SPAM, SPAM, SPAM,...

Transkript

1 Dienstag, , Restaurant Gallusplatz, St. Gallen SPAM, SPAM, SPAM,... Prof. Dr. P. Heinzmann, ITA-HSR / cnlab AG, Tiefenaustrasse 2, CH-8640 Rapperswil peter.heinzmann@cnlab.ch url: cnlab / HSR 2/21/ ist neben World Wide Web (WWW) die gegenwärtig wichtigste Internet- Anwendung. Allerdings wird bei vielen Leuten die "Kommunikationsfreude" durch eine Flut von unerwünschten Mails - so genannten SPAM Mails - getrübt. Im Rahmen dieser Veranstaltung gehen wir folgenden SPAM-Fragen nach: - Was ist wirklich SPAM? - Wieso kennen plötzlich alle meine -adresse? - Was haben Viren und Würmer mit SPAM zu tun? - Wie kann ich mich gegen SPAM wehren? Im Rahmen des Vortrags sollen die Teilnehmenden vertiefte Kenntnisse zum Thema e- Mail/SPAM erlangen und entscheiden können, wie sie sich künftig gegen die SPAM-Flut wehren sollen. Referenzen: Mike Spykerman, Typical spam characteristics - How to effectively block spam and junk mail, White Paper, Red Earth Software. Spamming countermeasures: Howto gegen Schweizer SPAM: Michael Heuberger, Spamming Spamming the Internet, Hochschule Rapperswil, I- Seminar SS 2001, Release Matthias Rambold, Wie wird SPAM bekämpft?, Hochschule Rapperswil, I-Seminar WS 2001/02. 1

2 Cnlab Information Technology Research AG und Hochschule für Technik Rapperswil (HSR) ita.hsr.ch Gegründet 1997 HSR spin-off 10 Mitarbeiter Internet Security Performance-Testing Spezialanwendungen HSR: ITA: Teilschule der Fachhochschule Ostschweiz Studierende, 6 Abteilungen (Informatik, Elektrotechnik, Bauingenieurwesen, Maschinenbau, Siedlungsplanung, Gartenarchitektur) Kompetenzzentrum für Internet- Technologien und -Anwendungen cnlab / HSR 2/21/

3 Einleitung: Wie komme ich an meine TourLive-Kunden cnlab / HSR 2/21/

4 cnlab TourLive-Mobile System Positions-, Geschwindigkeitsund Bildinformationen von bewegten Objekten Sportler (Radfahrer/Biker, Wanderer, Langläufer, Inline- Skater, ) Personal (Securitas) Personen (Kinder) Online-Verfolgung Alarmierung bei Unfällen Event-Informationssystem Offline-Verfolgung Trainingsdatenanalyse Alternative Art zu Fotografieren cnlab / HSR 2/21/

5 Internet: the Net of Nets pc4.cnlab.ch cnlab.ch polizei.bayern.de switch.ch Router greenpeace.org hsr.ch sky.hsr.ch mci.com cnlab / HSR 2/21/ Das Internet ist ein Netz von Netzen. Die einzelnen Teilnetze - auch Domains genannt erhalten einen weltweit eindeutigen Namen (z.b. hsr.ch). Die Datenübertragung im Internet erfolgt paketweise. (Man spricht von Paketvermittlung.) Jedes Datenpaket enthält die Internet Protocol (IP) Adresse der Destination und des Absenders, d.h. jedem via Internet ansprechbaren Rechner muss eine (weltweit) eindeutige IP-Adresse zugewiesen werden. Die eigene IP-Adresse kann man sich im DOS- Fenser( Eingabeaufforderung) mit dem Befehl ipconfig anzeigen lassen. Die IP-Adresse, unter welcher man beispielsweise bei einem Web-Server bekannt ist, kann man sich auf darstellen lassen. Ein Teil der IP-Adresse (z.b ) bezeichnet das Teilnetz, der andere Teil bzw. die gesamte Adresse identifiziert einen bestimmten Rechner im entsprechenden Teilnetz (z.b ). Einen Rechnern kann man anstatt über die IP-Adresse (z.b ) auch über den Domain-Namen (z.b. ansprechen. Die Zuordnung von Domain-Namen zu IP-Adresse erfolgt über das Domain Name System (DNS). Weitere Informationen zur Domain-Namen- Zuordnung und zu den Inhabern von Domains findet man bei 5

