ITU WSIS Thematic Meeting on Countering Spam: The Scope of the problem. Mark Sunner, Chief Technical Officer MessageLabs

Transcription

1 ITU WSIS Thematic Meeting on Countering Spam: The Scope of the problem Mark Sunner, Chief Technical Officer MessageLabs 6 th July 2004

2 MessageLabs MessageLabs protects businesses worldwide against threats reaching their networks. Over 8,700 Business Customers Globally More than 2.5 million End Users 400 Global Enterprises With Over 2,500 Employees Over 55 Million Business s Scanned Per Day 99% Customer Retention Rate Sole Focus On Business Enterprise Market

3 Dynamic Global Platform Secure management service Globally distributed architecture 24/7 threat monitoring and response Provisioning and supporting clients 24/7 - globally Instant scanning over 55 million business s a day

4 Operating at the Internet Level Client Simply Points MX (Mail Exchange) Record to MessageLabs is Scanned and Handed to Client Mail Server Protected & Controlled All Threats are Kept AWAY from the Client Network

5 Skeptic Predictive Technology Predictive technology identifies unknown and dynamic threats 6+ years R&D 2Gb+ self learning rules knowledge base: Virus & Spam DNA Thousands of Heuristic Rules Known Security Vulnerabilities Analysis of traffic patterns Scale only possible at internet level Thresholds are dynamic & action taken accordingly

6 Global Spam Patterns and Trends Spam to Mail Ratio m 900.0m 800.0m 700.0m 600.0m 500.0m 67.6% 62.7%63.0% 59.9% 55.6% 51.0% 52.6% 55.1% 52.8% 50.5% 43.5% 43.7% 38.5% 35.7% 400.0m 24.4% 25.6% 21.3% 17.5% 16.4% 17.2% 300.0m 200.0m 6.7% 9.4% 4.6% 0.8% 0.8% 0.8% 0.8% 0.1% 100.0m 0.0m 76.1% January February March April May June July August September October November December January February March April May June July August September October November December January February March April May % 80.0% 60.0% 40.0% 20.0% 0.0% -20.0% Mail/Spam Volume Ratio in Mail Mail Received Spam Received Percentage of Ratio Trend

7 Global Patterns and Trends is now considered a business-critical application (Gartner Sept 2003) is also considered a legal document and industry is required to treat it as such June 2004: 1 in 10.8 (9.3%) s contained viruses; equivalent to 37.6 virus borne s every second June 2004: Spam accounted for 85.3% of traffic; equivalent to spam messages per second US >80%, UK 50-60%, Germany 40%, Australia 30%, Netherlands 30%, Hong Kong 25%

8 Convergence Recent viruses contain Remote Access Trojan (RAT) component Fizzer, Sobig, MyDoom, Sober Spyware: leaking information to spammers Case study: Sobig.F Sobig.F was the fastest spreading worm in the past 4 years It generated over 200 million infected messages during its first week of activity Staged deployment of WinGate Proxy software Currently 70% of spam intercepted by MessageLabs is sent via open proxies Spammers will portscan for open proxies Some Ratware comes with pre-set lists or daily updated lists This leads to 50,000 new zombies appearing each week Traded online as potential open proxies for the spammers or as hosts for everything from paedophile images, DDoS attacks (distributed denial of service) to Phishing scams Some estimates suggest that15% to 25% of the Internet may be controlled by spammers or criminal gangs

9 The Bot-net Phenomenon Around 70% of all spam is sent via an open proxy 75% of which originated from virus infected domains EML/Worm.SM TrojanDropper.JS.Mimail.b JS/Fortnight.A-m Heuristic IP in blacklist Sender in blackhole Sender in blacklist EML/Worm.VW W32/Ganda.A-mm W32/Lovgate.f-m W32/Sobig.D-mm Troj/CasinoSpam W32/BugBear.A-mm W32/Heloc-mm W32/Sobig.A-mm W32/CIH.1003.A EML/WinCritUpd Troj/JS-Seeker.T W32/Klez.H-mm Troj/Backdoor.AVF W32/Sobig.C-mm W32/Sobig.E-mm W32/BugBear.B-mm W32/Fizzer.A-mm Early example of trojan with spam connections 0 100, , , , , , ,000 Mail/Virus Volume Spam Volume

10 MyDoom.A: window of vulnerability Case Study: MyDoom.A Window of Vulnerability: 9 hours, 58 minutes

11 Growth of Open Proxies

12 The Impact of Spam Legislation New EU spam legislation enacted in December 2003 In December 2003, 62.7% of scanned was spam, rising to 63.0% in January 2004 >70% of spam sent to UK in January originated in the US Figure set to rise to >80% by July 2004 Open to interpretation Jurisdiction not clearly defined EU/US legislation unlikely to ease spam epidemic CAN-SPAM opt-out vs. opt-in Majority of CAN-SPAM compliant spam is dressed-up to appear legitimate Regulation for a previously ungoverned industry Corporate governance (e.g. Sarbanes-Oxley, Basel-2) archiving policies Risk Management

13 Tackling Spam Legal framework is only part of an overall solution Less appealing Difficult to operate and be profitable Locks vs. Laws Need a technology based solution as well IP Block-listing / Permitted sender lists Fingerprints / Signatures Collaborative filtering Heuristics Statistical methods, e.g. Bayes Sender Warranted , e.g. Habeas haiku Open Proxy detection URL signatures

14 Phishing and Identity Theft Phishing s intercepted by MessageLabs

15 Phishing: A Global Problem Worldwide Phishing

16 Questions & Answers Any Questions?