Increasing spam from free email providers

minstrel Illustrious Member

Messages:: 15,082

Likes Received:: 1,243

Best Answers:: 0

Trophy Points:: 480

#1

Spam coming from free email providers increasing
by Dancho Danchev, ZDNet
July 18th, 2008

After analyzing three weeks of spam data between June 13 to July 3, 2008, Roaring Penguin Software Inc. found evidence that spam originating from the top three free email providers :acrobat: (Gmail, Yahoo Mail and Hotmail) is increasing, with spammers in favor of abusing Gmailâ€™s privacy preserving feature of not including the senderâ€™s original IP in outgoing emails :

â€œSpammers are increasingly using free e-mail providers to avoid IP address-based reputation systems. These systems track mail sent by various IP addresses and assign each IP address a rating. Some anti-spam software operates largely or exclusively on the basis of the IP address rating.

Roaring Penguinâ€™s data shows that over the three weeks from June 13 to July 3, 2008, the percentage of US-originated spam originating from the top 3 free e-mail providers (Yahoo, Google and Hotmail) rose from about 2% to almost 4%. Roaring Penguin believes that spammers are using Googleâ€™s service in particular to send spam, relying on the fact that blacklisting Googleâ€™s servers is impractical for most organizations. According to their data, the probability that an e-mail originating from a Google server is spam rose from 6.8% on June 13 to a whopping 27% on July 3.â€
Spammers and phishers are not just interested in the clean IP reputation of free email providers, they are also interested in taking advantage of the trust they have established among themselves through the use of DomainKeys and Sender ID Frameworks, and by abusing this through the bogus accounts that theyâ€™ve automatically registered by breaking the CAPTCHA based authentication, reach the widest possible audience and ensure the successful receipt of their spam/scam.

How are they managing to efficiently abuse these services, and is CAPTCHA breaking for the purpose of automatically registered bogus accounts to blame? The broken CAPTCHAs are only part of the problem. It all starts from the basics, in this case, the companies themselves admitting thereâ€™s a problem and how committed they are in not just fighting incoming spam, but also, outgoing spam.

The whole quality and assurance process applied by spammers is nothing new, in fact phishers and malware authors have been putting more efforts into coming up with easier ways to measure the return on investment (ROI) for themselves, and to present clear performance data to those taking advantage of their services. Just because someone has successfully sent several million spam emails, doesnâ€™t mean that the messages didnâ€™t got filtered, and when they did, what number exactly. Coming up with in-depth spam campaign metrics, and processes for verification of delivery, are becoming a top priority for everyone involved in this underground ecosystem.

The problem of spam and phishing coming from free email providers, has had its peaks in the past two years, prompting popular spam blacklists such as SORBS and Spamcop to blacklist entire Gmail servers due to their inability to obtain the real senderâ€™s IP. Itâ€™s a signal from the anti spam community, and since Gmail will continue not revealing the real senderâ€™s IP, something theyâ€™ve received a lot of criticism from anti spam vendor, but a lot of applause from privacy fighters, the best they can do is balance their incoming VS outgoing spam fighting strategy. Hereâ€™s a comment from an anti-spam vendor commenting on the problem back in 2006:

â€œGmail has taken an extreme position on privacy that inhibits the antispam community from doing their job, and itâ€™s ticking people off,â€ says Tom Gilles, co-founder of IronPort. Some 10% to 15% of the spam IronPort sees comes from free Web-mail accounts, too big a slice to turn a blind eye to. â€œFrom time to time, Gmail mail is getting blocked because spam is leaking out of their service,â€ Gilles says. â€œSometimes the babies get thrown out with the bath water, and that is the rub.

Itâ€™s difficult to gauge how widespread the problem of missing Gmail is, since no blocking records are available, though experts worry itâ€™s growing along with the Gmail service. Gmail had 6.7 million visitors in February, up 4.1 million from a year ago, according to measurement firm comScore Networks, a jump that suggests lost email has yet to hurt the serviceâ€™s growth. Yahoo Mail is still nearly 10 times bigger, hosting 64.6 million visitors last month, and AOL and Hotmail are also orders of magnitude larger. The situation reveals again how the studiously iconoclastic search engine is wrangling with where to draw the line on Internet privacy. As in other recent cases, Google is taking a harder line than its peers.â€
Moreover, the abuse of the authentication at these free email providers, by either breaking the CAPTCHA images automatically, or outsourcing the process to human CAPTCHA breakers who earn cents to authenticate the registration process for the spammers to abuse, is clearly making an impact. For instance, underground services offering hundreds of thousands of pre-registered bogus accounts are popping up like mushrooms these days, and their maturity into a customer-tailored proposition offering everyone the possibility to pre-register bogus accounts at services and web sites that they are not currently targeting, speaks for the confidence theyâ€™ve built into their ability to deliver the goods. The most recent one which I covered in a previous post is continuing to automatically pre-register accounts with its inventory emptying and filling itself automatically in between the customerâ€™s feedback indicating the quality of the service. Hereâ€™s a sample of their inventory as of the last five minutes :

Yahoo.com - 270,565 pre-registered accounts

Hotmail.com - 167,013 pre-registered accounts

Gmail.com - 159,892 pre-registered accounts

These is just the tip of the iceberg, with many other such services offering different inventories and using different tactics in the registration process. And while the companies themselves are keeping track of the latest developments in this ongoing abuse of their services, itâ€™s all a matter of drawing the line at a particular moment of time. For instance, a known to be malware infected IP that has repeatedly attempted to send hundreds of thousands of phishing and spam emails on behalf ot the botnet its participates in, shouldnâ€™t be trusted in any authentication or registration attempts if youâ€™re to take the radical approach, or have the end user warned about whatâ€™s going on and why is she not allowed to use the siteâ€™s services unless action is taken. The point is that, preventing automatic authentication abuse as a process is very similar to preventing click fraud, and fighting spam in general with the only different in the shift of perimeters from applying the techniques on incoming emails, to the authentication process in general.