6 Internet «Killer» Applications Web Suchmaschinen 2004: Mehr als die Hälfte der Schweizer Bevölkerung (51,2%) nutzt das Internet täglich oder mehrmals pro Woche. ( Ref: Nick Hösli, Baromedia 2001, Ringier AG, cnlab / HSR 2/21/ : 3,8 Millionen Personen das Internet. Dies entspricht 66,7% der Bevölkerung ab 14 Jahren. Mehr als die Hälfte der Schweizer Bevölkerung (51,2%) nutzt das Internet täglich oder mehrmals pro Woche. 6

7 Spezielle Suchmaschinen: Harvester 1. Phase: Web-Seiten mit Suchbegriffen finden Weiteren Links folgen 2. Phase: Adressen auf Web-Seiten Suchen cnlab / HSR 2/21/ search engines from 36 countries two HTML parsers Microsoft parser and built-in parser scripting technology to process found s on fly very flexible plugins technology flexible limiters of scanning range command line mode to automize 7

8 Was ist SPAM? cnlab / HSR 2/21/

9 SPAM History 1937: Hormel & Co. economical pork loaf called SPAM government did not allow to call it ham) advertising campaign for "Spamwich" or "Spambled eggs" 1970: Monty Python's Flying Circus Wikingersketch (SPAM) 1994: Laurence Canter and Martha Siegel made a newsgroup posting about a Green Card Lottery SPAM used for messages to flood newsgroups with irrelevant or inappropriate messages 2002: SPAM is getting a significant Internet problem cnlab / HSR 2/21/ US company Hormel Trademark: During the Great Depression, George A. Hormel 's ( ) company sold 1.5-pound cans of beef stew for only 15 cents, providing an affordable, filling, and nutritious meal for the families of unemployed workers. The beef stew and other "poor man's dishes" (including canned products such as corned beef and cabbage, spaghetti and meat balls, and chili con carne) were highly regarded in those lean years. "Encouraged by the success of its poor man's dishes, Hormel & Co. introduced an economical pork loaf in The canned meat ran into a major problem before it even got to market, however, when the U.S. government would not allow the company to call it ham, because it was made from pork shoulder instead of the hindquarters. The product was called SPAM instead ov Ham (as an Abbrevation for Spiced Pork and Ham ) November 1970 there was a Monty Python's sketch on SPAM in a cafe. One table is occupied by a group of Vikings with horned helmets on. A man and his wife enter. Whenever they hear the word Spam everybody is repeating and singing Spam, Spam,. April 13, 1994 there was a lowers couple, Laurence Canter and Martha Siegel, who used the Usenet to send out an advertisement about their (overpriced) immigration help service. They made an announcement, that people could win Green Cards by sending a postcard to the Green Card lottery service and at the same time they advertised their (overpriced) services to immigrant communities. This created a big, endless discussion about advertising in Usenet news groups. Around 2002, SPAM is really an important problem in communication. 9

10 Mails an cnlab Dez 04 / Jan 05 80% 75% 70% 65% 60% total Mails an gültige Adressen ohne Virus nicht Spamassassin tagged nicht Brightmail tagged 55% 50% 45% 40% 35% Nur etwa 10% aller Mails sind keine (nicht erwünschte) Massenmails 30% 25% 20% 15% 10% 5% 0% cnlab / HSR 2/21/

11 SPAM-Arten Other; 3% Spiritual; 4% Leisure; 6% Internet; 7% Health; 7% Products; 25% SPAM Unaufgeforderte Massenmails, welche maschinell versandt wurden UBE (Unsolicited bulk ) UCE (Unsolicited commercial ) Keine (Geschäfts)Beziehung zwischen Sender und den meisten der Empfägner Scams; 9% Financial; 20% Adult; 19% 2003: spam-statistics.html SPORN: SPAMs mit pornographischem Inhalt SCAM: SPAMs mit gefälschtem/ bösartigem/ kriminellen Inhalt Nigeria Info Grabber (Phishing) cnlab / HSR 2/21/ The 2003 statistics were derived from a number of different reputable sources including: Google, Brightmail, Jupiter Research, emarketer, Gartner, MailShell, Harris Interactive, and Ferris Research. Worst of the Spam - Sporn - How well does the filter support the blocking of sporn or spammed pornography? Does it allow you to block all pornography and/or adult themes? Does it allow you to view quarantined without viewing any of the pornographic i? As much as 8% of all is pornographic in nature, what we at Spam Filter Review call Sporn or spammed pornography. 11

