Re: [apps-discuss] update to rfc5965

[SM <[e-mail]>]

Hi Franck,
At 15:31 06-07-2013, Franck Martin wrote:
>http://tools.ietf.org/html/rfc5965
>
>Specifies the format of Abuse Reporting Format of emails.
>
>2.d indicates the report should contain either the headers of the 
>reported email as a text/rfc822-headers MIME part or the complete 
>message as an message/rfc822. However if the message reported 
>contains spam, virus, bad links, or in general malware, the complete 
>report is likely to be discarded by the receiver anti-spam filters, 
>never reaching abuse desks for processing.
>
>It is common amongst security professionals to exchange such 
>dangerous payloads as an encrypted zip file with the common password 
>"infected". This format allows to bypass anti-spam filters as the 
>MTA/MUA is not able to decrypt the attachment to analyze the content.
>
>It i difficult to request abuse desk to create a separate email 
>infrastructure for [e-mail] and especially to disable 
>anti-spam and anti-virus checks. Some of these addresses are part of 
>email hosted in the cloud.

One of the purposes of the report is to inform the operator about 
email abuse.  In my opinion such a message might have usually 
undesirable content.  The problem is that the operator is using a 
content filter for their abuse mailbox.  It is well-known that it's 
not a good idea to do that.  Whether they do that because they are 
using the "cloud" is immaterial.  When something is difficult for 
non-technical reasons it is ample reason not to try to fix it by 
technical means unless profit is all that matters.

Security professionals exchanging dangerous payloads by using with 
encrypted to bypass content filters can be described as being 
realistic or something else.  After all, if security professionals do 
that, other people can do that too.

>I suggest we add the possibility to send the complete email as 
>message/rcf822 email within either an encrypted zip file or within a 
>GPG symmetrically encrypted file, both using the common password "infected".

The problem is not the suggestion.  It's what will happen after that.

Regards,
-sm