| ismak | hello all, lets go with the last talk |
|---|
| ismak | This night we have the talk Spamikaze: an automatic spam blacklist system |
|---|
| ismak | by Rik van Riel |
|---|
| ismak | Rik van Riel, a kernel hacker employed by Red Hat. He lives in New Hampshir |
|---|
| ismak | This night he is going to present a new great Project, Spamikaze |
|---|
| ismak | and now, its time to start, Rik, the channel is yours... |
|---|
| riel | thank you, ismak |
|---|
| riel | Spamikaze is a project to block spam |
|---|
| riel | but with a difference |
|---|
| riel | in order to explain why it is needed, I'll give a history of how spam has been sent |
|---|
| riel | as we all know, spam is unsollicited bulk email |
|---|
| riel | that is, email that is sent in bulk and hasn't been requested |
|---|
| riel | usually this is email that the receiver doesn't want |
|---|
| riel | the reason spammers can get away with advertising to people who aren't interested is that the cost of this advertising medium is paid for mostly by the recipient, not by the sender |
|---|
| riel | anyway |
|---|
| riel | in the beginning, spam was sent directly from the spammer's computers to the recipient |
|---|
| riel | of course, people didn't want spam, so they started blocking the spammer's computers using the MAPS RBL, the Realtime Blackhole List |
|---|
| riel | in order to get around that, spammers started using other people's mail servers to send spam |
|---|
| riel | they would search the internet for mail servers that would send spam for anybody, to anybody, so-called open relays |
|---|
| riel | as an extra benefit, spammers could send one spam to an open relay with a few thousand recipients, and then the open relay would do the hard work |
|---|
| riel | meaning that the spammer needed less bandwidth himself, but could steal other people's bandwidth instead |
|---|
| riel | as you know, it didn't take long for people to start blocking email from these open relays, using lists such as ORBS, the MAPS RSS, ORDB, etc... |
|---|
| riel | after that, the spammers went to the next stage in this "arms race" |
|---|
| riel | spammers started searching for proxies that could connect anywhere |
|---|
| riel | and sending spam through these proxies |
|---|
| riel | now most ISPs block email from open proxies, so spammers cannot use those |
|---|
| riel | today the big thing with spammers are trojans (malicious programs) that are installed hidden on Windows machines of unsuspecting users |
|---|
| riel | the most popular ones seem to be Jeem and Fizzer (fizzler?) |
|---|
| riel | Jeem is essentially an open proxy, except that it listens on random ports |
|---|
| riel | this means it can still be listed in open proxy blocklists, but it is VERY hard to find these proxies |
|---|
| riel | I am not sure what Fizzer exactly is, but I've heard that spammers control it via IRC, making it almost impossible to detect for anti-spammers |
|---|
| riel | of course, once anti-spammers know how to find these, spammers will move on ... |
|---|
| riel | ... to something even more difficult to find |
|---|
| riel | eventually spammers will be using something that is impossible to detect and block using traditional blocklists that contain the IP addresses of systems with known vulnerabilities |
|---|
| riel | the conclusion is that anti-spammers need a new type of list to block spam |
|---|
| riel | one that will always work, even if you don't know anything about the systems that are sending out spam |
|---|
| riel | (btw, if you have questions, just ask them in #qc) |
|---|
| riel | before I move on, I should say something about why spam filtering is not really a good option |
|---|
| riel | spam blocking will always block some legitimate email, so there needs to be a good reason why we cannot just filter email |
|---|
| riel | the reason is simple: cost |
|---|
| riel | sending spam is extremely cheap, in fact it costs almost nothing |
|---|
| riel | receiving and filtering email at an ISP is relatively expensive though |
|---|
| riel | say that an ISP has a great new idea for a spam filter, one that filters 99% of the spam without any problems |
|---|
| riel | if everybody starts using these filters, spammers will simply send 100x as much spam in order to escape the filters |
|---|
