Announcements Blog Projects Next class: spam infrastructure Next next class: Dave Aucsmith 1

Class Blog! (courtesy Chris Kanich) Please register (available via the syllabus page) Use it to: u Follow-up on discussions in class u Post interesting Internet crime-related stuff you find Class requirement u Over the course of the quarter, everyone should contribute at least one thoughtful post u Topics could include »New scams you’ve encountered personally »Summary/discussion of interesting stories from online news/blog sites (I’ve posted a list of cyber-crime relevant blogs) »Your own analysis, experiments, thoughts on the readings 2

Class projects For those of you taking the class for four units Solo or group (up to 3 people) Deliverable is minute class presentation u We’ll probably schedule it during the finals period Topic up to you, but you should discuss with me Try to decide topic within next two weeks so I can help you with resources, refining, etc In my experience a couple of these each year are publishable 3

Some assets UCSD specific u Spam feed (lots and lots of spam) u Spamscatter database (ip chains and rendered pages of spam urls) u Storm target addresses (hundreds of millions) u People with some experience (Chris, Brandon, Kirill) Phishtank (reported phishing sites) URIBL (domains that appear in spam) Blacklist sites (jizzillions) Spamtrackers.eu (identifies different spammers/gangs) (browse the forums) 4

Random topic ideas Phishing site detection via logo matching (taken) Measuring site “cloaking” u Different answers based on user-agent string or IP Literature review of MC/Visa transaction protection u E.g., how does the encrypted PIN block get created? Weaknesses? Human factors experiment on phishing u Importance of envelope context vs link info vs site appearance in risk judgment Spam domains? u Mine spam url domains (e.g. via uribl) and look at whois records to characterize… patterns to domain naming, registrar, etc? How long live? 5

More random ideas Compare overlap between blacklist feeds Build software to “feed” data to form grabber spyware and validate that it works with real spyware Investigate HYIP fraud and write report Characterize generation process for Storm mailing list Document and explain the “wholesale” traffic delivery business (e.g. mediatraffic.com) and the PTC/PTR businesshttp:// See if you can detect vote fraud in youtube (ala youtube automator) Do something interesting to analyze Blogspam Get a copy of PRStorm and explain how/why it works… 6

Next classes 10/16: Spam infrastructure u Geoff Voelker is guest interlocutor 10/21: David Aucsmith (Microsoft) u What we know, how we know what we know, and what we do with the information u Navy -> Intel (chief security arch) -> Microsoft (CTO security biz unit), now Sr. Director MS Institute for Adv Tech in Govts u NSA advisory board, Co-chair of FBI IT study group, Secret Service task force on computer-aided counterfeiting, US industry rep to the G8 on high tech crime, etc… 7