1. Spam May 15 2006 CS239

2. Taxonomy E-mail (UBE)  Advertisement  Phishing Webpage  Content  Links From: Thrifty Health-Insurance Mailed-By: noticeoption.comReply-To: Thrifty Health-Insurance To: richard.sia@gmail.com Date: May 10, 2006 9:30 PM Subject: No obligation Health Insurance Quotes Great health insurance quotes. Get a quote from us and let local agents compete for your business. Health insurance is more affordable than you think. Health Plans Dental Plans Prescription Plans Vision Plans and more Check out the lowest rates in the industry. http://www.cuffseetotal.com/healthy27/ This email is a commercial message. …………. http://www.cuffseetotal.com/healthy27/

3. How worse is the situation 30-40% mail traffic are spam End-user  Waste time reading junk (may fall in trap)  ~1 billion productivity lost per year System operator  Increased running cost

4. Why people spam? Economic incentive  Effectiveness = sent x (1-P filtered ) x P read x P clickthrough Business strategy?

5. How spammer collect e-mails UseNet Web pages Registration forms Dictionary attacks

6. Defense mechanism Authentication Challenge/response system DNSxL Check-sum based filtering Statistical filtering Micro-payment Spam poisoning A brand new architecture

7. Authentication Avoid forged sender address  SMTP AUTH Verify sender is a legitimate user  Sender Policy Framework (SPF) Verify sender’s IP corresponds to the domain

8. Challenge/response system Work together with white list  Only sender in the contact list can get through  If not, a challenge is posted to the sender  Ensure sender is a human instead of a program

9. DNSxL Block list  A list of IP/domain observed to be sending out spam consistently  use DNS to distribute the list  Similar to reverse DNS lookup White list  Similar idea but work in the other way

10. Check-sum based filtering Collaborative filtering  Distributed Checksum Clearinghouse (DCC)  Vipul’s Razor  Brightmail A checksum is computed for a spam reported The list is consistently updated and distributed

11. Statistical filtering 2-class text classification problem  Words, phrases  Training samples  Adaptive

12. Statistical filtering False positive Classified junk Classified legitimate Total Acutally junk36945 Actually legitimate 3 174177 Total39183222

13. Payment Increase the cost of spammers Micro-payment / e-cash “Computational” payment  HashCash (SHA-1) X-Hashcash: 1:20:060408:adam@cypherspace.org::1QTjaYd7niiQA/sc:ePa Takes 1 second to generate Takes 1 microsecond to verify (both on 1GHz machine)  CAMRAM

14. Spam poisoning Expose e-mail address in human-readable format  user@exampleREMOVETHIS.com user@exampleREMOVETHIS.com Generate fake e-mail dynamically by CGI script Create e-mail addresses to harvest spam e-mails (similar to honeypot)

15. New architecture Internet Mail 2000  Pull based  Sender’s ISP responsible for storing e-mails  Receiver gets a notification only  A global deployment is unlikely anytime in the near future

16. How spammer response? Append random string at the end of each spam e-mail Improve spambot to filter characters used in spam poisoning Use worms to infect e-mail client programs Analyze user’s e-mail pattern