The problems of The origins Variations on the theme spam The - PDF document

Introduction • Introduction The problems of • The origins • Variations on the theme spam • The rise of phishing and pharming • Inter-governmental (in)activity Ewan Sutherland • Conclusions and issues TMGT 632 TMGT 632 08.v.06 1 08.v.06 2 Spam Monty Python’s Spam menu • Egg and spam • Commercialisation of the Internet • Egg, bacon and spam • Electronic mail is “free” • Egg, bacon, sausage and spam • Spam was originally a tinned meat product • Spam, bacon, sausage and spam • Spam, egg, spam, spam, bacon and spam from the USA, short for SPicy hAM • Spam, sausage, spam, Spam, spam, bacon, • Monty Python’s Flying Circus: spam, tomato and spam – The Green Midget Café • Spam, spam, spam, egg, and spam • Spam, spam, spam, spam, spam, spam, baked – Every meal included Spam beans, spam, spam, spam and spam – The Spam song TMGT 632 TMGT 632 08.v.06 3 08.v.06 4 Unsolicited advertisements Filtering at destination • Originally the Internet was non-commercial • Companies and individuals are expected • As commercial use grew, so did unsolicited to filter out spam on arrival electronic mail • Assumes that the cost are insignificant: • Addresses were freely available – carriage of spam • “spam” grew to unacceptable levels – filtering • Spam became a vector for viruses • Filtering is never totally effective: • Spam became a profitable business model: – false positives – even at minimal response rates – false negatives – infinitesimal cost http://www.email-policy.com/Spam-black-lists.htm TMGT 632 TMGT 632 08.v.06 5 08.v.06 6 1

Open relays ORDB rankings of open relays • Electronic mail is transmitted by relays 1. USA 82,981 11.Spain 3,079 2. China 25,774 12.India 3,056 • Some SMTP relays are open for anyone 3. South Korea 16,421 13.France 2,969 • In this way spam enters the global system 4. Japan 9,921 14.Hong Kong 2,779 • SMTP relays should only allow mail from 5. Taiwan, China 8,468 15.Mexico 2,681 6. Germany 6,233 16.Australia 2,492 registered clients 7. United Kingdom 5,457 17.Russia 2,420 • ORDB currently reports 250,000 open 8. Canada 5,115 18.Poland 2,034 relays worldwide 9. Italy 3,661 19.Netherlands 1,559 10. Argentina 3,587 20.Sweden 1,306 http://www.ordb.org/ TMGT 632 TMGT 632 08.v.06 7 08.v.06 8 Spamhaus Spamhaus – countries and ISPs • An international non-profit organisation, based in the 1. United States 2,292 1. mci.com 214 UK, whose mission is: 2. China 392 2. sbc.com 90 – to track the Internet's Spam gangs 3. Russia 293 3. comcast.net 70 – to provide dependable real-time anti-spam protection for Internet networks 4. Japan 282 4. hinet.net 50 – to work with Law Enforcement Agencies to identify and pursue spammers worldwide 5. Taiwan 184 5. ocn.ne.jp 42 – to lobby governments for effective anti-spam legislation 6. Canada 169 6. nttpc.ne.jp 42 • It maintains the Register of Known Spam Operations (ROKSO) 7. South Korea 160 7. xo.com 39 8. UK 144 8. level3.net 38 80% of spam received by Internet users in North America and Europe can be traced via aliases and addresses, redirects, hosting locations 9. Netherlands 139 9. interbusiness.it 37 of sites and domains, to a hard-core group of around 200 known 10. Hong Kong 124 10.newworldtel.com 32 spam operations ("spam gangs") http://www.spamhaus.org/ TMGT 632 TMGT 632 08.v.06 9 08.v.06 10 Sophos rankings Zombie computers October to December, 2005 • A computer compromised by a security cracker, a virus or a trojan horse 1. United States 24.5 % • One of many computers in a "botnet", used to perform a 2. China (inc Hong Kong) 22.3 % malicious task under remote direction 3. South Korea 9.7 % • Owners are unconscious vectors and thus compared to 4. France 5.0 % a “zombie” 5. Canada 3.0 % • Infected computers — predominantly running Windows 6. Brazil 2.6 % — are the major delivery method of spam, between 50% 7. Spain 2.5 % and 80% 8. Austria 2.4 % 9. Taiwan 2.1 % • Zombie computers allow spammers to avoid detection 10. Poland 2.0 % and bandwidth costs 10. Japan 2.0 % • They are also used to commit “click fraud” against sites 12. Germany 1.8 % displaying pay-per-click advertising http://www.sophos.com http://www.microsoft.com/presspass/features/2005/oct05/10-27Zombie.mspx TMGT 632 TMGT 632 08.v.06 11 08.v.06 12 2

