Tracking the source of email spam by examining its header

19
Tracking the source of email spam by examining its header Anh Nguyen May 3 rd , 2010

TAGS:

description

Tracking the source of email spam by examining its header. Anh Nguyen May 3 rd , 2010. Organization. Introduction Email Headers Overview Spam Examples Email Tracer Tool: eMailTrackerPro Conclusions . Introduction. Introduction Email Headers Overview Spam Examples - PowerPoint PPT Presentation

Transcript of Tracking the source of email spam by examining its header

Page 1: Tracking the source of email spam by examining its header

Tracking the source of email spam by examining its header

Anh NguyenMay 3rd, 2010

Page 2: Tracking the source of email spam by examining its header

2

Organization

• Introduction• Email Headers Overview• Spam Examples• Email Tracer Tool: eMailTrackerPro• Conclusions

Page 3: Tracking the source of email spam by examining its header

3

Introduction

• Introduction• Email Headers Overview• Spam Examples• Email Tracer Tool: eMailTrackerPro• Conclusions

Page 4: Tracking the source of email spam by examining its header

4

Introduction

• Spammers usually fake their email’s headers• Headers can be examined to identify the true

source of email• Assumption: Full headers of the examined

email can be shown by the mail reader

Page 5: Tracking the source of email spam by examining its header

5

Email Headers Overview

• Introduction• Email Headers Overview• Spam Examples• Email Tracer Tool: eMailTrackerPro• Conclusions

Page 6: Tracking the source of email spam by examining its header

6

Email Headers Overview

• From– First line in headers– Not actually part of the e-mail header– Inserted by mail transfer software– Used by many Unix mailers to separate messages– Can be faked, but not always

• From:– Who the message is from– The easiest to forge

Page 7: Tracking the source of email spam by examining its header

7

Email Headers Overview (Cont.)

• Reply-To:– The address to which replies are sent– Easily to be forged– Often provides a clue

• Return-Path:– The address for return mail

• Sender: – The account that sent the message– Many mail software fails to insert this line

Page 8: Tracking the source of email spam by examining its header

8

Email Headers Overview (Cont.)

• Message-ID:– Unique string assigned to message by mail system when

the message is first created– Forgeable, but requires more knowledge than forging the

From: line– Often identifies the system where the sender is logged in– Not identifies the system where the message originated– Every mail software has its own unique string style– Spam can be identified by comparing its message-id with

legitimate messages from the same site

Page 9: Tracking the source of email spam by examining its header

9

Email Headers Overview (Cont.)

• Received:– Most important field for tracking– Format:

• Received: from ? by ? via ? with ? id ? for ? ; date-time

– List all sites (mail servers) through which the message traveled before reaching the destination.

– Lines are read from bottom to top

Page 10: Tracking the source of email spam by examining its header

10

Email Headers Overview (Cont.)

• Received: from.foo.com by bar.com id AA15057; Fri, 25 Jul 97 09:39:02– foo.com: the name that the sending machine uses to identify itself

• Received: from foo.com ([129.2.3.4]) by bar.com id AA15057; Fri, 25 Jul 97 09:39:02 – IP address of the sending machine is inserted by bar.com. The IP and

the machine name can be compared to identify a forgery– IP validity can also be checked (ex., no component in the address can

be > 255)• Received: from foo.com (x.y.alterdial.uu.net [129.2.3.4]) by bar.com id

AA15057; ... – Both IP and the actual name of the sending machine are inserted

Page 11: Tracking the source of email spam by examining its header

11

Spam Examples

• Introduction• Email Headers Overview• Spam Examples• Email Tracer Tool: eMailTrackerPro• Conclusions

Page 12: Tracking the source of email spam by examining its header

12

Spam Examples• Received: from cola.bekkoame.or.jp (cola.bekkoame.or.jp [202.231.192.40]) by srv.net

(8.8.5/8.8.5) with ESMTP id BAA00705 for <[email protected]>; Wed, 30 Jul 1997 01:15:27 -0600 (MDT)

• From: [email protected]• Received: from cola.bekkoame.or.jp (ip21.san-luis-obispo.ca.pub-ip.psi.net [38.12.123.21])

by cola.bekkoame.or.jp (8.8.5+2.7W/3.5W) with SMTP id OAA11439; Wed, 30 Jul 1997 14:35:50 +0900 (JST)

• Received: from mailhost.aol.com(alt1.aol.com(244.218.07.32)) by aol.com (8.8.5/8.6.5) with SMTP id GAA00075 for <"">; Tue, 29 Jul 1997 22:19:42 -0600 (EST)

