You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Joe Emenaker <jo...@emenaker.com> on 2004/04/16 03:02:04 UTC
A rule to lower spam score of certificate-signed emails?
Howdy all,
I'm trying to find out if there are any plans to build into SA (or, how
difficult it would be to write my own otherwise) a rule that would lower
the spam score of a message that was signed (ala PGP, S/MIME, etc.)
using a trusted-CA-signed certificate.
At my workplace, we were pondering the idea of (acting as a CA and)
issuing e-mail certificates to all employees. One reason for this would
be to make it easy to track down virus-infected machines (since e-mail
viruses forge "From" headers, but I don't know of any that can forge a
cert). There are some other reasons... but I don't want to get into them
without being asked to do so... since I don't want to incite a flame-war.
Anyhow... does anyone know of any plans for something like this? If
not, how hard would it be to write one myself. All of the examples I've
seen are just basic "body", "rawbody", "header" pattern matching. In my
case, I think I'm going to need to run some external scripts to verify
the certs.
- Joe
Re: A rule to lower spam score of certificate-signed emails?
Posted by Kai Schaetzl <ma...@conactive.com>.
Joe Emenaker wrote on Mon, 19 Apr 2004 21:53:48 -0700:
> the computers are
> issued to users already set up by a central IT dept here (even more
> "central" than me, in other words). However, many of the users in my
> dept use our local mail server for *inbound* mail because we have better
> spam blocking and virus scanning than the central IT dept does.
>
well, I see that SMTP AUTH won't help you, sorry. I assumed that you had a
network and a gateway, so you have control over that gateway. If there are
conflicts between your dept. and the "central IT" dept. it might be better
to evaluate the current structure instead of hoping that certificates
would be of any benefit.
Kai
--
Kai Sch�tzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org
Re: A rule to lower spam score of certificate-signed emails?
Posted by Joe Emenaker <jo...@emenaker.com>.
Kai Schaetzl wrote:
>Joe Emenaker wrote on Sun, 18 Apr 2004 04:19:05 -0700
>
>
>>But doesn't this assume that you control the originating authenticating
>>SMTP server?
>>
>>
>if I understood you correctly you wanted to "control" the mail of your
>users and want to stop it going out if it doesn't have a sig or identify
>the user if it has a sig.
>
Umm... not quite. I don't want to control it "going out" of the
organization, because I can't... I don't have control of the SMTP server
that most of the users use.
Instead, I'm hoping that:
1) The signatures would aid in tracking down virus-infected machines at
our facility, and
2) The signatures would also server as a big help in sorting ham from spam.
>So, you do have control over that server, don't
>you?
>
Nope. Without getting too much into the gorey details, the computers are
issued to users already set up by a central IT dept here (even more
"central" than me, in other words). However, many of the users in my
dept use our local mail server for *inbound* mail because we have better
spam blocking and virus scanning than the central IT dept does.
- Joe
Re: A rule to lower spam score of certificate-signed emails?
Posted by Kai Schaetzl <ma...@conactive.com>.
Joe Emenaker wrote on Sun, 18 Apr 2004 04:19:05 -0700:
> But doesn't this assume that you control the originating authenticating
> SMTP server?
>
if I understood you correctly you wanted to "control" the mail of your
users and want to stop it going out if it doesn't have a sig or identify
the user if it has a sig. So, you do have control over that server, don't
you? SMTP AUTH will block viruses trying to send out unless they grab the
SMTP AUTH information from the client's registry (and if they do, they
probably can grab the certificate as well) and if the SMTP AUTH
information is used you can identify them.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org
Re: A rule to lower spam score of certificate-signed emails?
Posted by Joe Emenaker <jo...@emenaker.com>.
wrote:
> All the functions you are talking of are fulfilled by SMTP AUTH. It's
> "automatic", it provides for authentication and it blocks unauthenticated
> sending.
But doesn't this assume that you control the originating authenticating
SMTP server?
- Joe
Re: A rule to lower spam score of certificate-signed emails?
Posted by Kai Schaetzl <ma...@conactive.com>.
All the functions you are talking of are fulfilled by SMTP AUTH. It's
"automatic", it provides for authentication and it blocks unauthenticated
sending.
Kai
--
Kai Sch�tzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org
Re: A rule to lower spam score of certificate-signed emails?
Posted by Joe Emenaker <jo...@emenaker.com>.
John Hardin wrote:
>On Fri, 2004-04-16 at 14:29, Joe Emenaker wrote:
>
>
>>However, if everyone in our company were issued and used e-mail signing
>>certificates, then I could get a virus-infected e-mail from
>>dave@ourcompany.com but the crypto signature would be from, say,
>>stan@ourcompany.com. So, we'd know to go pay Stanley a visit.
>>
>>
>That might work for a user consciously sending out a virus-infected
>program as an email attachment, but you're assuming a worm will use the
>Outlook SMTP client objects to send its attack and that those objects
>will automatically sign the message. That won't happen. First, worms use
>their own built-in SMTP clients,
>
Well, we might ave different words for what we're talking about. To me
"worms" are the ones that come *to* you and get in through some
vulnerability in one of your services that's listening on an open port.
