NBLUG Presentation: Dealing with spam

July 11, 2003 @ 7:30PM, General Meeting

Speakers:

Dealing with spam: Overview of Presentation

  1. What is spam? (M.E.)
  2. Categories of methods to deal with spam (E.E)
  3. Avoiding spam (F.B., M.E.)
  4. Incoming spam (F.B., M.E., E.E.)
  5. Dealing with spam after receipt (M.E.)
  6. Conclusions (F.B., M.E., E.E.)
  7. Questions (F.B., M.E., E.E.)
  8. Links (F.B., M.E., E.E.)

  1. Dealing with spam: What is spam?

    M.E.: What is spam? (problems with these)

    M.E.: What is ham?

    Grey Areas:

  2. Dealing with spam: Categories of Anti-spam tools

    Ideal is to receive no spam in your inbox, no network traffic from spam and no false positives. Unfortunately, this probably isn't possible.
    If you can, you want to let spam use as few resources as possible.
    If your machine accepts the mail (layer 6+) you want to do your best to identify the mail as spam, usually placing it into a special inbox that you only review occassionally.

    General categories of anti-spam techniques (EE)
    Total Block Manual Lists Automatic Lists Static Analysis Dynamic Analysis Other
    You wish or 100% false positive You update; whitelists; blacklists; both. Everybody updates Coded heuristics Intelligent updating Mostly designed to raise spammers' costs above 50/cent
    layer 0: Before they even try to spam you Don't do email.
    Don't give your address to spammers.
    Make it hard to automatically figure out your address.
    Make the address temporary.
    layer 1/2 (physical/link): Impractical, Difficult or Impossible. Unplug your net cable: no email, no spam.
    Unplug spammer: moves or replaced.
    layer 3 (network (IP)): Good for spam havens; Invisible; no transfer; bounces. IP via iptables/ipchains. RBL, DUL, SPEWS, ORBS in routing table (etc.). tarpitting techniques.
    layer 4 (transport (TCP)): Spam havens; Visible; no transfer; bounces. hosts.allow, mail/access or similar MTA mechanisms. RBL, DUL, SPEWS, ORBS in MTA (refuse connection).
    Total Block Manual Lists Automatic Lists Static Analysis Dynamic Analysis Other
    layer 5 (session (SMTP)): Individual email addresses or entire domains. Good for "legit" spammers. Visible; minimal transfer; bounces. mail/access. uncommon (easy to forge); easynet naive rules looking for "spammer-like" addresses. soft rejects
    layer 6 (presentation (email headers)): Giveaway headers, incorrect headers, obvious subjects. Less effective as spammers get smarter. "Legit" spammers often easier. Transfer; no bounce. Greylists.

    Shared online lists of spam checksums; Razor, Pyzor, etc.

    		 Rules-based analysis; procmail, spamassassin Bayesian analysis
    layer 7 (application (body)): HTML mail; advertising phrases, disguised URLs, etc. Transfer; no bounce. Reply required: TMDA. Inconvenient for legit senders
    layer 8 (social): Laws, morals, ethics, shame and other non-computerized solutions

    legislation; imperfect, non-universal, may supplement other techniques. Worst spammers could get imprisoned. "Legit" spammers might include filterable giveaways.

    		 Hire a human; almost perfect
    Total Block Manual Lists Automatic Lists Static Analysis Dynamic Analysis Other

    For each category provide an example app/tool

    Also cover what these are:

    Something about how Bayes works.