• Date: Tue, 29 Jul 97 22:19:42 EST• Subject: You can have what you want... • Message-ID: <[email protected]> • Reply-To: [email protected] • X-PMFLAGS: 56354433 0 • Comments: Authenticated sender is <aol.com> X-UIDL: vjg79u26gfkjjrty38jf983j309jfyrw

Page 13: Tracking the source of email spam by examining its header

13

Spam Examples• From [email protected] Wed Apr 2 21:13:04 1997 • Received: from watagashi.zzzzzzzzzzz.zzz (watagashi.zzzzzzzzzzz.zzz [10.168.192.43]) by

ccshst06.cs.uoguelph.ca with ESMTP (8.7.5/8.7.3) id OAA20088 for &lt;[email protected]&gt;; Wed, 2 Apr 1997 14:35:28 -0500 (EST)

• From: [email protected] • Received: from zzzzzzzzzzz.zzz (Cust76.Max7.Los-Angeles.xx.xxxxx.xxx [10.168.73.204]) by

watagashi.xxxxxxxxxxx.xxx (8.7.5+2.6W/3.5W) with SMTP id DAA06068; Thu, 3 Apr 1997 03:58:21 +0900 (JST)

• Received: from mailhost.nowhere.com (alt1.nowhere.com (206.1.562.999)) by nowhere.com (8.8.5/8.6.5) with SMTP id GAA00597 for &lt;[email protected]&gt;; Wed, 02 Apr 1997 10:18:14 -0600 (EST)

• To: [email protected] • Message-ID: &lt;[email protected]&gt; • Date: Wed, 02 Apr 97 10:18:14 EST• Subject: How To E-Mail Up To A Million Messages Per Hour--No Kidding• Reply-To: [email protected]• X-PMFLAGS: 34078848 0 • X-UIDL: 3671313288a65eb1890m0762123a

mailto:[email protected]
Page 14: Tracking the source of email spam by examining its header

14

eMailTrackerPro

• Introduction• Email Headers Overview• Spam Examples• Email Tracer Tool: eMailTrackerPro• Conclusions

Page 15: Tracking the source of email spam by examining its header

15

eMailTrackerPro• Received: from unknown (HELO 38.118.132.100) (62.105.106.207)

by mail1.infinology.com with SMTP; 16 Nov 2003 19:50:37 -0000Received: from [235.16.47.37] by 38.118.132.100 id <5416176-86323>; Sun, 16 Nov 2003 13:38:22 -0600Message-ID: <[email protected]>From: "Reinaldo Gilliam" <[email protected]>Reply-To: "Reinaldo Gilliam" <[email protected]>To: [email protected]: Category A Get the meds u need lgvkalfnqnh bbkDate: Sun, 16 Nov 2003 13:38:22 GMTX-Mailer: Internet Mail Service (5.5.2650.21)MIME-Version: 1.0Content-Type: multipart/alternative; boundary="9B_9.._C_2EA.0DD_23"X-Priority: 3X-MSMail-Priority: Normal

Page 16: Tracking the source of email spam by examining its header

16

eMailTrackerPro

Page 17: Tracking the source of email spam by examining its header

17

Conclusions

• Introduction• Email Headers Overview• Spam Examples• Email Tracer Tool: eMailTrackerPro• Conclusions

Page 18: Tracking the source of email spam by examining its header

18

Conclusions

• Thank you for your time• Questions and feedback are welcome

Page 19: Tracking the source of email spam by examining its header

19

References

• Spam Tracking Page– http://www.rahul.net/falk/

• Email Tracer Tutorial– http://www.visualware.com/resources/tutorials/

email.html


Spam and Anti Spam Techniques

Spam and Anti Spam Techniques

Email Marketing 101: Maximize Email Results€¦ · Emails Server IP address reputation Complaints against your domain, IPs ... spamtraphits Correct sender header, etc. Page 6 6 SPAM

Email Marketing 101: Maximize Email Results€¦ · Emails Server IP address reputation Complaints against your domain, IPs ... spamtraphits Correct sender header, etc. Page 6 6 SPAM

CASL vs CAN-SPAM - Canada’s Anti‐Spam Law

CASL vs CAN-SPAM - Canada’s Anti‐Spam Law

Spam and Anti-Spam By Aditi Desai Yousuf Haider. Agenda Introduction Purpose of Spam Types of Spam Spam Techniques Anti spam Why Spam is so Easy Anti.