"Viruses" are the ones that you get by going and retrieving something,
like an e-mail attachment, vba scripts, for example.
So, I think that, if the mail clients were configured to automatically
sign the outgoing mail (which I'll get to in a second), then viruses
that used the user's usual mail client to do their evil work would get
their outgoing mail signed.
However, even if the worms/viruses *did* send out unsigned mail via
their own, built-in, SMTP clients, we could still stop them by blocking
any unsigned company-originated mail.
>and second, signing isn't (or shouldn't be) automatic.
>
Well, I'd say it depends upon the situation. Our users aren't all that
bright. If signing weren't automatic, they'd all forget to do it (well,
SA would help them remember, I guess :) ). If it were automatic but
their cert had a passphrase... well, that might fly. For now, however,
just to ease the adoption of it, I'm willing to go with automatic,
unpassphrased signing.
>A cryptographic signature should prove that the PERSON
>sent the mail, not their computer.
>
Well... yes... that would be nice, but I think that's trying to eat the
whole cake in one bite.
>That's why it should prompt for your
>passphrase at least every session, if not every message that is being
>signed.
>
>
Right. A passphrase for each message would cause outright revolt here.
Once per session would be good.
But are we drifting off the topic of: does anybody else here feel that
there might be some benefit in SA being able to verify signed email?
- Joe
Re: A rule to lower spam score of certificate-signed emails?
Posted by John Hardin <jo...@aproposretail.com>.
On Fri, 2004-04-16 at 14:29, Joe Emenaker wrote:
> However, if everyone in our company were issued and used e-mail signing
> certificates, then I could get a virus-infected e-mail from
> dave@ourcompany.com but the crypto signature would be from, say,
> stan@ourcompany.com. So, we'd know to go pay Stanley a visit.
That might work for a user consciously sending out a virus-infected
program as an email attachment, but you're assuming a worm will use the
Outlook SMTP client objects to send its attack and that those objects
will automatically sign the message. That won't happen. First, worms use
their own built-in SMTP clients, and second, signing isn't (or shouldn't
be) automatic. A cryptographic signature should prove that the PERSON
sent the mail, not their computer. That's why it should prompt for your
passphrase at least every session, if not every message that is being
signed.
--
John Hardin KA7OHZ
Internal Systems Administrator/Guru voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
If you smash a computer to bits with a mallet, that appears to count
as encryption in the state of Nevada.
- CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------
Re: A rule to lower spam score of certificate-signed emails?
Posted by Kelson Vibber <ke...@speed.net>.
At 04:01 PM 4/16/2004, Joe Emenaker wrote:
>You seem to be thinking along the lines of catching inbound viruses to
>prevent infection... which is good, but not what I'm immediately concerned
>with.
>
>I'm thinkning along the lines of tracking down *already-infected* machines
>at our company.
As am I. The viruses on your infected machines aren't going to sign their
outgoing messages with your users' client certificates.
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: A rule to lower spam score of certificate-signed emails?
Posted by Joe Emenaker <jo...@emenaker.com>.
Kelson Vibber wrote:
> At 02:29 PM 4/16/2004, Joe Emenaker wrote:
>
>> However, if everyone in our company were issued and used e-mail
>> signing certificates, then I could get a virus-infected e-mail from
>> dave@ourcompany.com but the crypto signature would be from, say,
>> stan@ourcompany.com. So, we'd know to go pay Stanley a visit.
>
>
> The way most viruses seem to work these days, you're more likely to
> get a virus-infected email with *no* signature,
Exactly... and those emails would be put into a "unsigned and, hence,
suspicious" folder. But that's kinda off the topic.
You seem to be thinking along the lines of catching inbound viruses to
prevent infection... which is good, but not what I'm immediately
concerned with.
I'm thinkning along the lines of tracking down *already-infected*
machines at our company.
I have the resources to to issue certificates to all of our employees
and configure them into their mail clients, etc. However, SpamAssassin
would be instrumental in ensuring 100% adoption of "the plan" (since it
could block unsigned mail from, say, employees trying to send mail from
their home PC or personal laptop and "encourage" them to load and use
their certificate on those machines as well).
So, viruses from the outside world would still arrive unsigned. That's a
problem for a later day. For the short term, we could, at least, have SA
treat the signed e-mail with less suspicion than unsigned ones. However,
down the road, if it becomes easier for enterprises to enforce some kind
of mail signing policy (ie, having it available in a tool that they
already use... SA being one of them), then maybe we'll start seeing
more-common usage of email signing, in which case we stand to reap even
more benefits.
So, if it's not too difficult to put this capability into SA.... and if
it doesn't break any of SA's current functionality, then I don't see
much reason not to do it.
- Joe
Re: A rule to lower spam score of certificate-signed emails?
Posted by Kelson Vibber <ke...@speed.net>.
