocking and censorship.

o There is no risk of some central database being compromised by spammers or
censors.

o Users receive more timely warnings of new spam, without needing to
periodically check and download a spam-list.

o  The spammers have no-one to sue for freedom-of-speech violations.
While I'm not a lawyer, I can't see any way to sue someone for merely
suggesting that a spammer's mail isn't worth reading. 

> > The risk of harm to innocent bystanders who happen to share hostnames,
> > ISPs, or other characteristics with targeted spammers.
> 
> This is not a risk.  This is a benefit.  [...]

I can't see that this is a benefit. Changing your ISP is hardly a trivial
task - you have to notify all of your correspondents of your new e-mail
address, archive any web pages you may have stored at your ISP, reconfigure
your internal network if you were using a Class C subnet, etc. It's grossly
unfair to punish legitimate users because they were unfortunate enough to
have some Canter and Siegal wanna-be set up shop on their ISP.

Ted Wong  Information Technology Section  Mann Library, Cornell University
<tmw5@cornell.edu>

------------------------------

Date: Wed, 2 Apr 1997 08:33:02 -0800 (PST)
From: "Rosenthal, Harlan" <rosenthh@dialogic.com>
Subject: Re: Risks of automatic spam blockers (Zerkle, RISKS-19.02)

> [...] they will take their business elsewhere.  

Easy to say from a university or company account.  In the real world, nobody
wants to change addresses and notify all of their correspondents, especially
if it means losing an established presence that may have been widely
disseminated to =potential= correspondents (not to mention reprinting
stationary and business cards).  And why should the multitude suffer this
inconvenience, expense, and loss of communication, for the activities of the
few?

Spam is the biggest single argument for usage charges.  As long as it's
cheap to set up a new address and free to abuse it, there's no reason for
the spammers to cut down on e-mailing spam and freeloading on other people's
processors and comm lines.  The fact that spam can be sent from a domain
shared by many legitimate users, and that even new addresses may be reused
after the spammer changes away, means that abusers are hiding among the
innocent like hostage-taking terrorists - hyperbole, perhaps, but congruent
in style if not in magnitude.  The goal of any anti-spam approach should be
to block, slow, or encumber transmission as close to the source as possible.
Yet legitimate cases are always at risk; limiting the cc: lines, for
example, could inconvenience clubs or companies almost as much as it slows
the spammers.  As in any police-power or security effort, the problem is how
much freedom the average innocent person is prepared to give up so that the
abuser can be blocked.

-harlan

------------------------------

Date: Wed, 2 Apr 1997 09:32:46 -0800 (PST)
From: Dan Franklin <dan@copernicus.bbn.com>
Subject: Re: Risks of automatic spam blockers (Zerkle, RISKS-19.02)

> The original spamming host is going to show up somewhere in the Received: 
> line, [...]

Note that if you are fortunate enough to have Received: lines to work from
(the most recent spam I received had none at all, either because the relay
host was defective or because it really was sent directly to my mailhost)
you still have a challenge, because the spammer can insert one or more bogus
Received lines in the initial message, so the one added by the first relay
host will be buried in the middle.

By the way, it does not seem practical to me to block all mail-relay sites
that don't add Received lines.  How would you generate such a list?  What
incentive would you provide to such a site to change their software?

Dan Franklin

------------------------------

Date: Wed, 2 Apr 1997 10:57:55 -0800 (PST)
From: "J. DeBert" <onymouse@hypatia.com>
Subject: Re: Risks of automatic spam blockers (Zerkle, RISKS-19.02)

Any method of auto-blocking spam will create a serious problem for anyone
who later acquire the spammers' discarded domain names.

Spammers are registering lots of domain names and faking many to evade
anti-spam and cancel bots and to hide from their enemies as well as the
public at large. Once they are done with the domain names and they--the
registered names--become available again, the next organization to acquire
the name will find their mail bouncing or disappearing into /dev/null
somewhere and perhaps harassed by bots and hostile spam-haters which do not
know that the domain name has changed hands. The unfortunate victims of such
acts may not even be able to escape them by merely changing their domain
name, either.

Who is going to removed dead spammer domains from the anti- spam and cancel
bots' records and make sure that everyone knows about it?

onymouse@hypatia.com | I've only one thing to 
 Send NO spam        | say to spammers: "47USC227".

  [Many thanks to an onymouse contributor (J DeBert), 
  who acted as a guest moderator for this topic.  PGN]

------------------------------

End of RISKS-FORUM Digest 19.04 
************************



Date: Tue, 22 Apr 1997 12:03:12 -0700 (PDT)
From: risks@csl.sri.com
Subject: RISKS DIGEST 19.10

RISKS-LIST: Risks-Forum Digest  Tuesday 22 April 1997  Volume 19 : Issue 10

----------------------------------------------------------------------

Date: Thu, 17 Apr 97 19:49:30 EDT
From: dlv@bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Subject: Re: Risks of automatic spam blockers (Curtin, RISKS-19.04)

On the risks of issuing NoCeMs

I've been issuing NoCeMs for off-topic articles in several newsgroups (both
global Usenet and the nyc.* hierarchy) since the summer of '96.  I've
received two legalese threats of legal action from posters of material that
matched my criteria of being off-topic.

1. Michael Weir, a recruiter from Canada, insisted on posting job ads in
an unmoderated discussion newsgroup whose charter prohibits job ads and
resumes. He threatened to sue me for using his name in the NoCeM notices.
He also posted a series of abusive flames about me. A search of DejaNews
revealed several articles from him in Canadian newsgroups discussing
his litigations and asking for personal information about a judge.
Eventually he went away.

2. The "New York Theosophical Society" insists on posting in the local
newsgroup nyc.seminars (usually used to announce, what else, seminars).  One
Bart Lidofsky responded to the NoCeM articles by saying:

"I consider these messages to be a form of harassment, and will treat them
as such."

I have also seen several claims that the NoCeM notices themselves are
"spam".  Apparently, this term now applies to any traffic that the user
doesn't like for any reason.

I understand that other issuers of NoCeMs have also received threats, and at
least one poster has been forging old-fashioned cancels for the NoCeM
notices that mention his articles (another good reason to stop processing
all old-fashioned cancels).

Dimitri "co-proponent of news.lists.filters where NoCeM notices are posted"
Vulis  Dr.Dimitri Vulis KOTM

------------------------------

End of RISKS-FORUM Digest 19.10 
************************


Standard Risks reuse disclaimer:

  Reused without explicit authorization under blanket
  permission granted for all Risks-Forum Digest materials.
  The author(s), the RISKS moderator, and the ACM have no
  connection with this reuse.