12 "419" Scam (Advance Fee Scam) Nigeria or West African Scam large sum of money sitting in a bank account making payments through you to us At some point, the victim is asked to pay up front an Advance Fee of some sort Fake Lottery Scam (Elgordo Lottery Madrid, Microsoft Lottery) you have therefore been approved for a lump sum pay out of US$ 500, To file for your claim, please contact Ghana Gold Scam prepared to provide quantities of up to 400 kilograms of 22.karat alluvial gold monthly offer the quantity of gold required to the Buyer [or their representative] upon their arrival here in Accra kindly contact me at the numbers listed above cnlab / HSR 2/21/ The so-called "419" scam (aka "Nigeria scam" or "West African" scam) is a type of fraud named after an article of the Nigerian legal code under which it is prosecuted. Most "normal" spam uses bogus sender addresses. For 419 spam existing mailboxes at legitimate mail providers are used. When such mailboxes get cancelled for abuse, often similarly names mailboxes are created at the same provider. Most 419 scams originate from about a dozen fre er domains (netscape.net, yahoo.com/yahoo.*, tiscali.co.uk, libero.it, telstra.com, bigpond.com, indiatimes.com, 123.com (Chile), zwallet.com, fsmail.net, hotmail.com, etc., see addresses by domain). A small minority uses throw-away domains registered via MSN (see example), Rediffmail, XO/Concentric, Yahoo/Geocities or other webhosters (ns.signon-africa1.net) as the sender instead of a fre er service, particularly for fake companies and fake banks (e.g. firstcapitalft.com)

13 Info Grabber: Cheap Rolex? cnlab / HSR 2/21/ Lockvogelangebote für Rolex-Uhren, Windows Software, Wettbewerbe, Gefälschte Bestellung, mit falscher MC Nummer und Junk am abgeschickt: Keine Verschlüsselung Falsche Kreditkartennummer nicht detektiert Keine -Bestätigung für die Bestellung wahrscheinlich geht es nur darum, Kreditkarten- und Personen Informatinen zu sammeln. 13

14 Phishing 1. Spoof (Spam) Real site 3. Spoofed Web Site 2. Camouflaged Hyperlink Fake Pop-Up cnlab / HSR <A HREF= Ref. Gartner Group, Cannes 2004 Phishing is a spam-based scam that has grown in popularity. Phishing is not a "cyberattack," such as propagating malicious code. It is a social-engineering attack, in which attackers (or "phishers") trick users into doing something that will harm them or their companies. The phisher sends an message that looks like it comes from a legitimate source for example, an online merchant. In many cases, the message states that there is a problem with the user's account and requests that the user confirm the merchant's information by entering sensitive account information (such as a credit card number, address, user name and password) into the phisher's Web site, which resembles the merchant's site. Using this information, the phisher can steal access to the account or perpetrate identity fraud. In addition, phishing could provide attackers with access to an organization's internal systems, but it is used for identity theft in most cases. 14

15 SPAM-Kosten Kalkulator cnlab / HSR 2/21/ Finden Sie heraus wie sich Spam auf die Finanzen und Produktivität Ihrer Unternehmung auswirkt. Füllen Sie Felder 1-5 mit den entsprechenden Zahlen und clicken sie auf 'Spamkosten Berechnen'. Diese Kalkulation ist nur eine Schätzung und bezieht keine Kosten ein, welche durch verschwendeten Speicherplatz, Bandbreite und IT Personal entstehen. Durch Spamming fallen Kosten an. Mehrheitlich werden diese nicht vom Spammer bezahlt: Download der Nachrichten Unnötiger Verbrauch von Festplattenplatz Unnötiger Traffic auf Netzwerkressourcen SPAM auf falsche Adressen: Fehlermeldungen kommen zum ISP Wenn Spammer fremde Mail-Server für ihre Zwecke missbrauchen, können dadurch ganze Server lahmgelegt werden Geschätzte Kosten weltweit: 10 Milliarden Euro 15

