Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Stopping Spam Before It Hits the Mail Server

Soulskill posted more than 5 years ago | from the napalm-would-catch-it-even-earlier dept.

Networking 157

Al writes "A team of researchers at the Georgia Institute for Technology say they have developed a way to catch spam before it even arrives on the mail server. Instead of bothering to analyze the contents of a spam message, their software, called SNARE (Spatio-temporal Network-level Automatic Reputation Engine), examines key aspects of individual packets of data to determine whether it might be spam. The team, led by assistant professor Nick Feamster, analyzed 2.5 million emails collected by McAfee in order to determine the key packet characteristics of spam. These include the geodesic proximity of end mail servers and the number of ports open on the sending machine. The approach catches spam 70 percent of the time, with a 0.3 false positive rate. Of course, revealing these characteristics could also allow spammers to fake their packets to avoid filtering."

cancel ×

157 comments

Sorry! There are no comments related to the filter you selected.

It'll work..except when it doesn't. (3, Interesting)

MrCrassic (994046) | more than 5 years ago | (#28868395)

I'll go first.

All spammers have to do is change the characteristics of the message. It's always going to be a cat and mouse game, just like antivirus and antispyware, so saying that they've found THE solution to blocking spam from hitting the server is slightly irresponsible.

Re:It'll work..except when it doesn't. (2, Interesting)

ByOhTek (1181381) | more than 5 years ago | (#28868739)

Unless they use a truly novel approach of stopping spam before it hits the server.

I suggest an AK-47.

Re:It'll work..except when it doesn't. (1)

MrCrassic (994046) | more than 5 years ago | (#28868783)

C4 on the outside of the firewall. That might remove more than expected...but it works!

Re:It'll work..except when it doesn't. (3, Insightful)

gnick (1211984) | more than 5 years ago | (#28868865)

I realize that you're kidding, but removing more than expected is something that I consider unacceptable. If it hits the mail server and gets shuffled off into a spam folder with 100 pieces of trash, that's fine. But if it's not even going to make it to the mail server, 0.3% is too high a false positive rate.

Obligatory!! (4, Funny)

jammindice (786569) | more than 5 years ago | (#28869137)

Your post advocates a

( X ) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( X ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( X ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( X ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( X ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( X ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email ( X ) Killing them that way is not slow and painful enough Furthermore, this is what I think about you: ( X ) Sorry dude, but I don't think it would work. ( ) This is a stupid idea, and you're a stupid person for suggesting it. ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Obligatory!! (0)

Anonymous Coward | more than 5 years ago | (#28869575)

Aw, you got beaten [slashdot.org] by a minute.

Too bad the nested comment system is easily abusable; yours will probably end up seen by more people.

Re:Obligatory!! (1)

Sir_Lewk (967686) | more than 5 years ago | (#28869903)

This one seems to be filled out more correctly.

Re:Obligatory!! (0, Offtopic)

Sir_Lewk (967686) | more than 5 years ago | (#28869795)

This form is amazing, always manages to be relevant.

Re:Obligatory!! (1)

morcego (260031) | more than 5 years ago | (#28870371)

Ideas similar to yours are easy to come up with, yet none have ever
been shown practical

This is partially true. Spamassassin uses a few of the things described on the article already.

Re:It'll work..except when it doesn't. (1)

OrangeMonkey11 (1553753) | more than 5 years ago | (#28870413)

you've hit the nail on the head also considering they said the app catches 70% of the spam , so what happen to the other 30%

Re:It'll work..except when it doesn't. (1)

Have Brain Will Rent (1031664) | more than 5 years ago | (#28870509)

You are right, it is a cat and mouse game. The problem is that the solution being employed is looking at the wrong mouse and the wrong cat.

In this case the mice are the spammers themselves - the people - not the messages. And the cat shouldn't be anti-spam software, at least not in the sense of detect and eliminate software. The cat should be a bounty on the spammers themselves. There are always people who know who the spammers are. Those people are likely just as unscrupulous as the spammers so they can be induced to rat out the spammers for a reasonable reward. Think of the amount of money spent on software to deal with this, the value of ISP resources, the value of individual time dealing with this etc. It should be possible to offer some pretty significant rewards in return for helping with the elimination of the spammers.

The same method would work with those who deliberately spread a virus/worm for any reason.

Re:It'll work..except when it doesn't. (1)

TheBeardIsRed (695409) | more than 5 years ago | (#28870519)

Did you read the article? I mean, sure it is a cat and mouse game, autonomous system manipulation and IP based forensics goes a little beyond the "characteristics of the message".

