Re: ] Replay attacks and ISP business models

[Michael Thomas <mike@xxxxxxxx>]

Sam Hartman wrote:
> I'd like to ask us to think particularly about the impact of this
> attack on business models of medium sized ISPs.  Fundamentally few
> people are going to block all mail from AOL,, Yahoo, Gmail or the
> like.  However smaller ISPs have been subjected to a wide variety of
> problems with various blackhole lists.  Sometimes this was because
> they were doing something wrong, sometimes the blackhole lists were
> doing something wrong.  There's a lot of debate about where the right
> balance is that I would like to avoid.

Are you implying that this problem wouldn't crop up
without the "replay" problem? I expect that it would,
although I'd hope we're past many of the teething pains
given the existance of RBL's for quite some time now.

> However there is a similar issue with DKIM.  It's not clear what
> policies a medium sized ISP could adopt to avoid being subject to such
> an attack.  It's not clear how you could maintain a reputation while
> still defaulting to providing service to anyone who wants an account.

I would expect that outgoing spam filtering ought to be the
norm for ISP's. I don't believe that's currently the case (?).
And in particular, an ISP may want to *really* dial up the
filters for new and/or quiescent accounts. And I don't think
that this is just an ISP problem: zombied machines in enterprise
could lead to negative reputation too.

There's also room for further work in this area too in the
area of accreditation. Note also that DKIM has an expirey
on the signature, so there is at least some time horizon
for an individual attack.

> Do we care?  Is this acceptable to the operations communities?

Yes, at least I care. What's not entirely clear to me is whether
this a new attack per se, or just a permutation of an old one.
Lots of spam is relayed through ISP MTA's today. Those MTA's doing
outbound filtering would help a lot regardless of whether DKIM is
around or not. DKIM seems to me to help the incentive to do that
kind of policing. A wildcard is that I believe that some ISP's
are not allowed to block outgoing mail (European?). This might
put them in an untenable position even if they have good remediation
procedures. I have some thoughts here, but I'm afraid I might be
out in the weeds.

		Mike