[Air-L] (advice sought) Public safety and configuration of list

Sky Croeser scroeser at gmail.com
Mon Apr 22 22:31:19 PDT 2013


I'm glad to see this being addressed, particularly in light of the use of
targetted viruses sent specifically to activist mailing lists (which is, of
course, a slightly different issue). In the past this mostly seems to be
around Chinese/Tibetan issues, but it's probably useful to start thinking
about mailing list security more broadly.


On 23 April 2013 06:45, Michael Allan <mike at zelea.com> wrote:

> To the experts in Liberationtech, Air-L and Mailman lists,
> (cc General Counsel of Stanford University)
>
> Stanford University has configured the Liberationtech mailing list in
> a manner that is potentially unsafe.  University staff are aware of
> the problem and are evalutating the situation, but have yet to take
> action.  I'm a subscriber to the list, and I ask your advice.
>
>
> SITUATION
>
>   The Liberationtech mailing list is run by Stanford University in
>   connection with its Program on Liberation Technology.  That program
>   investigates the use of IT "to defend human rights, improve
>   governance, empower the poor, promote economic development, and
>   pursue a variety of other social goods." [1] Experts on the list
>   advise and inform on matters such as encrypting communications,
>   protecting infrastructure from cyber attack, and protecting onself
>   from personal danger.  Often those seeking help are in vulnerable
>   situations.  They include aid workers, reporters and activists who
>   live and work in environments where human rights are not well
>   respected, or where the government is too weak to protect people
>   from organized criminals, rival militias, and so forth.
>
>   The list software is GNU Mailman.  The administration interface
>   includes the following configuration items: [2]
>
>     (a) Should any existing Reply-To: header found in the original
>         message be stripped?  If so, this will be done regardless of
>         whether an explict Reply-To: header is added by Mailman or
>         not.
>
>          X  No
>          -  Yes
>
>     (b) Where are replies to list messages directed?  Poster is
>         *strongly* recommended for most mailing lists.
>
>           X  Poster
>           -  This list
>           -  Explicit address (c) _________
>
>   Shown above is the default, recommended setting of (1 No, 2 Poster).
>   It leaves the sender's Reply-To headers (if any) unaltered during
>   mail transfer.  Instead of this, the Liberationtech mailing list is
>   configured as follows:
>
>     (b) Where are replies to list messages directed?  Poster is
>         *strongly* recommended for most mailing lists.
>
>           -  Poster
>           X  This list
>           -  Explicit address (c) _________
>
>   With this setting, whenever a subscriber Q sends a message to the
>   list, the software adds a Reply-To header pointing to L, which is
>   the address of the list itself.  The message is then passed on to
>   the subscribers.  The meaning of the added Reply-To header is, "Q
>   asks that you reply to her at L." [3]
>
>   Note that this is false information; Q does not ask that.
>
>
> EXAMPLE OF DANGER
>
>   Matt Mackall has suggested that, "here of all places", people might
>   get hurt as a consequence of this configuration [4].  I agree.
>   Here's a brief example of how people might get hurt:
>
>     1. Subscriber P is in a vulnerable situation.  P is distacted by
>        the situation and is not getting a lot of sleep.
>
>     2. P asks the mailing list for advice on the situation, because
>        that's the purpose of the list.
>
>     3. Subscriber Q replies with helpful information.
>
>        The mailing list adds a Reply-To header to Q's message that
>        points to address L.  Again, the mis-information is, "Q asks
>        that you reply to her at L". [3]
>
>     4. P replies with private information, including (as Matt puts it)
>        a "potentially life-endangering datum".  Tired and distracted,
>        P replies by hitting the standard Reply button.  In the mail
>        client, this means "reply to Q".
>
>        The reply goes instead to L, which is the public mailing list.
>
>        Oh my god!  What have I done!
>
>     5. People get hurt.
>
>   Isn't this a danger?
>
>
> POSSIBLE EXPLOIT THAT INCREASES THE DANGER
>
>   Suppose that P is actually a police operative in an authoritarian
>   state, or a criminal operative in a failed state.  He only pretends
>   to be a vulnerable activist (say).  His real aim is to hurt the
>   activists and other opponents; damage the university's reputation;
>   close down the mailing list; make democracy look foolish [5]; and
>   finally make some money in the bargain [6].  The likelihood of his
>   success is roughly proportional to the amount of harm suffered by
>   the activists and other innocent people.
>
>   If such an exploit were even *perceived* to be feasible, then the
>   mis-configuration of the mailing list would not only be exposing the
>   public to a haphazard danger, but also providing the means and
>   incentive to orchestrate and amplify that danger.
>
>   Might not this exploit be perceived as feasible?
>
>
> INTERIM RECOMMENDATION
>
>   While Stanford University is evaluating these safety concerns and
>   has yet to make a decision, it should return the configuration to
>   its default setting.  The default setting is known to be safe.
>
> --
> Michael Allan
>
> Toronto, +1 416-699-9528
> http://zelea.com/
>
>
> NOTES
>
>   [1] https://mailman.stanford.edu/mailman/listinfo/liberationtech
>       http://liberationtechnology.stanford.edu/
>
>   [2] The meaning of configuration variables (a,b,c) is defined here:
>       http://www.gnu.org/software/mailman/mailman-admin/node11.html
>
>   [3] 'The "Reply-To" field is added by the message originator and is
>       intended to direct replies.'  Section 4.4.3, RFC 822.
>       http://www.ietf.org/rfc/rfc0822.txt
>
>       Note that the mailing list is not the "message originator", and
>       is not supposed to add a Reply-To header.  It is mis-configured.
>
>   [4] Matt Mackall originally pointed to the danger in this post:
>
> https://mailman.stanford.edu/pipermail/liberationtech/2013-March/007762.html
>
>   [5] The current configuration of the mailing list was approved by
>       the subscribers in a vote.
>
> https://mailman.stanford.edu/pipermail/liberationtech/2013-March/007973.html
>
>   [6] America is a litigious society.
> _______________________________________________
> The Air-L at listserv.aoir.org mailing list
> is provided by the Association of Internet Researchers http://aoir.org
> Subscribe, change options or unsubscribe at:
> http://listserv.aoir.org/listinfo.cgi/air-l-aoir.org
>
> Join the Association of Internet Researchers:
> http://www.aoir.org/
>



More information about the Air-L mailing list