From rucus-bounces@ietf.org Wed Oct 22 13:29:31 2008 Return-Path: X-Original-To: rucus-archive@ietf.org Delivered-To: ietfarch-rucus-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 07D413A6B13; Wed, 22 Oct 2008 13:29:31 -0700 (PDT) X-Original-To: rucus@core3.amsl.com Delivered-To: rucus@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 967213A6B13 for ; Wed, 22 Oct 2008 13:29:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2PeqJyxj8j58 for ; Wed, 22 Oct 2008 13:29:28 -0700 (PDT) Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by core3.amsl.com (Postfix) with ESMTP id 78F283A6A8C for ; Wed, 22 Oct 2008 13:29:28 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.33,466,1220227200"; d="scan'208";a="50002079" Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-5.cisco.com with ESMTP; 22 Oct 2008 20:30:37 +0000 Received: from sj-core-2.cisco.com (sj-core-2.cisco.com [171.71.177.254]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id m9MKUbFB002802 for ; Wed, 22 Oct 2008 13:30:37 -0700 Received: from dwingwxp01 (dhcp-128-107-109-157.cisco.com [128.107.109.157]) by sj-core-2.cisco.com (8.13.8/8.13.8) with ESMTP id m9MKUbNG008788 for ; Wed, 22 Oct 2008 20:30:37 GMT From: "Dan Wing" To: Date: Wed, 22 Oct 2008 13:30:37 -0700 Message-ID: <057801c93485$0addc2d0$c3f0200a@cisco.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 Thread-Index: Ack0hQrKjTEPFTWYTT6vpb7qelHLIw== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=5044; t=1224707437; x=1225571437; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=dwing@cisco.com; z=From:=20=22Dan=20Wing=22=20 |Subject:=20=3D?us-ascii?Q?Fwd=3A_MAAWG=3A_It's_Not_Just_Ab out_Email_Anymore?=3D |Sender:=20; bh=rjIm7tw9TLzWoICCWtBM3lCHn+RYX08bffdl8vvugVI=; b=YvHPUTHu8Ag7COh+vE28l6vD9lNY6WsnrZl/SxAQcUyiK9tceVcVMd6KDy Ny0gt21QwuF/vPWDCVP5iaw1n3ERixcOus6Wv4JEbgIsmED/D4UAVAvl8r5j F0BvihM55Y; Authentication-Results: sj-dkim-3; header.From=dwing@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); Subject: [Rucus] Fwd: MAAWG: It's Not Just About Email Anymore X-BeenThere: rucus@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Reducing Unwanted Communication Using SIP \(RUCUS\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: rucus-bounces@ietf.org Errors-To: rucus-bounces@ietf.org http://blogs.nortel.com/voicesecurity/?p=36 > > Stephan Varty of my team is back, covering his attendance at the > recent MAAWG General Meeting...Lawrence > > I recently attended the Messaging Anti-Abuse Working Group (MAAWG > http://www.maawg.org) 14th General Meeting between Sept 22-24, 2008. > MAAWG is a global organization focusing on preserving electronic > messaging from online exploits and abuse with the goal of enhancing > user trust and confidence, while ensuring the deliverability of > legitimate messages. Right now you are probably thinking: "That > sounds like email, what does this have to do with voice security?" > > In fact MAAWG's vision is that "messaging" should be viewed more > holistically than "just email". New forms of messaging (e.g. SMS, > MMS, PAP) are rapidly evolving in different industries and this > evolution will continue as we move to unified communications. In > MAAWG's view the success of these new services will be heavily > dependent on their ability to reach users through different devices > and different networks. There is also the fact that Spam over > Internet Telephony (SPIT) and Instant Message Spam (SPIM) have a lot > in common with email spam in terms of motivation, mechanisms, and > potential solution space. > > I was surprised to find that most of the presentations at the MAAWG > meeting were not email centric. They focused on topics such as > malware, botnets, and the economics of messaging abuse. There were > also presentations on subjects which are more general such as DNSSEC > and IPv6. I found the subjects to be of interest and appreciated the > technical content of many of the presentations. > > One presentation I attended included