Understanding Forgery Properties of Spam Delivery Paths.pptVIP

Understanding Forgery Properties of Spam Delivery Paths Fernando Sanchez, Zhenhai Duan Florida State University Yingfei Dong University of Hawaii Problem Statement Email header forgery But to what degree and how well they do it? Why this is important? Investigating email-based crimes such as phishing and threats Email sender accountability Spam control Focus of this study Received: header fields Sequence of servers in Received: fields shows (claimed) spam delivery path 2 Outline Background on Received: header fields Data set and methodology Results and implications of this study Summary and future work 3 Received: Header Fields From-from: From-address: From-domain: ppp89-110-22-1.pppoe.avangarddsl.ru By-domain: 4 Received: from (ppp89-110-22-1.pppoe.avangarddsl.ru []) by (Postfix) with SMTP id 9C6714DE89 Prepended by each mail server into email header Data Sets Two complementary data sets 3 year spam archive MX records of about 1.2M network domains Interpret and confirm findings from first data set Spam archive U spam archive 2007 – 2009, totaling about 1.84M spam messages Bait addresses and domains obtained from Delivered-To: field 5 Data Set: MX Records MX records of about 1.2M network domains Domains extracted from 15 day email trace Collected on FSU campus network in 2008 Sender’s envelope email addresses (MAIL FROM) About 53M msgs, about 47M or 88.7% are spam Representative of the domains 247 top-level domain (TLD) Containing all major email service providers 6 Methodology Length of spam delivery paths Different internal mail server structures of recipient’s domain First external and internal MTA servers MX of 7 Spam Delivery Paths Raw path From (claimed) origin to first internal MTA server (inclusive) Network-level consistent (NLC) path fi and bi-1 belong to the same network Same /16 network prefix Same domain name 8 MX Dataset Analyses Two types of mail servers Load balancing servers: servers within same domain has 11 mail servers all in