I'm glad to see this being addressed, particularly in light of the use of targetted viruses sent specifically to activist mailing lists (which is, of course, a slightly different issue). In the past this mostly seems to be around Chinese/Tibetan issues, but it's probably useful to start thinking about mailing list security more broadly.
On 23 April 2013 06:45, Michael Allan <[email protected]> wrote: > To the experts in Liberationtech, Air-L and Mailman lists, > (cc General Counsel of Stanford University) > > Stanford University has configured the Liberationtech mailing list in > a manner that is potentially unsafe. University staff are aware of > the problem and are evalutating the situation, but have yet to take > action. I'm a subscriber to the list, and I ask your advice. > > > SITUATION > > The Liberationtech mailing list is run by Stanford University in > connection with its Program on Liberation Technology. That program > investigates the use of IT "to defend human rights, improve > governance, empower the poor, promote economic development, and > pursue a variety of other social goods." [1] Experts on the list > advise and inform on matters such as encrypting communications, > protecting infrastructure from cyber attack, and protecting onself > from personal danger. Often those seeking help are in vulnerable > situations. They include aid workers, reporters and activists who > live and work in environments where human rights are not well > respected, or where the government is too weak to protect people > from organized criminals, rival militias, and so forth. > > The list software is GNU Mailman. The administration interface > includes the following configuration items: [2] > > (a) Should any existing Reply-To: header found in the original > message be stripped? If so, this will be done regardless of > whether an explict Reply-To: header is added by Mailman or > not. > > X No > - Yes > > (b) Where are replies to list messages directed? Poster is > *strongly* recommended for most mailing lists. > > X Poster > - This list > - Explicit address (c) _________ > > Shown above is the default, recommended setting of (1 No, 2 Poster). > It leaves the sender's Reply-To headers (if any) unaltered during > mail transfer. Instead of this, the Liberationtech mailing list is > configured as follows: > > (b) Where are replies to list messages directed? Poster is > *strongly* recommended for most mailing lists. > > - Poster > X This list > - Explicit address (c) _________ > > With this setting, whenever a subscriber Q sends a message to the > list, the software adds a Reply-To header pointing to L, which is > the address of the list itself. The message is then passed on to > the subscribers. The meaning of the added Reply-To header is, "Q > asks that you reply to her at L." [3] > > Note that this is false information; Q does not ask that. > > > EXAMPLE OF DANGER > > Matt Mackall has suggested that, "here of all places", people might > get hurt as a consequence of this configuration [4]. I agree. > Here's a brief example of how people might get hurt: > > 1. Subscriber P is in a vulnerable situation. P is distacted by > the situation and is not getting a lot of sleep. > > 2. P asks the mailing list for advice on the situation, because > that's the purpose of the list. > > 3. Subscriber Q replies with helpful information. > > The mailing list adds a Reply-To header to Q's message that > points to address L. Again, the mis-information is, "Q asks > that you reply to her at L". [3] > > 4. P replies with private information, including (as Matt puts it) > a "potentially life-endangering datum". Tired and distracted, > P replies by hitting the standard Reply button. In the mail > client, this means "reply to Q". > > The reply goes instead to L, which is the public mailing list. > > Oh my god! What have I done! > > 5. People get hurt. > > Isn't this a danger? > > > POSSIBLE EXPLOIT THAT INCREASES THE DANGER > > Suppose that P is actually a police operative in an authoritarian > state, or a criminal operative in a failed state. He only pretends > to be a vulnerable activist (say). His real aim is to hurt the > activists and other opponents; damage the university's reputation; > close down the mailing list; make democracy look foolish [5]; and > finally make some money in the bargain [6]. The likelihood of his > success is roughly proportional to the amount of harm suffered by > the activists and other innocent people. > > If such an exploit were even *perceived* to be feasible, then the > mis-configuration of the mailing list would not only be exposing the > public to a haphazard danger, but also providing the means and > incentive to orchestrate and amplify that danger. > > Might not this exploit be perceived as feasible? > > > INTERIM RECOMMENDATION > > While Stanford University is evaluating these safety concerns and > has yet to make a decision, it should return the configuration to > its default setting. The default setting is known to be safe. > > -- > Michael Allan > > Toronto, +1 416-699-9528 > http://zelea.com/ > > > NOTES > > [1] https://mailman.stanford.edu/mailman/listinfo/liberationtech > http://liberationtechnology.stanford.edu/ > > [2] The meaning of configuration variables (a,b,c) is defined here: > http://www.gnu.org/software/mailman/mailman-admin/node11.html > > [3] 'The "Reply-To" field is added by the message originator and is > intended to direct replies.' Section 4.4.3, RFC 822. > http://www.ietf.org/rfc/rfc0822.txt > > Note that the mailing list is not the "message originator", and > is not supposed to add a Reply-To header. It is mis-configured. > > [4] Matt Mackall originally pointed to the danger in this post: > > https://mailman.stanford.edu/pipermail/liberationtech/2013-March/007762.html > > [5] The current configuration of the mailing list was approved by > the subscribers in a vote. > > https://mailman.stanford.edu/pipermail/liberationtech/2013-March/007973.html > > [6] America is a litigious society. > _______________________________________________ > The [email protected] mailing list > is provided by the Association of Internet Researchers http://aoir.org > Subscribe, change options or unsubscribe at: > http://listserv.aoir.org/listinfo.cgi/air-l-aoir.org > > Join the Association of Internet Researchers: > http://www.aoir.org/ >
-- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at [email protected] or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
