Subject: [Asrg] Spam profitability analysis and countermeasures

From: sam bledsoe <[email-masked]>
Date: Wed, 25 Apr 2007 12:02:09 -0500 (CDT)

Hello brave digital warriors,

I submit for discussion an idea about combating spam.  It is not
wholly novel based on my findings, and I may fall in to the following
'You might be an anti-spam kook'[1] categories:
spam-fighter-2
spammers-are-stupid-3
dont-get-no-respect-7

My work consists of a paper[2], the abstract of which is below, and a
a collection of Python scripts[3]. There is also a C# implementation[4].
I realize this is a technical list, but it still seems an appropriate
forum for this post.

Happy flaming,
Sam

1.      ABSTRACT
Almost all Internet and email users have experienced
problems relating to spam. There is no doubt that it is a scourge,
and many attempts have been made to fight the difficulties it
imposes.  Legislators have passed laws banning the practice, and
measures such as greylisting and adaptive filtering have been
effective at limiting its detrimental effects -- but decreasingly
so.  However this research takes a different view on the issue than
the ones mentioned. The legislative approach seems incomplete
because preservation of rights is not the central issue, although
theft of service concerns are legal in nature.  The technical
approach is closer but misses a key point.  Many of the problems
that are a result of spam are technical in nature, but its cause
is economic[4] (section 1, paragraph 1).

A clear understanding of the spam phenomenon is crucial to fighting
it.  This research investigates the causes for spam and the factors
that influence its continuing viability, as well as provides an
implementation of a suitable countermeasure.  The motivating reason
for sending spam seems clear:  monetary profit.  Businesses are
willing to pay marketers and look the other way, and mass email
marketers are seeking only profit.  The combination of conditions
that are involved in profiting from abusing email systems in this
way are less clear, but include very low cost to send, sender
anonymity, large target market, and low user response rate.  Note
that technical considerations will not be ignored, but rather they
provide the backdrop for dealing with this instance of crass
profiteering.

[1] http://www.rhyolite.com/anti-spam/you-might-be.html
[2] http://mrmoe.net/~samble/spamthing/spam_profitability.txt
         - plaintext, not wrapped
     http://mrmoe.net/~samble/spamthing/spam_profitability-fmt.txt
         - plaintext, wrapped
     http://mrmoe.net/~samble/spamthing/spam_profitability.odt
         - OpenDocument Text
[3] http://mrmoe.net/~samble/spamthing/src/
     http://mrmoe.net/~samble/spamthing/
[4] http://randonom.com/~wladek/projects/spamthing.net/

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matthias Leisi <[email-masked]>
Date: Wed, 25 Apr 2007 19:38:19 +0200

sam bledsoe wrote:

> [Quoting from]

| One click per spam [per spam recipient] could destabilize spammers'
| business models, upsetting their clients' cash flow, and leading to an
| end to the economic viability of the practice.

You assume that spammers use their own bandwidth for web hosting, which
is rare -- quite (most?) often, they use someone else's infrastructure:

* Hosting on a botnet, so all that would be achieved is saturating an
(not-so) innocent bystander (zombie owner and it's ISP), but not causing
direct economic disincentive to the spammer.

* Hosting on an abused website. Again, this will negatively affect the
rightful owner and it's ISP.

* Hosting on a server rented by the spammer - often with fake credit
card data or other fraudulent tactics. This will at best impact the ISP,
but not cause cost for the spammer.

Any kind of (d)DoS attack on a spamvertized host may decrease that
particular hosts' lifespan, because it is detected and cleaned sooner
than it would be without DoS. This may drive up a spammer's cost
slightly because he has to rotate the landing hosts faster, but given
the wide availability of such spam-hosting resources, I would not expect
a noticeable effect.

Further, given that botnets can be in the tens of thousands of members,
it's easy for the botnet operator to initiate counter-attacks if the
number, "click-rate" and aggregated bandwidth of spam-recipients does
not outnumber the botnet operator's resources by an order of a magnitude.

- -- Matthias

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 25 Apr 2007 13:55:05 -0400

> not outnumber the botnet operator's resources by an order of a magnitude.

We must _not_ forget the Blue Frog lesson:

http://en.wikipedia.org/wiki/Blue_Frog

---

From: Douglas Otis <[email-masked]>
Date: Wed, 25 Apr 2007 12:24:52 -0700

On Apr 25, 2007, at 10:55 AM, Chris Lewis wrote:

> Matthias Leisi wrote:
>
>> Further, given that botnets can be in the tens of thousands of  
>> members, it's easy for the botnet operator to initiate counter- 
>> attacks if the number, "click-rate" and aggregated bandwidth of  
>> spam-recipients does not outnumber the botnet operator's resources  
>> by an order of a magnitude.
>

Latency in any counter-measure makes reacting to individual events  
futile.  As such, counter-measures must be broad and lasting.  A  
fly's perceptions and reactions are much faster, making them  
difficult to swat.  With their low persistence, by the time a swatter  
can even be raised, they have already taken light.  Warnings only  
work accompanied with negative ramifications.  A "No Solicitation"  
announcement can be made with rfc3865.  IP addresses might be  
exploited, so a safe identity for which to apply long lasting  
ramifications would be the ASN at the very moment of the offense.

