Map

pin

g t

he

E-m

ail U

niv

erse

Dm

itri A

lper

ovitc

hP

rinci

pal R

esea

rch

Eng

inee

r

Cip

herT

rust

Pro

prie

tary

& C

onfid

entia

l

On

e o

f th

e F

aste

stG

row

ing

Tec

h C

om

pan

y

•Bes

t-of

-bre

ed y

et

Inte

grat

ed –

inbo

und

& o

utbo

und

•G

loba

l int

ellig

ence

(T

rust

edS

ourc

e) fo

r pr

oact

ive

thre

at

prev

entio

n•

11 p

aten

ts

pend

ing/

awar

ded

•Bes

t-of

-bre

ed y

et

Inte

grat

ed –

inbo

und

& o

utbo

und

•G

loba

l int

ellig

ence

(T

rust

edS

ourc

e) fo

r pr

oact

ive

thre

at

prev

entio

n•

11 p

aten

ts

pend

ing/

awar

ded

•Am

ong

top

50

fast

est g

row

ing

com

pani

es: R

ed

Her

ring,

Alw

aysO

n,

Cat

alys

t and

ot

hers

.•P

rofit

able

for

cons

ecut

ive

12

quar

ters

•Am

ong

top

50

fast

est g

row

ing

com

pani

es: R

ed

Her

ring,

Alw

aysO

n,

Cat

alys

t and

ot

hers

.•P

rofit

able

for

cons

ecut

ive

12

quar

ters

Th

e L

ead

er in

M

essa

gin

g S

ecu

rity

•ID

C: C

iphe

rTru

st

is b

igge

r th

an th

e ne

xt 4

com

petit

ors

com

bine

d•1

/3 o

f For

tune

500

co

unt o

n C

iphe

rTru

st•G

loba

l pre

senc

e w

ith c

usto

mer

s in

40

+ c

ount

ries

•ID

C: C

iphe

rTru

st

is b

igge

r th

an th

e ne

xt 4

com

petit

ors

com

bine

d•1

/3 o

f For

tune

500

co

unt o

n C

iphe

rTru

st•G

loba

l pre

senc

e w

ith c

usto

mer

s in

40

+ c

ount

ries #1

in A

ll C

ateg

ori

es b

y L

ead

ing

Rev

iew

ers

& A

nal

ysts

Cip

her

Tru

st H

igh

ligh

ts

Pio

nee

red

E-m

ail

Sec

uri

ty G

atew

ay

Cip

herT

rust

Con

fiden

tial

Cip

herT

rust

Lead

er's

Qua

dran

t

Bes

t Buy

Aw

ard

Bes

t All-

arou

nd S

olut

ion

#1 in

Mar

ket S

hare

Edi

tor’s

Cho

ice

Cip

herT

rust

Pro

prie

tary

& C

onfid

entia

l

Pio

nee

rin

g E

mai

l Sec

uri

ty A

pp

lian

ceE

nte

rpri

se L

ead

ersh

ip L

ead

s to

Mar

ket

Do

min

ance

SC

M A

pp

lian

ces

(200

4)

So

urc

e: ID

C 2

005Cip

her

Tru

st’s

mar

ket

shar

e eq

ual

s th

e 4

clo

sest

co

mp

etit

ors

co

mb

ined

.

Co

mp

etit

or

1 -

3.1%

Co

mp

etit

or

4 -

4.3%

Co

mp

etit

or

2 - 9.

8%

Co

mp

etit

or

3 -

4.8%

Oth

ers

42%

Cip

her

Tru

st24

%

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

His

tory

of M

essa

gin

g A

ttac

ksH

isto

ry o

f M

essa

gin

g A

ttac

ks

•E

-mai

l•

May

3, 1

978:

1stE

-mai

l Spa

m (

DE

C)

•Ja

nuar

y 19

96:

1stM

ajor

Phi

shin

g S

cam

(A

OL)

•F

ebru

ary

26, 1

997:

1stE

-mai

l Viru

s (S

hare

Fun

)•

Mar

ch 2

6, 1

999:

1stM

ajor

E-m

ail V

irus

(Mel

issa

)•

Nov

embe

r 1,

199

9:1s

tA

utom

ated

E-m

ail W

orm

(B

ubbl

e B

oy)

•Ja

nuar

y 13

, 200

3:1s

tE

-mai

l Viru

s C

onne

cted

to

Spa

mm

ers

(Sob

ig)

•In

stan

t M

essa

gin

g•

Late

199

7:

1stIM

spa

m

•A

pril

25, 2

001

1stw

orm

to u

se IM

for

prop

agat

ion.

