Original URL: https://www.theregister.com/2007/04/02/spam_sucks/
Spam: it sucks like a tarpit
Trapping the pump'n'dumpers
Posted in Channel, 2nd April 2007 14:10 GMT
Spam sucks. That is the conclusion reached by a roomful of scientists at MIT on Friday after hearing a bunch of new research papers pitched at dealing with the problem.
Before adjourning to the pub, the group voted on the best paper. The award went to Ken Simpson, founder and CEO of Vancouver-based Mail Channels.
Simpson's paper was one of two covering tarpit simulators. Tarpit simulators are a way of throttling delivery times - slowing the speed of the bits - of suspected spam. For example, think of a web page loading very slowly. You'll kill the attempt and retry and often it will load quicker. The idea is that spammers are impatient and will give up if it is taking too long for their messages to get through.
Simpson's start-up company has been working on this for two and a half years, during which time the idea has mutated from the original goal of reducing spam into creating a product that would help deal with the volume.
"We had a theory that if spammers get impatient they will just go away," he said in his presentation. He was talking particularly about pump-and-dump spam – for example, the image-based messages that began appearing last November. He cited a New York Times study of a typical spam campaign of this type.
Just before the New York stock market closed on a Friday, a buyer acquired 11 million shares of an obscure penny stock. After a weekend of spam, the stock touted in these messages ticked upwards in the first few minutes of trading on Monday, just enough to net the spammers about $20,000 for their weekend's rampage.
For campaigns like these, speed and timing are of the essence. Therefore, the spammers turned out to be surprisingly impatient. The Request for Comments documents (RFCs) on which good email practice is based recommend that a sender stay connected for 10 minutes to ensure that a message is sent successfully, which gave him an opportunity to observe senders' behaviours.
Simpson's research showed that 80 to 90 per cent of spam traffic drops off after two minutes – with no loss of legitimate traffic. With throttling in place, he says, the load is hugely reduced, dropping the amount of spam landing in junk folders by 90 per cent and the amount that escapes the filters and lands in inboxes by 25 per cent.
The price, however, is a huge rise in the number of concurrent connections, which are far above the number most mail transfer agents can handle. Mail Channels handles this by creating a middle layer, a front end for SMTP that multiplexes these many connections into a small number the MTA is comfortable with.
"I think eventually everybody will have to have throttling," said Simpson. "But others disagree."
Tobias Eggendorfer, author of the second tarpits paper, noted that greylisting has begun to fail. This technique, which many people fighting spam favour, relies on requiring senders to retry.
"Once they learn about retrying it starts to fail," he said. Eggendorfer also compared spam filters to painkillers: "It relieves the symptoms, but doesn't eliminate the cause."
For other types of spam, such as Nigerian 419 scams, this technique may be less effective as these spammers win if they snare a single human sucker, no matter how long it takes. The Spamnet (originally called Spamalot until Monty Python objected) project, from the University of Illinois at Chicago, set out to see if they could consume enough of the spammers' time and resources to make it not worth their while to continue.
The technique was simple enough and easily copied: reply to the spam with email expressing interest and asking for a phone call to a supplied phone number. Doing this manually resulted in as many as 50 email exchanges and numerous phone calls. Similarly, following the links in phishing messages and filling out web forms netted as many as 25 calls from mortgage brokers.
Based on this, the Spamnet group attempted to automate the process by creating three types of agent: Arthur (Nigerian 419), Patsy (web forms), and Lancelot (phishing), and achieved some success in getting spammers to interact with the agents. This technique might allow law enforcement and banks to track down and eliminate the sources of these types of attack.
Both these papers share another helpful characteristic: they do not break email as we know it. Other efforts, such as using multiple filters and detecting the obscured text in image spam (presented by Battista Biggio from the University of Cagliari) also seem promising.
Simpson's next effort, to be released soon, is working on a way to automate a way for senders to tell the receiving server that a message is not actually spam.
"It makes false positives a non-issue," he says.
Still, all the papers made one thing plain: spam isn't going away any time soon, despite all the research being thrown at the problem.
Which is why those outside the profession favour hiring a bunch of programmer-detectives and a couple of trained assassins instead. ®