28th March 2003 SPAM Presenter: Matthew Sullivan

28th March 2003 What is SPAM...? Spiced Ham UCE (Unsolicited Commercial )..? UBE (Unsolicited Bulk )..?

28th March Austin, Minnesota, in 1937 Hormel Foods. A spicy ham packaged in a ‘handy dandy’ 12-ounce can. Sixty years later, it's still going strong. More than 5 billion cans have been sold. ‘Spam’ or ‘spam’ is the term that should be used to describe unwanted Internet . SPAM is a Registered Trademark of Hormel Foods

28th March 2003 So why did bad get named after a canned meat product? and the notorious Monty Python Gang The Green Midget Café in Bromley … A bunch of loud Vikings...

28th March 2003 Remember SPAM is pronounced: Thank you “A Trademark of Hormel Foods”

28th March 2003 Spam Presenter: Matthew Sullivan

28th March 2003 UBE, UCE or Spam? UBE (Unsolicited Bulk ) UCE (Unsolicited Commercial ) Any Unsolicited or Any Unwanted …?

28th March 2003 What Can be done...? What Should be done...? What can we do as endusers…? What can we do as admins…? What can the law do…?

28th March 2003 Filters Content filters Content filters Baysian Filters Baysian Filters Server side Filters Server side Filters Client side Filters Client side Filters The DELETE key The DELETE key

28th March 2003 Content Filters False Positives Keyword filtering Detecting False Headers Spamassassin - Spamassassin - SpamCop -

28th March 2003 DCC - Distributed Checksum Clearinghouses Vipul's Razor - SpamNet Content Filters

28th March 2003 Bayesian Filters How do they work? Do they really work? Filter projects…

28th March 2003 Blocklists Used to Block or Filter...? Access files or DNSbls..? Which DNSbl...? Do you create your own…?

28th March 2003 DNSbls SPEWS - Spam Prevention Early Warning System SORBS - Spam and Open Relay Blocking System DSBL - Distributed Server Boycott List ORDB - Open Relay DataBase NJABL - Not Just Another Bogus List MAPS - Mail Abuse Prevention System ROKSO - Register Of Known Spam Operations SBL - Spamhaus Block List

28th March 2003 SPEWS Spam Prevention Early Warning System Lists Spammers as they are spotted. Lists Spammers as they are spotted. Lists ISPs who refuse to disconnect Spammers. Lists ISPs who refuse to disconnect Spammers. Good for finding spam history of a Spammer. Good for finding spam history of a Spammer. 3 Levels of blocking.. 3 Levels of blocking.. Level 0 - Spammer gone. Watching… (Not in DNS) Level 0 - Spammer gone. Watching… (Not in DNS) Level 1 - Spammer or blatant spam supporter Level 1 - Spammer or blatant spam supporter Level 2 - All Level 1 plus ‘suspicious’ hosts. Level 2 - All Level 1 plus ‘suspicious’ hosts.

28th March 2003 SORBS Spam and Open Relay Blocking System Is Software that automatically blocks incoming connections. Is Software that automatically blocks incoming connections. Lists Open Proxies and Open Relays Lists Open Proxies and Open Relays Lists Hacked Servers Lists Hacked Servers Lists vulnerable scripts (eg. formmail.pl) Lists vulnerable scripts (eg. formmail.pl) Lists Spammers when spam is received. Lists Spammers when spam is received. Lists ISPs after 3 separate spams are received from Lists ISPs after 3 separate spams are received from the spam spammer or ISP. the spam spammer or ISP. More Later on SORBS

28th March 2003 DSBL Distributed Server Boycott List Lists Open Proxies and Open Relays Lists Open Proxies and Open Relays Lists Hacked Servers Lists Hacked Servers Lists vulnerable scripts (eg. formmail.pl) Lists vulnerable scripts (eg. formmail.pl) Lists Servers sending to Lists Servers sending to Does not perform any testing Itself. Does not perform any testing Itself.

28th March 2003 ORDB Open Relay DataBase Lists verified Open Relays Lists verified Open Relays

28th March 2003 NJABL Not Just Another Bogus List Lists Open Proxies and Open Relays Lists Open Proxies and Open Relays Lists Hacked Servers Lists Hacked Servers Lists vulnerable scripts (eg. formmail.pl) Lists vulnerable scripts (eg. formmail.pl) List Dial-Up/Dynamic Netblocks. List Dial-Up/Dynamic Netblocks. Lists spammers as they send spam to NJABL spamtraps Lists spammers as they send spam to NJABL spamtraps

28th March 2003 MAPS Mail Abuse Prevention System RBL List - Real-Time Blackhole RBL List - Real-Time Blackhole DUL List - Dialup User List (Modem pool Address blocks) DUL List - Dialup User List (Modem pool Address blocks) RSS List - Relay Spam Stopper (Spam relaying Servers) RSS List - Relay Spam Stopper (Spam relaying Servers) Subscription required (Educational Rates Available). Subscription required (Educational Rates Available). Attempts to ‘educate’ spammers & ISPs into stopping spam. Attempts to ‘educate’ spammers & ISPs into stopping spam. Have judgements against them NOT to list some networks. Have judgements against them NOT to list some networks.

28th March 2003 ROKSO Register Of Known Spam Operations Lists Spammers. Lists Spammers. Lists Spam Support Services Lists Spam Support Services Lists Spam gangs Lists Spam gangs Criteria for listing is that the spammer has been Criteria for listing is that the spammer has been identified as being ejected from at least 3 ISPs for spamming.

28th March 2003 SBL Spamhaus Block List Lists Spammers. Lists Spammers. Lists Spam Support Services Lists Spam Support Services Lists Spam gangs Lists Spam gangs Lists other spam sources (like proxies) though this is Lists other spam sources (like proxies) though this is activly published.

28th March 2003 Enduser Filters Spam Killer - Mail Washer - Spam Eater - Microsoft Outlook Express - SpamPal - Mozilla -

28th March 2003 Questions?

Thank You Presenter: Matthew Sullivan