(F

unny

File

s)

•F

ebru

ary

24, 2

004

1stm

ass-

spre

adin

g IM

wor

m.

(Biz

ex)

Wir

eles

s M

essa

gin

g

June

14,

200

41s

tce

ll ph

one

viru

s (C

abir)

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Spam

Gro

wth

Rat

eSpam

Gro

wth

Rat

e

0%10%

20%

30%

40%

50%

60%

70%

80%

90%

100% Ja

n-02

Mar

-02 M

ay-0

2Ju

l-02

Sep-0

2Nov-0

2Ja

n-03

Mar

-03 M

ay-0

3Ju

l-03

Sep-0

3Nov-0

3Ja

n-04

Mar

-04 M

ay-0

4Ju

l-04

Sep-0

4Nov-0

4Ja

n-05

Spa

m

Goo

d M

ail

Janu

ary

2004

68%

Spa

m

Janu

ary

2003

49%

Spa

m

Janu

ary

2005

81%

Spa

m

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Fighting S

pam

Fighting S

pam

•T

wo

mai

n ap

proa

ches

to fi

lter

spam

: –

Exa

min

e th

e co

nten

t of t

he m

essa

ge•

Mac

hine

-lear

ning

tech

niqu

es (

Bay

esia

n, S

VM

)•

Sig

natu

re-b

ased

pat

tern

mat

chin

g te

chni

ques

–E

xam

ine

the

send

er o

f the

mes

sage

•W

hite

lists

/Bla

cklis

ts•

Cha

lleng

e R

espo

nse

Sys

tem

s•

Rep

utat

ion

Sys

tem

s

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Conte

nt

Conte

nt --

Filter

ing C

hal

lenges

Filter

ing C

hal

lenges

•N

ever

-end

ing

cat &

mou

se g

ame

agai

nst

spam

mer

rand

omiz

atio

ns

•M

ost s

olut

ions

fail

mis

erab

ly a

gain

st s

pam

in

Asi

an c

hara

cter

set

s (m

any

Asi

an la

ngua

ges

have

no

whi

tesp

ace

sepa

ratio

n be

twee

n w

ords

)

•M

achi

ne-le

arni

ng te

chni

ques

that

req

uire

tr

aini

ng g

ener

ally

are

less

effe

ctiv

e in

gat

eway

/ or

gani

zatio

n-w

ide

depl

oym

ents

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Sim

ple

Dru

g S

pam

Sim

ple

Dru

g S

pam

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Not

so s

imple

...

Not

so s

imple

...

<!D

OC

TY

PE

HT

ML

PU

BLI

C "

-//W

3C//D

TD

HT

ML

4.0

Tra

nsiti

onal

//EN

"><

HT

ML>

<H

EA

D>

<M

ET

A c

onte

nt=

"MS

HT

ML

6.00

.280

0.11

06"

nam

e=G

EN

ER

AT

OR

><

ST

YLE

><

/ST

YLE

><

/HE

AD

><

BO

DY

bgC

olor

=#f

fffff>

<D

IV>

<F

ON

T fa

ce=

Aria

l>H

ello

, do

you

wan

t to

spen

d Ie

ss<

SP

AN

sty

le=

"DIS

PLA

Y: n

one"

>sa

iled

alon

g o'

Bis

hop.

But

Bis

hop

didn

't tr

ust u

s. H

e kn

ew to

o</S

PA

N>

on

your

dr

rugs

?</F

ON

T>

</D

IV>

<D

IV>

<F

ON

T fa

ce=

Aria

l><

/FO

NT

>&

nbsp

;</D

IV>

<D

IV>

<F

ON

T fa

ce=

Aria

l>T

he <

A h

ref=

"http

://w

ww

.jptl.

requ

iyot

.com

">P

HA

R<

SP

AN

sty

le=

"DIS

PLA

Y:

none

">lo

ng, i

nact

ive

wai

ting

was

str

aini

ng th

e ne

rves

of b

oth

Lord

</S

PA

N>M

AC

Y-B

Y-M

AlL

SH

OP

</A

>&

nbsp

; offe

r<S

PA

N s

tyle

="D

ISP

LAY

: non

e">

leve

l of t

he n

egro

esw

ho s

omet

imes

to

iled

besi

de h

im.

