How Will Authentication Reduce Global Spam? OECD Anti-Spam Task Force Pusan – September, 2004 Dave Crocker Brandenburg InternetWorking OECD Anti-Spam Task Force Pusan – September, 2004 Dave Crocker Brandenburg InternetWorking Spammer?Phisher?

2 2 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September 2004 Questions About Authentication…  Will it stop spam, by itself, or do we need additional processes?  Will authentication prevent “phishing”?  Can we reduce spam without jeopardizing the sending of legitimate ?  Will it stop spam, by itself, or do we need additional processes?  Will authentication prevent “phishing”?  Can we reduce spam without jeopardizing the sending of legitimate ?

3 3 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September Security Functions TermFunctionIdentification Who does this purport to be? Authentication Is it really them? Authorization What are they allowed to do? Accreditation What do I think of the agency giving them that permission? ??

4 4 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September 2004 What to Authenticate? IdentityTypeSemanticScheme Peer Provider IP net Peer site Peer MTA IP SMTP Peer SMTP EHLO Domain SMTP Peer CSV SMTP Mail-From /Domain Bounce address SPF, BATV ReceivedDomainIntermediary Sender /DomainPosterSender-ID From /DomainAuthorDomainKeys

5 5 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September 2004 Spam Dilemmas  Nothing has yet reduced global spam!  So we should proceed tentatively  Unsolicited mail, from unknown author  Could be spam; could be legitimate  Spam is sent by army of compromised systems  Authentic signature can be is misleading  Assessing single signature is not enough  Mail clients do not show all the headers  And deceptions are often buried in the content  Users are not skilled or attentive to subtleties  Nothing has yet reduced global spam!  So we should proceed tentatively  Unsolicited mail, from unknown author  Could be spam; could be legitimate  Spam is sent by army of compromised systems  Authentic signature can be is misleading  Assessing single signature is not enough  Mail clients do not show all the headers  And deceptions are often buried in the content  Users are not skilled or attentive to subtleties

6 6 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September 2004 Q1 – More Than Authentication?  Authentication means you know “who”  But nothing about whether they are ok  We need Authorization  We need Accreditation (Reputation)  Use layered defense – multiple tests  Message contents (maybe)  Message author  Message transfer service  Traffic analysis  Authentication means you know “who”  But nothing about whether they are ok  We need Authorization  We need Accreditation (Reputation)  Use layered defense – multiple tests  Message contents (maybe)  Message author  Message transfer service  Traffic analysis

7 7 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September 2004 Q2 –Will It Prevent “Phishing”?  Joe Job  Fake ID to gain acceptance  Phishing is Joe Job to get returned information  Social engineering  Criminals are very creative and very aggressive  Is a police ID fake?  Is URL fake??  Joe Job  Fake ID to gain acceptance  Phishing is Joe Job to get returned information  Social engineering  Criminals are very creative and very aggressive  Is a police ID fake?  Is URL fake??  Levels of importance  Need levels of protection  Bad guys are good at finding cracks defenses  A good beginning:  Sign all identifiers & content  Upgrade clients  Create “reputation” services  Educate users Spammer! Phisher!

8 8 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September 2004 Is Legitimate Jeopardized?  If we are not very careful, then yes it is  Will restrict legitimate usage scenarios  Adds burden to everyone, not just bad guys  Adds long-term burden for short-term symptoms  is a rich, basic service  It can be used far more flexibly than most people realize… if we do not cripple it.  If we are not very careful, then yes it is  Will restrict legitimate usage scenarios  Adds burden to everyone, not just bad guys  Adds long-term burden for short-term symptoms  is a rich, basic service  It can be used far more flexibly than most people realize… if we do not cripple it.

9 9 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September 2004 SPF and Sender-ID: Author Path Registration MUAMSA MTA 1 MTA 4 MDAMUA MTA 3 MTA 2 Peer Assigns Sender and MailFrom Did MSA authorize MTA 1 to send messages for domain ? Did MSA authorize MTA 2 ? Did MSA authorize MTA 3 ? MSA must pre-register and trust each MTA in entire path! Mail Agents MUA = User MSA = Submission MTA= Transfer MDA= Delivery

10 D. Crocker, Brandenburg InternetWorkingOECD, Pusan / September 2004 In summary  Authentication is essential building block  Multiple authentications needed  Authorization and Accreditation also needed  Attackers are creative  This is a continuing battle  is at core of human activities  Efforts to stop bad behavior could also damage good behavior  Authentication is essential building block  Multiple authentications needed  Authorization and Accreditation also needed  Attackers are creative  This is a continuing battle  is at core of human activities  Efforts to stop bad behavior could also damage good behavior