McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret...
Transcript of McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret...
![Page 1: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/1.jpg)
Lose weight Limited time only Save big money Lose weight Limited time only Save big money ViagraViagra Supplies are limited Take action now No Supplies are limited Take action now No disappointment Nitroglycerin disappointment Nitroglycerin Dear friendDear friend No questions No questions asked Offer expires Work at home You have been asked Offer expires Work at home You have been
selected selected McCain Says Unsure If Obama A McCain Says Unsure If Obama A Secret Hippopotamus Secret Hippopotamus Urgent Unlimited Urgent Unlimited This This isn’t spamisn’t spam Social security number Serious cash Free Social security number Serious cash Free membership Click to remove mailto Outstanding values membership Click to remove mailto Outstanding values Online pharmacy Act now! Online pharmacy Act now! Don’t hesitate!Don’t hesitate! Potential Potential earnings earnings Contemporary Spam FightingContemporary Spam Fighting Reverses aging Reverses aging Lowest price Meet singles Sign up free today Lowest price Meet singles Sign up free today Opportunity Opportunity Risk freeRisk free Removes wrinkles Financial Removes wrinkles Financial freedom Full refund freedom Full refund Christoph NiemzChristoph Niemz No strings No strings attached attached What are you waiting for? No medical exams What are you waiting for? No medical exams Once in lifetime Once in lifetime ETH Zürich ETH Zürich Extra cash passwords Free Extra cash passwords Free cell phone cell phone Fast Viagra deliveryFast Viagra delivery Drastically reduced Drastically reduced Don’t delete Congratulations Click here link Avoid Don’t delete Congratulations Click here link Avoid bankruptcy Additional income bankruptcy Additional income Great offerGreat offer Accept Accept
credit cardscredit cards 07.03.2012 07.03.2012 Join millions of Americans Join millions of Americans
![Page 2: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/2.jpg)
Lose weight Limited time only Save big money Lose weight Limited time only Save big money ViagraViagra Supplies are limited Take action now No Supplies are limited Take action now No disappointment Nitroglycerin disappointment Nitroglycerin Dear friendDear friend No questions No questions asked Offer expires Work at home You have been asked Offer expires Work at home You have been
selected selected McCain Says Unsure If Obama A McCain Says Unsure If Obama A Secret Hippopotamus Secret Hippopotamus Urgent Unlimited Urgent Unlimited This This isn’t spamisn’t spam Social security number Serious cash Free Social security number Serious cash Free membership Click to remove mailto Outstanding values membership Click to remove mailto Outstanding values Online pharmacy Act now! Online pharmacy Act now! Don’t hesitate!Don’t hesitate! Potential Potential earnings earnings Contemporary Spam FightingContemporary Spam Fighting Reverses aging Reverses aging Lowest price Meet singles Sign up free today Lowest price Meet singles Sign up free today Opportunity Opportunity Risk freeRisk free Removes wrinkles Financial Removes wrinkles Financial freedom Full refund freedom Full refund Christoph NiemzChristoph Niemz No strings No strings attached attached What are you waiting for? No medical exams What are you waiting for? No medical exams Once in lifetime Once in lifetime ETH ZürichETH Zürich Extra cash passwords Free Extra cash passwords Free cell phone cell phone Fast Viagra deliveryFast Viagra delivery Drastically reduced Drastically reduced Don’t delete Congratulations Click here link Avoid Don’t delete Congratulations Click here link Avoid bankruptcy Additional income bankruptcy Additional income Great offerGreat offer Accept Accept
credit cardscredit cards 07.03.201207.03.2012 Join millions of Americans Join millions of Americans
![Page 3: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/3.jpg)
Job
Salary
![Page 4: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/4.jpg)
Job
Salary
![Page 5: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/5.jpg)
Job
Salary
![Page 6: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/6.jpg)
Job
Salary
![Page 7: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/7.jpg)
Job
Salary
![Page 8: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/8.jpg)
Outline
$$$$
![Page 9: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/9.jpg)
The Value Chain of Spam
Advertising Click Support Realization $$$$
![Page 10: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/10.jpg)
Actors in the Spam Value Chain
Advertising Click Support Realization
Spammers Affiliate Programs
Most often distinct, but sometimes one and the same organization!
![Page 11: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/11.jpg)
Affiliate Programs
For each successful sale, you get a commission
of 4-15% from Amazon
![Page 12: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/12.jpg)
Affiliate Programs
For each successful sale, the spammer gets a
commission of 30-50% from e.g. GlavMed
![Page 13: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/13.jpg)
Source: The Partnerka – What is it, and why should you care?
