Spam Sonia Jahid University of Illinois Fall 2007

2 Outline Definition Problem Spam Categories How works: quick overview Why is spam still a problem? Spammers’ approach

3 Definition Submitting the same message to a large group of individuals in an effort to force the message onto people who would otherwise choose not to receive this message. A message is spam only if it is both Unsolicited and Bulk. –Unsolicited is normal (examples: first contact enquiries, job enquiries, sales enquiries) –Bulk is normal (examples: subscriber newsletters, customer communications, discussion lists) What is spam: SpamLawsWhat is spam: Spamhaus

4 Problem MAAWG Metrics Report 07 The statistics reported below are compiled from confidential data provided by participating MAAWG member service operators for Q1 2007

5 Spam Categories Products25% Financial20% Adult19% Scams9% Health7% Internet7% Leisure6% Spiritual4% Other3% Evett 06 According to information compiled by Spam filter review, spam for 2006 can be categorized as shown in the table

6 How Works: Quick Overview helo test 250 mx1.mindspring.com Hello abc.sample.com [ ], pleased to meet you mail from: Sender ok rcpt to: jsmith... Recipient ok data 354 Enter mail, end with "." on a line by itself from: subject: testing John, I am testing e1NMajH24604 Message accepted for delivery quit mx1.mindspring.com closing Connection Connection closed by foreign host. Brain

7 Why Is Spam Still a Problem? Spoofing – system design Headers allow spoofing –Identity concealing Bot-networks Open proxies Open mail relays Untraceable Internet connection –Available bulk tools Boneh 04

8 System Design SMTP protocol provides no security – is not private –can be altered en route –no way to validate the identity of the source Use SMTP-AUTH ? –Not a solution for spam SMTP-AUTH

9 System Design Headers are unreliable, can be used for spoofing –Insert fictitious addresses in the From: lines –Exception: first Received header Received: from unknown (HELO ) ( ) by mail1.infinology.com with SMTP; 16 Nov :50: Received: from [ ] by id ; Sun, 16 Nov :38: MS: Mail Server Tschabitscher

10 How Works: Quick Overview helo test 250 mx1.mindspring.com Hello abc.sample.com [ ], pleased to meet you mail from: Sender ok rcpt to: jsmith... Recipient ok data 354 Enter mail, end with "." on a line by itself from: subject: testing John, I am testing e1NMajH24604 Message accepted for delivery quit mx1.mindspring.com closing Connection Connection closed by foreign host. Brain

11 Identity Concealing: Bot-networks Compromised machines running malicious software Once infected, spammer can send spam from it The bot software hides itself and periodically checks for instructions from the human bot- network administrator s appear to come from legitimate users Example bot-networks: –Phatbot: largest reported bot-network to date, 400,000 drones –Bobax: assimilates machines with high speed Internet connection

12 Identity Concealing: Open Proxies An open proxy is one which will create connections for any client to any server, without authentication Possible for a computer to be running an open proxy server without knowledge of the computer's owner More difficult to detect when chain of open proxies used

13 Identity Concealing: Open Mail Relays An server configured to allow anyone on the Internet to relay through it. Network address of spammer appears in one of the Received: headers Add fake Received: headers

14 Combining Open Proxy and Open Relay Establish TCP connection with Open Proxy1 Connect with Open Proxy2 Send to Open Relay through this chain Forward to destination SMTP server Andreolini Bulgarelli Colajanni Mazzoni 05

15 Identity Concealing: Untraceable Internet Connection Public Internet cafes Free/stolen wireless connections Connections not needing identifying users Need not hide network address –Send directly to spam recipients –No way to associate accounts with the spammer

16 Available Bulk Tools Designed to generate and send about 500, 000 s per hour hiding spammers’ identity –Send-safe Search for open proxies, open relays Download updated list of open proxies Distribute load over multiple open proxies Periodically verify if open proxies working properly –Massiv er –Dark-mailer

17 Spammers’ Approach Gather address – harvesting from web –Gather address from newsgroups –DNS and WHOIS system –Buy data from 3 rd party Generally spam-bots used for harvesting What makes it easy? –Publish addresses Andreolini Bulgarelli Colajanni Mazzoni 05

18 Spammers’ Approach Verify address –A web bug in a spam message written in HTML may cause recipient’s client to transfer its address –Unsubscribing from a service Send messages anonymously

19 Reading List D. Boneh, The Difficulties of Tracing Spam , September 09, 2004The Difficulties of Tracing Spam M. Andreolini, A. Bulgarelli, M. Colajanni, and F. Mazzoni, HoneySpam: Honeypots fighting spam at the source, In Proc. USENIX SRUTI 2005, Cambridge, MA, July 2005.HoneySpam: Honeypots fighting spam at the source H. Tschabitscher, What Headers Can Tell You About the Origin of SpamWhat Headers Can Tell You About the Origin of Spam Spam on WikipediaWikipedia