Re:It'll work..except when it doesn't. (0)

Anonymous Coward | more than 5 years ago | (#28870997)

Well, yes, and how is a 70 percent effectiveness justified? Who is that good enough for? You'll lose 3 out of 10 emails, but you'll be mostly spam free? Great.

You'd think a simple keyword blocker would achieve results better than 70 percent. Maybe they can tune it better, maybe not. Either way, it's pretty useless right now.

RFC 3514 (4, Funny)

Anonymous Coward | more than 5 years ago | (#28868407)

Problem already solved back in 2003, I don't get any spam now.

Re:RFC 3514 (4, Informative)

darpo (5213) | more than 5 years ago | (#28868639)

For those who don't feel inclined to Google for it:

"The evil bit is a fictional IPv4 packet header field proposed in RFC 3514, a humorous April Fools' Day RFC from 2003 authored by Steve Bellovin. The RFC recommended that the last remaining unused bit in the IPv4 packet header be used to indicate whether a packet had been sent with malicious intent, thus making computer security engineering an easy problem."

Re:RFC 3514 (1)

NevarMore (248971) | more than 5 years ago | (#28871111)

Fictional?!?!?!?

Well then I guess its time to go polish up the old resume.

I don't get it... (1, Interesting)

KC7GR (473279) | more than 5 years ago | (#28868411)

Why do we need a crazily complex scheme like this when a simple entry in your router's 'Deny' list (for the source IP of the spam) has the same end effect?

Given the spew pouring out of the IP space of China, LACNIC, and Russia, blocking in such a manner appears to be near-lossless compression.

Re:I don't get it... (3, Insightful)

BlueKitties (1541613) | more than 5 years ago | (#28868515)

Many spam messages are propagated by botnets, spoofed IPs, etc, so that isn't a perfect solution. Really, we need to combine different approaches, instead of trying to find a holy-grail.

Not practical. (0)

Anonymous Coward | more than 5 years ago | (#28868613)

And for those of us who do business with Chinese entities that have a ".cn" at the end of their domains?

Am I going to have to request a whitelist entry every time I get a new contact?

And what happens when someone tries to contact me out of the blue before I have a chance to white list them?

Re:Not practical. (4, Funny)

oldspewey (1303305) | more than 5 years ago | (#28868769)

what happens when someone tries to contact me out of the blue before I have a chance to white list them?

Absolutely nothing happens ... at least from your perspective.

Re:Not practical. (1)

gnick (1211984) | more than 5 years ago | (#28869389)

Slightly off-topic, sorry, but I think it's abysmal enough to post and interest a few (or just make you thankful you're not here.)

"Absolutely nothing" is my company's solution to filtering out large or suspect attachments. If somebody sends me an attachment and my company's filters don't like it, the e-mail is dropped. I don't get a notice saying, "This e-mail contains suspicious attachments and has been removed." My customer doesn't get a reply saying, "This e-mail could not be delivered to the recipient because it contained suspicious attachments." Nothing - Zip, zero, nothing. My customer thinks it went through and it's invisible to me.

After numerous complaints to IT, the response was that I need to contact each of my customers and any of their contacts that may be sending e-mail that I may be copied on with an attachment and have them call me on the phone any time they send on so that I know to expect it.

Beautiful, huh?

Re:I don't get it... (1)

JoeBuck (7947) | more than 5 years ago | (#28868745)

Spam is almost exclusively produced by botnets. Vulnerable computers exist all over the world, so it shouldn't be surprising that more spam comes from outside your country (wherever you live) than inside. You, personally, have no one in China or Russia that you correspond with, but a debtor nation like the US is in a rather poor position to f*ck with the legitimate mail traffic of its main creditor. The most effective way to kill spam would be to aggressively eliminate botnets, wherever they are. A machine determined to be a member of a botnet could be isolated, blocked from sending email any place other than the support address of its ISP. Access could be restored when the machine is disinfected.

Re:I don't get it... (2, Interesting)

Lennie (16154) | more than 5 years ago | (#28869433)

Many have found, if your outside the US, blocking US is much more effective then blocking China and Russia.

Re:I don't get it... (1)

element-o.p. (939033) | more than 5 years ago | (#28870645)

Not in my experience, for however much or little that's worth.

I found that the bulk of UCE that hit my mail server came from either China or Korea. After I began blocking all IP addresses from either of those two countries, I found the amount of spam hitting my inbox was almost nil.

Of course, it was my personal mail server, and I don't have any contacts in either of those countries, so the SNR from China and Korea was essentially zero (no signal, all noise). YMMV, however.

