Next Generation Spam Zombies Will Use Data Mining

branewashd writes "The Globe and Mail is covering some new research on the future of spam. The paper 'Spam Zombies from Outer Space', from researchers at the University of Calgary, will be presented on Sunday at the European Institute for Computer Anti-Virus Research conference. According to the paper, the next generation of spam zombies will employ 'sophisticated data mining of their victims saved email'. When a computer is turned into a spam zombie, it will first be mined of its address book, mail client configuration, and mail archives. Then the spam program will use Natural Language Processing techniques to send spam messages to the victim's contacts that look a lot like messages that the user has previously sent. The researchers predict that this will be extremely hard to detect, but they do offer a few suggestions for combating it."

The three forces driving spam

Technical advances

Better tricks to fool spam filters, like the examination of text the user has written mentioned in TFA. This is close to impossible to stop, the only way is to try to be faster in developing better anti spam tools.

Lack of security

Most spam today is send from captured machines, and in the future these machines will not only be used to send but also to improve spam. This could be helped by better educated users, better default system security or easier to understand security configurations. At least there is hope.

Response

The only reason for all this spam is that it still pays. Even though it is a very small number of people, it is enough to finance the whole illegal business of building bot nets, stealing addresses etc. If there was a way to stop people to buy that stuff, the other two points would be irrelevant. Unfortunately this is not going to happen, which is the most frustrating part.

Well poisoners...

These are attempts to poison word-based beysian(sp?) spam filters.

If you mark enough of these random collection of useful word messages as spam, your beysian spam filer will start filing real, useful email as spam, and you will eventually decide the filter doesn't work and turn it off...

Of course, if you feed your filter just the headers and stuff that actually looks like spam, and not the blocks of random words, it can still learn useful things.

Re:Well poisoners...

If evolution wasn't broken and stupid people did less breeding and more dying ...

I think this would be an universal solution to almost all of mankinds problems.

Re:The three forces driving spam

The only reason for all this spam is that it still pays.

Here's the funny thing. Joe will receive a spam that has been carefully constructed as to appear to be coming from his mother. Why the fsck would he believe it? Is he so stupid that he would buy viagra and hoodia from his mother? The answer, unfortunately, is yes...

"Dear Son,

I am so sorry to hear about your injury. Have you considered **Ci@L15**? My arthritis is acting up, I think I will LAST ALL WEEKEND! When will you come down next, because PLEASE THE CHICAS!

Love,
Mum"

Welcome to the world of tomorrow!

Or... the world of 1998? Didn't pretty much all Outlook worms do this?

I Hope They Don't Know About Weka!

Damn, I hope they don't abuse the hell out of the Weka Project [waikato.ac.nz], that's one slick open source engine I've used time and again. It'd be a crying shame to see it put to use of ill repute!

The researchers predict that this will be extremely hard to detect, but they do offer a few suggestions for combating it.

Like what? Capital punishment for spammers?

Where's the revenue?

Then the spam program will use Natural Language Processing techniques to send spam messages to the victim's contacts that look a lot like messages that the user has previously sent.

Do they make money on that? (1. Re-send mail 2. ??? 3. Profit!)?

Not Anytime Soon

The spammers don't innovate, they just use existing technology for their own ends. This would definitely qualify as innovation, so it's not going to happen.

Some will be lucky

There will be some people who will get pop-ups from the zombie virus requesting that they upgrade their machine to be able to run the virus properly.

That's sure to be a dead giveaway...

Same reply for all these threads..

1. This is Microsoft's fault.. Microsoft should fix their operating system to ask for a password any time a program is installed, registry settings are changed, key files are modified, etc.. Also, 'install on demand' should be eliminated from Internet Explorer. Ever notice how spyware pretty much didn't exist before Microsoft gave the developers complete control over a person's PC? The end user is stupid. The whole premise of Windows assumes that.. So then why did Microsoft decide that the end user should be able to have his system completely compromised with ONE SINGLE GODDAMN FUCKING WRONG CLICK WHEN BROWSING A SHADY SITE?

2. This is the fault of the legal system. Spyware is ALREADY illegal. Congress has talked about making it 'illegaler.' Someone needs to jump forth and realize the moneymaking potential that it is to sue the pants off the incessant spammers.

Again.. 99.9% of spyware problems can be fixed by just running in limited user mode. Ubuntu has the right idea..

From the average college student's computer...

"Hi mom, I'm coming home this weekend, and I'll have a load of laundry. I'll also need some money because I can get P3NNY ST0X GO WILD OVER OTCBB FFFF! and some C1AL1S CHEAP AT HTTP //CHEAPERDR00GZ.MX/ !! Could you just transfer the funds to my account, it's easy to do, just go to 12.51.53.21/htedit/upload/pics/boa_rip/index.htm [bankofamerica.com]!"

How to kill a zombie

The researchers predict that this will be extremely hard to detect, but they do offer a few suggestions for combating it.