The

man

,</S

PA

N>s

you

&nb

sp;a

grea

t dea

I</F

ON

T><

/DIV

><

DIV

><

FO

NT

face

=A

rial>

</F

ON

T>

<F

ON

T fa

ce=

Aria

l><

/FO

NT

>&

nbsp

;</D

IV>

<D

IV>

<F

ON

T fa

ce=

Aria

l>V

lA<

SP

AN

sty

le=

"DIS

PLA

Y: n

one"

>w

ould

be

plac

ed if

you

had

dire

ct w

ord

from

him

of w

hat h

as h

appe

ned.

</S

PA

N>

GR

AV

A<

SP

AN

sty

le=

"DIS

PLA

Y: n

one"

>le

vel o

f the

ca

lves

of h

is fi

ne b

oots

of S

pani

sh le

athe

r, C

apta

in<

/SP

AN

>LlU

MC

lAL

<S

PA

N s

tyle

="D

ISP

LAY

: no

ne">

and

in th

e la

titud

e in

to w

hich

Lor

d Ju

lian

had

stra

yed

this

was

a<

/SP

AN

>lS

LE

V<

SP

AN

st

yle=

"DIS

PLA

Y: n

one"

>al

l res

olve

d up

on jo

inin

g th

e gr

eat B

roth

erho

od o

f the

Coa

st,

as</

SP

AN

>lT

RA

and

man

y ot

her.

</F

ON

T>

</D

IV>

<D

IV>

&nb

sp;<

/DIV

>

Mes

sag

e S

ou

rce:

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

EE-- m

ail Sen

der

IP

Univ

erse

mai

l Sen

der

IP

Univ

erse

Gra

y M

ail S

ende

rs

Goo

dB

ad7%

Legi

timat

eR

egul

arC

omm

unic

atio

nP

artn

ers

42%

Egr

egio

usly

Bad

Sen

ders

51%

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Tra

ditio

nal

Appro

ach

Tra

ditio

nal

Appro

ach

Goo

dB

ad7%

Wh

itel

ists

42%

Bla

cklis

ts

Ign

ore

d

51%

Cip

herT

rust

Pro

prie

tary

& C

onfid

entia

l

Tru

sted

So

urc

eA

rch

itec

ture

Sh

are

glo

bal

inte

llig

ence

wit

h lo

cal b

ehav

ior

Tru

sted

So

urc

e.o

rg

Gener

al D

ata

Enter

pris

es

170,

000

zom

bies

per

day

1/3

of F

ortu

ne 5

00 d

ata

Bill

ions

of g

ener

al

mes

sage

s fr

om 1

00,0

00

orga

niza

tions

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Sen

der

Beh

avio

ral Tes

tsSen

der

Beh

avio

ral Tes

ts

•S

pam

sen

der

beha

vior

is v

astly

diff

eren

t fr

om le

gitim

ate

mai

lers

•G

oal:

send

qui

ckly

as

man

y m

essa

ges

as

poss

ible

to a

wid

e re

cipi

ent p

opul

atio

n (f

ew le

gitim

ate

send

ers

exhi

bit t

hose

ch

arac

teris

tics)

•S

endi

ng IP

sar

e pr

edom

inan

tly z

ombi

es

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Zom

bie

s: D

efin

itio

nZom

bie

s: D

efin

itio

n

•Z

ombi

e: in

noce

nt m

achi

ne in

fect

with

a w

orm

/viru

s th

at c

arrie

s (o

r do

wnl

oads

) a

‘bot

’pro

gram

as

its p

aylo

ad, u

sed

as s

tagi

ng g

roun

d fo

r at

tack

s

•T

he ‘b

ot’s

oftw

are

repo

rts

to a

con

trol

ler

Inte

rnet

Rel

ay C

hat (

IRC

) ch

anne

l/web

site

and

dow

nloa

ds a

nd e

xecu

tes

inst

ruct

ions

from

it

•In

stru

ctio

ns:

–La

unch

DD

oSat

tack

–O

pen

SO

CK

S/S

MT

P r

elay

pro

xy

–H

arve

st p

assw

ords

/e-m

ail a

ddre

sses

from

infe

cted

sys

tem

–D

istr

ibut

ion

of v

iruse

s

•Po

pu

lar

bo

tso

ftw

are:

