Application

Canning spam

Faced with a spam explosion, service providers are advocating a variety of technology standards to stop spammers in their tracks, says Srikanth R P

As spam reaches astronomical proportions, service providers are using technology to filter out unsolicited mail and phishing attacks. What has made their task more difficult is the ability of spammers to mask their identities and those of the servers from which they send e-mail. The solution, reckon service providers, lies in authenticating e-mail senders and servers.

Different vendors have proposed methodologies with the common objective of stopping the spam count from reaching unmanageable proportions. While Yahoo has proposed DomainKeys, Microsoft is pushing Sender ID. Both expect their technology to be adopted by other players. While there are a variety of techniques to filter out spam, Yahoo’s proposed standard goes beyond just fighting spam, it tackles phishing attacks as well.

DomainKeys leverages public key cryptography to verify the sender of an e-mail message at the domain level. The domain owner generates a pair comprising a public and a private key to be used for signing all outgoing messages. The public key is then published in the DNS and the private key is made available to e-mail servers. When an e-mail is sent by an authorised user within the domain, the DomainKey-enabled system automatically uses the stored private key to generate a digital signature for the message. This signature is then appended as a header to the e-mail message and sent to the recipient’s mail server. The receiving e-mail system extracts the signature and the claimed sender’s domain from the e-mail headers and fetches the public key from the DNS server for the claimed ‘From’ domain. The public key from the DNS server is then used by the mail system of the recipient to verify that the signature was generated by the matching private key. If the keys check out, it proves that the message was sent from the claimed ‘From’ domain and that its headers and content were not altered during transfer. If the keys don’t match, the message can be flagged or deleted.

Fishing out ‘Phishing’

If ISPs can put a restriction on the number of e-mails generated by a single user, it can go a long way in controlling spam Jasminder Gulati Manager Enterprise Marketing Microsoft India

The DomainKeys technology lets e-mail servers confirm that a message has in fact originated from a user authorised to send e-mail for the domain stated in the header. Sify was the first service provider to implement DomainKeys for Sify Mail and believes that it can go a long way in stopping spam and preventing phishing attacks. What is also interesting is that no certificate authorities are involved with Yahoo’s

proposed standard. Since DomainKeys leverages DNS as a public key distribution system and as only a domain owner can publish to its DNS, service providers know that the public key belongs to the said domain.

Explains Manvendra Bhanguli, vice president, Software and Systems, Sify, “Organisations such as banks who are susceptible to phishing attacks will benefit by adopting DomainKeys. For instance, if a company, example.com, signs all its outgoing e-mail with DomainKeys, Sify can add a filter to its e-mail system that drops any unsigned or improperly signed messages claiming to come from that particular domain. This will protect example.com’s customers from phishing attacks.” The ability to verify the sender’s domain will let service providers build databases that can be shared with the community and also be used to apply anti-spam policies.

Along the same lines, Cisco is proposing a standard called Identified Internet Mail (IIM) that helps identify fraudulent messages and apply user-defined policies. Cisco claims that deploying IIM makes a domain more accountable for e-mail messages emerging from its domain and limits the ability of spammers and malware such as viruses and worms to forge return addresses or disguise the identity of infected systems.

Caller ID for e-mail

Another standard that has attracted a lot of interest is Microsoft’s Sender ID that uses a different approach. While e-mail addresses can be spoofed, IP addresses cannot be forged. A company’s IP addresses are available on public DNS servers. When a message comes from a domain that claims to be from the said company, the recipient’s e-mail program checks the information in the header and compares it with the information in the DNS database. If there is a mismatch, the message is dropped.

If these proposed standards become popular, e-mail marketers will be forced to authenticate and sign their messages to prevent them from being blocked. Says Jasminder Gulati, manager-Enterprise Marketing, Microsoft India, “Using our technologies, Hotmail.com blocks in excess of 2.5 billion messages a day. We believe that an era of spam-free e-mail can be conceived if all the service providers get together and agree upon standards.” Gulati also believes that if ISPs can put a small restriction on the number of e-mails generated by a single user, it can go a long way in controlling spam. Organisations who want to set up bulk mailing lists can get their domains identified to avoid being classified as spammers.

Microsoft is also pushing its SmartScreen Technology that uses artificial intelligence techniques to filter out spam. The technology uses a series of algorithms to extract words from each e-mail message and classifies the message as legitimate or spam. Microsoft claims that SmartScreen already searches for more than 5 lakh characteristics of spam that are based upon user feedback. The Redmond-based giant is also assembling a huge list of spammers that it plans to share with service providers. Gulati also proposes simple processes like putting a cap on the number of e-mail messages sent by users, a system he believes would act as a powerful deterrent against spammers. Another step that can be taken is to set a rate limit for outbound mail from consumer accounts.

In conclusion, service providers would have to look at combining multiple technology options to stop the spread of spam. In the future, both IP-based solutions such as Sender ID and digital signature-based approaches (Yahoo’s DomainKeys and Cisco’s Identified Internet Mail) could help control this menace.

srikanth@expresscomputeronline.com