Re: [Asrg] An "ideal" false positive (TMGRS take 2)

Alessandro Vesely <vesely@tana.it> Wed, 07 July 2010 16:24 UTC

Return-Path: <vesely@tana.it>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 421C63A67A5 for <asrg@core3.amsl.com>; Wed, 7 Jul 2010 09:24:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.119
X-Spam-Level:
X-Spam-Status: No, score=-2.119 tagged_above=-999 required=5 tests=[BAYES_50=0.001, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hCQkqDRdW7d9 for <asrg@core3.amsl.com>; Wed, 7 Jul 2010 09:24:46 -0700 (PDT)
Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by core3.amsl.com (Postfix) with ESMTP id 32B7D3A65A6 for <asrg@irtf.org>; Wed, 7 Jul 2010 09:24:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tana.it; s=test; t=1278519881; bh=WC533bvzmX5WqtEwQAEypTnu7BhqJHoStHVATUYfcyA=; l=495; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=MTKEpEe7xaBUuhjIlW3YPTsSce0rKyKbzlyESuenZkH0ANwocRqWdNSi0fUF8Hd5r MzwjrKPec5NlxSSYuQy7V+p6rCTTCRufu7Xx991acWRykVXUAj7CvhHm9YgNP3Oz2D ZHedwxdV9CjdbCXxu4AXcZieK5tm2oUJxHw6J0yA=
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Wed, 07 Jul 2010 18:24:41 +0200 id 00000000005DC02B.000000004C34AA49.00003D09
Message-ID: <4C34AA49.5020409@tana.it>
Date: Wed, 07 Jul 2010 18:24:41 +0200
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: asrg@irtf.org
References: <4B61D1BA.6060807@tana.it> <20100129135607.GB27203@gsp.org> <FBFC96085D5112AA96E23D0F@lewes.staff.uscs.susx.ac.uk> <20100214224735.GB11546@gsp.org> <60F30C47-57A0-4D27-ACAD-3501666F8229@blighty.com> <20100214235728.GA19491@gsp.org> <69337EC16D97A928D8EC3442@lewes.staff.uscs.susx.ac.uk> <20100707114637.GB4483@gsp.org>
In-Reply-To: <20100707114637.GB4483@gsp.org>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Asrg] An "ideal" false positive (TMGRS take 2)
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Jul 2010 16:24:47 -0000

On 07/Jul/10 13:46, Rich Kulawiec wrote:
> 	An associate of Mizhen allegedly contacted Microsoft and
> 	said that the messages weren't spam -- as evidenced by the
> 	statistics showing that people moved the messages into their
> 	inboxes. Microsoft was taken in by the associate's representations
> 	and unblocked the spam messages, according to its complaint.

That attack unveils the flaw inherent in not having any sort of 
control on multiple mailboxes assigned to the same person.