16 Wie finde ich SPAM und Spammer? (Spam-Abwehr) cnlab / HSR 2/21/

17 Mail Format (RFC 822 standard text message format) header lines To: From: Subject: body the message, ASCII characters only SMTP-Envelope (written by servers) RCPT To: Mail From: header body DATA blank line cnlab / HSR 2/21/ Die Header-Informationen werden beim normalen Client vom Client- Programm an den SMTP Prozess übergeben. D.h. beim Versand einer normalen werden die Adressen, die im Mailprogramm des Absenders in die Felder "To:" und "CC:" eingetragen wurden, nicht nur zur Generierung dieser beiden Headerzeilen benutzt, sondern auch beim SMTP-Dialog als "RCPT TO:" und Mail From: auf den Umschlag übertragen. Die Envelope enthält die für die Zustellung einer relevanten Informationen, welche vor allem durch die Mail- Server interpretiert werden. Dem Client interessieren die Envelope-Informationen in der Regel nicht. Allerdings werden manchmal gewisse Daten aus der Envelope in den Header übertragen. 17

18 Versand, Weiterleitung und Empfang (SMTP = Simple Mail Transfer Protocol, POP = Post Office Protocol) Alice@aaa.com Send Server Internet Router Receive Server Bob@bbb.ch Mail Client Host 1 Router Send Server Host 1 Router Router Receive Server Send Server Host 1 bbb.ch aaa.com Router cnlab / HSR 2/21/

19 Return-Path: Received: from mx3.gmx.example [ ]) by ancalagon.rhein-neckar.de (8.8.5/8.8.5) with SMTP id SAA25291 for Thu, 16 Sep :36: (MET DST) Received: (qmail 1935 invoked by alias); 16 Sep :36: Delivered-To: GMX delivery to Received: (qmail invoked by uid 0); 16 Sep :36: Received: from pbox.rz.rwth-aachen.example ( ) by mx3.gmx.example with SMTP; 16 Sep :36: Received: from post.rwth-aachen..example (slip-vertech.dialup.rwth-aachen.example [ ]) by pbox.rz.rwth-aachen.example (8.9.1/8.9.0) with ESMTP id RAA28830 for Wed, 16 Sep :35: Message-ID: Date: Wed, 16 Sep :33: From: Heinz-Gustav Hinz Organization: RWTH Aachen X-Mailer: Mozilla 4.05 [de] (Win95; I) To: Karl-Heinz Schmitt MIME-Version: 1.0 Content-Type: text/plain; charset=iso Content-Transfer-Encoding: quoted-printable Subject: Re: Hallo Nachbar! References: Reply-To: X-Resent-By: Global Message Exchange X-Resent-For: X-Resent-To: cnlab / HSR 2/21/ Die Return-Path Zeile sollte, wenn sie existiert, ganz am Anfang der E- Mail stehen. Sie enthält den Envelope-From (also die Absenderangabe aus dem SMTP-Umschlag). Diese kann allerdings bei SMTP beliebig angegeben werden. Die "eigentlichen" Zustellvermerke sind die "Received:"-Headerzeilen, die jeweils vor dem Weiterschicken einer vom Mailserver vorne angefügt werden. Die oberste "Received:"- Zeile wurde vom eigenen Mailserver (bzw. dem des Providers) erzeugt. Eine "Received:"-Zeile gibt immer an, wer die Mail von wem empfangen hat. Gewisse Received-Zeilen können je nach verwendetem Mail-Server sehr speziell aussehen (vgl. Received: (qmail...) und Delivered-To: GMS..., bei welchen es sich um eine Spezialität des GMX-Mailers handelt. Die Message-ID ist eine eindeutige Kennung der (vergleichbar einer Seriennummer). Sie sollte aus einer unverwechselbaren Zeichenfolge vor dem "@" (meistens Datum und Benutzerkennung in einer kodierten Form) und einem Rechnernamen hinter dem "@" bestehen. Häufig wird die Message-ID bereits vom Mailprogramm des Absenders erzeugt; ansonsten tragen die meisten Mailserver sie nach, soweit sie fehlt. Alle mit "X-" beginnenden Headerzeilen sind nicht standardisiert und können von verschiedenen Programmen (oder auch Benutzern) beliebig eingefügt werden. 19