Re:I don't get it... (1)

element-o.p. (939033) | more than 5 years ago | (#28870513)

A machine determined to be a member of a botnet could be isolated, blocked from sending email any place other than the support address of its ISP. Access could be restored when the machine is disinfected.

That's what we did at the ISP I used to work at.We ticked off a few customers but not as many as were ticked off at us before we implemented that policy. I was amazed at how vocal our customers could be when AOL started rejecting our e-mails...

Re:I don't get it... (1)

Drakin020 (980931) | more than 5 years ago | (#28868787)

Because many spam emails are generated from open relay servers.

Global companies (1)

mu51c10rd (187182) | more than 5 years ago | (#28868793)

I hear this suggestion a lot. However, many of us work for global companies that deal with legitimate email from these countries. We can't just reject IP blocks for countries when we have dealings in them. China and Russia are huge for international companies.

Re:I don't get it... (1)

TheRaven64 (641858) | more than 5 years ago | (#28870305)

Good plan, block the countries sending the most spam. Currently, most spam is sent from the USA. I notice that your mail server is in the USA, so unfortunately this means you won't be able to contact anyone adopting this plan, but I don't think it's too high a price to pay for reducing the total amount of spam.

Re:I don't get it... (1)

John Hasler (414242) | more than 5 years ago | (#28870459)

> Good plan, block the countries sending the most spam.

No, just block countries that send a lot of spam and in which you have no correspondents. Obviously this will work well for some and poorly for others. If it won't work well for you don't do it.

My solution stops spam completely (0)

Anonymous Coward | more than 5 years ago | (#28868421)

I figured out how to stop 100% of spam. I've disconnected my mail server from the internet. Sure, it catches a few false positives that way, but that's really the best part... the more spam I get, the lower the false positive rate!

Spammers evolve from experience (3, Insightful)

pearl298 (1585049) | more than 5 years ago | (#28868483)

Just like other criminals, spammers must quickly respond to what actually works. In essence this is the flaw in any "security by obscurity" scheme, the bad guys simply respond to whatever works. If you get to try several billion times a day then you can try a whole lot of combinations.

.3% false positive is pretty high (5, Insightful)

Dynedain (141758) | more than 5 years ago | (#28868503)

That means that in my office of 50 people, with an average of 50 emails per day (a very very low estimate), we'd get 7-8 false positives daily. I'd hear bloody murder if that was the case.

We get a lot more mail than that per day, and our spamassassin without autolearning (simply flag anything higher than 5.0) does a hell of a lot better job than that... down in the range of 1-2 false positives a month. Assuming a low daily average of emails (like my example), that's .002% false positives.

Re:.3% false positive is pretty high (0)

Anonymous Coward | more than 5 years ago | (#28868595)

And a 70% hit rate is pretty low. And it seems a bit odd to pitch this as anything new just because the process doing the inspection isn't a SMTP service.

Re:.3% false positive is pretty high (1)

Sockatume (732728) | more than 5 years ago | (#28868717)

And of course, if you want to actually spot the false positives, you have to let all the spam hit the mail server anyway. Unless you're willing to just ignore all the spam packets and put up with all those false positives being lost to the ether, this won't reduce your mail processing load at all.

Re:.3% false positive is pretty high (1)

dyingtolive (1393037) | more than 5 years ago | (#28868807)

It is somewhat ambiguous, but I had read it 0.3%, not 3%, which implies that you'd lose 0-1 emails/day if you were averaging 50 total a day. Still higher that way than your current method, but nowhere near as bad as 7-8 daily.

Re:.3% false positive is pretty high (1)

Sockatume (732728) | more than 5 years ago | (#28868975)

50 a day * 50 people = 2500 messages, 2500 messages * 0.3% = 7.5 emails.

Re:.3% false positive is pretty high (1)

dyingtolive (1393037) | more than 5 years ago | (#28869233)

Ah, right. For some reason, I was reading 50 emails a day total. I seem to have taken my stupid pills today.

Re:.3% false positive is pretty high (0)

Anonymous Coward | more than 5 years ago | (#28869477)

I've gotten ~3500 Nagios emails since end of April. One of the guys is marking all of them "unread" until he quits. He's at over 9000.

Way too high I think. (1)

TheLink (130905) | more than 5 years ago | (#28871003)

But do those 2500 messages include spam or are they just the mails that get through the existing spam filters?

Otherwise my understanding of the 0.3% false positive is where 100% = the total number of emails.

