Re: [mile] [marf] Including Mail fields in IODEF
"Panos Kampanakis (pkampana)" <pkampana@cisco.com> Sun, 03 March 2013 22:37 UTC
Return-Path: <pkampana@cisco.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60AC321F88C1; Sun, 3 Mar 2013 14:37:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.598
X-Spam-Level:
X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dr41mYSW0Zm7; Sun, 3 Mar 2013 14:37:04 -0800 (PST)
Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by ietfa.amsl.com (Postfix) with ESMTP id ABD5D21F88BF; Sun, 3 Mar 2013 14:37:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=21339; q=dns/txt; s=iport; t=1362350224; x=1363559824; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=iGg9gjCTBheDSlzIYA07Wu+PTPYqcVwwQVtlQrbxPY4=; b=XEOCIx1BhfoqyILmtpeXvrKsbuyhWGd4lujs9LRVTCUvtcLg1kUyq4Wd nug1b8HfYlv/EgKguQb1Q4SnfaShfICiOdViQgiuu5hUWoRW4gxtbf+B2 9RTH4H4lt9SNcNC9pVcWLRnNYmkVNcfxaLBU8EdxDgfHjNwV9oxoViSde w=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AhIFADTQM1GtJXHA/2dsb2JhbABFgkOGa7ByAYgpfhZzgh8BAQEEAQEBKkELDAQCAQgRAwEBAQsdByEGCxQJCAIEDgEECBOHZgMPDL1fDYknjEWBBxCBECAGBgEEBgEGA4JWYQOUZ4J9ijaFGIMIgXI1
X-IronPort-AV: E=Sophos; i="4.84,774,1355097600"; d="scan'208,217"; a="183005571"
Received: from rcdn-core2-5.cisco.com ([173.37.113.192]) by rcdn-iport-1.cisco.com with ESMTP; 03 Mar 2013 22:37:02 +0000
Received: from xhc-aln-x05.cisco.com (xhc-aln-x05.cisco.com [173.36.12.79]) by rcdn-core2-5.cisco.com (8.14.5/8.14.5) with ESMTP id r23Mb2Na007233 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Sun, 3 Mar 2013 22:37:02 GMT
Received: from xmb-rcd-x10.cisco.com ([169.254.15.195]) by xhc-aln-x05.cisco.com ([173.36.12.79]) with mapi id 14.02.0318.004; Sun, 3 Mar 2013 16:37:02 -0600
From: "Panos Kampanakis (pkampana)" <pkampana@cisco.com>
To: "Murray S. Kucherawy" <superuser@gmail.com>
Thread-Topic: [marf] Including Mail fields in IODEF
Thread-Index: AQHOF+7Za9kyjHSIHUueKEyqFsBb8piUjOJQ
Date: Sun, 03 Mar 2013 22:37:01 +0000
Message-ID: <1C9F17D1873AFA47A969C4DD98F98A75187BDA@xmb-rcd-x10.cisco.com>
References: <F5063677821E3B4F81ACFB7905573F24D6253D43@MX15A.corp.emc.com> <B14C10CA81885B4AAE1954F18457F2AB057004DB6D@MX36A.corp.emc.com> <F5063677821E3B4F81ACFB7905573F24D6253D5D@MX15A.corp.emc.com> <1C9F17D1873AFA47A969C4DD98F98A75187684@xmb-rcd-x10.cisco.com> <CAL0qLwZxwkcJi7Ej0fU5s8k-xZ=n_4fa0cvVVF05YtQPc3Ndag@mail.gmail.com>
In-Reply-To: <CAL0qLwZxwkcJi7Ej0fU5s8k-xZ=n_4fa0cvVVF05YtQPc3Ndag@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.116.63.179]
Content-Type: multipart/alternative; boundary="_000_1C9F17D1873AFA47A969C4DD98F98A75187BDAxmbrcdx10ciscocom_"
MIME-Version: 1.0
Cc: "mile@ietf.org" <mile@ietf.org>, "marf@ietf.org" <marf@ietf.org>
Subject: Re: [mile] [marf] Including Mail fields in IODEF
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/mile>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Mar 2013 22:37:09 -0000
Thank you Murray. The "<arf:EmailMessage> Received: from mailserver.example.net (mailserver.example.net [192.0.2.1]) by example.com with ESMTP id M63d4137594e46; Thu, 08 Mar 2005 14:00:00 -0400 From: <somespammer@example.net> To: <Undisclosed Recipients> Subject: Earn money MIME-Version: 1.0 Content-type: text/plain Message-ID: 8787KJKJ3K4J3K4J3K4J3.mail@example.net Date: Thu, 02 Sep 2004 12:31:03 -0500 Spam Spam Spam Spam Spam Spam Spam Spam Spam Spam Spam Spam </arf:EmailMessage>" that I see in http://bgp.potaroo.net/ietf/all-ids/draft-vesely-mile-mail-abuse-00.txt looks like just an email message. I don't see "feedback-type" or other ARF fields for example that would make it a ARF. draft-vesely-mile-mail-abuse-00.txt seems to define a header and then have the option for the actual message (EmailMessage). Am I reading it wrong? Panos From: Murray S. Kucherawy [mailto:superuser@gmail.com] Sent: Sunday, March 03, 2013 4:10 AM To: Panos Kampanakis (pkampana) Cc: Moriarty, Kathleen; mile@ietf.org; marf@ietf.org Subject: Re: [marf] Including Mail fields in IODEF The issue with MARF inside IODEF is that the receiver needs to know that the payload being provided inside an EmailMessage element is itself an ARF report, and not the message that caused the report in the first place. You certainly could crack open the EmailMessage content and see if conforms to the ARF specification to tell which kind of report you've gotten, but that seems inelegant. I suppose then another option is an extension element that indicates you've received an ARF payload rather than the actual offending message. Also of note: An ARF can contain the offending message or only the offending message's header, and still be