Text 26327, 49 rader
Skriven 2015-07-29 06:47:04 av Matt Bedynek (1:19/10)
  Kommentar till text 26322 av Michiel van der Vlist (2:280/5555)
Ärende: Routing 200MB of echomail via an unsuspecting system
============================================================
Michiel,

Wednesday July 29 2015 12:48, you wrote to me:

 MV> The past is the past.

Not so fast.  I just confirmed with a simple test that a contemporary piece of
software still operates in this fashion - by design.  Squishmail was well known
to be among the best (free) tossers for hubbing.

 MV> Yes, there is a field for the destination address, albeit only 2D. So
 MV> if a (echo)mail processor ignores the AREA: XXX kludge and treats the
 MV> message as netmail, yes than it can be routed. Assuming there is a
 MV> valid address in de destination field.

I also found a potential issue in software that Mr. Felten runs.  Even if the
packet and message come from a secure link for a linked echo area the tosser
makes decision toss or forward based on destaddr.  If he has a netmail tracker
or made "fixes to code" not shared is irrelevant.

 MV> I would not just hope, but expect this to be an issue of the past.

 MV> Yes, you did. But others claim it is still possible today. There is
 MV> one among us who's name I shall not mention, who has the habit of
 MV> making claims based on outlandish scenarios. This may have some
 MV> entertainment value at first, but when repeated it becomes boring. It
 MV> becomes annoying when it degrades into a standard discussion tactic.

I disagree with being outlandish issue.  If I had demonstrated in similar
fashion a vulnerability in major operating system the vendor would either claim
it as documented feature or scramble to issue patch.   If squishmail failed to
annotate those messages was "** ECHOMAIL **" then I would assume it were bug. 
The software acted exactly as I remember from a time when my direct links alone
generated over 2000 messages a day.

 MV> I do not pounce on anyone. I just partcipate in an experiment that
 MV> provides those claiming they can route echomail, with an opportinity
 MV> to put their money where their mouth is.

A test on our individual systems disproves that echomail cannot be routed on
those systems.  It does not cover the wide array of software and interconnects
in place at this moment.

Take care,

Matt

---
 * Origin: The Byte Museum - An IPV6 Capable System (1:19/10)