Team Excel What is SPAM ?
Team Excel
What is SPAM ?
Spam Offense Team Excel
'‘a distinctive chopped pork shoulder and ham mixture''
Image Source:Appscout.com
Emails Misdirected into Honeypot
The domain name used in the study honeypot is not given
Opportunity for legitimate mail due to “typos”
Examples: [email protected] [email protected] [email protected] [email protected]
Image Source: Apple.com
Typos can happen!
Primary Country Data is Misleading
Number of SMAM messages is not normalized against number of legitate messages
While China has a large number of SPAM messages, it also has the 2nd largest number of online Internet users
SPAM is a problem in China AND the U.S.
Example: Internet Population
Table 1: Top Spam Networks
Source: InternetWorldStats.com
Route Stability
Route stability to determine whether or not a message is spam will be difficult and may result in false positives.
The short lived IP subnets, could be due to flapping of Internet links in which BGP is flushing/adding/then flushing the route.
Global Internet Threat The Backhoe Fiber Map Route Frequency
Source: Wired.com and Benmautner.com
Black Lists
Blacklisting an entire AS runs the risk of blocking legitimate traffic and/or legitimate email
Blocking an IP address or group of IPs, especially in the case when NAT is used, could result in blocking legitimate mail
Image Source: Bonq.org
Email ISP Selection
The trace file of "legitimate email" from an ISP could be partial to particular ISPs, depending on who the customers of the ISP communicate with
The demographics of the sample data may play a part in why email is seen from certain ISPs
Comparing "legitimate email" from an ISP, provides little value in comparison to the "SPAM email" sample
Incomplete Data by Country
The data is not normalized. Saying Korea and China produce the most SPAM, may be true, however the total amount of email messages processed (both good and SPAM) is not given
It is possible China produces 10 times more email than other countries since the population is much higher
When normalized it is possible the percent of SPAM vs. non-SPAM is lower in China than other countries
DNS registration Methodology
Using DNS name lookup only to collect spam limits the scope and type of spam received, such as mail received from Harvesters and mailing lists, thus limiting spammer capability types.
BotNet
The generalization of Bobax data across all botnets will generate misleading results
Behavior may be different
Spammers sending limited messages
The conclusion that hosts send finite messages to the sinkhole may be a symptom of the behavior of the sinkhole rather than the behavior of the botnet
Route based spam detection
Route based spam detection is limited correlating route behavior to spam
There are many reasons for short lived routes, so detection of spam by detecting short lived routes will need to be used in conjunction with other methods to detect spam
Spam Filters
What is the likely-hood of network level filters blocking legitimate e-mail?
What if a corporation makes a change to their MX records – will their technique cause issues?
Most corporate filters allow some spam through vs. risk blocking legitimate e-mail
Destination Security
The results of the study could be flawed due to security measures on the Internet
The researchers attempts to trace back to hosts, may have been blocked by access-lists on routers, and/or firewalls
It is also conceivable the "hijack" of the botnet they performed may of caused other ISPs to "blacklist" the researchers thinking they were possible Spammers
Intelligent Spammers
Study assumes that spamming technology is static
Spammers continually adjust tactics to minimize the effectiveness of new efforts of screening
The SPAM Offensive Team
Glenn Allison
Bryan “BDT” Tabiadon
Joe Mathew
Dan Hoadley Raj Varma
Michael Ehrenhofer
Thank you
VOTE
OFFENSE