1. 1 RedIRIS Reputation Block List September 2008

2. RedIRIS Reputation Block ListPágina 2 RedIRIS and mail services At the beginning, RedIRIS was directly involved in the direct provision of e-mail services to affiliated institutions However, several years ago it stopped providing those services (including webmail)  End of life cycle within NREN – commodity services provided by the institutions and the market RedIRIS has kept working on issues related to e-mail, but mostly trying to improve its quality and to fight against spam  RACE (audit of University mail configuration, coordinated by RedIRIS and done by peers)  Promotion of security policies (e.g., SPF,DKIM,BATV)  Whitelists, spamtraps  These initiatives were well received, but it was necessary to bring them further to have a real impact  Ideas obtained from TF-LCPM (spam filtering services offered by SURFnet and UNINETT, and presented at TF-LCPM meetings)

3. RedIRIS Reputation Block ListPágina 3 Spam evolution Spam1.0Spam2.0Spam3.0 What’s being sent Unsolicited advertising : Massive distribution of services: Viagra,loans, sex etc. Worms/virus Masive distribution ++ plus economic fraud Images, pdf etc. Convergence spam/worms- virus Email addresses Simple methodsMassive harvesting of e-mail addresses Directionary attacks E-mail addresses bought and sold How Open-relayVulnerabilities: cgi, php, open- proxies, sockets Open-proxies, BOTNETs Solutions Basic content filter DNSbl Bayesian, multilingual content filters Evolution of DNSbl zombies Adaptation of content filters New evolución of DNSbl to target zombies Spamtraps

4. RedIRIS Reputation Block ListPágina 4 Less spam Zombies Some data about zombies (botnets) * New bots per day500 Nº of bots anytime6-8 millions Average lifetime of bots2-3 hours Nº of bots in some attacks10.000-200.000 Nº of messages sent by botnet80 millions/hour 85% from spam is sent from zombies * Data: “Email Threats Trend Report” October 2007. Commtouch Block SMTP zombies Warnings about IP zombies Zombies are main origin of spam Identification of zombies

5. RedIRIS Reputation Block ListPágina 5 Criteria for a reputation system GoalsDescription EffectivenessReduce spam 70-90% False positivesAs few as possible – and easy to solve if any ScalabilityEasy to adapt to new needs SimpleEasy usage and configuration Compatible with users policiesUsers decides what’s spam and what it makes with it ResilienceAny service problem shall not affect users email services SupportTechnology known by system administrators OpenComplementarities with RedIRIS projects as white lists, spamtraps ReportDetection of suspicious IP Cost24/7?

6. RedIRIS Reputation Block ListPágina 6 RedIRIS whitelist Reputation scheme SMTP zombie DNS medium hard SMTP IRISRBL Servicio AntiSpam Red Académica Sends spam to University University Sends spam to spamtraps RedIRIS spamtraps IP DNS query Is IP in the zone?  Updates in real time exclusion External sources: CBL, SORBS, Spamhaus,Sophos rsync

7. RedIRIS Reputation Block ListPágina 7 Service Model  Need to integrate several sources  RedIRIS internal sources such as spamtraps are statistically very effective, but they cover a very limited part of the zone  It is necessary to add external databases ModelSources MaximumSpamhaus + Habeas + Sophos + TrendMicro Very effective + intermediateSpamhaus80-90% MinimumCBL+DUL+spamcop +…75-80%

8. RedIRIS Reputation Block ListPágina 8 Trial  University of Zaragoza ModelDetection% spam detected % spam undetected Spamcop14519663,96%34,73% soft.rediris15109466,56%32,13% Spamhaus15752869,39%28,3% hard.rediris18617882,01%16,8%

9. RedIRIS Reputation Block ListPágina 9 We did a survey to collect information about use of RBL in RedIRIS institution Survey (1)

10. RedIRIS Reputation Block ListPágina 10 Survey (2) Answers from 65 Institutions 74% use RBLs 80% block 82% willing to use RedIRISRBL 84% use Whitelist 78% has SPF record

11. RedIRIS Reputation Block ListPágina 11 What next Service on trial using RKS developed with Sandvine  50 institutions trying it  15 millions queries per day  Positive feedback Need to increase information in the system – collective purchase of licence of commercial providers? First stage to gain confidence from users – and then upgrade the service? Evaluation towards new model of service similar to those of Surfnet and Nordunet

12. RedIRIS Reputation Block ListPágina 12 Thanks for your attention!