![Page 14: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/14.jpg)
Conversion Rate Analysis [Storm Botnet]
0.0000081% of all emails sent lead to a customer buying a spam-advertised pharma
product.
⇔Spammer needs to send ≈ 12 500 000 mails
until one customer places an order!
Source: Spamalytics: An Empirical Analysis of Spam Marketing Conversion
![Page 15: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/15.jpg)
Conversion Rate Analysis [Storm Botnet]
With an average order price of $100, the Storm Botnet ”produced” revenues of ≈
$9500/day ⇔ $3.5 mio./year
Source: Spamalytics: An Empirical Analysis of Spam Marketing Conversion
![Page 16: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/16.jpg)
Is Spamming Profitable? [Storm Botnet]
Source: Spamalytics: An Empirical Analysis of Spam Marketing Conversion
+ $3.5 mio. Annual Revenue
![Page 17: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/17.jpg)
Source: Spamalytics: An Empirical Analysis of Spam Marketing Conversion
+ $3.5 mio. Annual Revenue
- $1.75 mio. 50% for Affiliate Program
Is Spamming Profitable? [Storm Botnet]
![Page 18: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/18.jpg)
Is Spamming Profitable? [Storm Botnet]
Source: Spamalytics: An Empirical Analysis of Spam Marketing Conversion
+ $3.5 mio. Annual Revenue
- $1.75 mio. 50% for Affiliate Program
- $26 mio. (≈ $80 for domain names & bulletproof hosting for 1 mio. mails) x 328 000 mio. mails sent
![Page 19: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/19.jpg)
Is Spamming Profitable? [Storm Botnet]
Source: Spamalytics: An Empirical Analysis of Spam Marketing Conversion
+ $3.5 mio. Annual Revenue
- $1.75 mio. 50% for Affiliate Program
- $26 mio. (≈ $80 for domain names & bulletproof hosting for 1 mio. mails) x 328 000 mio. mails sent
- $24.25 mio.
![Page 20: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/20.jpg)
Is Spamming Profitable? [Storm Botnet]
Source: Spamalytics: An Empirical Analysis of Spam Marketing Conversion
+ $3.5 mio. Annual Revenue
- $1.75 mio. 50% for Affiliate Program
- $26 mio. (≈ $80 for domain names & bulletproof hosting for 1 mio. mails) x 328 000 mio. mails sent
- $24.25 mio.
The Storm operators probably do everything ”under one roof”The Storm operators probably do everything ”under one roof”
![Page 21: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/21.jpg)
The Economic Damage of Spam
Estimated cost for deleting spam by hand in the US ≈ $22 bio. / year
Other Cost Factors: Mail Filters Additional IT Infrastructure Loss of Network Bandwidth
Source: http://technoreadymarketing.com/Articles/Summary%20Report-NTRS%202004.pdf
![Page 22: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/22.jpg)
Curious Facts
≈ 4-7% of people who read a spam mail buy products advertised by this mail
≈ 88% settled orders were actually delivered to the customer!
≈ 20% of the customers come back!
Sources: http://technoreadymarketing.com/Articles/Summary%20Report-NTRS%202004.pdf Click-Trajectories: End-to-End Analysis of the Spam Value Chain
![Page 23: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/23.jpg)
So let's just shutdown their servers!
![Page 24: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/24.jpg)
Why it's not that easy...
![Page 25: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/25.jpg)
Bottleneck Analysis of the Spam Value Chain
Advertising Click Support Realization
![Page 26: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/26.jpg)
Potential Bottlenecks
Botnet
![Page 27: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/27.jpg)
Botnet Takedown Effectiveness
Source: MessageLab March 2011 Intelligence Report
![Page 28: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/28.jpg)
Botnet Takedown Effectiveness
Source: MessageLab March 2011 Intelligence Report
![Page 29: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/29.jpg)
Domain Name Registrars
![Page 30: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/30.jpg)
Web Hosters
Providers hosting
![Page 31: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/31.jpg)
Banks
![Page 32: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/32.jpg)
Switching a bank...
Requires coordination with:
Bank
Payment Processor
...and usually takes days or weeks!
Banks are the primary Bottleneck!Banks are the primary Bottleneck!
