Abusing the Network: Spam in All its forms Joshua Goodman, Microsoft Research with slides from Geoff Hulten and all the hard work done by other people, including Robert Rounthwaite, David Heckerman, John Platt, Carl Kadie, Eric Horvitz, Scott Yih, Geoff Hulten, Nathan Howell, Micah Rupersburg, George Webb, Ryan Hamlin, Kevin Doerr, Elissa Murphy, Derek Hazeur, Bryan Starbuck, lots of people at Hotmail and Outlook and Exchange and MSN… 3/15/2018 1
Overview u Introduction to spam • There’s a ton of it, and people hate it u u Kinds of Spam (lots) Techniques Spammers Use • Can be used for other kinds of spam u Solutions to spam • Machine Learning, Fuzzy Hashing, Turing Tests, Blackhole lists, etc. • Can apply to other kinds of spam u Conclusion
Info. World Poll July 25, 2003
Pew Internet Study Numbers u 25% of email users say spam has reduced their overall email use u 76% of email users are bothered by offensive or obscene content of spam. u Economics favor spam • 7% of email users report that they have ordered a product advertised in spam. • Cost of sending spam is only about. 01 cents/message! • If 1 in 100, 000 people buy, and you earn $11, you make a profit
Kinds of Spam “Advertising Wants to Be Free” u u u Email spam (I’ll talk about this in detail) Usenet spam (usenet now nearly useless in many groups) Chat rooms Instant Messenger Popups (Web pages, Adware) Search engine spam • Link spam • Word spam • Blog spam u u VOIP? Conclusion: If you can advertise for free, someone will
Chat Room Spam u u MSN closed its free chat rooms Spambots come in and pretend to chat • But really just advertising porn sites • Some spambots trivial • Don’t talk at all, but take up space • Link to porn spam in their profile • Some spambots very sophisticated • You can have a short conversation with them before they try to convince you to go to their website • Randomized conversations so hard for users to spot
Chat Bot Conversation joshuagood 9: hi there super_christina 12: hey there how u doin? joshuagood 9: are you a bot? super_christina 12: im not a bot are u? lol joshuagood 9: are you a bot? super_christina 12: i hate bots lol joshuagood 9: asl? super_christina 12: im 20 f usa and u? joshuagood 9: asl? super_christina 12: im 21 f usa and u? joshuagood 9: 74/M, WA super_christina 12: nice age joshuagood 9: thank you super_christina 12: yw sweety. . could u do me a favor. . check out my homepage and my profile see if my cam works? brb
super_christina 12’s home page
Instant Messenger Spam “SPIM” u Send messages to people via IM u Microsoft solved this by requiring to get permission before IMing u Spammers put spam in their “name” – so permission request message now has spam!
Popup Spam u Web page popups • You go to a web page, and get a popup • May be a “pop under” that appears under all other windows, so you don’t even know where it came from u Adware (e. g. Gator) • Software installed on your computer either without your permission, or where permission is hidden deep in license agreement. • Creates popups all the time u Messenger Spam (not IM) • Method meant to deliver notices like “Printer is out of paper” • Spammers exploit it to create notices like “Buy a diploma”
Search Engine Spam u Link spam • Search engines use number of links to determine rankings • Spammers create millions of pages that link to their site • Fake pages may be realistic and may be returned as search results, too. u Word spam • Spammers put misleading words on their page, e. g. celebrity names or technical terms • Page is actually porn u Cloaking • Put useful content on page when crawler comes (use IP address or agent ID) • Put spam on page when people click on the link
VOIP spam? u u Make free or low-cost internet phone calls Internet to internet is free • Could be fully automated • Speech recognition someday • Almost no cost u Internet to POTS (fixed line) 2 cents/minute • Could be cheap foreign labor • International calls too expensive over traditional phone lines for most advertising, become more affordable with VOIP
Techniques Spammers Use u u Examples of Tricks Sending spam • Open proxies • Zombies u (Lots of other nasty stuff, won’t have time to talk about today)
Weather Report Guy u u Content in Image Good Word Chaff Weather, Sunny, High 82, Low 81, Favorite…
Secret Decoder Ring Dude u Another spam that looks easy u Is it?
Secret Decoder Ring Dude u u Character Encoding HTML word breaking Pharm acy Produ c<!LZJ>t<!LG>s
Diploma Guy u Word Obscuring Dplmoia Pragorm Caerte a mroe prosoeprus
Diploma Guy u Word Obscuring Dipmloa Paogrrm Cterae a more presporous
Diploma Guy u Word Obscuring Dimlpoa Pgorram Cearte a more poosperrus
Diploma Guy u Word Obscuring Dpmloia Pragorm Caetre a more prorpeosus
Diploma Guy u Word Obscuring Dplmoia Pragorm Carete a mroe prorpseous
More of Diploma Guy u Diploma Guy is good at what he does
Trends in Spam Exploits (Hulten et al. ) • Based on 1, 200 spam messages sent to Hotmail Exploit 2003 Spam 2004 Spam Delta (Absolute %) Description Misspelling words, putting words into images, etc. Word Obscuring 4% 20% 16% URL Spamming 0% 10% 41% 50% 9% Token Breaking 7% 15% 8% MIME Attacks 5% 11% 6% Putting non-spam content in one body part and spam content in another. Text Chaff 52% 56% 4% Random strings of characters, random series or words, or unrelated sentences. URL Obscuring 22% 17% -5% Encoding a URL in hexadecimal, hiding the true URL with an @ sign, etc. 5% 0% -5% Pharm acy renders into Pharmacy. Domain Spoofing Character Encoding Adding URLs to non-spam sites (e. g. msn. com). Using an invalid or fake domain in the from line. Breaking words with punctuation, space, etc.
