Gold Country Computer Learning Center March 2007 Spam Roger Thornburn

Gold Country Computer Learning Center spam Roger Thornburn March What is Spam Needs to meet 2 requirements Unsolicited Bulk Name comes from a Monty Python skit Monty Python's spam video Monty Python's spam Mostly commercial 25% - Products20%- Financial 19% - Adult9%- Scams 7%- Health7%- Internet Not Spam: Jokes from friends Newsletters you signed up for

Gold Country Computer Learning Center spam Roger Thornburn March A Few Statistics Amount of Spam 90 Billion spam s a DAY (Feb 2007) Average of 50 spam s a day – per address 94% of all is spam Sources of Spam US – 23% China – 20% Russia -10% South Korea – 6% Surprise! 28% reply to spam 8% purchase from spam

Gold Country Computer Learning Center spam Roger Thornburn March Current Situation IP addresses last 4 hours June 2006 – 35M new domains, 32M not paid Hi jacked mail servers – listed as spammers Creates problem for legitimate users Use of “Zombie” PC’s and the Botnet Maybe 1 in 4 PC’s infected. Image spam Hard for a computer to read Hi growth from 0 to 25% of spam Getting your address Dictionary attackSpam bots (websites) Infected computersVendors/subscriptions

Gold Country Computer Learning Center spam Roger Thornburn March Spam Safety tips Encrypt your address (not in a dictionary) Use a fake address where possible Use bcc to send an to many people Don’t open spam and set Outlook Express to “Block images…..” Avoids confirming your Don’t reply to spam – again it confirms you’re real! Don’t post your address on a website. Uncheck all those “subscribe” boxes Unsubscribe from reputable companies only Use a spam filter

Gold Country Computer Learning Center spam Roger Thornburn March Spam Filtering Techniques Rules based Matches specific words in the To, From, Subject or Body of the Very specific – can only make an exact match Bayes filter/Fuzzy logic Uses a mathematical set of probabilities, gathered from being told what’s “spam” and what’s “ham” Needs to “learn” and kept up to date Black list Blocks specific “From” addresses. Not very effective today – new domain every 4 hours! Good for blocking family/friends or newsletters

Gold Country Computer Learning Center spam Roger Thornburn March Spam Filtering Techniques (cont.) On-line Database (DNSBL) Can work well - if accurate. Can easily stop legitimate s as well. Signature analysis for specific s White list List of addresses you will accept from Challenge/response systems Needs to be kept up-to-date Most effective method Important!: No spam filter is perfect. The worst thing is putting legitimate s in your Spam/Junk/Bulk mail folder. It’s essential to check this folder so you can receive your good , as well as train the filter.

Gold Country Computer Learning Center spam Roger Thornburn March Reducing Spam in Real Life! Different if using Web mail or POP mail Web mail is when you use your internet browser (Internet Explorer or Firefox, etc) to read and send your . POP mail is when you use an client (a program such as Outlook/Express, Thunderbird, Endura, etc.) to read and send your . With POP mail, the messages are downloaded to your computer – can be read and new ones composed, without beeing connected to the internet. To read or compose messages in Web mail, you must be connected to the internet Many accounts can be accessed by either/both

Gold Country Computer Learning Center spam Roger Thornburn March Web Mail All your stays on the Web mail server You have little control Large providers such as Yahoo, Google, Hotmail, etc. provide excellent spam filtering – using a combination of all the above techniques Any legitimate s in the spam/junk box, must be identified – now added to your white list Yahoo has AddressGuard Create a separate address for each person or class of persons Many of the smaller ISP’s/ providers, aren’t as sophisticated.

Gold Country Computer Learning Center spam Roger Thornburn March POP 3 Spam filter sits between the mail server and your client Many ISP’s or servers have own spam filter Yahoo (SBC, AT&T, Pacbell, etc.) use same as Web mail Can be harder to check spam folder – may need to configure Huge selection of programs – freeware to $$’s Use different techniques – either singly or in combination. Some are tightly integrated to the client

Gold Country Computer Learning Center spam Roger Thornburn March POP3/Outlook Express Examples Outlook Express –Rules Text matching – limited Good for White list – can import address book K-9 Freeware Uses Bayesian technology – so must train Plus has White list and Black list Regex filters for advanced users Easy interface – but not elegant Computer Associates ($30) White list Integrated to Outlook/Express – easy to use

Gold Country Computer Learning Center spam Roger Thornburn March More Examples MailWasherPro ($30) Freeware version available Combination of Bayes, White list, Black list, DNSBL, User filters and Signature Reviews on the server Spam is removed before download Save time with dial up Easy to use

Gold Country Computer Learning Center spam Roger Thornburn March Phishing Scams to trick users to reveal personal information Normally an official looking Directed to a fraudulent website Losses from phishing attacks: $137 million$2.8 billion # US adults who received at least one phishing 57 million 109 million Number of victims:53 thousand2.25 million Per-victim loss:$257 $1,244 Money recovered by consumers: 80% 54% Don’t click a link in an Call your bank or credit card company if suspicious Check the website is secure (

Gold Country Computer Learning Center spam Roger Thornburn March Useful Links Wikipedia Reference Links to resources and anti-spam filters More links to many anti spam resources (More spam filters) Review of some spam filters Freeware Bayes filter (plus White and Black list) Computer Associates anti spam program (Or Google ca spam). Paid, easy to use White list – integrates to Outlook Express. Mail Washer free and paid anti-spam versions. Uses multiple methods for detection Spam Butcher – fuzzy logic anti-spam

Gold Country Computer Learning Center spam Roger Thornburn March Summary Web mail Dependant on the ISP/Web mail provider Larger providers often provide configurable options Yahoo AddressGuard is a good solution MUST go into JUNK/BULK/SPAM folder to mark good s – regularly POP3 mail Most effective method is White list (or safe senders list) – but needed to be kept up-to-date. Using built in Rules of Outlook Express works fine Purchased product – often more convenient. Above all – Protect Your Address!!