20 Example: Mail header additions by involved (SMTP) servers Each SMTP engine adds his Domain Name (with IP Address) and a Time Stamp to the Mail Header sky.hsr.ch (SMTP/POP Server) mail.iprolink.ch (SMTP Server) tslzgp157.iprolink.ch (Mail Client/SMTP) Received: from mail.iprolink.ch (titan.iprolink.ch [ ] by sky.hsr.ch (8.8.6/8.8.6) with ESMTP id UAA06615 for <rvogt@hsr.ch>; Wed, 5 Feb :04: (CET) Received: from tslzgp157.iprolink.ch (tslzgp157.iprolink.ch [ ] by mail.iprolink.ch (ipl/ipl) with ESMTP id UAA46506 for <rvogt@hsr.ch>; Wed, 5 Feb :04: (CET) Received: by tslzgp157.iprolink.ch with Microsoft Mail id <01BD31A7.B4C12C20@tslzgp157.iprolink.ch> Wed, 5 Feb :01: (CET) cnlab / HSR 2/21/ Mail from user 01BD31A7.B4C12C20@tslzgp157.iprolink.ch to rvogt@hsr.ch These stamps are placed on the envelope of the mail by each SMTP server. The SMTP/ESMTP IDs as well as the time stamp have local significance only (i.e. it is just the local time of the corresponding server). [see also 20

21 SPAM-Detektion und Filterung cnlab / HSR 2/21/

22 Technische SPAM-Abwehrmassnahmen Accept mail from local Clients only (no relaying) Client Authentication Delay mass mails (Teergrube) Send Server Internet Router Router Receive Server Filtering (header, content) Router Router Spammer Router Blacklist Blacklists (do not accept certain senders) / whitelists Make sure the sender exists (SPF, Greylisting) Filtering (header, content, mail signature) cnlab / HSR 2/21/ Avoid grabbing Identify and abort dictionary attack Identify and abort address-harvesting attack ( tag handling) Boundary Defense Non accept a message (simply decline to accept it, rather than receiving it at all) Disable relaying, verify, expand Header Analysis (Reading headers by ) Validity of the sender (using reverse lookup ) Consistency between the sender and the from fields Tactics used by known spammers that are highly unlikely to be found in normal messages Content Analysis A set of rules to search for known spammer tactics A set of rules to search for known chain letters, hoaxes and urban legends The ability to look for words and phrases in a targeted words list (for example, porn, financial services) The ability to do contextual analysis The ability to tune the product for the environment Sensing or Reporting put accounts in all the places spammers love to harvest addresses (SPAM honeypot, decoy addresses) create consortia or user groups to develop and share anti-spam rules Blacklist and White Lists Create a blacklist of servers (and networks) which support spamming create a white list of servers (and networks) that are always allowed to receive , no matter what the content is URL-Blacklist 22

23 Mail Abuse Prevention System (MAPS) MAPS RBL (Realtime Blackhole List): first list of IP addresses of known sources of unsolicited commercial and bulk (established in 1996) MAPS DUL (Dynamic User List): list of IP addresses that should not be running mail servers MAPS RSS (Relay Spam Stopper): list of IP addresses of known insecure ("open relay") mail servers MAPS OPS (Open Proxy Stopper): list of IPs that have been used, as an open proxy, to transmit spam MAPS NML (Non-confirming Mailing List): list of IP addresses that have been demonstrated to be the sources of mailing lists, which do not fully verify the addresses on their list Spam URI Realtime Blocklists (SURBL) was purchased by Kelkea, Inc. on July 1, 2004, cnlab / HSR 2/21/ The MAPS RBL is a list of hosts and networks that allow spam to originate on their system. Vendors of spam-filtering services or software develop blacklists by compiling possible spam addresses and domains through accounts in different markets. The vendor makes a decision whether the suspect constitutes spam and the address or domain should go on its blacklist. On July 1, 2004, Kelkea, Inc. purchased the assets of Mail Abuse Prevention Systems, LLC. The MAPS subscription services are now offered as part of the Kelkea Antispam Service. 23

