The problems associated with operating an effective anti-spam blocklist system in an increasingly hostile environment. Robert Gallagher September 2004

Introduction and Overview > There is an increasing tendency for spammers to enlist the services of malware authors. > Spammers are finding sophisticated ways of sending bulk whilst concealing their identity. > Anti-spam systems are coming under frequent attack. > This practicum investigated the collaboration between spammers and malware authors and the threat this poses to anti-spam systems – specifically blocklists.

Blocklists > A list of IP addresses. > All these IP addresses have a common factor, they are usually associated with spam. > Criteria: Exploitable or poorly configured systems (Open Relays, Open Proxies), blocks of IP addresses under the control of a known spammer. > servers or anti-spam software can be configured to query a blocklist upon receipt of a message. > The most successful blocklists have strict guidelines for listing an IP address.

Spam and Malware > The frequency and severity of attacks on blocklist systems has vastly increased in recent times. > Such attacks have been characterised by the involvement of machines infected with trojans, viruses or worms – so-called ‘Zombie’ machines. > ‘Zombie’ machines act as spam relays, content hosts or DDoS agents.