On Fri, Jan 30, 2004 at 09:09:50AM +0000, Fridrik Skulason wrote:
The worm authors would of course attempt to get around this. The most
obvious way would be to determine the "real" domain name of the infected
computer, and use that, but make up a new first part of the name.
Creating a new worm to do that would not be hard, so we just expect
that to happen more and more frequently as authentication methods
become more common.
This is a benefit ...
And this is the problem. Some ISPs seem incredibly reluctant to stop
worms spreading from machines owned by their users (whether that has
anything to do with the fact that some of them charge for the traffic is
a good question). Blocking the ISP as a whole will be problematic, as
at any given time obly a small number of the computers connecting to
the net through it are infected with a mass-mailing worm or operating as
spam zombies.
... because exactly these kind of ISPs don't care someone else is
joe-jobbed but wait until _they_ suffer from the problem.
I don't care too much if virusses were to spoof "abuse(_at_)$isp". That
would, IMHO, be just the incentive such ISPs need to do their job.
I am _not_ saying I think virusses should be written for this task
(or at all, for that matter) but spoofing $myname(_at_)$mydomain as the
sender is worse than spoofing $theirname(_at_)$theirdomain(_dot_)
cheers,
Alex
--
begin sig
http://www.googlism.com/index.htm?ism=alex+van+den+bogaerdt&type=1
This message was produced without any <iframe tags
-------
Sender Permitted From: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
Latest draft at http://spf.pobox.com/draft-mengwong-spf-02.9.5.txt
Wiki: http://spfwiki.infinitepenguins.net/pmwiki.php/SenderPermittedFrom/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname(_at_)©#«Mo\¯HÝÜîU;±¤Ö¤Íµø?¡