Sending Spam: Open Proxies u These are web-page proxy servers • Used for getting web-pages past firewalls • Should have nothing to do with email u Spammers exploit holes • Exploit a hole that you can use some proxies to send email • Exploit another hole that anyone can access the proxy-server • Both holes must be present to use an open proxy u Spammers really love these • Almost impossible to trace spammer • Spammer uses someone else’s bandwidth • Less incentive for owner to close the proxy than to close open mail relays u Everyone who abuses things likes open proxies (example: click fraud on Google and Overture advertisements)
Sending Spam: Zombies u As much as 2/3 of spam may originate from zombies now! u Consumer computers taken over by viruses or trojans • Spammer tells them what to send • Very difficult to trace • Very cheap for spammer
Blogs, Referrers u For link spam, some spammers manually or automatically add links to blogs • Increases page rank of site • Blog site tends to have high page rank u Some sites will put list of referrer pages or proxy traffic somewhere on site • Spammers generate fake traffic to site to get entries, which are then indexed by search engines u Even secure features like these are vectors for abuse
Solutions to Spam u Filtering • Machine Learning • Matching/Fuzzy Hashing • Blackhole Lists (IP addresses) u Postage • Turing Tests, Money, Computation u Smart. Proof
Filtering Technique Machine Learning u Learn spam versus good u Problem: need source of training data • Get users to volunteer GOOD and SPAM • 100, 000 volunteers at Hotmail u Should generalize well u But spammers are adapting to machine learning too • Images, different words, misspellings, etc. u We use machine learning – details later
Filtering Technique Matching/Fuzzy Hashing u Use “Honeypots” – addresses that should never get mail • All mail sent to them is spam u Look for similar messages that arrive in real mailboxes • Exact match easily defeated • Use fuzzy hashes • How effective? u The Madlibs attack defeats exact match filters or fuzzy hashing Make u working at home !!! Earn u thousands of dollars lots of money in the comfort of your own house . Spammers already doing this Good work from IBM and AOL (Josh Alspector) on solutions
Blackhole Lists u Lists of IP addresses that send spam MSN blocks e-mail from rival ISPs By Stefanie Olsen Staff Writer, CNET News. com February 28, 2003, 2: 34 PM PT • Open relays, Open proxies, DSL/Cable lines, etc… Microsoft's MSN said its e-mail u Easy to make mistakes • Open relays, DSL, Cable send good and spam… u Who makes the lists? • Some list-makers very aggressive • Some list-makers too slow services had blocked some incoming messages from rival Internet service providers earlier this week, after their networks were mistakenly banned as sources of junk mail. The Redmond, Wash. , company, which has nearly 120 million e-mail customers through its Hotmail and MSN Internet services, confirmed Friday it had wrongly placed a group of Internet protocol
Postage u Basic problem with email is that it is free • Force everyone to pay (especially spammers) and spam goes away • Send payment pre-emptively, with each outbound message, or wait for challenge u Multiple kinds of payment: Turing Test, Computation, Money
Turing Tests (Naor ’ 96) u You send me mail; I don’t know you u I send you a challenge: type these letters u Your response is sent to my computer u Your message is moved to my inbox, where I read it
Computational Challenge (Dwork and Naor ’ 92) u Sender must perform time consuming computation u Example: find a hash collision • Easy for recipient to verify, hard for sender to find collision u Requires say 10 seconds (or 5 minutes? ) of sender CPU time (in background) u Can be done preemptively, or in response to challenge
Money $$$ u u Pay actual money (1 cent? ) to send a message My favorite variation: take money only when user hits “Report Spam” button • Otherwise, refund to sender • Free for non-spammers to send mail, but expensive for spammers u u Requires multiple monetary transactions for every message sent – expensive Who pays for infrastructure?
The Smart. Proof Approach Overview u Combines best aspects of several previous techniques: • Machine learning • Challenge response • Postage (multiple techniques)
Smart. Proof: Selective Challenging u u Most challenge-response approaches challenge every message We use machine learning to challenge only some messages • Definite spam deleted (saves processing costs) • Definite good passed through to inbox (avoids annoying challenges, and avoids many challenges that will not be answered. ) • Only possible spam, possible good is challenged
Smart. Proof: Sender Chooses Type of Proof u Can auto-respond with computation • Least annoying to sender – he may never see the challenge • Usable by people with disabilities u Can respond by solving a Turing Test • Works for people with old computers or incompatible computers or who do not want to download code u Future? : Can respond with micro-payment • Works for small businesses. Hardest for spammers to work around.
Why Email and Spam need Their Own Field/Conference u Email is one of top two applications • Search is the other (TREC, SIGIR) • Email is why my grandfather and my wife’s grandmother bought computers u If you are interested in the frontiers of the internet, you should be very interested in the number one application on the internet
Example: Anti-Spoofing u Cryptographic approaches • S/MIME, PGP • Small adoption because of problems distributing keys – need solutions that work for email u Systems/networking approaches • DNS/IP address-based approaches u Combination approaches • Put key in DNS entry (e. g. Yahoo’s Domain. Keys) u Need a conference where the crypto people and systems people and email people and spam people all come together to compare and learn
Conference on Email and Anti-Spam u u www. ceas. cc How it’s different: • First academic-style research conference on email or spam • Plenty of informal conferences, industrial conferences u u Thursday and Friday at Stanford If you can’t come this year, make sure you come next year, and submit papers!
Conclusion u Machine learning filters combined with postage seem like the best approach to stopping spam u Any thing on the network that can be abused will be abused
Скачать презентацию Abusing the Network Spam in All its forms
50f9a173070feee7a4675144af9e28c1.ppt