compliant. If your application needs the whole message, you'll have to add some additional stipulations someplace. -MSK On Fri, Mar 1, 2013 at 1:52 PM, Panos Kampanakis (pkampana) <pkampana@cisco.com<mailto:pkampana@cisco.com>> wrote: I think MARF provides more functionality and should be leverage for emails in IODEF. I also think we need to resurrect http://tools.ietf.org/html/draft-vesely-mile-mail-abuse-00 within MILE since MARF was concluded.. Panos -----Original Message----- From: mile-bounces@ietf.org<mailto:mile-bounces@ietf.org> [mailto:mile-bounces@ietf.org<mailto:mile-bounces@ietf.org>] On Behalf Of Moriarty, Kathleen Sent: Thursday, February 21, 2013 5:19 AM To: mile@ietf.org<mailto:mile@ietf.org>; marf@ietf.org<mailto:marf@ietf.org> Subject: [mile] Including Mail fields in IODEF Hello, Cross posting with MAIL and MARF - In MILE related work, I have come across use cases that would like to include DKIM and SPF information in addition to specific mail fields (like the ones Chris lists below). We would like some help to figure out the best approach. Should we embed ARF and MARF RFC extensions to accommodate this need or should we look at updating RFC5901? Both take the approach of including an email message as opposed to using XML to tag each field and allow for this in the data model (in my opinion, that is fine and reduces bloat, but there may be other opinions). There was a draft published last year (link included below) that includes MARF in an IODE extension. Thanks, Kathleen ________________________________________ From: Harrington, Christopher Sent: Wednesday, February 20, 2013 2:57 PM To: Moriarty, Kathleen; mile@ietf.org<mailto:mile@ietf.org> Subject: RE: Mail fields I'm for the simplest solution as always. These are the indicator types that we routinely share. I would use these as a base: Email address (denoting if it is to or from) Email Subject Email attachment name Email attachment hash X-Mailer (from header) Hyperlink in email It's also very common to share the whole header. Bad guys routinely forge them and put extra header items that can be used as indicators. Although not an indicator sharing the entire email as an .eml or .msg file is also pretty common. Thanks, --Chris -----Original Message----- From: mile-bounces@ietf.org<mailto:mile-bounces@ietf.org> [mailto:mile-bounces@ietf.org<mailto:mile-bounces@ietf.org>] On Behalf Of Moriarty, Kathleen Sent: Wednesday, February 20, 2013 2:58 AM To: mile@ietf.org<mailto:mile@ietf.org> Subject: [mile] Mail fields Hi, In looking at the updated rfc5070bis and coming across some requests for handling certain types of exchanges, I am curious to hear how others think we should handle mail related indicators and incidents. A couple of commonly exchanged fields were added into the Record class. You can still extend out using RFC5901 and include a full mail message, but if you wanted to include DKIM or Sender Policy Framework, you need something else. The IETF group MARF already solved these issues. MARF uses the email tags rather than XML and there was a draft that embedded MARF content into IODEF (contains an example), can be found here: http://tools.ietf.org/html/draft-vesely-mile-mail-abuse-00 Since mail is already marked and can be parsed, would this be a better option to use what MARF has already done to solve the question on how to exchange this data? Other options would be to update RFC5901 or to extend IODEF further. I prefer the use of MARF. It is already in use by mail operators, so there is adoption. Thanks, Kathleen _______________________________________________ mile mailing list mile@ietf.org<mailto:mile@ietf.org> https://www.ietf.org/mailman/listinfo/mile _______________________________________________ mile mailing list mile@ietf.org<mailto:mile@ietf.org> https://www.ietf.org/mailman/listinfo/mile _______________________________________________ marf mailing list marf@ietf.org<mailto:marf@ietf.org> https://www.ietf.org/mailman/listinfo/marf
- [mile] Mail fields Moriarty, Kathleen
- Re: [mile] Mail fields Harrington, Christopher
- [mile] Including Mail fields in IODEF Moriarty, Kathleen
- Re: [mile] [marf] Including Mail fields in IODEF Alessandro Vesely
- Re: [mile] Including Mail fields in IODEF Panos Kampanakis (pkampana)
- Re: [mile] [marf] Including Mail fields in IODEF Murray S. Kucherawy
- Re: [mile] [marf] Including Mail fields in IODEF Murray S. Kucherawy
- Re: [mile] [marf] Including Mail fields in IODEF Panos Kampanakis (pkampana)
- Re: [mile] [marf] Including Mail fields in IODEF Murray S. Kucherawy
- Re: [mile] [marf] Including Mail fields in IODEF Moriarty, Kathleen