You have to destroy its brain, of course [portlandmercury.com].

Data Mining?

That doesn't sound like data mining, nor complicated data mining even... just a simple markoff-chain driven text generator would do. Anything more complicated than that wouldn't be data mining either, but rather computer linguistics.

What piques me about the article...

...is that they fail to mention the fact that _most_ (if not all) of these "spam zombies" happen to be Windows based machines. Agreed, most of the machines in the world run Windows, but shouldn't the news article atleast mention the fact that the 'zombification' is attributable (most of the time) to Windows vulnerabilities? Don't know if the UCalgary research team mentioned it in their paper.

I can see it now...

With rising concerns about spam and viruses sent by e-mail, we shall return days when mail was secure because it was written on paper. Riders on horseback would race across the expansive west with only the worry of Indians and dehydration.

I mean seriously, after scalping the rider would the Indian then send a slightly reworded copy of each letter?

The best cure for such spam is...

...yes, yes - Mac OSX and Linux.

But besides that, maybe an ISP should by default block all but a few outbound ports unless the user requests them specifically (either via a web interface @ the ISP or by phone)?

Or for those who recoil under privacy threats by such a thing, maybe offer a locked-all-to-hell ISP service for $x.00 (web, mail, maybe some game port ranges, and that's it) and a "we'll assume you have a clue about what you're doing" service that leaves ports as they are now for $x+y.00 (nominal enough to scare off the average users, but low enough to prevent gouging and such).

dunno... prolly a bad idea and yes full of holes (technical and otherwise), but an idea nonetheless.

/P

That's not data mining. It's just copying data

Pet Peeve: Data mining is about making statistical inferences based on a large group of data and extracting patterns that nobody saw before.
Examining someone's address book, copying an email in the Outbox, and inserting junk in the middle of that is no more than low tech vandalism.

Data Mining Spam Zombies?

Wasn't that on Sci-Fi last Thursday at 3am? I think they were From Beyond...

Bring back colonial-era punishment

Isn't it fun to imagine spammers being sentenced to a couple hours in the stocks in the village square?

Sigh.

their estimates are low

Research firms figure spam accounts for about 40 per cent of the billions of e-mails sent each day.

It's more like 70-80% as my spam firewall allows 22% of email.

Email for Messaging Only

"What we want to do in our research at the University of Calgary is get out of the cycle of just reacting to new problems we see."

Change the spammer's email environment before it changes you.
Have an email option solely for communication and not for commercial transfer or for selling things.
I guess people/business wouldn't go for that.

Data mining huh?

I'm waiting for someone to come up with an expert system /AI that looks for new securtity exploits and then uses them to spread it's own code to other systems. Try filtering that out.

From a practical standpoint...

As much as I would like to see everyone drop all the Windows, Outlook, Internet Explorer crap so we can all move on from things such as spam and worms, I doubt that this is going to happen to any good degree in the next 5 years. But who knows?

What I'm sure will happen, sadly, is that Microsoft will push Vista, and it will contain some half-assed attempts at curbing these horrible, large-scale problems of zombies, worms, etc, etc. How effective these attempts will be (if at all) remains to be seen.

So, the next 5 years will be... interesting. Will Vista do anything to curb the problems which are likely to be exacerbating as described in TFA? (Doubtful.) Will less stupid technologies like Linux and OSX start moving in to actually do something about the sorry state of things? (Also doubtful.)

On the bright side, what I can see in the next 5 years or so, is the older PC's that are sitting in a den somewhere pumping out viruses and spam, dying off as their cheap Dell consumer-grade components go kaput. What these zombie computers are replaced with is what will make the difference. We can always cross our fingers and hope that these computers will be replaced with Linux or OSX. And hope, and hope.

At any rate, I for one do not welcome our outer space spam zombie overlords.

Harman Hamburgaz HAHAHAH

Harman Hamburgaz HAHAHAH

Err thanks guys...

researchers at the University of Calgary, will be presented on Sunday at the European Institute for Computer Anti-Virus Research conference. According to the paper, the next generation of spam zombies will employ 'sophisticated data mining of their victims saved email'.

Nice, so even if most spammers don't have the intelligence or resources to do the research for more sophisticated spamming (beyond finding yet another exploit for IE), a bunch of researchers do it for them and publish the papers.

How helpful of them.

And btw that's happening all the time - researchers publishing papers of the next generation terrorism, virii (with working proof of concepts), spamming, identity theft and so on.

Good, do your research, maybe just don't make it widely available to the people you're claiming you're trying to protect us from.

Oh, really?

Then the spam program will use Natural Language Processing techniques to send spam messages to the victim's contacts that look a lot like messages that the user has previously sent. The researchers predict that this will be extremely hard to detect, but they do offer a few suggestions for combating it.

For instance, before sending someone your credit card number, take a moment to ask yourself whether or not your mother is likely to be offering to sell you penis enlargement pills.