Which is rather unacceptable given the handling of false positives, and the total number of emails could be very high when you include spam.

Re:.3% false positive is pretty high (1)

scorp1us (235526) | more than 5 years ago | (#28869977)

Right, you read it wrong, like you were supposed to. 70% = 0.7, 30%= 0.3. Ergo, if it isn't catching spam correctly, its marking the rest as spam, that way you catch all the spam! I wonder at what point in time it'd be better to reject everything and just deal with escalated messages (to phone calls, txts, tweets, etc). Then you can ignore email all together.

Re:.3% false positive is pretty high (2, Informative)

Ioldanach (88584) | more than 5 years ago | (#28870879)

From the article, "The end result was a system capable of detecting spam 70 percent of the time, with a 0.3 percent false positive rate." The summary dropped an instance of the word "percent". I wasn't sure how to read it either so I specifically looked for the source of the 0.3 in the original.

Re:.3% false positive is pretty high (1)

Ioldanach (88584) | more than 5 years ago | (#28870943)

50 * 50 * .3% = 2500 * .003 = 7.5, so yes 7-8 emails per day. 3% would be 75 false positives per day. Incidentally, the 70% success rate if every person got one spam for every good email means the company would still receive 750 spams per day, or 15 per person per day.

Re:.3% false positive is pretty high (1)

element-o.p. (939033) | more than 5 years ago | (#28870705)

I wonder if you could make this technology a plug-in to SA to simply bump up the spam score by, say, a point and continue with your SA filtering anything higher than 5.0?

If you going to cut & paste, then do it correc (1)

davebarnes (158106) | more than 5 years ago | (#28868555)

The original is "The end result was a system capable of detecting spam 70 percent of the time, with a 0.3 percent false positive rate."

Re:If you going to cut & paste, then do it cor (1)

godrik (1287354) | more than 5 years ago | (#28868999)

Oh yeah. I was thinking a rate of 0.3 was huge. 0.3 percent is much better but still not acceptable.

False positive rate? (4, Insightful)

johndiii (229824) | more than 5 years ago | (#28868577)

0.3 would be terrible - three out of ten false positives. 0.3 percent - what the article actually says - is not too bad. But current techniques allow me to check the spam bin for such messages. This technique would pretty much preclude that capability, since the mail would never arrive at the server. I'm not sure that a rate of 0.003 would be acceptable under those circumstances.

Re:False positive rate? (1)

santax (1541065) | more than 5 years ago | (#28868819)

Help me here... Personally I would think that if 10 is 100% 0.3 is less than 1 mail. And not 3 out of 10. Personally I'd rather deal with spam than mis out one 1 legitimate mail. My own personal anti-spam filter is quite rough but I don't mis that many mails. And when my mail filters blocks spam, it sends out a message with redirections to an alternative gsm-number telling them to call me so I can whitelist the adres. I had about 4 times people calling me. Not one of those was a spamwhore :) So the granted whitelist turned out to work perfect.

Re:False positive rate? (1)

amorsen (7485) | more than 5 years ago | (#28869005)

Personally I would think that if 10 is 100%

10 isn't 100%. 1 is 100%. That's how % is defined.

Re:False positive rate? (1)

element-o.p. (939033) | more than 5 years ago | (#28870895)

Personally I would think that if 10 is 100%

10 isn't 100%. 1 is 100%. That's how % is defined.

Trying to follow all of the numbers without any context is making my head hurt.

Neither TFS, GPP nor you were very clear on the key aspect of percentages: they are a ratio. You said, " 10 isn't 100%" but that's not necessarily true. Ten out of how many? 10 out of 10 is 100%. However, expressed as a ratio, 10/10 = 1, which is what you said is how 100% is defined (100 per cent, i.e., 100 per 100, or 100/100 = 1 = 100%). Since no one specified ten out of how many total, 10 could be 1%, 100%, 1000% 3.14159265358% or 42%; you can't tell.

</pedantic>

Re:False positive rate? (2, Interesting)

raju1kabir (251972) | more than 5 years ago | (#28869081)

Help me here... Personally I would think that if 10 is 100% 0.3 is less than 1 mail. And not 3 out of 10.

.3 is 300 out of 1000.

.3% is 3 out of 1000.

It's similar to the confusion created when idiots write "It only costs me .25 cents to make a phone call" when they really mean ".25" or "25 cents".

Re:False positive rate? (5, Insightful)

vux984 (928602) | more than 5 years ago | (#28869287)

And when my mail filters blocks spam, it sends out a message with redirections to an alternative gsm-number telling them to call me so I can whitelist the adres.

