Forgot your password?
typodupeerror
Spam IT Technology

Researchers Claim "Effectively Perfect" Spam Blocking Discovery 353

Posted by ScuttleMonkey
from the sounds-evolutionary-not-revolutionary dept.
A team of computer scientists from the International Computer Science Institute in Berkeley, CA are claiming to have found an "effectively perfect" method for blocking spam. The new system deciphers the templates a botnet is using to create spam and then teaches filters what to look for. "The system ... works by exploiting a trick that spammers use to defeat email filters. As spam is churned out, subtle changes are typically incorporated into the messages to confound spam filters. Each message is generated from a template that specifies the message content and how it should be varied. The team reasoned that analyzing such messages could reveal the template that created them. And since the spam template describes the entire range of the emails a bot will send, possessing it might provide a watertight method of blocking spam from that bot."
This discussion has been archived. No new comments can be posted.

Researchers Claim "Effectively Perfect" Spam Blocking Discovery

Comments Filter:
  • Hooray for the good guys! Now if they could find something similar to fight viruses.

  • "Perfect"??? (Score:5, Insightful)

    by Locke2005 (849178) on Monday January 25, 2010 @04:46PM (#30895436)
    Sure, it will work "perfectly" for about 2 days, until the spammers change their methods to work around it. This is an arms race; there is no "final solution" (although modifying the email protocol to allow authentication of the sender's address would be a big help.)
    • by NeoSkandranon (515696) on Monday January 25, 2010 @04:47PM (#30895452)

      Oh, there's a final solution alright.

      • by Anonymous Coward on Monday January 25, 2010 @04:49PM (#30895488)
        I don't know how killing all the Jews will help worldwide spam. Everyone knows all spammers are Nigerian Princes.
      • by Thelasko (1196535) on Monday January 25, 2010 @04:50PM (#30895506) Journal

        Oh, there's a final solution alright.

        Hitler, is that you?

        I'm all for stopping Spam, but genocide crosses the line.

      • Re:"Perfect"??? (Score:5, Insightful)

        by Afforess (1310263) <afforess@gmail.com> on Monday January 25, 2010 @04:54PM (#30895554) Journal
        The final solution is to nuke spammers from orbit. It's the only way to be sure.
      • by Thelasko (1196535) on Monday January 25, 2010 @05:15PM (#30895870) Journal

        Oh, there's a final solution alright.

        Your post advocates a
        ( ) technical ( ) legislative ( ) market-based (X) vigilante

        approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

        ( ) Spammers can easily use it to harvest email addresses
        ( ) Mailing lists and other legitimate email uses would be affected
        ( ) No one will be able to find the guy or collect the money
        ( ) It is defenseless against brute force attacks
        ( ) It will stop spam for two weeks and then we'll be stuck with it
        ( ) Users of email will not put up with it
        ( ) Microsoft will not put up with it
        (X) The police will not put up with it
        ( ) Requires too much cooperation from spammers
        ( ) Requires immediate total cooperation from everybody at once
        ( ) Many email users cannot afford to lose business or alienate potential employers
        ( ) Spammers don't care about invalid addresses in their lists
        ( ) Anyone could anonymously destroy anyone else's career or business

        Specifically, your plan fails to account for

        (X) Laws expressly prohibiting it
        ( ) Lack of centrally controlling authority for email
        ( ) Open relays in foreign countries
        ( ) Ease of searching tiny alphanumeric address space of all email addresses
        ( ) Asshats
        ( ) Jurisdictional problems
        ( ) Unpopularity of weird new taxes
        ( ) Public reluctance to accept weird new forms of money
        ( ) Huge existing software investment in SMTP
        ( ) Susceptibility of protocols other than SMTP to attack
        ( ) Willingness of users to install OS patches received by email
        ( ) Armies of worm riddled broadband-connected Windows boxes
        ( ) Eternal arms race involved in all filtering approaches
        ( ) Extreme profitability of spam
        ( ) Joe jobs and/or identity theft
        ( ) Technically illiterate politicians
        ( ) Extreme stupidity on the part of people who do business with spammers
        ( ) Dishonesty on the part of spammers themselves
        ( ) Bandwidth costs that are unaffected by client filtering
        ( ) Outlook

        and the following philosophical objections may also apply:

        ( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
        ( ) Any scheme based on opt-out is unacceptable
        ( ) SMTP headers should not be the subject of legislation
        ( ) Blacklists suck
        ( ) Whitelists suck
        ( ) We should be able to talk about Viagra without being censored
        ( ) Countermeasures should not involve wire fraud or credit card fraud
        ( ) Countermeasures should not involve sabotage of public networks
        ( ) Countermeasures must work if phased in gradually
        ( ) Sending email should be free
        ( ) Why should we have to trust you and your servers?
        ( ) Incompatiblity with open source or open source licenses
        ( ) Feel-good measures do nothing to solve the problem
        ( ) Temporary/one-time email addresses are cumbersome
        ( ) I don't want the government reading my email
        (X) Killing them that way is not slow and painful enough

        Furthermore, this is what I think about you:

        (X) Sorry dude, but I don't think it would work.
        ( ) This is a stupid idea, and you're a stupid person for suggesting it.
        ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

      • Re: (Score:3, Funny)

        by bennomatic (691188)
        OK, I can speak from personal knowledge: the Jews are NOT responsible for your SPAM.
    • Spammers will just incorporate this technique into their botnets to test whether sending certain spam will succeed.

    • Re:"Perfect"??? (Score:5, Insightful)

      by MBCook (132727) <foobarsoft@foobarsoft.com> on Monday January 25, 2010 @05:00PM (#30895662) Homepage

      Fine with me. Most spam I get is obviously a template, since I get the same one for weeks. This would stop those additional sent copies. The false positive rate on this kind of thing is effectively 0%, so I'm willing to have it be an additional check on my email.

      If it can stop a lot of this kind of spam, that's fine with me. Let it be an arms race. If the spammers have to make up new templates every 4 hours, that's going to make things a lot harder.

      This isn't a cure for all spam, it's a fantastic filter for one (of the biggest) kinds of spam. Only headline makes it sound like it will solve all spam.

    • Re:"Perfect"??? (Score:4, Insightful)

      by xZgf6xHx2uhoAj9D (1160707) on Monday January 25, 2010 @05:05PM (#30895728)

      There is a final solution: make sending spam more expensive. Spammers will only spam so long as it's mind-blowingly wealthy. If you can raise their operating costs and bump them down from "mind-blowingly wealthy" to only "obscenely wealthy", they might switch to other lucrative immoral industries like manufacturing printer ink.

      What this does is increase the computational power required to generate a spam email. The method they described sounds like it's self-learning (just hook it up to a spambot "oracle" and it'll figure out the new template), so spammers will likely have to abandon the use of templates altogether. If you increase the amount of computational time required to generate spam, you decrease the amount of spam sent and really decrease the profitability of it.

      We keep pushing the requirements for spam further and further up the computational totem pole (or Chomsky hierarchy, if you will) and you get closer and closer to a point where spammers are going to have to create strong AI to write spam. If they fail, we don't have spammers anymore and if they win, well we have spam, but we also have strong AI! Win-win, I say.

      • Re: (Score:2, Informative)

        by Simon (S2) (600188)

        There is a final solution: ...

        Your post advocates a
        (x) technical ( ) legislative (x) market-based ( ) vigilante

        approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

        ( ) Spammers can easily use it to harvest email addresses
        (x) Mailing lists and other legitimate email uses would be affected
        ( ) No one will be able to find the guy or collect the mone

      • Re: (Score:3, Insightful)

        by afidel (530433)
        That doesn't work since it's been ages since spammers used their own machines to send spam, these days they just use whatever botnet they control. Increasing computational complexity only means they make their victims PC's work harder thus harming the environment.
      • Re:"Perfect"??? (Score:4, Interesting)

        by khayman80 (824400) on Monday January 25, 2010 @05:33PM (#30896170) Homepage Journal

        We keep pushing the requirements for spam further and further up the computational totem pole (or Chomsky hierarchy, if you will) and you get closer and closer to a point where spammers are going to have to create strong AI to write spam. If they fail, we don't have spammers anymore and if they win, well we have spam, but we also have strong AI! Win-win, I say.

