Methods for Stopping Spam James Lick

The Problem AOL blocks 780,000,000 spams each day (Feb 2003) I am sent ~900 spams each day (Jan 2003)

Methods for Stopping Spam ● Security ● Policy Enforcement ● Blocking ● Filtering ● Avoidance

Disclaimer No method will block all spam Every method will sometimes block real mail Spammers always get more aggressive These tools are just a sample Combining tactics works best Blocking/Filtering hides extent of problem

Security ● Make sure you aren't part of the problem ● Check infrastructure and customers: – Open relays – Open proxies – Use of latest security patches ● A lot of spam is sent through security holes ● Notify authorities for extreme cases

Policy Enforcement ● Have a reasonable AUP ● Have users agree to it (legal contract) ● Enforce it! – This is a contract, lack of spam law is no excuse – Don't give second chances too easily ● Respond to complaints

Policy Enforcement (cont) ● If you get a reputation of soft on spam: – You will get more spamming customers! – Your mail will be blocked more and more – You lose customers – You go out of business ● The earlier you address problems, the easier it is to solve ● Policy enforcement is an ongoing responsibility

Blocking ● Bad sender address ● Spam Source lists ● Open Relay lists ● Open Proxy lists ● Dialup/Dynamic IP lists ● Other ● Local blocks

Bad sender ● Most spam is sent with forged sender ● Look up sender domain – Reject message if it doesn't exist – Defer message if lookup fails ● Supported by most mail servers ● Default in modern sendmail ● You can also check sending hostname, but this is not reliable as spam sign

Spam Source lists ● Lists IP addresses which belong to spammers ● MAPS RBL ( ● Spamhaus BL ( ● Sometimes widens block to whole networks, but usually in extreme cases

Open Relay lists ● Blocks mail from old servers which allow anyone to send mail through them ● MAPS RSS ( ● ORDB ( ● Can block real mail from insecure sites ● Sometimes listings are based on old information

Open Proxy lists ● Blocks mail from insecure open proxies ● OPM ( ● Usually doesn't block any real mail ● Most lists incomplete – finding open proxies is hard

Dialup/Dynamic IP lists ● Blocks direct mail from dialups and dynamic IP addresses ● Be sure to whitelist your own customers! ● Dynamic clients should use ISP mail server to send mail ● SMTP MSP can be used to send mail remotely safely ● Usually does not block real mail

Dialup/Dynamic IP lists (cont) ● MAPS DUL ( ● PDL ( ● Dynablock (basic.wirehub.nl/dynablocker.html)

Other ● As spammers get more aggressive, anti-spammers get more aggressive in blocking ● Blocking is often done by: – Any IP sending any spam ever – Countries/regions perceived as soft on spam – Networks perceived as soft on spam – Faulty methods of identifying spam – Other forms of 'spite' listings

Other (cont) ● Most of these methods are not used widely ● As spam problem gets worse, these methods may become more widespread. ● Before using a blocking service – Make sure their policies match your expectation – Make sure it is reputable – Test it out first

Local blocks ● Setup your own local blocks (access_db, local dnsbl) ● Requires diligence and upkeep ● Do it only if you can devote resources to it every day! ● Better yet, get involved with contributing to public blocking lists

Filtering ● Analyze content, not where it came from – Pattern matching – Bulk detection

Pattern Matching ● Spams have common 'spam signs' – Common types of header forgery – Common disclaimers – Common wording of sales pitch – Garbage strings, header style, etc. ● Filters can detect and score based on how many spam signs are in a message

Spam Assassin ( ● Has a set of rules, each with a score ● If a message scores over a threshold, marked as spam ● Can also use bulk detection, blocking lists ● Uses a lot more CPU – Can scale to large mail loads by using a cluster of cheap servers running SA's spamd ● Can be run on a client system too

Spam Assassin 2.50 ● Just out! ● Adds Bayesian filtering ● Bayesian filtering statistically analyzes what content shows up in spam more often than real mail ● For best results, needs training on what is and isn't spam ● SA 2.50 auto-trains based on SA scoring

Bulk Detection ● Razor (razor.sourceforge.net) aka SpamNet ( ● DCC ( ● Reliably detects messages sent in bulk ● Razor designed to detect unsolicited bulk ● Not perfect, sometimes blocks large mailing lists (recently Crypto-Gram)

Avoidance ● Try not to expose addresses – Don't publish user directories – Give users help and tools to do filtering ● Advise users – Use spam filtering software (in addition to ISP) – Don't give out address freely – Use disposable addresses – Change addresses periodically

Q&A Questions Answers Discussion