That's called back scatter and its as bad as spam.

Think about it, my mail servers block about 35,000 spam per day. If they sent a message to each failed recipient with alternative instructions, that would be 35,000 messages I sent out. Some 34,990 of those messages would either be undeliverable or would get delivered to people who had nothing to do with the original message. You are effectively clogging up a bunch of innocent peoples mail systems with your messages.

Put it another way, suppose some spammer sends 1,000,000 messages with your email address spoofed as the sender. If everyone else did what you do, you would then receive 1,000,000 messages back to your inbox giving you alternate instructions to contact these people.

You wouldn't want that. Nobody else does either. So please stop.

Re:False positive rate? (0)

Anonymous Coward | more than 5 years ago | (#28870751)

And the undeliverable messages cause their own backscatter and on and on and on...

Re:False positive rate? (1)

element-o.p. (939033) | more than 5 years ago | (#28870981)

Mod parent up!

Back scatter spam has been a known issue for a long time now. There's no more excuse for anyone still operating a mail server this way than there is for anyone still knowingly operating an open relay (since for all intents and purposes, that's what this is).

Re:False positive rate? (1)

girlintraining (1395911) | more than 5 years ago | (#28868881)

0.3 percent false positive

They predicted something around 97 billion e-mails per day sent in 2007. I wouldn't want to guess what it's at today, but it's probably higher. Regardless, 0.3% of the emails equates to about 291 million legitimate emails per day black holing. No errors. No "marked return to sender". It just vanishes, eaten by the shub internet. Oops. And we can be pretty sure those numbers are higher -- this is a back of the envelope analysis.

Re:False positive rate? (1)

amorsen (7485) | more than 5 years ago | (#28869047)

No errors. No "marked return to sender".

If the box just dumps the packets on the floor, the sender will eventually get an error message from their mail server. Of course the mail server will have tried uselessly quite a lot of times (for days, usually) before giving up.

Re:False positive rate? (0)

Anonymous Coward | more than 5 years ago | (#28869451)

Ya know what? If you can't make a mail message that doesn't look like spam, I don't want to hear from you.

Re:False positive rate? (1)

mshieh (222547) | more than 5 years ago | (#28871113)

.3% false positive rate isn't bad but isn't great. However, you have to think of this approach as a technique rather than a solution. An effective anti-spam solution will combine several techniques, so the false-positive rate of any individual technique won't be enough to reject mail. Also, the penalty for flagging a mail as spam can be scored in a way that mail is not lost. For example, yahoo is notorious for flagging legitimate mail as spam, but generally delays the mail via greylisting instead of rejecting it outright.

When combined with other scoring mechanisms into an overall heuristic, .3% is tolerable as one tool in the box. However, my first impression is that this is at best an incremental improvement over an IP blacklist.

Re:False positive rate? (1)

gujo-odori (473191) | more than 5 years ago | (#28871453)

Actually, that's horrible, especially at such a low catch rate. I work for one of the major anti-spam vendors, and if our FP rate was that high, the only thing that would stop our customers from killing us is the fact that they would all be former customers. People get called in the middle of the night for an FP rate much, much lower than that. And our catch rate is way, way north of 99%.

At a catch rate of only 70%, we could guarantee zero false positives. Ever. Anyone who gets an FP rate that high at a catch rate of only 70% has nothing to brag about. I'd be ashamed to show my face in public, let alone publish my results.

Just analyze the source.... (0)

Anonymous Coward | more than 5 years ago | (#28868607)

Did the e-mail message originate from Taiwan, Indonesia, or some other third-world country? If so, block it.

Re:Just analyze the source.... (1)

jarl1976 (1000672) | more than 5 years ago | (#28869097)

Taiwan is not a third world country, and depending on who you ask not even a country. Anyway blocking out all of asia is probably a bad idea for many businesses.

"IP addresses, he notes, are easy to fake." (2, Informative)

amorsen (7485) | more than 5 years ago | (#28868685)

IP addresses, he notes, are easy to fake.

Sure, you can fake your IP address so you get past this filtering, because it just looks at the first packet. It won't help you though, because you can't complete a TCP 3-way handshake from a fake address, and without doing that you can't actually send spam.

Re:"IP addresses, he notes, are easy to fake." (0)

girlintraining (1395911) | more than 5 years ago | (#28868979)

You can't complete a TCP 3-way handshake from a fake address...

Oh ye of little faith....