        I agree with nearly everything you've said, but I don't consider the invention of strong AI by spammers to be a "win". Previously [slashdot.org], I've argued [slashdot.org] that individual rights aren't related to human genetics, but rather to the organism's sapience. In other words, roaches have more rights than yeast cells (but not much more), cats have more rights than roaches, cetaceans/hominids/humans/"strong AI" have more rights than cats.

        Allowing spammers to create beings who should be treated as citizens but are actually used as slave labor is wrong. Note that I'm specifically referring to strong AI; weak AI wouldn't qualify as sapient under most definitions.

    • by hoggoth (414195)

      Hmmm, you idea's intriguing to me and I would like to subscribe to your newsletter, but unfortunately as soon as it's template is recognized I'll stop getting it.

  • Unplugging the ethernet cable DOESN'T COUNT.

    • Re: (Score:3, Funny)

      by Dunbal (464142)

      Unplugging the ethernet cable DOESN'T COUNT.

            I'm using my neighbor's WiFi you insensitive clod!

  • So what happens when botnets start adjusting the templates?
    • Re: (Score:2, Insightful)

      by Tablizer (95088)

      Man, building spamming systems and finding ways to vary the content but not the message seems like a fun cat-and-mouse game. Too bad it's so evil. Can I cut off my Guilt Lobe?

      • by jeffmeden (135043)

        Why do the spammers have to be on one particular side? It's an arms race, which is more like a game of cat and cat; we both (the good guys and the bad guys) want end users to get just the messages we send. Each will do whatever it takes to get in the others' way. In my experience, it's just as fun (and a lot more gratifying) to stay on the good side.

  • effectively (Score:3, Insightful)

    by characterZer0 (138196) on Monday January 25, 2010 @04:47PM (#30895450)

    "effectively" = "not quite good enough to actually work"

    • by Chris Burke (6130)

      No no...

      "Effectively" = "'Perfect' is a very effective word to use in marketing campaigns".

  • by rhainman (952694) on Monday January 25, 2010 @04:48PM (#30895468)
    1. Mash up dubious quality meat. 2. Insert into can.
  • by Thyamine (531612) <thyamine@@@ofdragons...com> on Monday January 25, 2010 @04:49PM (#30895480) Homepage Journal
    And since most devices will download updates and things automatically, new templates could be discovered and pushed out as well. I'm sure there will be some work around that the spammers will figure out, but hey, I'm up for most anything that will cut down/stop/prevent spam. I am also still a fan of the 'kill them until they die from it' club when it comes to spammers.
  • Reactive only (Score:5, Insightful)

    by oheso (898435) on Monday January 25, 2010 @04:49PM (#30895482)
    So it still needs to see a certain volume of spams in order to figure out the template. Then it reacts to the template. Then when the spammers figure out it's uncovered the template, they change the template. Spam will exist until the fundamental nature of e-mail operation changes.
    • by jimicus (737525)

      In which case the spamming process will change to make it practical to update the template hundreds of times a day.

    • I don' tthink that's where it will fail -- yes, some will get through in that windows before the system learns the new template, but it could drastically reduce the problem for a short time. But it introduces a new kind of issues: what happens when this runs for a month, and the spammers come up with a way to auto-generate new templates and change it once every few minutes. The net results is that the filter apps will need to compare each email against millions of potential templates... and it becomes fast
  • "Perfect" (Score:5, Insightful)

    by VorpalRodent (964940) on Monday January 25, 2010 @04:49PM (#30895490)
    You keep using that word. I do not think it means what you think it means.
  • by magsol (1406749)
    The researchers are seeking to infer the hidden distribution of spammers' find-and-replace tactics, rather than simply trashing emails with "pen1s" in the subject.

