Upload File

protecting e-mail from spam and malware

16

Click here to load reader

Upload: scott-mcdermott

Post on 13-May-2015

185 views

Category:

Technology


4 download

Report

TRANSCRIPT

Page 1: Protecting E-mail From SPAM and Malware

Protecting email from SPAM and Malware

By Scott [email protected]

http://www.octaldream.com/~scottm/talks/protectingemail/

Page 2: Protecting E-mail From SPAM and Malware

04/12/232

What Is SPAM

• Unsolicited Commercial E-Mail (UCE)– Not requested– Sent to a large number of users– Often with forged headers– Often exploiting insecure mail servers– You don’t care about the message

Page 3: Protecting E-mail From SPAM and Malware

04/12/233

What Is Malware

• Malicious Software– Includes viruses, worms, and trojans– Designed for:

• Harm• Theft of data• Annoyance/Attention• Anything undesirable

Page 4: Protecting E-mail From SPAM and Malware

04/12/234

Why Stop It?

• SPAM– Impacts productivity– Annoying

• Malware– Impacts productivity– Annoying– Impacts site security

Page 5: Protecting E-mail From SPAM and Malware

04/12/235

Solutions

• Spam Filters– Detects spam

• Anti-virus and sanitizing software– Filter Malware– Improve Privacy and Security

Page 6: Protecting E-mail From SPAM and Malware

04/12/236

Solution I Use

• Amavisd-new– Builds upon SpamAssassin for spam filtering– Builds upon a variety of anti-virus software for AV

• ClamAV– Open Source– Detects phishing and other email attacks– Even if you have another AV engine, it’s good to

provide security in layers

Page 7: Protecting E-mail From SPAM and Malware

04/12/237

SpamAssassin

• Rules– Header Analysis– Body Analysis

• Blacklists• Razor• Score-based

– High enough score means it’s SPAM

Page 8: Protecting E-mail From SPAM and Malware

04/12/238

SPAM: -------------------- Start SpamAssassin results ----------------------

SPAM: This mail is probably spam. The original message has been altered

SPAM: so you can recognise or block similar unwanted mail in future.

SPAM: See http://spamassassin.org/tag/ for more details.

SPAM:

SPAM: Content analysis details: (10.6 hits, 5 required)

SPAM: PLING (0.1 points) Subject has an exclamation mark

SPAM: MORTGAGE_RATES (4.4 points) BODY: Information on mortgage rates

SPAM: CLICK_BELOW (1.5 points) BODY: Asks you to click below

SPAM: OPT_IN (2.1 points) BODY: Talks about opting in

SPAM: CLICK_HERE_LINK (0.8 points) BODY: Tells you to click on a URL

SPAM: CTYPE_JUST_HTML (1.7 points) HTML-only mail, with no text version

SPAM: -------------------- End of SpamAssassin results ---------------------

SpamAssassin Scores

Page 9: Protecting E-mail From SPAM and Malware

04/12/239

Protection For All

• Filter all mail through amavisd-new– Use clamd– Spamd not used– Amavisd-new calls Mail::SpamAssassin directly

Page 10: Protecting E-mail From SPAM and Malware

04/12/2310

Amavisd-new basics

• Amavisd runs on localhost:10024• Protocol is LMTP

– Like ESMTP, but designed specifically for local delivery

• Analyzes message• Sends processed message (maybe) to

specified MTA

Page 11: Protecting E-mail From SPAM and Malware

04/12/2311

Message flow for postfix example

• Postfix receives email• Postfix sends email to amavis on

localhost:10024• Amavis processes message

– ClamAV– SpamAssassin

• Amavis sends email back to MTA, default is localhost:10025– Use of alternate port avoids recursion– Allows custom settings to improve performance

Page 12: Protecting E-mail From SPAM and Malware

04/12/2312

Amavis Options

• Per-User Configuration– SQL backend available

• Quarantine• Spam Options

– Score at which spam headers are added– Score at which message is marked as spam– Score at which message is dropped on floor

• Auto-Whitelist

Page 13: Protecting E-mail From SPAM and Malware

04/12/2313

More Amavis Options

• Defanging– Bad headers– Spam

• Notifications– Sender notifications considered harmful– Can restrict to internal mail

Page 14: Protecting E-mail From SPAM and Malware

04/12/2314

Discussion

Page 15: Protecting E-mail From SPAM and Malware

04/12/2315

What If I’m on Windows?