Re:"IP addresses, he notes, are easy to fake." (3, Insightful)

Anonymous Coward | more than 5 years ago | (#28869101)

oh ye of little knowledge.

Re:"IP addresses, he notes, are easy to fake." (3, Funny)

Minwee (522556) | more than 5 years ago | (#28869161)

It's easy, really. All you need to do is use a fake address which happens to be exactly the same as your real address.

It's as simple as closing a user's browser window without using Javascript [thedailywtf.com] .

Re:"IP addresses, he notes, are easy to fake." (2, Interesting)

girlintraining (1395911) | more than 5 years ago | (#28871105)

oh ye of little knowledge.

If I compromise any layer 2 device on any network between you and the destination, not only can I fake the address, I can have it doing 480 spins in a pink tutu. Have you read any of the reports from the major network access points around the world? Bogus packets pass through them all the time. They even have a name for them -- martian packets.

Re:"IP addresses, he notes, are easy to fake." (1)

element-o.p. (939033) | more than 5 years ago | (#28871159)

Research before slamming others, please.

It is possible to spoof an IP address and fake a TCP three-way handshake from a fake address. The trick is that any modern OS randomizes TCP sequence numbers to make it difficult to "complete" the three-way handshake without actually receiving part 2 of the three-way handshake. However, if you have the analytical tools to guess the correct sequence number to send back in part 3 of the three-way handshake, you're golden.

It's not exactly trivial, but girlintraining is correct -- it is possible to complete a three-way handshake from a fake address.

Still reaching its destination (1)

darpo (5213) | more than 5 years ago | (#28868701)

Isn't this just pushing the processing back a level, but still arriving at its destination? I guess you could implement bandwidth-provider-level (i.e. before the customer even gets their packets) spam filtering this way, but I'm sure most organizations would prefer to retain control by doing their own filtering.

Spatio-temporal (5, Funny)

CopaceticOpus (965603) | more than 5 years ago | (#28868711)

So this software functions in both space AND time? Fascinating.

It's good that they specified that in the name, to avoid questions such as "Will this software work in the universe which we inhabit?"

Re:Spatio-temporal (1)

amorsen (7485) | more than 5 years ago | (#28869107)

Perhaps they should add some disclaimers [physics.uwo.ca] , just to be completely sure.

Re:Spatio-temporal (0)

Anonymous Coward | more than 5 years ago | (#28869259)

my kingdom for a modpoint!!!! +5 awesomeness.

I'd use ... (1)

neonprimetime (528653) | more than 5 years ago | (#28868749)

a baseball glove.

But I'd first have to question why somebody is throwing spam at my mail server in the first place?

IronPort and the ilk (1)

snooz_crash (802357) | more than 5 years ago | (#28868779)

I've got a device in front the mail server, many people do. These and others work fine. Sorry for folks that don't have one. As long as it is free, it will be abused. Someone already said it was cat and mouse.

Is that really a practical trade-off? (2, Interesting)

damn_registrars (1103043) | more than 5 years ago | (#28868921)

It sounds like this approach would be fairly CPU intensive; analyzing the characteristics of packets, comparing them to other packets, looking for information on their originating systems, etc... It seems like they are throwing a non-trivial amount of computational time at the problem in order to spare the storage space that would be otherwise taken up by spam.

And of course as others have already pointed out, this just starts another round of whac-a-mole by pursuing this avenue.

Re:Is that really a practical trade-off? (0)

Anonymous Coward | more than 5 years ago | (#28869649)

Actually it should be pretty straight forward. I use a similar system system, for about 5 years now. Turned of spamassassin a year ago because of high CPU usage.
My system inspects/judges the first packet from any unknown source. System is firewall rules connected to SQL DB (PostgreSQL) , for a time I would run it on a bridge in front of the mail servers with parallel db. Turns out I didn't need that either.

Re:Is that really a practical trade-off? (1)

element-o.p. (939033) | more than 5 years ago | (#28871211)

I was thinking the same thing, only along a slightly different line:

These include...the number of ports open on the sending machine.

WTF? Does the filter nmap the sending mail server before accepting the message?!?!

A Spam Filter is like DRM (1)

olsmeister (1488789) | more than 5 years ago | (#28868929)

Regardless of how complex you make it, someone will always eventually figure out a way around it.

Wrong approach (4, Insightful)

Animats (122034) | more than 5 years ago | (#28868993)

The fundamental property of spam is that it involves many similar messages going to a large number of destinations. That's what to look for. Google can do that, because they manage a very large number of mailboxes with a single system. SpamCop used to do that, but they had to be in the mail-forwarding business to do it and that was too expensive.