| riel | and the ISP will need to buy 100x as many servers |
|---|
| riel | this is paid for by the users of the ISP (you) and not by the spammer |
|---|
| riel | in short, filtering email encourages spammers to send out MORE email, not less |
|---|
| riel | if you want to remove the load of spam from the internet, you need to use a method that encourages people to do something against the sending of spam |
|---|
| riel | something to make sure less spam will be sent |
|---|
| riel | this is why spam needs to be blocked and not silently filtered |
|---|
| riel | ........ |
|---|
| riel | I guess at this point it is time to explain the design goals of Spamikaze and the ways in which it wants to achieve these goals |
|---|
| riel | 1) Spamikaze should block spam |
|---|
| riel | 2) Spamikaze should make it possible for anybody to send legitimate email |
|---|
| riel | 3) Spamikaze should make the _sending_ of spam by an ISP irritating to that ISP's users, just like receiving spam is irritating to the rest of the internet |
|---|
| riel | 4) Spamikaze should make it hard for spammers to send spam |
|---|
| riel | ..... |
|---|
| riel | the reasons behind (1), (2) and (4) are probably obvious (ask if they aren't) |
|---|
| riel | the reason behind (3) is more subtle, so I will explain it here |
|---|
| riel | there are some ISPs who do good spam blocking and filtering for their own users, so their users receive little spam from the internet |
|---|
| riel | but those same ISPs do absolutely nothing against users who SEND spam |
|---|
| riel | meaning that the users of the ISP are happy, even though the ISP is making the rest of the world unhappy with spam |
|---|
| riel | of course, such an ISP has shown that it cares about its own users, since it filters their spam |
|---|
| riel | what I want to do is give those users a reason to ask their ISP to do something against the SENDING of spam from that ISP |
|---|
| riel | ....... |
|---|
| riel | Now that you know what Spamikaze should do, let me explain how it works |
|---|
| riel | and also, what extra functionality would be nice in the future |
|---|
| riel | Basically, Spamikaze works like any other DNS blocklist, it lists the IP addresses of systems that are suspected of having sent spam |
|---|
| riel | in my setup, it works like this: |
|---|
| riel | 1) I have a few thousand email addresses on my system that do not belong to real users and receive only spam |
|---|
| riel | 2) For every spam received, the IP address of the system that delivered the spam to my server gets added to the list |
|---|
| riel | 3) I refuse email from those IP addresses |
|---|
| riel | 4) The error message my ISP gives to anybody who sends email from one of these IP addresses, looks like this: |
|---|
| riel | Your mailserver spammed me, see http://psbl.surriel.com/c gi-bin/listing.cgi?ip=209.226.175.189 |
|---|
| riel | 5) If that IP address has a real user (like in this example), that user can remove the IP address from my list immediately |
|---|
| riel | 6) However, the next time spam is sent from that IP address, it gets added back to the list |
|---|
| riel | .... |
|---|
| riel | Now, what does this mean ? |
|---|
| riel | Basically, it means that if somebody's mail server sends spam and that person wants to send me email, that person will need to remove his mail server from my blacklist once in a while |
|---|
| riel | ... but, that person can still email me if it's important, simply by removing his email server from my list and sending the mail again a few minutes later! |
|---|
| riel | I hope that this will annoy the users of ISPs with spam problems, resulting in their users asking their ISP to stop spamming |
|---|
| riel | Also, in case of open proxies and open relays, which send mostly spam and almost no legitimate email, there is nobody to remove the server from the list |
|---|
| riel | so systems that send out only spam will remain listed |
|---|
| riel | at the moment my list (psbl.surriel.com) has over 33000 IP addresses on the list, but only around 100 removals |
|---|
| riel | I think the other listed IP addresses have no real users but are only used by spam, and those 99% of servers get blocked very effectively |
|---|
| hans | riel: can you give a timeline for these ip addresses? |
|---|
