Re: [Rucus] [spitstop] Botnets, take 2... Re: Draft RUCUS charter

On 2008/02/22 12:02, Hannes Tschofenig <Hannes.Tschofenig@gmx.net> wrote:
> 
> I had a chat with Peter Saint-Andre this week and he reported me about 
> problems they had with malicious users (potentially using the XMPP 
> servers for file sharing) in their XMPP server infrastructure. He told 
> me that their community is looking into a mechanism to allow one domain 
> to report problems to another domain. This would correspond to Henning's 
> 2nd category below and a mechanisms similar to the one described in 
> http://www.ietf.org/internet-drafts/draft-niccolini-sipping-spam-feedback-00.txt 
> would be useful (expect that it would not be run between the end host 
> and the VoIP provider but between two VoIP providers).

I'm wondering what these kinds of feedback systems can do if either

* it's easy for the spitter to create new identities within the same
  domain

* it's easy for the spitter to create his own domain, and thus he 

  - can follow the protocol, and mint new indentities for each SPIT-run
  - or just forge the anti-spit feedback headers to indicate that no bad
    feedback had been received for this identity

In other words, don't all these ideas assume the the miscreants are
misbehaving clients using trustworthy service providers (which don't
allow mass-minting of accounts?)?

/ol
-- 
-=-  Otmar Lendl  --  ol@bofh.priv.at  -=-
_______________________________________________
Rucus mailing list
Rucus@ietf.org
http://www.ietf.org/mailman/listinfo/rucus