    Correct me if I'm wrong, but haven't hidden markov models been around for decades?
  • Headline tomorrow (Score:5, Insightful)

    by Korbeau (913903) on Monday January 25, 2010 @04:49PM (#30895504)

    A team of hackers from Russia are claiming to have found an "effectively perfect" method for countering spam blocking technology. The new system deciphers the templates Spam Blocker is using to filter spam and then teaches spam generators what to write.

  • Calling BS (Score:4, Insightful)

    by imunfair (877689) on Monday January 25, 2010 @04:50PM (#30895512) Homepage

    I don't believe any spam filter that advertises 100% accuracy, especially one claiming to do it by figuring out the spam email 'templates'

    • Re: (Score:3, Insightful)

      by pz (113803)

      I don't believe any spam filter that advertises 100% accuracy, especially one claiming to do it by figuring out the spam email 'templates'

      Yeah, and calling this a discovery stretches credulity. Who here thinks that Google, Yahoo, Hotmail, and your favorite big mail service provider, don't already do some version of this?
       

  • by Penguinisto (415985) on Monday January 25, 2010 @04:51PM (#30895522) Journal

    Err, what if I, as a corporation, blew out a spam that effectively incorporated a template unique to that which my largest competitor uses in their newsletters or customer communiques (or at least close enough to get my competitor blacklisted far and wide)?

    (it would take a shedload of doing, but certainly not impossible, and if it could be done, would make for one hell of a cheap and easy DoS).

    Heuristics is great and all, but go too deeply, and I can see it opening up a small but pretty scary can of worms.

  • Halting problem (Score:2, Insightful)

    by Jessta (666101)

    and then the researchers discovered the Halting problem and pretended it didn't exist.

    • Re: (Score:3, Informative)

      by Kijori (897770)

      and then the researchers discovered the Halting problem and pretended it didn't exist.

      I don't quite see your point - the halting problem proves that you cannot create an algorithm that will tell whether an arbitrary program will ever halt. It has no significance for this particular program, since it would be trivial to ensure that it does halt.

    • Re: (Score:3, Insightful)

      by grumbel (592662)

      The Halting problem only exist for theoretical computers with infinite memory, for real computers with finite memory its trivial to solve (wait till a memory state repeats, done).

  • by damn_registrars (1103043) <damn.registrars@gmail.com> on Monday January 25, 2010 @04:55PM (#30895566) Homepage Journal
    As long as there is money to be made in spam, spammers will continue to send spam. This "discovery" does nothing for that. Indeed it just dedicates more CPU time to trying to identify spam, which is just another way that internet users shoulder the cost of the profitability of spamming.

    I've said it before, and I'll continue to say it - spam is an economic problem. Until something is done to address the money that spammers make, they will continue to find ways around these "effectively perfect" "discoveries".
    • Re: (Score:2, Interesting)

      by Anonymous Coward

      Spammers send spam because it makes them money. It makes them money because people are stupid. The question is: why are people stupid, and how can we make them smarter? I would argue that spam is an educational problem.

      • Re: (Score:3, Insightful)

        Spammers send spam because it makes them money.

        Agreed.

        It makes them money because people are stupid

        Not directly. The spammers themselves are paid by moderately smart people who are selling products online that are often of questionable legitimacy. While some of those customers are stupid, there are generally fairly crafty individuals making money off of the customers along the way.

        The question is: why are people stupid, and how can we make them smarter?

        You could ask the same question in the light of why 419 scams work, why old-school pyramid schemes work, etc. Money can make smart people pretty dumb at times.

        I would argue that spam is an educational problem

        You will not succeed in educating the problem away. U

    • I've said it before, and I'll continue to say it - spam is an economic problem. Until something is done to address the money that spammers make, they will continue to find ways around these "effectively perfect" "discoveries".

      There is always a demand to get a message out to n% of x hundred thousand people for cheap. You can't realistically stop that. What you can realistically do is increase the cost of getting those messages out. Treating spam as simply an economic problem won't work.

      • What you can realistically do is increase the cost of getting those messages out.