• Use a UNIX relay• Commercial Options

Page 16: Protecting E-mail From SPAM and Malware

04/12/2316

Software URLs (OS)

SpamAssassinhttp://spamassassin.apache.org/

Amavisd-newhttp://www.ijs.si/software/amavisd/

ClamAVhttp://www.clamav.net


Using Information Economics & Spam to Thwart Malware

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2012

Identifying Spam Malware Infections, using DNS MX …delaat/rp/2013-2014/p30/report.pdf · Abstract Malware designed to be used for sending spam is a very real prob-lem. It is important

Fighting malware and spam CONTENTS IN THIS ISSUE · FEBRUARY 2013 CONTENTS IN THIS ISSUE ISSN 1749-7027 Fighting malware and spam NEW INTEREST In 2009, Intel introduced a new set

Twitter 103 Trolls, Malware and Spam

Fighting malware and spam VB100 COMPARATIVE REVIEW ON … · 2012-05-02 · APRIL 2012 ISSN 1749-7027 Fighting malware and spam VB100 COMPARATIVE REVIEW ON WINDOWS XP PROFESSIONAL

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2010

Canada’s Anti Spam Legislation. What is CASL? CASL was intended to combat negative online behaviour spam phishing malware spyware It will create

Fighting malware and spam CONTENTS IN THIS …...JANUARY 2011 CONTENTS IN THIS ISSUE ISSN 1749-7027 Fighting malware and spam 2 COMMENT How do we make bigger better? 3 NEWS Mobile

Marshal Security Threats: Spam, Phishing, MalwareMARSHAL SECURITY THREATS: SPAM, PHISHING, MALWARE - DECEMBER 2007 MARSHAL TRACE REPORT 4 as the spam-sending botnets sought to expand

Fighting malware and spam CONTENTS IN THIS ISSUE · CONTENTS IN THIS ISSUE ISSN 1749-7027 Fighting malware and spam 2 COMMENT PWN2KILL, EICAR and AV: ... Electronique, Automatique

Protecting from Zero-Day Malware Attacks - Idosi.org

T-110.6220 Kernel Malware...Protecting the irreplaceable | f-secure.com T-110.6220: Malware Analysis and Antivirus Technologies Windows Kernel Malware Kimmo Kasslin, 31.3.2010 Agenda

SPAM/BOTNETS and Malware

ISACA - Evolution of Malware and the Next Generation ... · • Malware professionalization • Use of marketing techniques in spam campaigns • Country/Time based malware variant

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2013

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2011

Protecting Endpoints From Malware Using ... - pds …download.pds-site.com/Avecto/Gartner-2016Endpoint-protection... · G00302931 Protecting Endpoints From Malware Using Application

Financial Aspects of Network Security: Malware and Spam · Financial Aspects of Network Security: Malware and Spam ITU Seminar on the Economics of Cybersecurity Brisbane, Australia

Tamper-Evident Digital Signatures: Protecting Certification Authorities Against Malware

Protecting Windows Networks From Malware

Protecting Your POS System from PoSeidon and Other Malware Attacks

IKARUS anti.virus Manual · IKARUS anti.virus secures your personal data and PC from all kinds of malware. Additionally, the Anti-SPAM module protects you from SPAM and malware from

What is Bad Email? Spam, Phishing, Scam, Hoax and Malware distributed via Email

Fighting malware and spam - Virus Bulletin · Fighting malware and spam 2 COMMENT A richer, but more dangerous web 3 NEWS Guidelines issued for UK hacker tool ban 3 VIRUS PREVALENCE

SPAM: Signal Processing for Analyzing Malware - … · SPAM: Signal Processing for Analyzing Malware Lakshmanan Nataraj, Student Member, IEEE, B.S. Manjunath, Fellow, IEEE C YBER

Financial Aspects of Network Security: Malware and Spam › en › ITU-T › Workshops-and... · Malware attack trends Overall increases Monthly growth ¾Trojans, rootkits slowing

Mobile Parental Controls - Protecting Our Children from Sexting, Spam and other Dangers

CAP6135: Malware and Software Vulnerability Analysis Spam and Phishing Cliff Zou Spring 2012

Protecting Your Network from Malware - Akamai...Protecting Your Network from Malware The threat landscape is becoming increasingly hostile. Malware and ransomware campaigns, phishing

NEW ABUSE REPORT - AFNIC · Google Safe Browsing Domain name Abuse spam phishing spam phishing spam Unwanted s spam spam malware GURID Registrar name Potential abuses Creation date

GOTHAM CITY RESEARCH LLC Endurance International Group: A ...€¦ · EIGI domains hosted 1,000s of spam/malware-related sites per spam/malware watchdogs (the hosting world’s Blinkx)

Marshal Security Threats: Spam, Phishing, Malware

SPAM/BOTNETS and Malware Neil Warner, CIO, GoDaddy.com Moderator: Dan Kaplan, deputy editor, SC Magazine

Malspam5 • Droppers are initial malware delivered by spam messages that install, or “drop”, additional malware such as keyloggers or ransomware • Malspam messages may have