At 02:29 PM 4/16/2004, Joe Emenaker wrote:
>However, if everyone in our company were issued and used e-mail signing
>certificates, then I could get a virus-infected e-mail from
>dave@ourcompany.com but the crypto signature would be from, say,
>stan@ourcompany.com. So, we'd know to go pay Stanley a visit.
The way most viruses seem to work these days, you're more likely to get a
virus-infected email with *no* signature, which leaves you right where you
started. They often have their own SMTP engines, which would bypass the
victim's mail client and, as a result, any certs they have.
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: A rule to lower spam score of certificate-signed emails?
Posted by Kai Schaetzl <ma...@conactive.com>.
Joe Emenaker wrote on Fri, 16 Apr 2004 14:29:23 -0700:
> However, if everyone in our company were issued and used e-mail signing
> certificates, then I could get a virus-infected e-mail from
> dave@ourcompany.com but the crypto signature would be from, say,
> stan@ourcompany.com. So, we'd know to go pay Stanley a visit.
>
And how do you ask the virus to kindly sign that mail for you with that
cert? Seems I'm missing something obvious in your explanation, but what?
Kai
--
Kai Sch�tzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org
Re: A rule to lower spam score of certificate-signed emails?
Posted by Joe Emenaker <jo...@emenaker.com>.
Kai Schaetzl wrote:
>Joe Emenaker wrote on Thu, 15 Apr 2004 18:02:04 -0700:
>
>
>>At my workplace, we were pondering the idea of (acting as a CA and)
>>issuing e-mail certificates to all employees. One reason for this would
>>be to make it easy to track down virus-infected machines (since e-mail
>>viruses forge "From" headers, but I don't know of any that can forge a
>>cert).
>>
>>
>I don't see how this would help in "tracking down virus-infected machines"
>with SA. What do you have in mind?
>
>
These days, viruses forge the return address in the infected e-mails
that they send out.
In days passed, if you got an infected email from "dave@ourcompany.com",
then that's the guy who's machine was infected. These days, all you can
figure is that both you *and* Dave are in the address book of the person
who *is* infected. And then, unless you're able to get your hands on the
logs of the first SMTP server in the delivery chain, that's about where
your pursuit ends.
However, if everyone in our company were issued and used e-mail signing
certificates, then I could get a virus-infected e-mail from
dave@ourcompany.com but the crypto signature would be from, say,
stan@ourcompany.com. So, we'd know to go pay Stanley a visit.
Now, you're probably thinking... "Well, if everyone's using
certificates, then you've got what you wanted... so where does SA play
into all of this?". Well, SA plays into it to: 1) help encourage
compliance amongst the users, and 2) to differentiate between "easily
traceable" mail versus mail that is not-so... ostensibly so that the
less kosher stuff can be put through more rigorous testing before
delivery (or delivered to a different folder altogether... the
possibilities are endless).
Now, I'm also hoping that it will eventually become a powerful weapon in
combatting spam as well. At the risk of inciting a religious battle
here, I'll say that, for a couple of years, I've felt that our best hope
of squelching spam is for cryptographic e-mail signing to be the
standard. I'm hoping that someday, perhaps 5 years down the road, almost
everyone will have/use e-mail ceritifcates, because (in this hypothetica
future world) signed e-mail will have a high likelihood of getting
through, while unsigned mail would be put through a fairly low-tolerance
set of spam filters.
However, I don't envision the popularity of email certificates growing
much without some increased incentive. The easiest way to add incentive,
I figure, is for the most popular spam filter to start offering
advantages to people who *do* sign their e-mail. So... that's the other
reason why I'm asking if there's a way to do it.
- Joe
Re: A rule to lower spam score of certificate-signed emails?
Posted by Kai Schaetzl <ma...@conactive.com>.
Joe Emenaker wrote on Thu, 15 Apr 2004 18:02:04 -0700:
> At my workplace, we were pondering the idea of (acting as a CA and)
> issuing e-mail certificates to all employees. One reason for this would
> be to make it easy to track down virus-infected machines (since e-mail
> viruses forge "From" headers, but I don't know of any that can forge a
> cert).
>
I don't see how this would help in "tracking down virus-infected machines"
with SA. What do you have in mind?
Kai
--
Kai Sch�tzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org
Re: A rule to lower spam score of certificate-signed emails?
Posted by Justin <li...@numbnuts.net>.
On Thu, 15 Apr 2004, Joe Emenaker wrote:
> Howdy all,
>
> I'm trying to find out if there are any plans to build into SA (or, how
> difficult it would be to write my own otherwise) a rule that would lower
> the spam score of a message that was signed (ala PGP, S/MIME, etc.)
> using a trusted-CA-signed certificate.
Are you talking about a rule/plugin to verify a cert or are you simply
looking for a rule/plugin that checks to see if a message claims to be
signed? IIRC isn't there a rule to match forged PGP sigs? I'm not a cert
buff so I don't know what all your inquiry implies.
Justin