Somehow, I don't think it is going to be difficult to tell the difference, simply because my friends are not trying to peddle things to me.

Unfortunately this is not new or next generation.

I regularly recieve emails of exactly this nature to several addresses I use to deal with shady/or poorly managed state agencies. I noticed address mining of this sort at least 16 months ago. I typically know that a given shop will be calling for some sort of aid when I start getting my own (slightly modified and links added) back with own signature attached(once again slightly mispelled).

My solution is to make no friends

Then I won't be in anybody's contact list.

MXSNDR / MXPTR Records

* Make every sending entity register rDNS MXPTR records that state IPs allowed to send mail for the domain.
* Don't accept mail that doesn't have properly registered rDNS MXPTR entries.
* Profit from ending site spoofing in spam, making the only outlets open relays and subverted real mail servers, which is considerably less than the whole of home systems worldwide

It's easy. It's distributed. It recognizes the frequent difference between Sending and Receiving MTAs. There are no new control structures to deal with, just an extra reverse DNS entry.

1.2.3.4 @example.com
1.2.3.5 @example.com
1.2.3.4 @subdomain.example.com
1.2.3.5 @subdomain.example.com

This is happening already

My wife was sent an email from a trusted friend of hers, which recommended she go to a particular website, and fill out a survey to receive a $25US gift card to Target (a major US retailer). As this email had come from a trusted friend, my wife, who is very computer savvy, went to the site to fill out the survey.

Once the survey posted, she noticed that her browser began acting very unusual. The website apparently hijacked her browser, backed up into her email, and proceeded to send emails to every person whom appeared in her inbox. She was so startled that she was not able to close her browser in time to stop this from occurring.

Now, the language used in the email appeared to be a form template, as the text which in the email I received from her was identical to the text she had recieved, but other than this it sounds fairly similar to what the article is discussing.

How soon will it be before we cannot even trust emails sent to us from our closest associates? This is totally unreasonable.

The left one option out

Ditch windows.

Time for vigilante SPAM defense...

To end SPAM, it seems like it's safer for internet users in general if some of us volunteer to automatically load those SPAM URL's. I.e. DDOS. Someone needs to hack up a cute little tray application to grab URLs from a central site and grab them a few thousand times... it won't end spam directly, but it might (finally) make the economics poor.

In Other News,

The Second War to End All Wars will be fought with armored dirigibles and giant marching robots. Also, we will have a permanent Moon base by 1975.

There's a huge flaw in this idea

I RTFpdf and I don't see any mention of the single gaping hole in this proposed spam method, which renders it highly unattractive to spammers : the zombies will be short lived. Currently, zombies can only be identified by IP address (for those who can be bothered to dig through the spam email headers), but all that lets the target do is complain to the owner of the netblock on which the zombie lives - there is no way to contact the owner of the infected machine directly, via email. Netblock owners (typically ISPs) may or may not have the resources and motivation to follow up complaints.

With this proposed scheme, the recipient has an email address that ties directly to the zombied machine; they maybe even know the purported sender IRL. When the recipient receives such a spam, maybe even falls for the pitch and clicks through, the next thing they do is mail the owner of the zombie machine with a "wtf did you send me that for? are you infected with something?" Granted this won't happen /every/ time, but given the very nature of the relation between sender and recipient, follow-ups will occur very often - it's unlikely the zombie could get off more than a handful of such spoofs before the whistle was blown and the zombie machine's owner is alerted that something is afoot.

I can't see how zombies operating in the manner proposed could live undetected for very long at all; and I don't see the spammers valuing a very small number of deliveries in a very short time window (albeit with an increased chance of success), more than the thousands of potential deliveries over a long window that current zombies offer.

Adopting this technique would significantly reduce the average lifetime of a zombie infection, and therefore massively reduce the value of that zombie. I can't see the zombie gangmasters willingly slitting their own throats in this way.

Re:welcome to #oldnews

1998 called and wants their news back

1990 called and wants their "$YEAR called and wants their $ITEM/CONCEPT back" meme back.

Re:Spam Zombie?

What does this exactly entail? Does the computer first have to be compromised? Spyware/spamware installed through a backdoor? I've lightly read through the paper and it does mention that some sort of malware may be present on the victim's machine.

Yes. This has been standard operating procedure for many spammers for about two years now. Virus, worm, and spyware authors set up backdoors through which compromised computers can be loaded with spam-sending software. Then they sell access to these botnets on the black market. Spammers use software designed to blast out commands to dozens or hundreds of bots sitting in homes, businesses and elsewhere, which then spew their virtual sludge across the internet.

The hardcore spammers effectively have infinite processing power and bandwidth, since they can distribute the load across a botnet, and when the same spam run is coming a few messages at a time from hundreds of IP addresses, it's a lot harder to blacklist by IP. That's why many ISPs have started filtering outgoing SMTP traffic, and why blacklists have cropped up that just block any incoming mail from dynamic IP space.