        The proposed "Spam Blocking Discovery" doesn't do jack shit to accomplish that goal. The people who install the spam filters aren't going to buy anything that was spamvertised, anyways. Meanwhile the spammers will continue to adjust their methods to get around the filters that are installed at the ISP level so that they can get their messages out to more people who would be interested.

        This craptacular "Discovery" is just another round of whack-a-mole. Hopefully at some point people will finally get ti

  • by Ambiguous Coward (205751) on Monday January 25, 2010 @04:56PM (#30895588) Homepage

    I, too, have designed a flawless spam filter. It works under similar principles, will filter 100% of incoming spam, will generate 0 false positives, and it's super easy to use:

    if(is_spam(message)) { delete_message(message); }

  • Had there been no spam filters, we'd all receive about the same amount of e-mail spam as we receive in the postal mail world. Instead, the spam industry spends it's time trying to break through spam filters -- and they do so with volume. Upping the ante further just doesn't help. So now you'll encourage spam without templates. My grandmother's just never going to have a chance.

    • by jfengel (409917) on Monday January 25, 2010 @05:06PM (#30895748) Homepage Journal

      Had there been no spam filters, we'd all receive about the same amount of e-mail spam as we receive in the postal mail world.

      I can't imagine what you base that statement on. Real-world junk mail is limited by the fact that it costs money to print and mail junk mail. Neither applies to spam.

      Spammers aren't just competing with spam filters. They're also competing with each other for attention. Even in the absence of spam filters, the spammers would continually seek new ways to get more of their spam into your inbox than their competitors.

      In fact, they might well invent the spam filter, with a deliberate back door so that their spam sails through while their competitors are dropped.

      • My point was that spam fitlers can't solve spam. All they can do is make spam more sophisticated, and then lose again at an even bigger game.

        And spam does cost money to send -- mail servers, developers to get around spam filters, and some actual sending thing, and managing lists, and making things more efficient, and dodging laws.

        But mont importantly, spammers get paid, anti-spam doesn't get paid. Therefore, budget vs. no budget, budget wins every time.

    • by Culture20 (968837)

      Had there been no spam filters, we'd all receive about the same amount of e-mail spam as we receive in the postal mail world.

      ...which I asked my postman to block (most intelligent spam filter ever). Before I asked him to do this, two or three days worth of "bulk rate mail" would be enough to fill my mailbox.

  • by dachshund (300733) on Monday January 25, 2010 @05:01PM (#30895664)

    As a researcher in the academic side of the Information Security field, I can't help but notice a significant increase in the level of puffery and misleading promotion of research results. Self-promotion obviously isn't new, it's just that as the amount of newspaper-assisted promotion increases, the level of accuracy has dropped significantly. And more importantly, researchers seem much less apologetic about it. It's generating some real blowback.

    The best recent example I can think of is Vanish, a cryptographic system for "destroying" data that was proposed out of University of Washington. It's not just that the system was broken [utexas.edu] a few days after it was presented, it's that this relatively minor result got more press than all of the perfectly legitimate crypto-systems research that was going on at the time. In fact, during the same time period a guy named Craig Gentry solved [techtarget.com] a major open crypto problem --- namely, how to compute on encrypted data --- and it got a fraction of the press coverage.

    Not that I'm saying these researchers specifically asked to have their invention described as an "effectively perfect" solution to preventing spam --- which I guarantee you 100% it is not --- but that by going out on a University-encouraged PR junket, they've more or less encouraged this kind of coverage. This kind of stuff is damaging; people should describe their work as what it is. They've developed a technique that is highly effective at filtering /current-gen/ spam generators, in the lab. It won't stop all spam, and it's not effectively perfect, since spamfiltering is by nature an arms race. But of course that's not how it's going to be presented. In the long run this'll just make people more jaded with our field.

  • Uh huh. (Score:2, Funny)

    Creators recieve chance to increase wang size in 3...2...1...
  • As a former manager and an "email direct-marketing" firm, I should point out that the spammers can increase the amount of complexity/variation in the templates by a wide variety of techniques, including rearranging paragraphs instead of just letters, making parts of the message optional, performing syntactic modifications of the included text,... Each new minor modification starts a research effort on the detecting side. The cost of detecting spam will rise much faster than the cost of generating spam.

