Spam, Spammers, and Spam Control

Spam, Spammers,
and Spam Control
A White Paper by Ferris Research
March 2009. Report #810
Ferris Research, Inc. One San Antonio Place San Francisco, Calif. 94133, USA Phone: +1 (650) 452-6215 Fax: +1 (408) 228-8067 www.ferris.com Table of Contents
Spam, Spammers, and Spam Control................................................3 Defining Spam.................................................................................3 Spammer Tactics .............................................................................3 Sending Mechanisms.................................................................4 Spammer Tricks.........................................................................4 Techniques for Identifying Spam ....................................................5 Connection Analysis..................................................................5 Behavioral Analysis...................................................................6 Content Scanning.......................................................................6 Controlling Spam: How and Where ................................................7 The Key Role of Reputation Services .......................................7 Conclusion: An Arms Race.............................................................8 Trend Micro Interview........................................................................9
Ferris Analyzer Information Service. Report #810. March 2009. © 2009 Ferris Research, Inc. All rights reserved. This document may be copied or freely reproduced provided you disclose 2 authorship and sponsorship and include this notice. For subscriptions, contact us at +1 415 986 1414 or info@ferris.com. Spam, Spammers,
and Spam Control
Just about anybody with an email address knows about spam and spam filters-or at least they think they do. However, it is a complex subject, with far more to it than meets the eye. This Ferris Research white paper looks at spam: what it is, how it is sent, and how it is filtered. It unravels the complexities and gives an accessible, factual overview into the scourge of spam.
Defining Spam
Most spam falls into the following categories, listed in roughly descending order of received volume: . Fake pharmaceuticals . Fake fashion items (for example, watches) . Pornography and prostitution . Stock kiting-that is, spammers driving up the price of stocks by inciting victims to buy them (also known as "pump and dump") . Phishing and other fraud, such as "Nigerian 419" and "Spanish Prisoner" . Trojan horses attempting to infect your PC with malware . Misdirected nondelivery reports and autoreplies sent by badly configured mail servers replying to forged email ("backscatter") . Spam from other types of senders, such as ignorant marketers, rogue affiliates, and misguided politicians or charities The word "spam" is sometimes used narrowly to describe just commercial advertisements for products and services. This definition is dubbed UCE: unsolicited commercial email. However, spam is more frequently used to describe any unsolicited email that is sent in bulk. Therefore, we prefer the definition UBE: unsolicited bulk email. This broader definition includes viruses by email, phishing, and other email-borne threats.
Spammer Tactics
Let's look at some of the tactics that spammers use to send their email and how they evade detection by spam filters. As this is a brief report, we do not provide a complete list but rather focus on the major issues that spam filter technologists need to deal with at present.
Ferris Analyzer Information Service. Report #810. March 2009. © 2009 Ferris Research, Inc. All rights reserved. This document may be copied or freely reproduced provided you disclose authorship and sponsorship and include this notice. For subscriptions, contact us at +1 415 986 1414 or info@ferris.com. 3 Sending Mechanisms A typical spam campaign sends millions of email messages. The economics of spam and ISPs' terms of service usually make it impractical for a spammer to send such a large volume using a conventional mail server. Here are the main ways that spammers get their messages out, listed in order of pervasiveness: . Botnets. Networks of "zombie" malware-infected PCs se... [download for more]