This indicates which ASNs monitor their outbound traffic, checks SMTP  
error rates generated by outbound clients, disables port 25 for  
residential access points, and responds to complaints of abuse.   
Alas, industry attempts to punish or restrict individual users, where  
various providers continue to profit from revenues generated by abuse  
and abuse counter measures.  Holding the ASN accountable is the  
_only_ practical means to affect the profit motive driving abuse.   
Many of the schemes that attempt to identity individuals actually  
enables devastating DDoS exploits.

-Doug

---

From: sam bledsoe <[email-masked]>
Date: Wed, 25 Apr 2007 14:49:00 -0500 (CDT)

On Wed, 25 Apr 2007, Douglas Otis wrote:

> Date: Wed, 25 Apr 2007 12:24:52 -0700
> From: Douglas Otis <[email-masked]>
> Reply-To: Anti-Spam Research Group - IRTF <[email-masked]>
> To: Anti-Spam Research Group - IRTF <[email-masked]>
> Subject: Re: [Asrg] Spam profitability analysis and countermeasures
> 
>
>>> number, "click-rate" and aggregated bandwidth of spam-recipients does not 
>>> outnumber the botnet operator's resources by an order of a magnitude.
>> 

Hi Matthias and others.  Part of the concept is that spammers aren't 
neccessarily the root of the problem.  I see it as analogous to the 
illegal immigrant worker problem - the immigrants are just trying to make 
a buck, and there are very many of them operating outside the bounds of 
the law, which makes enforcing laws over them extremely difficult.  They 
immigrate because companies will pay them.  Crack down on the guys
writing the paychecks, and people won't show up trying to get paid.
This is by no means an indisputable or even well established principle, 
but it makes sense to me.  Based on that idea though, the "legitimate" 
companies who employ spammers should be brought in to check.

I have not forgotten about Blue Frog, either.  I don't want to manage a 
database of users, or contact ISPs to tell on people, or any of that. 
With users  themselves running the countermeasure software, there is no 
centralized point of retaliation.

>
> Latency in any counter-measure makes reacting to individual events futile. 
> As such, counter-measures must be broad and lasting.  A fly's perceptions and 
> reactions are much faster, making them difficult to swat.  With their low 
> persistence, by the time a swatter can even be raised, they have already 
> taken light.  Warnings only work accompanied with negative ramifications.  A 
> "No Solicitation" announcement can be made with rfc3865.  IP addresses might 
> be exploited, so a safe identity for which to apply long lasting 
> This indicates which ASNs monitor their outbound traffic, checks SMTP error 
> rates generated by outbound clients, disables port 25 for residential access 
> points, and responds to complaints of abuse.  Alas, industry attempts to 
> punish or restrict individual users, where various providers continue to 
> profit from revenues generated by abuse and abuse counter measures.  Holding 
> the ASN accountable is the _only_ practical means to affect the profit motive 
> driving abuse.  Many of the schemes that attempt to identity individuals 
> actually enables devastating DDoS exploits.
>
> -Doug

Sorry Doug, while I can parse what you say I cannot understand your point.

[email-masked]
SDF Public Access UNIX System - http://sdf.lonestar.org

---

From: Douglas Otis <[email-masked]>
Date: Wed, 25 Apr 2007 14:06:06 -0700

On Apr 25, 2007, at 12:49 PM, sam bledsoe wrote:
>> difficult to swat.  With their low persistence, by the time a  
>> swatter can even be raised, they have already taken light.   
>> Warnings only work accompanied with negative ramifications.  A "No  
>> Solicitation" announcement can be made with rfc3865.  IP addresses  
>> might be exploited, so a safe identity for which to apply long  
>> lasting ramifications would be the ASN at the very moment of the  
>> offense.
>>
>> This indicates which ASNs monitor their outbound traffic, checks  
>> SMTP error rates generated by outbound clients, disables port 25  
>> for residential access points, and responds to complaints of  
>> abuse.  Alas, industry attempts to punish or restrict individual  
>> users, where various providers continue to profit from revenues  
>> generated by abuse and abuse counter measures.  Holding the ASN  
>> accountable is the _only_ practical means to affect the profit  
>> motive driving abuse.  Many of the schemes that attempt to  
>> identity individuals actually enables devastating DDoS exploits.
>

For example, don't expect a peer-to-peer version of the blue-frog  
approach to be either effective or safe.

1) The modus operandi is changing in response to ongoing "take downs".
2) Anyone can be a member of a peer-to-peer network.

So disabuse any expectation of a) confidentiality, b) information  
reliability as it may be corrupted, or c) effectiveness as  
information will be stale.  These weaknesses means the scheme will be  
highly dangerous.  Fines imposed upon ASN owners who permit abuse to  
continue would be more effective and safer.  AUPs will become more  
restrictive, and a response to abuse more immediate, when ignoring  
abuse directly effects the bottom-line.  Tossing out abusive high  
bandwidth customers or adding expensive router provisions become more  
easily justified.

-Doug