![Page 33: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/33.jpg)
Commercial Break more curious stuff about spam
![Page 34: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/34.jpg)
The CO2 Footprint of Spam
Annual global spam energy consumption could power 2.4 mio. US homes ≈ Chicago City
Source: McAfee: The Carbon Footprint of Spam
![Page 35: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/35.jpg)
>= 80% of all email communication worldwide is spam
Source: MessageLab March 2011 Intelligence Report
![Page 36: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/36.jpg)
![Page 37: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/37.jpg)
![Page 38: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/38.jpg)
ROKSO (Register Of Known Spam Operations)
Lists known professional spam organizations and individuals
A lot of spammers are actually known!
Source: http://www.spamhaus.org/rokso/
![Page 39: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/39.jpg)
0
50
100
150
200
250
Spam Concentration
Number of Spam Organizations responsible for 80% of Global Spam
2007 2009-2011
- 50%
Source: http://www.spamhaus.org/rokso/
![Page 40: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/40.jpg)
End of Commercial Break
(serious stuff from now on)
![Page 41: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/41.jpg)
Judo: ”Fighting Spam with itself”
Advertising Click Support Realization
![Page 42: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/42.jpg)
Traditional Spam Fighting
Vantage Point: Receiver e.g. Received the same mail 100k times must be →
spam URL Domain Blacklisting Subject-line Blacklisting
![Page 43: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/43.jpg)
Judo's Vantage Point: Source
Template InferenceAlgorithm
Template InferenceAlgorithm Template Inference
Algorithm
Template InferenceAlgorithm
![Page 44: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/44.jpg)
I.e., use your private botfarm to harvest spam.
![Page 45: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/45.jpg)
Single Template Inference
Template InferenceAlgorithm
Template InferenceAlgorithm
![Page 46: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/46.jpg)
Single Template Inference
Template InferenceAlgorithm
Template InferenceAlgorithm
Signature as Regular Expression
k Spam Mails
All assumed to be generated by the same template!All assumed to be generated by the same template!
![Page 47: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/47.jpg)
Building Blocks of Judo Signatures
Anchors: invariant strings: http://, Micro-Anchors: @ , . : ...
Macros: variant strings Dictionary-based: chanel | gucci | prada Noise Macros: zvcx, qwsy, ...
![Page 48: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/48.jpg)
An Example Judo Signature
Source: Botnet Judo – Fighting Spam with Itself
Noise
![Page 49: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/49.jpg)
Template Inference Algorithm
1. Learn Anchors http://
2. Learn Macros (= text between Anchors)
1. Dictionary Macros chanel | gucci | prada
2. Micro Anchors @ . , ;
3. Noise Macros (= the ”rest”) zvcx, qwsy
![Page 50: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/50.jpg)
Learning Anchors
1. Sequence of substrings Σ ← Slide window of length q over each message
2. Set of Anchors A Compute the Longest ← Common Subsequence (LCS) over Σ
![Page 51: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/51.jpg)
Sliding Window of Length q
![Page 52: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/52.jpg)
Selection of Parameter q
some less useful anchors (e.g. whitespaces) may be included
too small (e.g. 1):
q
too large:
some useful short anchors may be
excludedEmpirical evidence suggests q = 6 Empirical evidence suggests q = 6
0
![Page 53: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/53.jpg)
Source: Botnet Judo – Fighting Spam with Itself
Noise
![Page 54: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/54.jpg)
Learning Dictionary Macros
Q: Have we seen all dictionary elements?
A: Use a statistical test with
0-Hypothesis: ”There still is an unobserved dictionary element”
0-Hypothesis rejected Very probably a →dictionary macro.
chanel | gucci | prada
![Page 55: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/55.jpg)
Source: Botnet Judo – Fighting Spam with Itself
Noise
![Page 56: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/56.jpg)
Learning Micro-Anchors @ , . :
If Dictionary Test fails:
check if it's a Micro-Anchor using LCS but only allow non-alphanumeric chars
(@ , . : etc.) to match.
![Page 57: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/57.jpg)
Source: Botnet Judo – Fighting Spam with Itself
Noise
![Page 58: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/58.jpg)
Learning Noise Macros zvcx qwsy
Perform Dictionary Test on all elements delimited by Micro-Anchors
Test fails: Noise Macro→
Representation:
zvcx qwsy ⇔ [[:lower:]]{4}
![Page 59: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/59.jpg)
Source: Botnet Judo – Fighting Spam with Itself
Noise
![Page 60: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/60.jpg)
(Selected) Pre-Processing
Template InferenceAlgorithm
Template InferenceAlgorithm
![Page 61: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/61.jpg)
Special Tokens
16.09.2011 17:33:3516.09.2011 17:34:4416.09.2011 17:35:2216.09.2011 17:38:16
16.09.2011 17:(33|34|35|38):(35|44|22|16)
Anchor
Dictionary Macros
![Page 62: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/62.jpg)
Workaround
Dates IP addresses Multi-part message delimiters
...are treated as fixed Anchors during Learning Phase.