| riel | hans: all of those IP addresses have been added to the list in the last 4 weeks |
|---|
| riel | of course, spammers can remove their open proxies from the PSBL very, very easily |
|---|
| riel | this means that running just one Spamikaze list is not enough to protect the internet |
|---|
| riel | if we want to protect the internet, we will need hundreds, maybe even thousands, of people who all run the Spamikaze software and have their own lists |
|---|
| riel | ..... |
|---|
| riel | Distributed Spamikaze |
|---|
| riel | that means that when some server is abused for spam, it will get listed in not just one list, but in many lists |
|---|
| riel | <ismak2> a question: every user of kamikza has his own list, or is there a common list? < |
|---|
| riel | ok, let me explain this better ;)) |
|---|
| riel | 1) Everybody who wants runs their own copy of the Spamikaze software, with his/her own list |
|---|
| riel | 2) Other people can use the lists made by the people in (1) |
|---|
| riel | Now, lets get back to the distributed spamikaze |
|---|
| riel | 1) a spam is received from some IP address and gets added to my list |
|---|
| riel | 2) Hans and some of my other friends import that IP address into their own lists |
|---|
| riel | 3) if somebody wants to send me email, the person can remove his mail server from my list, but not from Hans' list |
|---|
| riel | This is ok ... |
|---|
| riel | if I send email to 5 people (and I was using a "bad ISP") it is easy to remove my ISP's mail server from one or more lists |
|---|
| riel | but if I am a spammer and want to send email to 10,000,000 people, then I would need to remove the servers I am abusing from thousands of lists ... which is VERY hard |
|---|
| riel | basically this means that spamikaze is just an annoyance for normal users ... and only if their mail server sends out spam |
|---|
| riel | but for spammers, it could be an impossible situation |
|---|
| riel | now the obvious question is, is Spamikaze effective ? |
|---|
| riel | that will depend on how much spam you get, of course |
|---|
| riel | but my Spamikaze setup is pretty effective, if you believe http://openrbl.org/stats.htm ;) |
|---|
| riel | Note that at the moment we have not implemented the distributed Spamikaze setup yet, the Spamikaze software is still in a very early version |
|---|
| riel | .... |
|---|
| riel | ok, time to answer some questions |
|---|
| riel | <jeffpc> Do you think that ISPs will implement spamikaze in the first place? You said it yourself, it will anoy people at first.. |
|---|
| riel | jeff, spamikaze will only annoy people who share a mail server with spammers, I do not believe it will not cause problems for most people |
|---|
| riel | ... are there any more questions ? |
|---|
| riel | today hans and I released the first version of Spamikaze |
|---|
| riel | version 0.1 |
|---|
| riel | you can download it from http://spamikaze.nl.linux.org/ |
|---|
| riel | <mjt> even with a "sufficiently" large number of such lists/systems running, it will be still very easy for spammers [to remove themselves automatically] ... |
|---|
| riel | mjt, hans and I are planning some software to prevent that |
|---|
| riel | just like the web mail services (like Outblaze and Yahoo) have code to prevent automatic creation of accounts and sending of mail |
|---|
| riel | <jeffpc> Why should an ISP use spamikaze instead of just seting up authentication on SMTP ? |
|---|
| riel | jeff, Spamikaze is a filter for incoming email, not for outgoing mail |
|---|
| riel | with SMTP authentication you make sure that only people who should have access can use the mail server to send mail |
|---|
| riel | but all of an ISP's users still want to _receive_ email from their friends and family, who are using other ISPs |
|---|
| riel | that means that an ISP must accept email from other places that is directed to its own users, without authentication |
|---|
| riel | ... if there are other questions, please ask them in #qc |
|---|
| riel | <Warmelink> For some people it is easier to decode a picture than to read them (blind people come to mind). njabl.org uses an (exponetially) increasing time for delisting. Should that work too, in your opinion? |
|---|
| riel | the problem with exponentially increasing delisting time is two-fold |