research across a large > number of antivirus products on the effectiveness of anti-virus > software at detecting new malware. Detection results were much > lower than I would have anticipated. Several days after > identification of a new variant detection was only about 50%. This > reinforces two things for me: > > * Reliance on a single technical control is insufficient. > * The black hat's tools, including such things as polymorphic > malware, continue to be effective against many existing > controls. > > A couple of presentations covered topics on the economics of botnets > and provided insight into the underground economy surrounding > compromised devices. Some examples of the content include: > > * Based on the research presented there are on average about 1 > million bots active on the Internet at any given time. > * Compromised Linux and UNIX devices are premium items. They are > often servers which have higher availability and better > bandwidth capabilities, and they aren't as likely to be > scanned for malware. > * The underground economy in this area isn't about barter, it is > about real money. Transactions for access to compromised > devices may take the form of such things as the exchange of > stolen credit card details or compromised online payment > accounts. > * There are enough people out there who will actually buy > something as a result of being spammed to make the activity > worthwhile for the perpetrators. The rate is low, but so is > the cost to the spammer. > > An area I heard frequently discussed was the frustration about > dealing with the sources of spam. The source networks of a majority > of spam activity appeared to be well known. Some recent news stories > may help to confirm this as well. > > * FTC shuts down major spam network > * Spam Volumes Plummet After Atrivo Shutdown > > I attended an interesting presentation about SMS spam. The > presentation included "return on investment" estimates based on > cases of SMS spam which suggest that medium may already be > attractive to spammers. MAAWG presentations are not posted in a > publicly available location so I can't provide a link to the exact > numbers here. However this medium as a target for spam should not be > surprising given the large number of people accessible by SMS. > (Wikipedia claims that SMS text messaging is the most widely used > data application on the planet, with 2.4 billion active users) One > message I would take away from this is that spam is a business. > Spammers will move to media other than email if the right conditions > exist to make it profitable. > > Many of the presentations at MAAWG applied much more widely than > just to email spam and would be of interest to many people in the > information security business. MAAWG is currently evaluating how > they might contribute in areas such as the potential abuse of > Internet telephony. Should the value/opportunity conditions arise to > make SPIT profitable groups like MAAWG may have a lot of insight to > offer in the area of voice security. > > Stephan Varty, CISSP, CEH > Security Vulnerability Analyst > Nortel > _______________________________________________ Rucus mailing list Rucus@ietf.org https://www.ietf.org/mailman/listinfo/rucus From rucus-bounces@ietf.org Fri Oct 31 04:22:28 2008 Return-Path: X-Original-To: rucus-archive@ietf.org Delivered-To: ietfarch-rucus-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B28AB28C37E; Fri, 31 Oct 2008 04:22:28 -0700 (PDT) X-Original-To: rucus@core3.amsl.com Delivered-To: rucus@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F53328C2EB for ; Fri, 31 Oct 2008 04:22:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.36 X-Spam-Level: X-Spam-Status: No, score=-5.36 tagged_above=-999 required=5 tests=[AWL=1.239, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HfybN464bZXw for ; Fri, 31 Oct 2008 04:22:26 -0700 (PDT) Received: from demumfd001.nsn-inter.net (demumfd001.nsn-inter.net [217.115.75.233]) by