Full Disclosure mailing list archives
E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky)
From: "Lachniet, Mark" <mlachniet () sequoianet com>
Date: Wed, 3 Mar 2004 16:45:57 -0500
RE: Accepting mail from spoofed hosts This is really a very simple idea, and a hundred people smarter than me must have thought of it, but I have to wonder if yet another layer of e-mail security might not be in order as well - don't all email systems have a unique message ID on them? Sendmail certainly does. Why not set up some kind of system where the recipient email server does a kind of challenge-response to the originating domain, kind of like IDENT. Here the recipient is the recipient.com mail server, and has a MX record for recipient.com and sender is the sender.com mail server and has a MX record for sender.com Recipient ---> Sender : I got a message from joe () sender com - is it a legit user? Sender ---> Recipient : Yes, that's one of my users Recipient ---> Sender : Do you have a record of email ID QF2341ASZF for this user? Sender ---> Recipient : Yes, that user sent the email Recipient ---> Sender : Thanks, party on Wayne (email accepted) Sender ---> Recipient : Party on Garth (super, thanks for asking) You might combine the first two dialogs in one, ie, "do you have message ID QF2341ASZF from user joe () sender com" and provide non-descriptive error messages, so people couldn't easily harvest email addresses ala SMTP VRFY. Of course on the down side, you'd have to use your email server, with legit MX record as your smart host for all users (may be a hassle for home offices and POP clients, maybe requiring outgoing SMTP auth, but that's easy right?) Add to that a good RBL system, and you could cut down a boatload of spam. Mark Lachniet -----Original Message----- From: Aditya, ALD [Aditya Lalit Deshmukh] [mailto:aditya.deshmukh () online gateway technolabs net] Sent: Wednesday, March 03, 2004 1:06 PM To: Bart.Lansing () kohls com Cc: full-disclosure () lists netsys com; full-disclosure-admin () lists netsys com Subject: RE: [Full-disclosure] Backdoor not recognized by Kaspersky
The zip's contents can be seen without the password, just not unpacked...no cracking it
required. now winrar has a option to encrypt file names with a password, me thinks pkzip with the 64 bit compression also has that feature... how are we going to deal with this ? by stopping all the compressed mail at the email gateway ? we do have one solutions: all the mail headers are spoofed so just stop accepting mail from spoofed host, this should solve your spam problem also
You should be blocking executables by policy anyway, yes?
that is always being done by the all the people in this day and age, only now we seem to forget to add the compressed file format that are encrypted so that their file contects cannot be seen ? -aditya ________________________________________________________________________ Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky) Lachniet, Mark (Mar 03)
- Re: E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky) Dave Sherohman (Mar 03)
- RE: E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky) Bill Royds (Mar 03)
- RE: E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky) Nick FitzGerald (Mar 04)
- RE: E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky) Bill Royds (Mar 04)
- Re: E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky) Szilveszter Adam (Mar 04)
- RE: E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky) Bill Royds (Mar 03)
- Re: E-mail spoofing countermeasures (Was: Backdoor not recognized by Kaspersky) Dave Sherohman (Mar 03)