Ipswitch – current view Variations on a theme • 62% of all e-mail received is spam, • SPIM – spam on Instant Messaging compared to 57% in the previous quarter • SPIT – spam on Internet Telephony • Pornography was the most common spam (24% of total) • Second place was offers of mortgages and loans (18%) • SPLOG – spam in weblogs • Third place was offers of “medication” (17%) • mobile Spam: • Fourth was electronics and pirated software (16%) • Fifth was attempts to ‘phish’ recipients' banking details – SMS with claims of lottery wins and online gambling accounts – MMS (10%) http://www.ipswitch.com/ TMGT 632 TMGT 632 08.v.06 13 08.v.06 14 Can Spam Act of USA (2003) China • Internet Society of China (ISC) and leading service • Delayed by efforts at technical solutions providers are to build a unified electronic mail • Delayed by industry lobbying, especially management platform • They will cooperate with international anti-spam by direct marketing companies organizations • Enabled ISPs to sue spammers • They will create a common blacklist of spam senders • An anti-spam reporting hotline received 5000 complaints • Some legal cases have been concluded in a few weeks, of which 70% were spam and 28% junk SMS • Has had no discernible effect in reducing • Growing problems with SMS the volume of spam originating from the • Government has announced the obligation to register all USA mail servers http://www.onguardonline.gov/ http://www.anti-spam.cn/ TMGT 632 TMGT 632 08.v.06 15 08.v.06 16 Australia Australia – code of conduct Networks Customers • Passed specific legislation • not to have open relay or open • to provide spam filtering proxy servers, and to impose • Bi-lateral inter-governmental agreements: options the same obligations on their customers • to explain their default filtering – e.g., Republic of Korea and Australia • to scan their own networks for of electronic mail subscribers’ misconfigured • Also a mandated Code of Conduct for • to advise how to deal with, and mail and proxy servers report, spam. • to allow for immediate operators termination of connections • to ensure they prohibit the use where it has become an open of their networks for spamming relay due to intentional and to inform their customers misconfiguration or a zombie • if notified that a customer’s computer is a zombie to warn them and suggest how to correct the problem http://www.spam.acma.gov.au/ TMGT 632 TMGT 632 08.v.06 17 08.v.06 18 3

ENISA report Mobile spam • European Network and Information Security Agency • A major problem in Japan, but spreading • There is no 100% protection against spam • Protection against incoming spam can only be improved marginally • NTT DoCoMo worked very hard to • Unless economic models for spam change dramatically, there is probably not much more that providers can do next to applying the variety of suppress it countermeasures to the largest extent possible • Most spam originates outside of the EU • Text messages from dating services • A major problem is that spammers often hide their true identity • The relationship between those national entities who control electronic communications and those who control transmission of unsolicited emails • SMS to call premium services should also be clarified and simplified • The terms opt-in and opt-out and the scenarios in which they are applicable • Devices are too small for firewalls and could be further clarified • Providers in Europe are more concerned about spam emails that their anti-virus software customers receive than they are concerned with spam that their customers send • Enforcement could be further improved to also prevent spam originating from Europe. http://www.gsmworld.com/documents/public_policy/digital_divide/mobile_spam.pdf http://www.enisa.eu.int/doc/pdf/deliverables/enisa_security_spam.pdf TMGT 632 TMGT 632 08.v.06 19 08.v.06 20 419 scams Phishing • Pronounced “fishing” • Derived from the Nigerian legal code • Phishing for or stealing personal identity and financial account details • Advanced fee scam • Mail messages and associated websites • Abuse and hi-jacking of brand names and logos • A request for personal information • 'spoofed' electronic mails to lead consumers to counterfeit websites designed to trick recipients into divulging • Based on promise of a share in an illegal – credit card numbers – account usernames and passwords scheme to access money in banks • Technical subterfuge is used to plant crimeware on PCs to steal credentials directly, e.g., Trojan keylogger spyware • Names used include the children and • The Bank of America example uses the genuine web site with redirection to the phishing site spouses of many former African leaders • The PayPal example uses a web site with a name similar to a genuine domain name http://www.ultrascan.nl/ TMGT 632 TMGT 632 08.v.06 21 08.v.06 22 Example – Bank of America Example – PayPal TMGT 632 TMGT 632 08.v.06 23 08.v.06 24 4