Most of the human CAPTCHA breakers, and the automated programs will either abuse malware infected hosts as open proxies, or use open proxy lists in order to change their IP on every several registrations. Considering that the majority of malicious activity comes from well known bad parties are often blocked by default at the email gateway without even bothering to inspect the content in email messages coming from their networks/IPs, the same approach, activity from malware infected hosts should be challenged more aggressively than it is for the time being.

The increasing spam and phishing emails originating from legitimate email service providers is prone to increase, and fighting incoming spam should be balanced with fighting outgoing spam. Moreover, email spam is so Web 1.0, that the possibilities for abusing the joys offered by Web 2.0 services are slowly starting to materialize, with spammers being a step ahead of the filtering solutions.
Click to expand...

minstrel, Jul 21, 2008 IP

Yousif Banned

Messages:: 233

Likes Received:: 4

Best Answers:: 0

Trophy Points:: 0

#2

Yeah, people are starting to understand the inner workings of "intelligent" proxies and gateways set by free email service providers. Dancho Danchev should start implementing and/or introducing some real security preventions to organizations since he's well-known. Yet, all he does is blog about the issues, where are the solutions? CAPTCHA's can be broken. They are flawed by nature. Their very design is buggy. Forging IP headers are automated now, it's just silly. The bad guys will always be a step ahead of the good guys if people like this guy is part of the media (giving him the benefit of getting word out) and does nothing but collect historical data and analytical information.

Yousif, Jul 21, 2008 IP

HomeRunner Peon

Messages:: 28

Likes Received:: 1

Best Answers:: 0

Trophy Points:: 0

#3

I saw a couple of days ago 2 tools that allow you to automatically open Gmail and Yahoo accounts AND automaticly send emails through the newly opened account.
This basically allows the spammers to send out millions of emails from approved emails, bypassing all spam filters.

The increase in Gmail's amount of spam sending is due to the fact that the CPATCHA algorithm was broken,
Spamming has never been so easy...

HomeRunner, Aug 20, 2008 IP

IMvisible Banned

Messages:: 54

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 0

#4

Mega interesting post.

I found very soon that I can send emails through Gmail SMTP. But I have a question here. What about the server I use to authenticate ? Didn't Gmail feel those authentications ? Can't he ban the connections from that IP ?

IMvisible, Sep 10, 2008 IP

IndiaNets Guest

Best Answers:: 0

#5

IMvisible said: ↑

Mega interesting post.

I found very soon that I can send emails through Gmail SMTP. But I have a question here. What about the server I use to authenticate ? Didn't Gmail feel those authentications ? Can't he ban the connections from that IP ?
Click to expand...

Yes, if Google catches you doing this, it will blacklist your IP address and so the domains hosted on the same IP too.

IndiaNets, Sep 10, 2008 IP

IMvisible Banned

Messages:: 54

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 0

#6

Do you have any idea how many emails can be sent through gmail and at what interval so that gmail wouldn't ban the IP ? What if someone makes 10 simultaneously connections to 10 email different accounts and send emails, how fast do you think gmail will ban that IP?

IMvisible, Sep 10, 2008 IP

SoulfulDude Peon

Messages:: 205

Likes Received:: 4

Best Answers:: 0

Trophy Points:: 0

#7

But why would you want to use GMail's smtp server anyway? To send spam of course so you're gonna get banned regardless

SoulfulDude, Sep 26, 2008 IP

IMvisible Banned

Messages:: 54

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 0

#8

Sending spam means to send unsolicited mails, but sending mails to peoples who can use your service and know for sure that they give them address for this purpose is something else.

IMvisible, Oct 1, 2008 IP

SoulfulDude Peon

Messages:: 205

Likes Received:: 4

Best Answers:: 0

Trophy Points:: 0

#9

But why do you want to send through GMail's servers? Why not just send through your ISP's smtp servers?

SoulfulDude, Oct 2, 2008 IP

IMvisible Banned

Messages:: 54

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 0

#10

SoulfulDude said: ↑

But why do you want to send through GMail's servers? Why not just send through your ISP's smtp servers?
Click to expand...

I saw that this kind of marketing is used by hi5, sending emails through peoples account. I've just asked

IMvisible, Oct 8, 2008 IP

IndiaNets Guest

Best Answers:: 0

#11

IMvisible said: ↑

Do you have any idea how many emails can be sent through gmail and at what interval so that gmail wouldn't ban the IP ? What if someone makes 10 simultaneously connections to 10 email different accounts and send emails, how fast do you think gmail will ban that IP?
Click to expand...

I don't have exact idea, but they definitely get the spamming domain/IP lists from some organizations which help fighting SPAM. They have their BigDaddy DC now and I think Gmail stays there.

IndiaNets, Oct 11, 2008 IP

Log in or Sign up

Increasing spam from free email providers

minstrel Illustrious Member

Yousif Banned

HomeRunner Peon

IMvisible Banned

IndiaNets Guest

IMvisible Banned

SoulfulDude Peon

IMvisible Banned

SoulfulDude Peon

IMvisible Banned

IndiaNets Guest

Useful Searches