    If
  • Honestly, I have to say between all the various filters I have or have written, I don't get a whole lot of spam. What I -want- though, is a way to identify it more reliably before my mail server even has to accept the message. With the current protocols, you can simply only block so much based on IP ranges or whatnot. There's a point where you have to accept the message to analyze. Sadly the only way we're likely to increase the chance of dropping the connection before receiving the message now is for t

  • Not our claim... :-) (Score:5, Informative)

    by StefanSavage (454543) on Monday January 25, 2010 @05:12PM (#30895828)

    As a co-author of this work, I should be clear that we never suggested that we have a perfect spam filter per se, simply a new tool that has the benefit of being orthogonal to existing techniques. For _existing_ botnets, our filters are extremely good, but the paper is also quite clear about the variety of ways that spammers might try to evade the approach.

  • ..I don't see it.
  • How would this work operationally?
    • Some anti-spam operators set up a network of honeypots to collect the spam,
    • analyze it using their new mechanism to divine the templates that are being used, then
    • create a subscription feed to distribute the templates to mail administrators to be used in filtering their incoming mail flow?

    Divining the template seems to depend on analyzing numerous messages. Presumably, only very large mail servers (or an aggregated network of smaller servers) would be able to collect enou

    • by vlm (69642)

      Presumably, only very large mail servers (or an aggregated network of smaller servers) would be able to collect enough messages to rapidly divine the various templates.

      If they don't graylist, and if they insist on putting the spam filtering in between accepting and placing in the mbox/maildir.

      If they wait for enough other small sites to aggregate the info, and then spamfilter mbox/maildir instead of spamfiltering the inputs to mbox/maildir...

  • I think it would be much more effective as well as cheaper to give free counseling to any one who ashamed of the size of their penis.

    No thanks, I'm good.
  • by dccase (56453) on Monday January 25, 2010 @05:20PM (#30895942)

    Since 95% of email is spam, just block it all.

    No one will notice the statistically-insignificant 5% false positives.

  • by Animats (122034) on Monday January 25, 2010 @05:28PM (#30896072) Homepage

    Spam filtering isn't very hard, if you see the email for a large number of accounts, as Gmail does. The one characteristic that spam must have is that it's sent in bulk. The commonality across receiving email accounts gives it away. The only hard part is recognizing the commonality, which is already working rather well. This is just a new technique for recognizing commonality.

    Recognizing spam for a single account is tougher, because you don't get to see the "bulk" property.

    • Re: (Score:3, Insightful)

      by sl149q (1537343)

      Amen to that.... we moved our email accounts to Gmail a few years back.

      Currently I get maybe two or three spam emails a week across three accounts, two of which have been in active use on the Internet for more than a decade.

      Of course if I look in the spam folder, I see that in actual fact anywhere up to 50-100 a day per account. Not my problem. Possibly a problem for Gmail. But they seem happy to undertake to offer the service and remove it for me.

      I do have to deal with it elsewhere.. I manage various Googl

  • This is actually quite simple once you've got the basics in place. It reminds me of a program I once wrote that could crawl a website and it would find out the templates used, identify the actual content, title and other blocks. Some postprocessing was required though, but since most e-mails are a lot simpler than webpages, I suppose this can be done completely automatic for spam. And probably indeed "effectively perfect". As long as spam is template-based, that is.

  • Yeah, this idea is great. . . until it starts blocking out legitimate emails which really are confirming orders shipped by Amazon or other retailers, newsletters that people really were wanting to get, and other info that 'looks' like spam, but isn't.

    This is why, while I use spam filters, I would never rely on them to delete email. All I want filters to do is punt suspect spam off to the Junk folder, where I can review it later, or find the email I was expecting which got mis-classified.

  • ...is the manual filtering by the recipient. Actually, scratch that, I've deleted emails that were clearly legitimate. Ah well, as long as it adds to the arsenal.

I'm all for computer dating, but I wouldn't want one to marry my sister.

Working...