Subject: [TOOLS-DEVELOPMENT] The latest round of spam

From: Glen <[email-masked]>
Date: Mon, 15 Oct 2018 16:34:54 -0700

Hi Tools Team -

So the latest round of IETF spam consists of a bot which forges email
from an @ietf.org address, to that same @ietf.org address, claiming
that the "account has been hacked", that the user has been video
recorded, and demanding a bribe of bitcoin to make the video go away
rather than being shown to all of the user's relatives.

I'm sure that "Mr. [email-masked]" would be horrified.

Needless to say, it's just junk spam.  I added some rules to filter
on bitcoin phrases, in the hope that that would solve the issue.

Of course, at AMS, I have all legitimate AMS addresses blocked, so
that only their users (with authentication) can send from those
addresses.  But, in the IETF, because of the way some of our legacy
tools work, and some of our interconnections between lists and tools,
some of these send-from addresses are not only not blocked, but
actually whitelisted in spam tables, making such forgeries easy.

I can of course block sending from these addresses, and/or unwhitelist
them, but when I've done so in the past it has caused legitimate email
from tools and systems to be blocked and/or to fail.

So - low priority - but perhaps at some point in the near future we
should inventory all of our tools, and review how each one sends
email, and determine if we really even still need some of them
(*cough* *coughANNOUNCEMENTTOOLcough*), and figure out how better to
allow people and tools to send email while more effectively blocking
forgeries from the outside world.

And two postscripts to the above:

#1. I sent this email on Saturday, just after adding the rules.  My
email at the time listed the specific phrases I had added to the
blacklist.  Because there were multiple phrases, spamassassin scored
up my own email so high that it got rejected and never made it to the
list.  Ha ha!  I am now resending this email to you two days later.

#2. Improbably, a thread on the MLS list talking about a certain
technique said that the technique was used in "Bitcoin Wallets" -
which caused a couple of replies sent after my rules were added to
also get rejected.  I've removed that particular rule from the
collection, and asked list members to resend any additional email.

Don't even get me started on cryptocurrency.  All of my savings are in Dogecoin.

Glen
--
Glen Barney
IT Director
AMS (IETF Secretariat)