Nobody's Anonymous - Black Hat

73 Pages·2004·0.71 MB·English

by  Ping Look

Nobody(cid:213)s Anonymous
Tracking Spam
Dr. Curtis Kret
Secure Science Corporation
http://www.securescience.net
Copyright 2003 Secure Science Corp. 1
Preface: We All Hate Spam...
¥ Spam is a problem.
— (cid:210)Problems(cid:211) cannot be resolved until they are
identified and classified.
¥ This presentation:
— Describes methods for identifying, classifying,
and tracking Spam
— Identifying individual Spammers & purpose
— Provides real-world examples
Copyright 2003 Secure Science Corp. 2
Contents
¥ Background
— How Email Works (in under 3 minutes!)
— Tracing Headers
¥ Organizing Spam
— Identification, Classification, Tracking
¥ Covert Channels
— Full-disclosure case study
¥ Conclusion & Questions
Copyright 2003 Secure Science Corp. 3
How Email Works
(A very brief overview)
Copyright 2003 Secure Science Corp. 4
Email Format
¥ Meta Header
— field: value
¥ TO: [email protected]
¥ FROM: [email protected]
¥ Blank line (separates sections)
¥ Content
— Usually plain text
Copyright 2003 Secure Science Corp. 5
Mail Forwarding and Delivery
3. Mail relays
2. Local Mail System
4. Recipient system
Apply more
Populate header
headers, route data Save to user(cid:213)s box
5. Recipient Repository
1. Create the data DNS: Used to
Specify content identify mail servers
6. Mail Reader
subject, recipient
View the mail
Copyright 2003 Secure Science Corp. 6
Mail Format and Delivery
Received: from mail.company.com ([10.8.17.2]) by exchange.company.com
with SMTP (Microsoft Exchange Internet Mail Service
Version 5.5.2653.13) id J2DWGL96; Mon, 22 Apr 2002 16:50:39 -0400
Received: from safard.company.com (safard.company.com [10.2.23.20])
by mail.company.com (Postfix) with ESMTP
id B54F2E00612; Mon, 22 Apr 2002 13:50:38 -0700 (PDT)
Received: (from bob@localhost) by safard.company.com
(8.8.6 (PHNE_17135)/8.7.3 SMKit7.1.1 hp hp) id OAA10071
for ecom; Mon, 22 Apr 2002 14:48:46 -0600 (MDT)
From: Bob <[email protected]>
Message-Id: <[email protected]>
Subject: PURCHASE repair
To: [email protected]
Date: Mon, 22 Apr 2002 14:48:46 MDT
X-Mailer: Elm [revision: 212.4]
Okay. Much tedious time later, the RECEIPT and PURCHASE tables are
repaired, *except*:
- I had to create new PURCHASE table entries for the 7 purchases
Copyright 2003 Secure Science Corp. 7
About Forging...
¥ (cid:210)SMTP(cid:211) not designed for security
¥ Email is trivial to forge
¥ Forged email passed easily to mail delivery agent
¥ Most spammers forge email
Can Forge... Cannot Forge...
¥ Subject, Date, Message-ID ¥ Final (cid:210)Received(cid:211) headers
¥ (cid:210)Originator(cid:211)
¥ Recipients: From, To, CC
— IP address
¥ Other headers
— Subsequent timestamps
¥ Content (body)
¥ Initial (cid:210)Received(cid:211) headers
Copyright 2003 Secure Science Corp. 8
Non-standard Email
Return-Path: <[email protected]>
Received: from FUSMTA02-LRS ([62.172.195.247]) by server.company.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with ESMTP
id <20021029142748.LLMT1493.server.company.com@FUSMTA02-LRS>
for <[email protected]>; Tue, 29 Oct 2002 14:27:48 +0000
Received: from [217.39.203.112] (helo=inverglen.co.uk)
by FUSMTA02-LRS with esmtp (Exim 4.05)
id 186XLB-0000Pi-00; Tue, 29 Oct 2002 14:27:33 +0000
Received: from 10.0.0.1 ([202.164.182.76]) by inverglen.co.uk with
Microsoft SMTPSVC(5.0.2195.5329); Tue, 29 Oct 2002 14:28:53 +0000
Message-ID: <[email protected]>
From: "Martin Williams" <[email protected]>
To: [email protected]
X-MS-JQU: BCWXNCDXQN
Date: Tue, 29 Oct 02 06:26:15 Eastern Standard Time
Content-Type: multipart/mixed;
boundary=WC_MAIL_PaRt_BoUnDaRy_05151998
Subject: New Pill guranteed to give you a thicker larger penis!
Copyright 2003 Secure Science Corp. 9
Forged Header Clues
¥ (cid:210)Received(cid:211) - mismatched (cid:210)From(cid:211) and (cid:210)By(cid:211)
— (cid:210)HELO(cid:211) name does not match IP address
¥ Non-standard headers
¥ Wrong or (cid:210)different(cid:211) format
— Date
— Received
— Message-ID
— Header labels
Copyright 2003 Secure Science Corp. 10