USENIX Association Proceedings of the FREENIX Track: 2003 USENIX Annual Technical Conference San Antonio, Texas, USA June 9-14, 2003 THE ADVANCED COMPUTING SYSTEMS ASSOCIATION © 2003 by The USENIX Association All Rights Reserved For more information about the USENIX Association: Phone: 1 510 528 8649 FAX: 1 510 548 5738 Email:
[email protected] WWW: http://www.usenix.org Rights to individual papers remain with the author or the author's employer. Permission is granted for noncommercial reproduction of the work for educational or research purposes. This copyright notice must be included in the reproduced paper. USENIX acknowledges all trademarks herein. ASK: Active Spam Killer Marco Paganini
[email protected] www.paganini.net Abstract tion message is crafted in such a way that a simple re- ply keeping the “Subject” line intact will suffice. The We present Active Spam Killer (ASK), a program that confirmation message also contains a unique MD5 [16] attempts to validate unknown senders before allowing hash computed by combining the contents of the original delivery of their message. Validation occurs by means of email with a secret key known only to the recipient. This a challenge reply sent to senders who are not yet known prevents false confirmation returns as the code is based to the system. Messages are kept in a queue pending on the unique characteristics of the receiver. confirmation until the sender replies to the challenge. Further messages coming from confirmed senders are The message remains stored in the pending mail delivered immediately. In a sample of 1000 spam mails, queue until a confirmation return is received (a reply ASK was 99.7% effective at blocking spam, resulting in to the confirmation message with the MD5 hash in the only 3 spam messages being delivered.