Once signature is learned, fixed Anchors are turned into a RegEx.
![Page 63: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/63.jpg)
Effectiveness: False Negative Rate
NOT SPAM
![Page 64: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/64.jpg)
Single Template Inference - Effectiveness
With k=50, 99% of templates were already captured perfectly, i.e. with
0 False Negatives!
Need k=1000 to achieve same result!
![Page 65: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/65.jpg)
Safety: False Positive Rate
Subject: [Seminar in DC]
Hi Samuel
Unfortunately I won't be able to give the talk today, since I'm tied to my bed having caught a cold.I'm sure you will have no problem finding someone else who will give a presentation today.
CheersChristoph
SPAM
![Page 66: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/66.jpg)
The Safety of Judo is due to...
...using Headers + Body (extensive information)
...forcing a signature to have Dictionary Macros and Anchors (very restrictive)
![Page 67: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/67.jpg)
Summary
$$$$
![Page 68: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/68.jpg)
Source: xkcd
![Page 69: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/69.jpg)
Multiple Template Inference
Template InferenceAlgorithm
Template InferenceAlgorithm
k
Signature A
Template InferenceAlgorithm
Template InferenceAlgorithm
k
Signature B
Template InferenceAlgorithm
Template InferenceAlgorithm
k
Signature C
Template InferenceAlgorithm
Template InferenceAlgorithm
k
Signature D
![Page 70: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/70.jpg)
Assumption: Incremental Template Deployment
time
Template A
Template B
Template C
And not:
time
Template A
Template B
Template C
![Page 71: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/71.jpg)
Multiple Template Inference
Template InferenceAlgorithm
Template InferenceAlgorithm
time
k
Signature A
Template InferenceAlgorithm
Template InferenceAlgorithm
k
Signature B
Template InferenceAlgorithm
Template InferenceAlgorithm
k
Signature C
Template InferenceAlgorithm
Template InferenceAlgorithm
k
Signature D
new
Signature ASignature BSignature CSignature D
![Page 72: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/72.jpg)
Size k of the Training Buffer
time
Template A
Template B
time
Template A
Template B
time
Template A
Template B
Too small:
Too large:
Just right:
k
![Page 73: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/73.jpg)
Multiple Template Inference - Evaluation
Classification Bufferd
False Negative Rate is inverse proportional to d
![Page 74: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/74.jpg)
Interesting Links
http://www.spamhaus.org/rokso/
http://www.symanteccloud.com/en/us/globalthreats/
http://www.commtouch.com/threat-report-january-2012
http://spamtrackers.eu/wiki/index.php
http://botlab.org/
In general: Work by Geoffrey M. Voelker & colleagues:http://cseweb.ucsd.edu/~voelker/
![Page 75: McCain Says Unsure If Obama A Secret Hippopotamus Urgent … in... · 2017. 7. 12. · Secret Hippopotamus Urgent Unlimited This isn’t spam Social security number Serious cash Free](https://reader035.fdocuments.in/reader035/viewer/2022063023/5fead189226c812862130465/html5/thumbnails/75.jpg)
References
Main Papers used for this presentation: Click Trajectories: End-to-End Analysis of the Spam Value Chain
K. Levchenko, A. Pitsillidis, N. Chachra, B. Enright, M. Felegyhazi, C. Grier, T. Halvorson, C. Kanich, C. Kreibich, H. Liu, D. McCoy, N. Weaver, V. Paxson, G. M. Voelker, and Stefan Savage. IEEE Symposium on Security and Privacy, 2011, Oakland, USA.
Botnet Judo: Fighting Spam with itselfA. Pitsillidis, K. Levchenko, C. Kreibich, C. Kanich, G.M. Voelker, V. Paxson, N. Weaver, and S. Savage. Proceedings of the 17th Annual Network and Distributed System Security Symposium (NDSS Symposiom 2010), San Diego, California. February 2010.
Spamalytics: An Empirical Analysis of Spam Marketing ConversionC. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Proceedings of the 15th ACM Conference on Computer and Communications Security (ACM CCS), Alexandria, Virginia, pp. 3-14. Also appeared in the Communications of the ACM, Vol. 52, No. 9, pp. 99-107, September 2009
Other sources are mentioned directly on the slides