core3.amsl.com (Postfix) with ESMTP id 7836C3A6A9B for ; Fri, 31 Oct 2008 04:22:23 -0700 (PDT) Received: from demuprx017.emea.nsn-intra.net ([10.150.129.56]) by demumfd001.nsn-inter.net (8.12.11.20060308/8.12.11) with ESMTP id m9VBMK8f020951 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Fri, 31 Oct 2008 12:22:20 +0100 Received: from demuexc022.nsn-intra.net (webmail.nsn-intra.net [10.150.128.35]) by demuprx017.emea.nsn-intra.net (8.12.11.20060308/8.12.11) with ESMTP id m9VBMKHw023136 for ; Fri, 31 Oct 2008 12:22:20 +0100 Received: from demuexc024.nsn-intra.net ([10.159.32.11]) by demuexc022.nsn-intra.net with Microsoft SMTPSVC(6.0.3790.3959); Fri, 31 Oct 2008 12:22:20 +0100 Received: from FIESEXC007.nsn-intra.net ([10.159.0.15]) by demuexc024.nsn-intra.net with Microsoft SMTPSVC(6.0.3790.3959); Fri, 31 Oct 2008 12:22:19 +0100 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Fri, 31 Oct 2008 13:22:26 +0200 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Interim Meeting in Malta Thread-Index: Ack7SvREUR93qHMqTLG77P7B/CX+rA== From: "Tschofenig, Hannes (NSN - FI/Espoo)" To: X-OriginalArrivalTime: 31 Oct 2008 11:22:20.0015 (UTC) FILETIME=[F03147F0:01C93B4A] Subject: [Rucus] Interim Meeting in Malta X-BeenThere: rucus@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Reducing Unwanted Communication Using SIP \(RUCUS\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: rucus-bounces@ietf.org Errors-To: rucus-bounces@ietf.org Saverio suggested to use the interim meeting in Malta to discuss RUCUS. This is an interesting idea. Who would be willing to show up there? Ciao Hannes PS: The request for creating an EG is with Cullen and Jon. Hope to hear some positive news soon. _______________________________________________ Rucus mailing list Rucus@ietf.org https://www.ietf.org/mailman/listinfo/rucus From rucus-bounces@ietf.org Fri Oct 31 09:19:17 2008 Return-Path: X-Original-To: rucus-archive@ietf.org Delivered-To: ietfarch-rucus-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E083A3A6DB2; Fri, 31 Oct 2008 09:19:17 -0700 (PDT) X-Original-To: rucus@core3.amsl.com Delivered-To: rucus@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 36D903A682A for ; Fri, 31 Oct 2008 09:19:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1kfknIp3MMHg for ; Fri, 31 Oct 2008 09:19:15 -0700 (PDT) Received: from voxeo.com (mmail.voxeo.com [66.193.54.208]) by core3.amsl.com (Postfix) with SMTP id C9D673A6DB7 for ; Fri, 31 Oct 2008 09:18:50 -0700 (PDT) Received: from [66.65.228.203] (account dyork HELO pc-00144.lodestar2.dyndns.org) by voxeo.com (CommuniGate Pro SMTP 5.2.3) with ESMTPSA id 36252910; Fri, 31 Oct 2008 16:18:49 +0000 Message-Id: From: Dan York To: "Tschofenig, Hannes (NSN - FI/Espoo)" In-Reply-To: Mime-Version: 1.0 (Apple Message framework v929.2) Date: Fri, 31 Oct 2008 12:18:47 -0400 References: X-Mailer: Apple Mail (2.929.2) Cc: rucus@ietf.org Subject: Re: [Rucus] Interim Meeting in Malta X-BeenThere: rucus@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: "Reducing Unwanted Communication Using SIP \(RUCUS\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: rucus-bounces@ietf.org Errors-To: rucus-bounces@ietf.org On Oct 31, 2008, at 7:22 AM, Tschofenig, Hannes (NSN - FI/Espoo) wrote: > Saverio suggested to use the interim meeting in Malta to discuss > RUCUS. > This is an interesting idea. > > Who would be willing to show up there? DY> I would doubt that I would be able to get to Malta for an interim, but I'd be glad to participate remotely. Regards, Dan -- Dan York, CISSP, Director of Emerging Communication Technology Office of the CTO Voxeo Corporation dyork@voxeo.com Phone: +1-407-455-5859 Skype: danyork http://www.voxeo.com Blogs: http://blogs.voxeo.com http://www.disruptivetelephony.com Build voice applications based on open standards. Find out how at http://www.voxeo.com/free _______________________________________________ Rucus mailing list Rucus@ietf.org https://www.ietf.org/mailman/listinfo/rucus