Team Excel

1
Team Excel

• What is SPAM ?

2
Spam Offense Team Excel

• 'a distinctive chopped pork shoulder and ham
  mixture''

Image SourceAppscout.com
3
Emails Misdirected into Honeypot

• The domain name used in the study honeypot is not
  given
• Opportunity for legitimate mail due to typos
• Examples
• user_at_google.com
• user_at_gooogle.com
• user_at_go0gle.com
• user_at_googlw.com

Typos can happen!
Image Source Apple.com
4
Primary Country Data is Misleading

• Number of SMAM messages is not normalized against
  number of legitate messages
• While China has a large number of SPAM messages,
  it also has the 2nd largest number of online
  Internet users
• SPAM is a problem in China AND the U.S.

Table 1 Top Spam Networks
Example Internet Population
Source InternetWorldStats.com
5
Route Stability

• Route stability to determine whether or not a
  message is spam will be difficult and may result
  in false positives.
• The short lived IP subnets, could be due to
  flapping of Internet links in which BGP is
  flushing/adding/then flushing the route.

Global Internet Threat The Backhoe
Fiber Map Route Frequency
Source Wired.com and Benmautner.com
6
Black Lists

• Blacklisting an entire AS runs the risk of
  blocking legitimate traffic and/or legitimate
  email
• Blocking an IP address or group of IPs,
  especially in the case when NAT is used, could
  result in blocking legitimate mail

Image Source Bonq.org
7
Email ISP Selection

• The trace file of "legitimate email" from an ISP
  could be partial to particular ISPs, depending on
  who the customers of the ISP communicate with
• The demographics of the sample data may play a
  part in why email is seen from certain ISPs
• Comparing "legitimate email" from an ISP,
  provides little value in comparison to the "SPAM
  email" sample

8
Incomplete Data by Country

• The data is not normalized. Saying Korea and
  China produce the most SPAM, may be true, however
  the total amount of email messages processed
  (both good and SPAM) is not given
• It is possible China produces 10 times more email
  than other countries since the population is much
  higher
• When normalized it is possible the percent of
  SPAM vs. non-SPAM is lower in China than other
  countries

9
DNS registration Methodology

• Using DNS name lookup only to collect spam limits
  the scope and type of spam received, such as mail
  received from Harvesters and mailing lists, thus
  limiting spammer capability types.

10
BotNet

• The generalization of Bobax data across all
  botnets will generate misleading results
• Behavior may be different

11
Spammers sending limited messages

• The conclusion that hosts send finite messages to
  the sinkhole may be a symptom of the behavior of
  the sinkhole rather than the behavior of the
  botnet

12
Route based spam detection

• Route based spam detection is limited correlating
  route behavior to spam
• There are many reasons for short lived routes, so
  detection of spam by detecting short lived routes
  will need to be used in conjunction with other
  methods to detect spam

13
Spam Filters

• What is the likely-hood of network level filters
  blocking legitimate e-mail?
• What if a corporation makes a change to their MX
  records will their technique cause issues?
• Most corporate filters allow some spam through
  vs. risk blocking legitimate e-mail

14
Destination Security

• The results of the study could be flawed due to
  security measures on the Internet
• The researchers attempts to trace back to hosts,
  may have been blocked by access-lists on routers,
  and/or firewalls
• It is also conceivable the "hijack" of the botnet
  they performed may of caused other ISPs to
  "blacklist" the researchers thinking they were
  possible Spammers

15
Intelligent Spammers

• Study assumes that spamming technology is static
• Spammers continually adjust tactics to minimize
  the effectiveness of new efforts of screening

16
The SPAM Offensive Team
Glenn Allison
Dan Hoadley
Raj Varma
Michael Ehrenhofer
Bryan BDT Tabiadon
Joe Mathew
17
Thank you
VOTE
OFFENSE