Trying to detect spam by looking only at the mail for a single account is inherently a form of guessing. The existing technologies are reasonably good, but not good enough that the spammers give up.

Re:Wrong approach (0)

Anonymous Coward | more than 5 years ago | (#28870159)

If you read the paper, the authors are doing exactly what you suggest (applying analysis across a large number of destinations).

Re:Wrong approach (1)

cpghost (719344) | more than 5 years ago | (#28870211)

The fundamental property of spam is that it involves many similar messages going to a large number of destinations.

It won't be long until the zombies create individual spams for each recipient. Just scramble the catch words, add some random stuff to the gifs so they message-digest differently etc..., and there's not enough similarity in the messages anymore to be statistically detectable. If at all, traffic analysis would help, but here too, botnets are extremely flexible and could spread batch runs in IP-space and time domain quite effectively, if need be. It's a never ending arms' race.

Re:Wrong approach (1)

jonbryce (703250) | more than 5 years ago | (#28870469)

Messagelabs are in the mail-forwarding business, and they seem to manage to make money out of it.

LinuxMagic already did this (0)

linuxmagicinc (1608019) | more than 5 years ago | (#28869031)

This isn't news... The team at LinuxMagic Inc (http://www.linuxmagic.com [linuxmagic.com] ) has already been doing this for years with their MagicMail Server product (http://magicmail.linuxmagic.com [linuxmagic.com] ), and more recently with the new MagicSpam software (http://www.magicspam.com [magicspam.com] ) which can be installed on any email server.

Re:LinuxMagic already did this (0)

Anonymous Coward | more than 5 years ago | (#28869551)

Wow, that's some ridiculously blatant spamvertising. I'm going to take this opportunity to say that I will actively avoid using that product PURELY because of your posting here, and will do whatever it takes to find an alternative, should I need said product.

I mean... spam is spam... but you're just trolling your product.

Re:LinuxMagic already did this (1)

babywhiz (781786) | more than 5 years ago | (#28870957)

The spam filter we use already does a geography-based check. Even allows you to choose how to classify it based on geography....as well as IP, grey listing, header, recipient, sender, subject, content, bayesian pattern, honeypot.... My complaint anymore is not about the amount of spam making it in (we have had 1 that slipped thru the filters in the last 6 months, but that is because it actually spoofed an email address on our whitelist (we don't whitelist domains at all). It's the amount of traffic created, and how huge our log files get, and even if we set the amount of logging to limit log file size, then we end up with HUNDREDS of smaller log files.

Re:LinuxMagic already did this (1)

babywhiz (781786) | more than 5 years ago | (#28871093)

Oh, and I don't use LinuxMagic LOL...

Uhh... Qpsmtpd? (0)

Anonymous Coward | more than 5 years ago | (#28869089)

Why this would matter is that in high volume sites they would, in theory, consume less resources and also quarantine the offending spam server.

For us mere mortals though qpsmtpd is pretty awesome.

Happy debugging! (0)

Anonymous Coward | more than 5 years ago | (#28869111)

If you set up such a packet-based filter and get a bug in your config (or the environment changes rendering your diligently-crafted config inappropriate), then you may end up with the wEiRdEsT error situations. Missing your new client's orders? Not receiving that hello email from the cutie you gave your address at yesterday evening's party? Bad luck, dear!

Not to mention other applications going gaga. Whoops, who would think a rotten packet filter might affect non-email packets?

Oblig Checklist (3, Funny)

crymeph0 (682581) | more than 5 years ago | (#28869125)

Your post advocates a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(x) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
(x) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
(x) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:Oblig Checklist (1)

dkleinsc (563838) | more than 5 years ago | (#28869387)

I think you missed a few:
(X) Bandwidth costs that are unaffected by client filtering

(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical.

Turn the telescope around (0)

Anonymous Coward | more than 5 years ago | (#28869133)

When will people understand the one simple, essential truth about spam?

Attacking the supply of spam will never work, except temporarily.

Attacking the demand for spam is the only possible way to fix it.

Two things: (1)

Hurricane78 (562437) | more than 5 years ago | (#28869147)

First: I do not want others to decide what's spam for me.
Second: I got graylisting, amavisd with spamd & co, and more. Why exactly would I put such a system on every other node of the net too? To throw away resources?

Blue Frog or Part 68 of FCC Code (0)

Anonymous Coward | more than 5 years ago | (#28869219)

Two thoughts. 1) Why doesn't anyone come up with an open source version of Blue Frog legal DOS attack on the merchants that fund the spammers? 2) Is it possible that at least in the US that a computer connected to the public internet and infected with a virus violates part 68 of the FCC code, and therefore the owner could in esssence be fined for being an idiot and not running any of the free anti-virus software?

Maybe we could fund anti-spam efforts from fines for spam-bot supporters.

Part 68 ...Under Part 68, wireline telecommunications carriers must allow all Terminal Equipment (TE) to be connected directly to their networks, provided the TE meet certain technical criteria for preventing four proscribed harms. These harms
are...degradation of service to customers other than the user of the TE...

with a 0.3 false positive rate (1)

QuietLagoon (813062) | more than 5 years ago | (#28869579)

What exactly does this mean? A rate is usually a comparison of two values. What two values were compared to get 0.3?

Sendio Solution (0)

Anonymous Coward | more than 5 years ago | (#28869623)

My business has been using Sendio ESP for about a year now with absolutely no false positives and nearly complete elimination of unwanted spam. If we utilized all of the features, I'm sure the spam would be completely eliminated.

Not that precise (1)

Big_Monkey_Bird (620459) | more than 5 years ago | (#28869913)

Big whoop. All it does is block email with IP addresses from France, Belgium, Russia, Italy, and Argentina.

Sounds like TurnTide (1)

rysar (1144437) | more than 5 years ago | (#28870181)

I want to try to keep this as non-spam as possible, but Symantec acquired a company about 5 years ago called TurnTide that did almost *exactly* that. Take the reputation of the sending address, and shape the TCP/IP packets to slow down the rate of mail into the system. Symantec touts a 70% reduction in mail volume and an 80% reduction in the amount of spam that hits a mail server. I've had it in production in one environment where the customer went from approximately 5 million messages/day to 500,000 messages/day.

I hope they don't get rid of my spam folder. (1)

FlyingSquidStudios (1031284) | more than 5 years ago | (#28870269)

It's become a source of unending comedy as spammers who aren't very good at English in the first place use a dictionary and thesaurus to get past the filtering software resulting in extremely entertaining subject lines. For example-

YOU REMEMBER WHEN SEX WAS THE LAST TIME? REFRESH THE MEMORY OF VIA GRA!

No more hair Rogaining medicine.

GIRLS DO ANYTHING FOR A BIG HOSE

It boosts your rod!

Make two days nailing marathon

for your delicate advantage

And all that is just from the most recent page in my spam folder.

I don't understand... (0)

Anonymous Coward | more than 5 years ago | (#28870533)

We already have a method to securely transfer data over SSL and verify the identity of the originating party, and virtually everyone trusts this method with their banking information among other information.

Can't this exact same process be leveraged to help fight spam? SMTP servers already support SSL, so _when used_ why not start verifying SMTP server SSL certificates and the identity of the originating server, if it matches simply reduce the likelihood that the email is spam (-5 score in SPAM ASSASSIN or something), or +5 if the mail comes from a server without a valid certificate.

Combine this with domain keys and eventually it should eliminate spam from botnets, as there is no way they would purchase SSL certificates and setup domain keys for each compromised host, and if they did it would just provide a nice little list of IP addresses to block.

To deal with spam coming from verified servers with certificates simply setup a service that assigns spam complaints to each certificate and a formula that raises the spam score from servers with higher complaint rates. Almost like a FICO/Credit score for email servers.

Since SSL certificates would cost money ($100 or so) and are verified against a corporation/personal identity, it would be relatively difficult/expensive for someone to obtain enough certificates to circumvent the system.

Don't worry about false positives (0)

IGnatius T Foobar (4328) | more than 5 years ago | (#28870567)

False positives are not that big a deal here. They show why it's actually better to reject spam instead of filter it. When you reject spam, false positives result in the sender getting a bounceback. They know their email didn't reach you. Rejecting spam, not filtering it, ought to be the predominant model.

Re:Don't worry about false positives (1)

Bondolo (14225) | more than 5 years ago | (#28870837)

Except that the sender's source domain is almost always forged in spam. So, as an owner of several domains, I get hundreds of bounce messages per day in response to spams sent with my one of domains as the source domain. The "Undeliverable Mail" messages I receive have become, for me, almost worse than the spam.

Nothing extraordinary... (1)

nudzo (1591357) | more than 5 years ago | (#28871397)

Technology which is already here for a long time has now a buzzword - SNARE. For example OpenBSD spamd doing the same based on blacklists, greylists and even on Operating System fingerprints. Wheel is reinvented again... ;-)
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>