Unsolicited emails are an ongoing security concern. In this video, you’ll learn about spam, spim, and spit.
<< Previous Video: SpoofingNext: Phishing >>
A type of attack that does not appear to be going anywhere quickly is spam. This is unsolicited emails we get. These emails are getting us or wanting us to click some links to buy something.
It could be sunglasses. It could be refinance your house. It could be pharmaceuticals. There are so many different things.
The problem with spam is that it is working for the bad guys. They’re finding if they send a million messages, somebody will buy something. The problem, of course, is that it is so easy and inexpensive to send a million messages out that they’re immediately getting some nice financial returns on these things.
And there is quite a different little network behind the scenes of botnets and spam senders that are creating problems for us. So it’s an ongoing issue we have to think about when we’re managing our email, managing our bandwidth, making sure we’re keeping our systems very, very secure in our organizations. This has traditionally been used for advertising to get you to buy something, but the bad guys are also noticing that if they send a million messages with links that can then infect your machines those can also now become additional spam botnets.
That’s how the bad guys are sending the spam these days. They’re infecting your machine. Your machine now becomes part of a botnet. They send a command down to your machine saying, go send some spam for me. And your machine begins sending spam out everywhere.
Becomes a big issue, especially when those are all distributed throughout the world. And that’s a pretty big challenge if you’re trying to figure out how to stop these things. You can’t go to a central source. It is a completely distributed process.
Another very common type of spam is spim. This is unsolicited instant messaging. This is when you pop open your IM and suddenly you’re getting messages all over the place.
These bad guys have found if they sneak make some links into your instant message that you may want to click that. Because instant messaging is something that’s a little more personal than spam and they think they can trick you into clicking those links. And those links can be really, really bad ones.
These are very, very directed and very, very specific types of spam. And generally, that’s their only chance at this. It’s something that also doesn’t stick around. It’s not something that’s in your email inbox so they have to be very tricky and very specific.
And it’s usually, of course, robots. There’s no real people sending in these messages. These robots are trying to get you to click those links and have it send that information, have you infect your machine, have you log into a fake website, send your info out to somebody else. There’s also something called split. This is spam over internet telephony.
It’s kind of a bad name for it. Spit. This is the saliva of unsolicited messages. But because it is voice, it becomes very, very difficult to avoid this. You also can’t filter out very easily with voice over IP.
Now one of the advantages of this is that voice over IP, like Skype, like your Google Voice, have made it very, very difficult for the bad guys to use this for bad purposes. So that’s one advantage we have and one reason we aren’t getting a lot of unsolicited internet telephony. But if you are ever in Skype, you know that Skype does have instant messaging capabilities so they’re often piggybacking on some of the additional capabilities built into the internet telephony. So you may not be getting voice, but you may still be contacted through other means within those internet telephony applications.
There are a number of different philosophies to blocking spam, and many of these work in conjunction with another. One of the more obvious ways is to create a white list, which means the only email that comes into my inbox are things that had been checked off as real people. Sometimes this is an automated process.
The first time you send a message to somebody, you may get an automated response back saying, I don’t know who you are. If you are a real person, please click this link, type this information in, and you will be added and your email will be sent on to my inbox. But the challenge, of course, is sometimes legitimate traffic might be blocked.
So we might want to approach it from the other direction. Have a blacklist. Stop everything that we definitely know is bad. Obviously, this can be a very, very, very large list, but this is something that third parties do keep track of and they have very, very big lists. This is one advantage of being on the internet is many people can all work together to create these blacklists.
The problem, of course, is if somebody legitimate gets on the blacklist, you may not be getting some legitimate traffic and that does occasionally occur. Somewhat of a smarter approach to resolve the spam issue is something called Bayesian filtering. This is where we’re not looking at a whitelist or a blacklist and we’re not looking for specific words in an email.
What we’re doing is looking at the entire email. We’re looking at words and phrases. And if we happen to see a number of words and phrases altogether at certain places within the email, you get a particular score.
And if that score is above or below a certain threshold, it either goes into your spam box or it goes into your inbox. So you have some adjustments you can do with this as well. Certainly, not perfect, but if you’re trying to block the majority of the bad stuff coming in, Bayesian filtering may be a good way to do that.
These days, our spam filters are just built into our email clients, of course. We have sometimes whitelists, blacklists, and Bayesian filtering all built into what we’re doing on our desktop. Maybe it’s built into our organizations’ Outlook Exchange front end.
Maybe we have a third party that does all of our spam filtering for us. They’re almost always using a number of these different technologies. And in reality, you have to use all of these working together to really keep all of the noise and all of the spam out of your inbox.