Spam Analysis
Total Page:16
File Type:pdf, Size:1020Kb
Analysis of Spam Anselm Lambert A dissertation submitted to the University of Dublin, in partial fulfilment of the requirements for the degree of Master of Science in Computer Science Department of Computer Science, University of Dublin, Trinity College September 2003 Declaration I declare that the work described in this dissertation is, except where otherwise stated, entirely my own work and has not been submitted as an exercise for a degree at this or any other university. Signed: ___________________ Anselm Lambert September 9th, 2003 ii Permission to lend and/or copy I agree that Trinity College Library may lend or copy this dissertation upon request. Signed: ___________________ Anselm Lambert September 9th, 2003 iii Acknowledgments I would like to thank Pádraig Cunningham for submitting this intriguing topic as a dissertation project. Thanks also to my classmates who strived to achieve the highest standards throughout the year while at the same time injecting humour and novelty into the learning process. iv Abstract Spam is a pervasive annoyance in the lives of the Internet user. It has exploded into all facets of communications from mobile phones to personal organisers, and it has become a topical subject of discussion due to recent media coverage. Spam has a tangible cost measured in lost productivity, bandwidth usage, administration, and invasion of privacy. As a result, an anti-spam industry has evolved in order to counter the spam attack with a focus on two spam-filtering categories: collaborative techniques and content-analysis techniques. This research involved analysing a wide variety of e-mail in order to produce a profile of spam and, more importantly, develop a profile of the spammer. A number of fundamental questions are answered, for example: are current definitions of spam adequate and if so, are they globally applicable? There was also an investigation to examine the possibility of a spammer successfully targeting e-mail to an individual or group of individuals. In this study, honeypot accounts were created and positioned to receive spam. The outcome of this research is a definitive guide to spam, which will provide researchers and regular Internet users alike with knowledge that will aid them in the fight against spam and facilitate the improvement of spam filtering techniques. v Table of Contents Declaration.......................................................................................................................... ii Permission to lend and/or copy..........................................................................................iii Acknowledgments.............................................................................................................. iv Abstract............................................................................................................................... v Chapter 1 ........................................................................................................................... 1 Introduction....................................................................................................................... 1 1.1 Motivation............................................................................................................... 2 1.2 Objectives ............................................................................................................... 3 1.2.1 Spam Analysis .................................................................................................... 4 1.2.2 Creation of a Spam Profile.................................................................................. 4 1.2.3 Creation of a Spammer Profile ........................................................................... 5 1.2.4 Examination of Spam Targeting ......................................................................... 5 1.3 Document Outline................................................................................................... 6 Chapter 2 ........................................................................................................................... 7 State of the Art .................................................................................................................. 7 2.1 Spam Overview....................................................................................................... 7 2.2 Spam Profile............................................................................................................ 7 2.3 Definition of Spam.................................................................................................. 7 2.3.1 Characteristics of Spam ...................................................................................... 9 2.3.2 Spam Breakdown.............................................................................................. 10 2.4 Top Spam E-mails................................................................................................. 10 2.5 False Positives....................................................................................................... 11 2.6 Economics of Spam .............................................................................................. 12 2.6.1 Cost of Spam..................................................................................................... 12 2.6.2 The Spam Industry............................................................................................ 13 2.6.2.1 Reputable Bulk E-mailers................................................................................. 14 2.6.3 The Anti-Spam Industry ................................................................................... 14 2.7 Legal Response ..................................................................................................... 15 2.7.1 Legal Action against Spammers ....................................................................... 16 2.7.2 Legal Action against Anti-Spammers............................................................... 18 2.8 Anti-Spam Legislation.......................................................................................... 19 2.8.1 United States ..................................................................................................... 19 2.8.2 Europe............................................................................................................... 20 2.8.3 Legislative Action Worldwide.......................................................................... 20 2.9 Success of the Legislative Approach .................................................................... 21 2.10 Opt-In versus Opt-Out Legislation ....................................................................... 21 2.11 Chapter Summary ................................................................................................. 22 Chapter 3 ......................................................................................................................... 23 Spammer Tactics and Tools........................................................................................... 23 3.1 Overview............................................................................................................... 23 3.2 Spammer Profile ................................................................................................... 23 3.2.1 Spammer Motivation ........................................................................................ 25 3.2.2 How a Spammer gets your E-mail Address...................................................... 25 3.3 Spamware.............................................................................................................. 27 vi 3.3.1 E-mail Harvester/Extractor ............................................................................... 27 3.3.1.1 Extracting Addresses from Newsgroups........................................................... 28 3.3.2 Desktop Server Software .................................................................................. 28 3.3.3 E-mail List Verifier........................................................................................... 29 3.3.4 E-mail List Manager ......................................................................................... 29 3.3.5 Targeting Software............................................................................................ 29 3.4 Spammer Support Services................................................................................... 30 3.4.1 Bulletproof Hosting .......................................................................................... 30 3.5 Spammer Tactics................................................................................................... 31 3.5.1 Dictionary Attack.............................................................................................. 32 3.5.2 Spambots........................................................................................................... 32 3.5.3 Spoofing............................................................................................................ 32 3.5.4 Bandwidth Theft ............................................................................................... 33 3.5.5 Bypassing Filters............................................................................................... 34 3.5.6 Spam Lists......................................................................................................... 34 3.5.7 Addresses that Spammers Avoid .....................................................................