  3. Dealing with spam: Avoiding spam

    F.B, M.E.: Prevention <F.B.>

    1. Never respond to spam - it validates your email address - you get more spam - F.B.
    2. Never buy anything advertised in spam. Doing so encourages spammers.
    3. Never go to a site to "Opt Out"
      • it validates your email address
      • you often get more spam
      • some opt outs are legitimate, some aren't and you can't tell which are which.
    4. HTML spam with images make money for the spammer if you look at it with a web browser that displays the image - the spammer gets paid every time an image loads.
    5. Some e-mail messages reference images through a server cgi or application that is passed unique strings to identify one spam message as a message sent to your address vs. one sent to any other address. From these unique strings, they can identify who has opened one of their e-mail messages and figure who to targent more often. This also gives them feedback for what techniques work to get customers to open e-mail. (M.E. explain this better in presentation.)
    6. Consider filling in fake e-mail addresses when you don't want to get any information from the provider. (Even though a service claims tey will not sell your address for spam, does not mean they are telling the truth. Also, when businesses are liquidated in bankruptcy, mailing lists can be sold without the required licensing, since the business who arranged for the license will not exist.)
    7. If you own your own domain, you can create custom aliases for delivery to check to see who sells your address to spammers. For instance, "e-Commerce-1.com" wants you to register your address with them. Create an alias e-mail address that points to you, like "e-Commerce-1.com@yourdomain.com".
    8. Consider using free "throw-away" accounts for untrusted services or in places where an e-mail address is required.
    9. Special disposable email forwarding services, such as jetable.org exist, too.
    10. .mailcap: text/html ; lynx -dump -force_html -localhost %s ; copiousoutput
    11. If you must post your address on your website obfuscate it. "spambots" harvest email addresses from webpages. Change frankb@sonic.net to:
    12. Any email address used when posting to USENET and NewsGroups will get major spammage.
      • obfuscate with frankb-at-sonic-dot-net or some other text based method.
    13. Don't give your e-mail address without knowing how it will be used. </F.B.>
    14. When forwarding any e-mail messages (jokes, etc.) strip out all valid e-mail addresses in the message for others who have forwarded the message. M.E.
    15. When you want to send a joke to others, use BCC for most addresses to try to protect disclosure of addresses. Also encourage others that your correspond with to do the same. M.E. (explain why: hotmail recipients and next item.)
    16. Avoiding sending e-mail to users using mail accounts at providers who are known to have sold e-mail addresses of people sending e-mail to their users. Some "free" e-mail account services are known to harvest e-mail addresses from messages sent to their "free subscribers'" accounts. M.E.
    17. When you sign up for responsible commercial services that send e-mail (such as Amazon, HP, BestBuy and others,) you can often specify what kinds of e-mail you wish to receive in a web-based profile editor. M.E.
    18. When required to register software, be careful and locate any boxes or options that permit the vendor to send you more e-mail or "offer you exceptional promotions from partner companies." M.E.

  4. Dealing with spam: Incoming spam

    F.B.: Brief examination of e-mail header.

    Received: from pop.sonic.net [209.204.190.2]
        by localhost with POP3 (fetchmail-5.9.11)
Received: from 12-249-60-91.client.attbi.com (12-249-60-91.client.attbi.com [12.249.60.91])
        by turbo.sonic.net (8.11.6p2/8.8.5) with SMTP id h5RDb2f08984

Received: from nortelnetworks.com (lsanca2-ar37-4-62-193-080.lsanca2.dsl-verizon.net [4.62.193.80])
        by sub.sonic.net (8.11.6p2/8.8.5) with SMTP id h5R9OjR13319;

Received: from 131.ts8.increments.net ([69.41.70.131])
        by turbo.sonic.net (8.11.6p2/8.8.5) with SMTP id h5RAL8f30190

Received: from 61.84.0.139 (cs242770-143.houston.rr.com [24.27.70.143])
        by sub.sonic.net (8.11.6p2/8.8.5) with SMTP id h5RN24g02665

Received: from rafgkcg (12-210-226-149.client.attbi.com [12.210.226.149])
        by ultra.sonic.net (8.11.6p2/8.8.5) with SMTP id h5SGYor02370

Received: from 216.204.151.29 ([216.204.151.29])
        by turbo.sonic.net (8.11.6p2/8.8.5) with SMTP id h5SJexp23730

    Tools: