20110524 a survey of spam
19
Copyright 2009 Trend Micro Inc. Mel Huang A Survey of Spam 1
Transcript of 20110524 a survey of spam
Copyright 2009 Trend Micro Inc.
Mel Huang
A Survey of Spam
1
Copyright 2009 Trend Micro Inc.
Outline
• Introduction
• As a Spammer
– Target
– Path
– Content
• Spam Ecosystem
• Anti-spam Solutions
• Do Anti-spam Solutions Work?
2
Copyright 2009 Trend Micro Inc.
Introduction
3
traditional spam
Copyright 2009 Trend Micro Inc.
Introduction
4
blog/wiki spam
social networking
spam
search engine spam
messaging spam
phone/SMS spam
Copyright 2009 Trend Micro Inc.
Introduction
5
0
10
20
30
40
50
60
70
80
90
100
1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010
% of emails
1998 "Spam and the Ongoing Battle for the Inbox,” Communications of the ACM, 20072001 "Ending Spam's Free Ride," ACM Networker, 20032003 "Spam and the Social-Technical Gap," IEEE Computer, 20042004 "Bot Software Spreads, Causes New Worries," IEEE Distributed Systems Online, 20042005 "Scalable and Reliable Collaborative Spam Filters: Harnessing the Global Social Email Networks," CEAS 20052006 "The E-Mail Honeypot System - Concept, Implementation and Field Test Results," IEEE International Conference on the Digital Society, 20082007 "Spam and the Ongoing Battle for the Inbox," Communications of the ACM, 20072008 "The Economics of Botnets," Kapersky Lab, 20092010 "Correlating Spam Activity with IP Address Characteristics," IEEE Conference on Computer Communications, 2010Related statistics http://ferris.com/reports/industry-statistics/McAfee’s report http://www.mcafee.com/us/resources/reports/rp-carbonfootprint2009.pdf
?
Business cost US$130BSpammers earned US$780M
Anti-spammers earned US$5B
62T spam emails sent33B kWh energy usage
(could support 2.4M home in US)17M tons of CO2
(0.2% of global emissions)
Filtering saves 135B kWh
1971 …
Copyright 2009 Trend Micro Inc.
As a Spammer
6
economic
social
moral“Freakonomics,” 2005
Copyright 2009 Trend Micro Inc. 7
Copyright 2009 Trend Micro Inc.
As a Spammer
8
target
path
Screenshot from Angry Birds by Rovio ®
content
Copyright 2009 Trend Micro Inc.
As a Spammer
• Target
– web crawler
– dictionary trial and error
– steal member list
– buy from others
9
“Who gets spammed?” Communications of the ACM, 2006
“Understanding How Spammers Steal Your E-Mail Address,” CEAS, 2005
“Do Zebras get more Spam than Aardvarks?“ CEAS, 2009
?
Copyright 2009 Trend Micro Inc.
As a Spammer
• Path
10
ESP/ISP
botnet
open proxy/relay
Copyright 2009 Trend Micro Inc.
As a Spammer
• Path
11
ESP/ISP
botnet
open proxy/relay
“The E-Mail Honeypot System,” CEAS, 2008“Spamming Chains,“ CEAS, 2009“On the Spam Campaign Trail,” 2008“Spamalytics,” Communications of the ACM, 2009
Copyright 2009 Trend Micro Inc.
As a Spammer
• Path
12
“Anti-Honeypot Technology,” IEEE Security and Privacy, 2004“Spamming Chains,“ CEAS, 2009
Copyright 2009 Trend Micro Inc.
As a Spammer
• Content
13
“A Survey of Modern Spam Tools,” CEAS 2008
fjdaslioejwjvcxzjvo
jvsd9jowe
jbvxc8b890
rkstjkfsbxjcv0g9d
fjew09as vcx89gjdfbvxciobd
salad
bcvxklmkwr
random characters
Copyright 2009 Trend Micro Inc.
Spam Ecosystem
14
spammers
botnet owners
target harvesters
rent for US$20/month/online botsell for US$0.5/botaverage sending rate: 10 messages/min/bot“The Ecomonics of Botnets,” Kaspersky Lab, 2009
US$70 for 1000+US$1000 for 10M+“The Ecomonics of Botnets,” Kaspersky Lab, 2009
response rate 0.0001% to survive“Who Gets Spammed?” Communications of the ACM, 2006“Spamalytics,” Communications of the ACM, 2009
free to EU$599“A Survey of Modern Spam Tools,” CEAS 2008
spam tools providers
EU$199“Anti-Honeypot Technology,” IEEE Security and Privacy, 2004
honeypot hunter
phishing hosting
US$1000-2000/month“The Ecomonics of Botnets,” Kaspersky Lab, 2009
Copyright 2009 Trend Micro Inc.
Anti-spam Solutions
• Law
– spam definition?
• Pricing
– Microsoft Penny Black Project
– Yahoo! CentMail
• Technology
15
“Spam and the Ongoing Battle for the Inbox,” Communications of the ACM, 2007
“Spam and the Social-Technical Gap,” IEEE Computer, 2004
HomeUS$999
ProfessionalUS$9999
EnterpriseUS$99999
Excuse me!I’m a newsletter.
StudentUS$99
Unsolicited Bulk Email
Unsolicited Commercial Email
Unsolicited Email
Junk Email
Copyright 2009 Trend Micro Inc.
Anti-spam Solutions
• Technology
– social networks
– content solutions
• Bayesian filter
• rules-based filter
– network solutions
• rule-based filter (black/gray/whitelist)
• authentication (DKIM, SenderID, …)
16
“Saving Private E-mail,” IEEE Spectrum, 2003
“Understanding Address Usage in the Visible Internet,” 2009
“IPv6 and Spam,” MIT Spam Conference, 2009
“Scalable and Reliable Collaborative Spam Filters,” CEAS, 2005
“Leveraging Social Networks to Fight Spam,” IEEE Computer, 2005
“Stopping Spam by Extrusion Detection,” CEAS, 2004“Stopping Outgoing Spam by Examining Incoming Server Logs,” CEAS, 2005“Using Early Results from the spamHINTS Project to Estimate an ISP Abuse Teams Task,” CEAS, 2006
“Filtering Spam E-mail on a Global Scale,” WWW Alt., 2004
Copyright 2009 Trend Micro Inc.
Do Anti-spam Solutions work?
17
“Spamalytics,” Communications of the ACM, 2009 < 0.0001% > 0.0001% > 0.0001%
Copyright 2009 Trend Micro Inc.
Ah… Ah… Ah…
18
Copyright 2009 Trend Micro Inc.
Thank You
19
