Using Throttling and Traffic Shaping to Combat Spam Ken Simpson, - - PowerPoint PPT Presentation

▶
using throttling and traffic shaping to combat spam
SMART_READER_LITE
LIVE PREVIEW

Using Throttling and Traffic Shaping to Combat Spam Ken Simpson, - - PowerPoint PPT Presentation

Sep 23, 2022 166 likes •509 views

Using Throttling and Traffic Shaping to Combat Spam Ken Simpson, Founder and CEO, for USENIX LISA November 14, 2007 Overview 1. Spammus Historicum 2. Spammus Economicus 3. Spammus Interruptus 4. Question & Answer Beer & Spam at

slide-1
SLIDE 1

Using Throttling and Traffic Shaping to Combat Spam

Ken Simpson, Founder and CEO, for USENIX LISA November 14, 2007

slide-2
SLIDE 2

Overview

  • 1. Spammus Historicum
  • 2. Spammus Economicus
  • 3. Spammus Interruptus
  • 4. Question & Answer
  • Beer & Spam at 8:30pm

Room: “Reunion G”

slide-3
SLIDE 3

Spam: A Personal History

Source: spamnation.info/stats The good old days.

slide-4
SLIDE 4

Spam: A Personal History

slide-5
SLIDE 5

The Dawn of Spam

  • First spam was sent in 1978
  • DEC marketing department advertising a

seminar in California

– Has anything really changed?

slide-6
SLIDE 6

Spam Circa 2002

  • Not much criminality yet
  • Spamming still legal in most places
  • First regex filters introduced
  • Attack:

– Simplistic shrouding of words – v1agra, c1al1s

  • Response: Smarter regular expressions,

and weighted rule sets.

slide-7
SLIDE 7

Spam Circa 2003

  • CAN-SPAM makes spamming illegal
  • Some spammers move underground,
  • thers become “email marketers”
  • Volume explodes
  • Attack: Try hiding in fancy HTML.

<html><img src="http://www.your-info-station.com/Sla/chalkboard.gif "><div><ahref="http://www.your-info-station.com/Sla/eb.php? x=52c"><img src="http://www.your-info- station.com/Sla/pitch.gif"></a></html>

  • Response: Filter on URLs, not words.

Introduce Bayesian filtering. Blacklists.

slide-8
SLIDE 8

Spam Circa 2004

  • Bill Gates predicts spam will be gone in two

years

  • Attack:

– Switch to botnets

  • Response:

– Improve reputation systems – Build enormous spamtraps – Implement greylisting

slide-9
SLIDE 9

Spam Circa 2005-Present

  • Attacks:

– Poison statistical filters – Hire full-time virus writers – Diversify into phishing and identity theft – Work with the mafia on stock spam – Rinse and repeat

  • Responses:

– Fingerprint-based filters

slide-10
SLIDE 10

Spammer Economics

  • Average filter accuracy is 90%

– 1/10 of spam messages get through

  • Improve accuracy to 95%

– 1/20 of spam messages get through

  • Solution?

– Double spam volume – Same profit

slide-11
SLIDE 11

11

slide-12
SLIDE 12

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 100000 200000 300000 400000 500000 600000 700000 800000

How often do we see a unique Botnet IP?

The Number of Unique IP's versus the number of times reported

# Times Reported # Unique Botnet IP's

slide-13
SLIDE 13

Blacklists Aren't Perfect

slide-14
SLIDE 14

Zombies are Fickle

  • 201.21.174.207

– RBLs did not block this sender until it had sent 55 emails over 19 days. – All 55 were “rejected” by throttling. – After the RBLs caught up, a further 379 messages were received over 13 days

slide-15
SLIDE 15

15

slide-16
SLIDE 16

Getting Paid

  • EHLO foo.com
  • 250 Ok
  • MAIL From: <bar@baz.com>
  • 250 Ok
  • RCPT To: <victim@example.com>
  • 250 Ok
  • DATA
  • 354 Go ahead
  • ...
  • 250 Queued – Now I make some money
slide-17
SLIDE 17

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 50 100 150 200 250 300 350 400 450 P e r c e n t a g e

  • f

C

  • n

e c t i

  • n

s S t i l C

  • n

e c t e d

T im e (S e c

  • n

d s )

S p a m m e rs a re L e s s P a tie n t th a n L e g itim a te S e n d e rs S pam m ers Leg itim ate S enders

17

slide-18
SLIDE 18

Intermission

  • Improving filters is hard
  • Identifying zombies is hard
  • What can we do?
slide-19
SLIDE 19

Idea

  • What can we do?
  • Attack the economics of the botnet.
slide-20
SLIDE 20
slide-21
SLIDE 21

Case Study

October, 2006 Before Traffic Control

3.5M

2.5M

October, 2006 After Traffic Control

0.7M

Six Overloaded Servers Two Servers

3.5M

slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25

5 10 15 20 25 30 35 40

Typical SMTP Session Duration

Typical SMTP Session Slow ed Dow n Session

Time (Seconds)

slide-26
SLIDE 26
slide-27
SLIDE 27

27

slide-28
SLIDE 28
slide-29
SLIDE 29

One of these kids is not like the others...

Delivered

Windows Linux FreeBSD Solaris Novell HP NetCache

Not delivered

Windows Linux FreeBSD Solaris Novell HP NetCache

slide-30
SLIDE 30

Storm Botnet Throttling

  • RBLs rejected 70% of the likely Storm

botnet zombies

  • Of those that remained...

– 74% did not complete delivery of a message

  • 10% were detected as consumer operating systems

(Windows 98, Windows XP, etc.)

  • The rest were unknown, and therefore throttled
slide-31
SLIDE 31

10 seconds 20 seconds 30 seconds 40 seconds 50 seconds 60 seconds

A Passing Storm

slide-32
SLIDE 32

Conclusions

1.Spamming is driven by economics 2.Botnet operators need to make money 3.Slowing down spam makes it go away

  • Beer & Spam at 8:30pm

Room: “Reunion G”

slide-33
SLIDE 33

questions@mailchannels.com

Nick Shelness, Former CTO, Lotus:

“I am able to report that I have been running an instance of TrafficControl in my own network for four months, and that it has reduced the volume of spam hitting my boundary MTAs on most days by approximately 95%.”

+1-778-785-6143 www.mailchannels.com