|---|
| riel | 1) the users of an ISP are powerless to do something about the listing |
|---|
| riel | 2) I will miss legitimate email that is being sent to me |
|---|
| riel | (1) means that the users of an ISP aren't just annoyed, they are experiencing real damage to their email service |
|---|
| riel | <weaah> Is there an URL to download Riel speech? |
|---|
| riel | yes, the Uninet people post logs of all the presentations online |
|---|
| riel | the organisers can give you the URL after the talk |
|---|
| riel | .... any other questions ? |
|---|
| riel | ok, then I guess this is it ;) |
|---|
| riel | if you are interested in Spamikaze, you can download it from http://spamikaze.nl.linux.org/ |
|---|
| riel | the software is available under the GPL |
|---|
| riel | everybody is welcome to help test and develop the program |
|---|
| riel | <ismak2> is the ip import process automated by spamikaze? |
|---|
| riel | yes, the import process is pretty much automated |
|---|
| riel | although you can also do it by hand if you want |
|---|
| riel | <mjt> Riel, you didn't that extra clean: an IP listed in spamikaze DB may be removed by ANYONE, at ANY TIME. It's easy to add an IP (spam to a spamtrap). And it's easy to remove it and resend rejected email. |
|---|
| riel | mjt, yes that's a good thing to remember ;) |
|---|
| riel | ... any more questions ? |
|---|
| riel | well, thank you for your attention |
|---|
| riel | ----------------------------------------------------------- |
|---|
| riel | This was the last lecture of this Infosec conference |
|---|
| riel | I hope to see you again at another Uninet conference ;) |
|---|
| xtingray | clap clap clap clap clap clap |
|---|
| jeffpc | clap clap clap clap clap clap clap clap clap clap clap clap |
|---|
| jeffpc | clap clap clap clap clap clap clap clap clap clap clap clap |
|---|
| jeffpc | clap clap clap clap clap clap clap clap clap clap clap clap |
|---|
| jeffpc | clap clap clap clap clap clap clap clap clap clap clap clap |
|---|
| xtingray | clap clap clap clap clap clap |
|---|
| xtingray | clap clap clap clap clap clap |
|---|
| xtingray | clap clap clap clap clap clap |
|---|
| jaimeEdu | clap clap clap clap clap clap clap clap clap clap clap * riel would like to thank the people who have organised this Infosec conference |
|---|
| ismak | plas plas plas plas |
|---|
| ismak | plas plas plas plas |
|---|
| ismak | plas plas plas plas |
|---|
| ismak | plas plas plas plas |
|---|
| ismak | plas plas plas plas |
|---|
| ismak | plas plas plas plas |
|---|
| garoeda | clap clap clap clap clap |
|---|
| garoeda | clap clap clap clap clap |
|---|
| garoeda | clap clap clap clap clap |
|---|
| garoeda | clap clap clap clap clap |
|---|
| ismak | Organizing Commitee of infosec want to thanks all the people that have made a reality this congress. Thansk to all the speakers and all the volunteers |
|---|
| hans | riel has gone home by now, he will join again (I suppose) if anyone has more questions then I am available |
|---|
| hans | thanks to the organisation for the conference time |
|---|
| ismak | We have to announce that the talk "Spamikaze: an automatic spam blacklist system" by Daniel Elias has to have been canceled |
|---|
| ismak | sorry• http://www.ircap.net •) |
|---|
| ismak | s/"Spamikaze: an automatic spam blacklist system"/"Firewalling using IPTables"/ |
|---|
| hans | ismak: b.t.w. if you would like to send patches then anything would do except visual basic :-) we are using php and perl but python for example would be great too |
|---|
| ismak | hans: visual basic puaggg no, i can help with php and perl, and the process to support other DB (postgres...) |
|---|
| hans | nice |
|---|
| hans | I suppose you know how to reach us? |
|---|
| ismak | i will try to dedicate some of my time to the project |
|---|
| ismak | hans: yes i know ;-) |
|---|
| hans | thank you, any input is welcome |
|---|
| krocz | :) |
|---|
| ismak | clap clap clap clap |
|---|
| hans | hehe :-) |
|---|
| ismak | clap clap clap clap |
|---|
| ismak | clap clap clap clap |
|---|
| ismak | clap clap clap clap |
|---|
| ismak | clap clap clap clap |
|---|
| ismak | congratulations to the translator for his work |
|---|
| hans | sorry I will not read it, my spannisch is to bad |
|---|
| hans | -c |
|---|