24 SMTP Basic Setup Ext. Mailserver Int. Mailserver Blacklists VirusScan_1 SPAM-Filter_1 SMTP User Unknown VirusScan_2 SPAM-Filter_2 POP/IMAP Tag SMTP Delete (Trash) Quarantine SPAM-Filter_3 VirusScan_3 Mail Client Feedback User Feedback cnlab / HSR 2/21/

25 SpamAssassin RuleScore AB_URI_RBL 5.00 Bayesian spam probability is 99 to 100% 5.40 Forged hotmail.com 'Received:' header found 0.50 From: contains numbers mixed in with letters 0.26 Reply To: contains numbers mixed in with letters 3.25 OB_URI_RBL 4.00 Razor2 gives confidence between 51 and Listed in Razor2 ( Bulk fingerprint (double IP) found 1.86 Sent via a relay in ipwhois.rfc-ignorant.org 0.10 Received: contains a numeric HELO 1.50 SPAMCOP_URI_RBL 3.00 WS_URI_RBL 3.00 Total cnlab / HSR 2/21/ Example from 25

26 Example: Graylisting at UniNE Incoming mail vs. Spam during last 12 months GreyListing since beginning August 2004 cnlab / HSR 2/21/ Anti-SPAM methods and their efficiency as used at Uni Neuchatel: 75% less incoming mails since GreyListing (new since ) was intruduced. The remaining SPAMs are tagged as follows: 50% Spam Lookup Service (SLS/RBL/MAPS) 50% URI Realtime Blocklists ( 20% Attachement blocking (.ade.adp.bas.bat.chm.cmd.com.cpl.crt.exe.hlp.hta.inf.ins.isp.js.jse.lnk.mdb.mde.msc.msi.msp.mst.pcd.pif.reg.scr.sct.shb.shs.url.vb.vbe.vbs.wsc.wsf.wsh.zip 20% Heuristic filter 1% SPF 0.2% Bayesian filter Futher methods: Hoax blocking (keywords based) Automatic whitelis 26

27 Fastnet Mailcleaner The Mailcleaner Viruswall uses the following guidelines to detect massive attacks: Simultaneous number of connections by sender's IP address Server black list Regular Expression filters Refused Recipient lists etrust Antivirus Computer Associates cnlab / HSR 2/21/ The Mailcleaner "Enterprise Solution" is composed of modules. Which (and how many) modules to install depends on the daily volume that your mail servers process. The Basic Version consists of a single machine that manages all of Mailcleaner's operations, including the incoming queue, filtering, quarantining, and the management interface. This version is sufficient for a daily volume of roughly 50,000 messages. With daily traffic above 50,000 messages, the Advanced Version is ideal. This version uses multiple servers working in parallel. It may have one or more Entry Point servers, which queue incoming messages and then distribute them evenly over the Filtering Servers. The Management Server hosts the control database and the web-based management interface. Anti-spam Mailcleaner uses a number of complementary techniques to distinguish spam from legitimate mail. Using artificial intelligence algorithms and daily updates, Mailcleaner adapts to identify the ever-changing techniques of spammers. Anti-virus Mailcleaner scans all incoming mail for viruses, worms, and suspicious attachments that may hide malicious scripts. Web-based User Interface Mailcleaner offers each user a simple way to review quarantine lists, change preferences, and consolidate reports for users who have more than one address. Pricing (regular price) per month License for 1000 mailboxes: EUR, You will need 1 server to handle messages daily. License for mailboxes: EUR, You will need 1 server to handle 500 messages daily. License for 500 mailboxes: EUR License for mailboxes: EUR, You will need 10 servers to handle messages daily. VAT and hardware excluded. 27