Mit

gle

ider

, rB

ot,

Ag

oB

ot

•Lar

ges

t b

otn

etd

etec

ted

to

dat

e: 3

50,0

00 z

om

bie

IPs

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Botn

ets

Botn

ets

(cont)

(cont)

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Zom

bie

s: L

oca

tion

Zom

bie

s: L

oca

tion

•A

vera

ge o

f 170

,000

nev

er b

efor

e se

en z

ombi

es e

ach

day

2.31

%T

aiw

an10

2.96

%S

pain

9

3.13

%U

nite

d K

ingd

om8

3.70

%Ja

pan

7

5.56

%B

razi

l6

5.69

%F

ranc

e5

5.99

%G

erm

any

4

9.61

%S

outh

Kor

ea3

14.5

6%C

hina

2

19.0

8%U

nite

d S

tate

s1 •~15

00 n

ew z

om

bie

s se

en e

ach

ho

ur

are

loca

ted

in U

S

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Top 1

0 N

etw

ork

s:Top 1

0 N

etw

ork

s:

1.A

S 4

134:

C

hina

Net

Bac

kbon

e

2.A

S 4

766:

K

orea

Tel

ecom

3.A

S 3

320:

D

euts

che

Tel

ekom

4.A

S 4

837:

C

hina

169

Bac

kbon

e

5.A

S 3

215:

F

ranc

e T

elec

om

6.A

S 9

318:

H

anar

oT

elec

om (

Kor

ea)

7.A

S 3

462:

C

hung

hwa

Tel

ecom

(T

aiw

an)

8.A

S 1

9262

: Ver

izon

Glo

bal N

etw

orks

9.A

S 7

738:

T

elec

omun

icac

oes

daB

ahia

(Bra

zil)

10.

AS

481

2:

Chi

na T

elec

om

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Top 5

Net

work

s in

US:

Top 5

Net

work

s in

US:

1.A

S 1

9262

: Ver

izon

Glo

bal N

etw

orks

2.A

S 3

356:

Le

vel 3

Com

mun

icat

ions

3.A

S 6

198:

B

ellS

outh

Net

wor

k S

olut

ions

4.A

S 7

132:

S

BC

Inte

rnet

Ser

vice

s

5.A

S 7

018:

A

T&

T W

orld

Net

Ser

vice

s

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Zom

bie

s: S

ourc

e of

Zom

bie

s: S

ourc

e of

Phis

hin

gPh

ishin

g

•O

nce

a zo

mbi

e is

told

to r

un a

SO

CK

S/S

MT

P p

roxy

, it i

s re

sold

to s

pam

mer

/phi

sher

who

pro

ceed

s to

rel

ay e

-m

ails

dire

ctly

thro

ugh

it

•G

et c

ontr

ol o

f the

zom

bie

mac

hine

whi

le it

is r

elay

ing

the

e-m

ails

from

the

phis

her

and

you

have

a g

reat

cha

nce

of

catc

hing

them

!

•Vir

tual

ly a

ll p

his

hin

gis

sen

t th

rou

gh

zo

mb

ies

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Phis

hin

gPh

ishin

gCyc

leCyc

le

Bo

tnet

Bo

tnet

Co

mm

and

& C

on

tro

lC

om

man

d &

Co

ntr

ol

(Co

mp

rom

ised

Mac

hin

e)(C

om

pro

mis

ed M

ach

ine)

Zo

mb

ieZ

om

bie

Ph

ish

erP

his

her

Ph

ish

ing

Ph

ish

ing

Web

Ser

ver

Web

Ser

ver

(Co

mp

rom

ised

Mac

hin

e)(C

om

pro

mis

ed M

ach

ine)

Ph

ish

ing

Ph

ish

ing

Vic

tim

Vic

tim

Vic

tim

Vic

tim

’’ ssm

ail s

erve

rm

ail s

erve

r1

234

5

6

7

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Oper

atio

nal

sec

urity

Oper

atio

nal

sec

urity

Car

der

Ph

ish

ing

Web

site

(co

mp

rom

ised

ser

ver)

VP

N S

erve

r(r

ente

d)

$

$

Vic

tim

`

``

`

Zo

mb

ieP

roxi

esS

pam

Ser

ver

(ren

ted

or

com

pro

mis

ed)

Bo

tnet

C&

CC

C #

CC

dat

a

prox

y/po

rt lis

t

phis

hing

emai

lsph

ishi

ngem

ails

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Phis

hin

gPhis

hin

g:

Org

aniz

atio

nal

Str

uct

ure

: O

rgan

izat

ional

Str

uct

ure

Dro

ps

Dro

ps

(vic

tim

s o

r co

(vic

tim

s o

r co

-- co

nsp

irat

ors

)co

nsp

irat

ors

)

Dro

p

Dro

p

han

dle

rh

and

ler

Sp

amm

erS

pam

mer

Car

der

Car

der

Exp

loit

E

xplo

it

Wri

ter

/ W

rite

r /

Bo

tnet

Bo

tnet

Co

nto

ller

Co

nto

ller

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Maf

ia:

Org

aniz

atio

nal

Str

uct

ure

Maf

ia:

Org

aniz

atio

nal

Str

uct

ure

So

ldie

rsS

old

iers

Cap

oC

apo

Cap

oC

apo

Bo

ssB

oss

Cap

oC

apo

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Typ

es o

f Typ

es o

f Ph

ishin

gPh

ishin

g

1.W

ebsi

te P

his

hin

gV

ictim

con

ned

into

vis

iting

to fr

aud

web

site

2.T

roja

n P

his

hin

gT

roja

n st

eals

dat

a di

rect

ly o

ff vi

ctim

’s m

achi

ne o

r m

odifi

es

OS

/bro

wse

r se

tting

s to

unw

ittin

gly

redi

rect

them

to fr

aud

web

site

3.P

ho

ne

Ph

ish

ing

Tra

ditio

nal p

hone

sca

mm

ing

(now

with

a V

oIP

twis

t)

4.E

-co

mm

erce

Sto

re P

his

hin

gF

ake

onlin

e st

ore

is s

etup

to h

arve

st c

redi

t car

ds

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Phis

hin

gPh

ishin

g:

What

is

invo

lved

?:

What

is

invo

lved

?

1.W

ebsi

te P

his

hin

g–

Sca

m e

-mai

l writ

er (

Eng

lish-

com

pete

nce

requ

ired)

–F

raud

web

site

dev

elop

er

–B

ulk

dom

ain

regi

stra

nt fo

r fr

aud

site

–W

eb h

ostin

g pr

ovid

er fo

r fr

aud

site

–P

rofe

ssio

nal s

pam

mer

•Typ

ical

ph

ish

ing

resp

on

se:

15-2

0 le

git

imat

e re

plie

s o

n 1

mill

ion

sen

t e-

mai

ls

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Phis

hin

gPh

ishin

g:

What

is

invo

lved

?:

What

is

invo

lved

?

2.T

roja

n P

his

hin

g–

Tro

jan

deve

lope

r

–W

eb h

ostin

g pr

ovid

er fo

r fr

aud

site

3.P

ho

ne

Ph

ish

ing

–E

nglis

h sp

eake

r

–E

quip

men

t•

IVR

(In

tera

ctiv

e V

oice

Res

pons

e) S

yste

m•

Pho

ne d

ialin

g sy

stem

(ex

. Big

Info

rm)

•A

nalo

g P

hone

Gat

eway

(ex

. Cis

co V

G22

4)

•Pro

lifer

atio

n o

f V

oIP

tech

no

log

y lik

ely

to s

oo

n r

esu

lt in

incr

ease

in P

ho

ne

Ph

ish

ing

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Phis

hin

gPh

ishin

g:

What

is

invo

lved

?:

What

is

invo

lved

?

4.E

-Co

mm

erce

Sto

re P

his

hin

g–

Web

site

dev

elop

er

–W

eb h

ostin

g pr

ovid

er

•T

ypic

ally

eac

h of

thes

e se

rvic

es

purc

hase

d fr

om m

ultip

le v

erifi

ed ‘v

endo

rs’

adve

rtis

ed o

n C

arde

r F

orum

s

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Phis

hin

gPh

ishin

gZom

bie

Anal

ysis

Zom

bie

Anal

ysis

Sen

din

g IP

: 15

1.41

.157

.148

(ad

slS

end

ing

IP:

151.

41.1

57.1

48 (

adsl

-- ull

ull

-- 148148 --

157.

4115

7.41

-- 151

.net

24.it

151.

net

24.it

)

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Tim

e is

of th

e es

sence

Tim

e is

of th

e es

sence

•15

1.41

.157

.148

glob

al s

endi

ng h

isto

ry:

2005

-05-

06 1

0:23

:51

ES

T20

05-0

5-06

10:

23:5

1 E

ST

2005

-05-

06 1

0:35

:58

ES

T...