Spam and Anti-Spam By Aditi Desai Yousuf Haider. Agenda Introduction Purpose of Spam Types of Spam Spam Techniques Anti spam Why Spam is so Easy Anti.

Spam Hammer 3 - WP Plugin To End Spam

Spam Hammer 3 - WP Plugin To End Spam

NEW ABUSE REPORT - AFNIC · Google Safe Browsing Domain name Abuse spam phishing spam phishing spam Unwanted s spam spam malware GURID Registrar name Potential abuses Creation date

NEW ABUSE REPORT - AFNIC · Google Safe Browsing Domain name Abuse spam phishing spam phishing spam Unwanted s spam spam malware GURID Registrar name Potential abuses Creation date

Spam Overview. What is Spam? Spam is unsolicited email in the form of: Commercial advertising Phishing Virus-generated Spam Scams E.g. Nigerian.

Spam Overview. What is Spam? Spam is unsolicited email in the form of: Commercial advertising Phishing Virus-generated Spam Scams E.g. Nigerian.

Examining IP Header Fields There are 2 types of attack towards Network Intrusion Detection System (NIDS): Insertion Attacks - Where an attacker forces.

Examining IP Header Fields There are 2 types of attack towards Network Intrusion Detection System (NIDS): Insertion Attacks - Where an attacker forces.

Handling Spam in Postfix. Computer Center, CS, NCTU 2 Nature of Spam Spam UBE – Unsolicited Bulk Email UCE – Unsolicited Commercial Email Spam There.

Handling Spam in Postfix. Computer Center, CS, NCTU 2 Nature of Spam Spam UBE – Unsolicited Bulk Email UCE – Unsolicited Commercial Email Spam There.

SPAM over Internet Telephony - andreas.schmidt.novalyst.deandreas.schmidt.novalyst.de/docs/SPAM over Internet Telephony_edi… · Title: SPAM over Internet Telephony Author: RashAdmin

SPAM over Internet Telephony - andreas.schmidt.novalyst.deandreas.schmidt.novalyst.de/docs/SPAM over Internet Telephony_edi… · Title: SPAM over Internet Telephony Author: RashAdmin

Introduction Spam in Society Email Spam IM Spam Text Spam Blog Spamming Spam Blogs.

Introduction Spam in Society Email Spam IM Spam Text Spam Blog Spamming Spam Blogs.

Vodafone Hosted Services Hosted Email Anti-Spam User Guide · Tagging the email involves either appending text to the subject field, or appending a specific header to the existing

Vodafone Hosted Services Hosted Email Anti-Spam User Guide · Tagging the email involves either appending text to the subject field, or appending a specific header to the existing

header and dot net image processing stsnoi ... stsd13 a fuzzy similarity approach for automated spam ... blurtooth mobile adveriising system using pull based approach

header and dot net image processing stsnoi ... stsd13 a fuzzy similarity approach for automated spam ... blurtooth mobile adveriising system using pull based approach

Hexamail guard anti-spam server spam filtering software - index

Hexamail guard anti-spam server spam filtering software - index

SPAM And SpamAssassin - haifux.orghaifux.org/hebrew/lectures/155/spam.pdf · The SPAM arms race SPAM filtering is a unique problem in AI. Moving target – SPAM keeps changing. –

SPAM And SpamAssassin - haifux.orghaifux.org/hebrew/lectures/155/spam.pdf · The SPAM arms race SPAM filtering is a unique problem in AI. Moving target – SPAM keeps changing. –

Telarus Managed Security (TMS)€¦ · 8.4 By default, Telarus Antispam will tag the spam email in the subject header and forward to Customer’s internal mail server. Customer is

Telarus Managed Security (TMS)€¦ · 8.4 By default, Telarus Antispam will tag the spam email in the subject header and forward to Customer’s internal mail server. Customer is

Fighting SPAM Spamassassin Statistical based on factors such as banned words and acronyms None plane text or strange ascii coding in mail header HTML body.

Fighting SPAM Spamassassin Statistical based on factors such as banned words and acronyms None plane text or strange ascii coding in mail header HTML body.

Detecting Spam and Spam Responses

Detecting Spam and Spam Responses

Telmex Spam

Telmex Spam

The Spam/Anti-Spam Battlefield - Sans Technology Institute · The Spam/Anti-Spam Battlefield At times, ... Spamming is the abuse of electronic messaging systems to send unsolicited,

The Spam/Anti-Spam Battlefield - Sans Technology Institute · The Spam/Anti-Spam Battlefield At times, ... Spamming is the abuse of electronic messaging systems to send unsolicited,