Feeds

Spam: it sucks like a tarpit

Trapping the pump'n'dumpers

Internet Security Threat Report 2014

Spam sucks. That is the conclusion reached by a roomful of scientists at MIT on Friday after hearing a bunch of new research papers pitched at dealing with the problem.

Before adjourning to the pub, the group voted on the best paper. The award went to Ken Simpson, founder and CEO of Vancouver-based Mail Channels.

Simpson's paper was one of two covering tarpit simulators. Tarpit simulators are a way of throttling delivery times - slowing the speed of the bits - of suspected spam. For example, think of a web page loading very slowly. You'll kill the attempt and retry and often it will load quicker. The idea is that spammers are impatient and will give up if it is taking too long for their messages to get through.

Simpson's start-up company has been working on this for two and a half years, during which time the idea has mutated from the original goal of reducing spam into creating a product that would help deal with the volume.

"We had a theory that if spammers get impatient they will just go away," he said in his presentation. He was talking particularly about pump-and-dump spam – for example, the image-based messages that began appearing last November. He cited a New York Times study of a typical spam campaign of this type.

Just before the New York stock market closed on a Friday, a buyer acquired 11 million shares of an obscure penny stock. After a weekend of spam, the stock touted in these messages ticked upwards in the first few minutes of trading on Monday, just enough to net the spammers about $20,000 for their weekend's rampage.

For campaigns like these, speed and timing are of the essence. Therefore, the spammers turned out to be surprisingly impatient. The Request for Comments documents (RFCs) on which good email practice is based recommend that a sender stay connected for 10 minutes to ensure that a message is sent successfully, which gave him an opportunity to observe senders' behaviours.

Simpson's research showed that 80 to 90 per cent of spam traffic drops off after two minutes – with no loss of legitimate traffic. With throttling in place, he says, the load is hugely reduced, dropping the amount of spam landing in junk folders by 90 per cent and the amount that escapes the filters and lands in inboxes by 25 per cent.

The price, however, is a huge rise in the number of concurrent connections, which are far above the number most mail transfer agents can handle. Mail Channels handles this by creating a middle layer, a front end for SMTP that multiplexes these many connections into a small number the MTA is comfortable with.

"I think eventually everybody will have to have throttling," said Simpson. "But others disagree."

Tobias Eggendorfer, author of the second tarpits paper, noted that greylisting has begun to fail. This technique, which many people fighting spam favour, relies on requiring senders to retry.

Internet Security Threat Report 2014

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.