......

......

......

......

......

2005

-05-

06 1

4:29

:35

ES

T20

05-0

5-06

14:

29:4

5 E

ST

2005

-05-

06 1

4:31

:22

ES

T

•H

it ~

8% o

f lar

ge U

.S. e

nter

pris

es•

Has

n’t b

een

hear

d fr

om s

ince

4 h

ou

r ac

tivi

ty w

ind

ow

•Ave

rag

e u

pti

me

for

a p

his

hin

gzo

mb

ie:

8 h

ou

rs

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Phis

hin

gPh

ishin

gZom

bie

sZom

bie

s

•R

easo

ns:

–P

hish

ers

and

Spa

mm

ers

use

e-m

ail ‘

hit’

lists

, ad

dres

ses

of a

ll th

e pe

ople

they

sen

d a

part

icul

ar e

-m

ail c

ampa

ign

to

–P

hish

ing

lists

are

typi

cally

sm

alle

r an

d m

ore

targ

eted

in

nat

ure

–T

he h

it lis

t is

usua

lly s

orte

d an

d di

vide

d be

twee

n al

l th

e zo

mbi

es th

at a

re u

sed

in a

cam

paig

n to

opt

imiz

e fo

r sp

eed

and

min

imiz

e ch

ance

s of

spa

mtr

apde

tect

ion

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Phis

hin

gPh

ishin

g:

Dis

trib

ution P

atte

rns

: D

istr

ibution P

atte

rns

E-m

ail h

it li

st

@ho

tmai

l.com

addr

esse

s@

aol.c

omad

dres

ses

@ve

rizon

.net

addr

esse

s@

...ad

dres

ses

@ci

pher

trus

t.com

addr

esse

s

Zo

mb

ie L

ist

(IP

s&

Po

rt n

um

ber

s)

Zo

mb

ie g

oes

sile

nt

on

ce it

is d

on

e w

ith

its

po

rtio

n o

f th

e lis

t:o

ften

do

es n

ot

com

e b

ack

for

mo

nth

s

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Sen

der

Auth

entica

tion

Sen

der

Auth

entica

tion

•3

Indu

stry

Evo

lvin

g S

tand

ards

:–

Sen

der

Pol

icy

Fra

mew

ork

(SP

F)

–S

ende

rID

–D

omai

nKey

sId

entif

ied

Mai

l (D

KIM

)

•G

oal:

Ver

ify th

at th

e se

ndin

g IP

is

perm

itted

to s

end

mai

l on

beha

lf of

the

dom

ain

it cl

aim

s to

com

e fr

om

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Sen

der

Auth

entica

tion S

tandard

sSen

der

Auth

entica

tion S

tandard

s

•S

PF

: Aut

hent

icat

es IP

bas

ed o

n co

nnec

tion-

leve

l dat

a (R

FC

821

MA

IL F

RO

M)

•S

ende

rID

: Aut

hent

icat

es IP

bas

ed o

n m

essa

ge

head

er d

ata

(RF

C 8

22 P

urpo

rted

Res

pons

ible

A

ddre

ss)

•D

KIM

: Cry

ptog

raph

ical

ly a

uthe

ntic

ates

mes

sage

ba

sed

on m

essa

ge h

eade

r da

ta (

RF

C 8

22

Fro

m)

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

Anti

Anti

-- Spam

Applic

atio

nSpam

Applic

atio

n

•M

essa

ge A

uthe

ntic

ity !=

Mes

sage

Rep

utat

ion

•S

pam

mer

sha

ve le

arne

d to

reg

iste

r S

PF

/Dom

ainK

eys

DN

S r

ecor

ds

–20

% o

f spa

mw

ith S

PF

rec

ords

pas

ses

Sen

derI

D

–6%

of s

pam

with

SP

F r

ecor

ds fa

ils S

ende

rID

•N

eed

for

repu

tatio

n sy

stem

s to

mak

e in

to a

n ef

fect

ive

anti-

spam

tool

Cip

herT

rust

Bus

ines

s P

ropr

ieta

ry -

Cop

yrig

ht C

iphe

rTru

st In

c. 2

005

•Tha

nk y

ou.

•Que

stio

ns?

Dm

itri A

lper

ovitc

hP

rinci

pal R

esea

rch

Eng

inee

rdm

itri@

ciph

ertr

ust.c

om(6

78)

904-

9235