28 Wie werde ich Millionär? cnlab / HSR 2/21/

29 200 known Spam Operations ( professional spammers) responsible for 90% of your spam operate 'offshore' using servers in Asia and South America spammer listed in ROKSO if terminated by a minimum of 3 consecutive ISPs for AUP violations spammers IP addresses are automatically sent to Spamhaus Block List ROSLO assists ISP Abuse Desks Law Enforcement Agencies (with special, sensitive information version) cnlab / HSR 2/21/ The Register Of Known Spam Operations (ROKSO) database collates information and evidence on the known spammers and spam gangs, to assist ISP Abuse Desks and Law Enforcement Agencies. 90% of spam received by Internet users in North America and Europe can be traced via redirects, hosting locations of web sites, domains and aliases, to a hard-core group of around 200 known spam operations. These spam operations consist of an estimated professional spammers loosely grouped into gangs ("spam gangs"), the vast majority of whom are operating illegally. Many of these spam operations pretend to operate 'offshore' using servers in Asia and South America to disguise the origin. Those who don't pretend to be 'offshore' pretend to be small ISPs themselves, claiming to their providers the spam is being sent not by them but by their non-existent 'customers'. Some set up as fake networks, pirate or fraudulently obtain large IP allocations from ARIN/RIPE and use routing tricks to simulate a network, fooling real ISPs into supplying them connectivity. When caught, almost all use the age old tactic of lying to each ISP long enough to buy a few weeks more of spamming and when terminated simply move on to the next ISP already set up and waiting. ROKSO is a "3 Strikes" register: To be listed in ROKSO a spammer must first be terminated by a minimum of 3 consecutive ISPs for Access User Policy (AUP) violations. IP addresses under the control of ROKSO-listed spammers are automatically and preemptively listed in the Spamhaus Block List (SBL). For Law Enforcement Agencies there is a special version of this ROKSO database which gives access to records with information, logs and evidence too sensitive to publish here. 29

30 CREATIVE MARKETING ZONE Alain Ralsky (SPAM King) Aliases: Jeff Kramer, Additional Benefits, Creative Marketing Zone Inc, Sam Smith, William Window, : couple of mailing lists, making $6,000 a week 2001: Creative Marketing Zone, Inc., Nevada 2002: 250 million valid addresses 0.25% response rate 0.75% of mails opened (hidden notification code) 89 Million people have opt-out (between 1997 and 2002) up to $22,000, for single mailing to entire database stealth spam (Romanian program), detect computers that are online and then flash them a pop-up ad 2004: Hundreds of domains: aboutchpecha.com,... cnlab / HSR 2/21/ Some statements from Alain Ralsky (Mike Wendland: Spam king lives large off others' troubles, November 22, and "I've gone overseas," he said. "I now send most of my mail from other countries. And that's a shame. I pay a fortune to providers to do this, and I'd much rather have it go to American companies. But I have to stay in business, and if I have to go out of the country, then so be it." The computers in Ralsky's basement control 190 servers located in Southfield, 50 in Dallas and 30 more in Canada, China, Russia and India. Each computer, he said, is capable of sending out 650,000 messages every hour -- more than a billion a day -- routed through overseas Internet companies Ralsky said are eager to sell him bandwidth. "I'll never quit," said the 57-year-old master of spam. "I like what I do. This is the greatest business in the world." It's made him a millionaire, he said, seated in the wood-paneled first floor library of his new house. "In fact," he added, "this wing was probably paid for by an I sent out for a couple of years promoting a weight-loss plan." In 1997 he bought a couple of mailing lists from advertising brokers and, with the help of the computers, launched a new career that soon was making him $6,000 a week. Ralsky said he includes a link on each he sends that lets the recipient opt out of any future mailings. He said 89 million people have done just that over the past five years, and he keeps a list of them that grows by about 1,000 every day. That list is constantly run against his master list of 250 million valid addresses. The response rate is the key to the whole operation, said Ralsky. These days, it's about one-quarter of 1 percent. Ralsky makes his money by charging the companies that hire him to send bulk a commission on sales. He sometimes charges just a flat fee, up to $22,000, for a single mailing to his entire database. Ralsky has other ways to monitor the success of his campaigns. Buried in every he sends is a hidden code that sends back a message every time the is opened. About three-quarters of 1 percent of all the messages are opened by their recipients, he said. The rest are deleted. Ralsky, meanwhile, is looking at new technology. Recently he's been talking to two computer programmers in Romania who have developed what could be called stealth spam. It is intricate computer software, said Ralsky, that can detect computers that are online and then be programmed to flash them a pop-up ad, much like the kind that display whenever a particular Web site is opened. "This is even better," he said. "You don't have to be on a Web site at all. You can just have your computer on, connected to the Internet, reading or just idling and, bam, this program detects your presence and up pops the message on your screen, past firewalls, past anti-spam programs, past anything. 30