Transcript Email Spam and Phishing Attacks

CAP6135: Malware and Software
Vulnerability Analysis
Spam and Phishing
Cliff Zou
Spring 2016
Acknowledgement

This lecture uses some contents from the lecture notes
from:


Dr. Dan Boneh (Stanford): CS155:Computer and Network
Security
Jim Kurose, Keith Ross. Computer Networking: A Top Down
Approach Featuring the Internet, 5th edition.
2
Electronic Mail
user mailbox
Three major components:



user
agent
user agents
mail servers
simple mail transfer protocol: SMTP
User Agent

a.k.a. “mail reader”

composing, editing, reading mail
messages

e.g., Eudora, Outlook, elm,
Netscape Messenger

outgoing, incoming messages
stored on server
outgoing
message queue
mail
server
SMTP
SMTP
mail
server
user
agent
3
SMTP
user
agent
user
agent
mail
server
user
agent
user
agent
How email works:
SMTP
(RFC 821, 1982)
Some SMTP Commands:
MAIL FROM: <reverse-path>
RCPT TO: <forward-path>
Repeated
for each
RCPT TO: <forward-path>

recipient
If unknown recipient: response “550 Failure reply”
DATA
email headers and contents
.

Use TCP port 25 for connections
4
Sample fake email sending
S: 220 longwood.cs.ucf.edu
C: HELO fake.domain
S: 250 Hello crepes.fr, pleased to meet you
C: MAIL FROM: <[email protected]>
S: 250 [email protected]... Sender ok
C: RCPT TO: <[email protected]>
S: 250 [email protected] ... Recipient ok
C: DATA
S: 354 Enter mail, end with "." on a line by itself
C: from: “fake man” <[email protected]>
C: to: “dr. who” <who@who>
C: subject: who am I?
C: Do you like ketchup?
C: How about pickles?
C: .
S: 250 Message accepted for delivery
C: QUIT
S: 221 longwood.cs.ucf.edu closing connection
5
Try SMTP interaction for yourself:



telnet servername 25
see 220 reply from server
enter HELO, MAIL FROM, RCPT TO, DATA, QUIT
commands
 “mail from:” the domain may need to be existed
 “rcpt to:” the user needs to be existed
 A mail server may or may not support “relay”


CS email server supports relay from Eustis machine
“from:” “to:” “subject:” are what shown in normal
email display
6
Using Telnet

On department Eustis or eustis2 Linux machine:



telnet longwood.cs.ucf.edu 25
In telnet interaction, “backspace” is not supported.
You can type “ctrl+backspace” to erase previous two
characters
On Windows 7 machine:


Telnet is not installed by default, check this tutorial
for install:
http://technet.microsoft.com/enus/library/cc771275%28v=ws.10%29.aspx
7
Advanced Manual Spam



But the above manual spam can only send text-only
spam email!
Effective spam and phishing email needs to have
authorities figures/logos.
Also need to have URLs

Especially for phishing
attack email
8
Email with Attachment?



What if a normal email user wants to send graphic email
and has email attachment with any file format?
Original SMTP protocol only support 7-bit ASCII text
transmission
Manual email attachment:

Sender use base64 to encode file into pure ASCII text
Sender appends the text to her email
Receiver extract the encoded text part from received email
Receiver use base64 to decode to recover the original file

Troublesome, easy to make mistake!



9
Message format: multimedia extensions

MIME (Multi-purpose Internet Mail Extensions)


multimedia mail extension, RFC 2045, 2056
additional lines in msg header declare MIME content type
MIME version
method used
to encode data
multimedia data
type, subtype,
parameter declaration
encoded data
From: [email protected]
To: [email protected]
Subject: Picture of yummy crepe.
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Type: image/jpeg
base64 encoded data .....
.........................
......base64 encoded data
MIME

Check some real email examples to see how MIME is
implemented
Content-Type: multipart/mixed;
boundary="_002_D2E669A13641EMichaelMacedoniaucfedu_"
MIME-Version: 1.0
--_002_D2E669A13641EMichaelMacedoniaucfedu_
Content-Type: text/plain; charset="us-ascii"
Content-ID: <[email protected]>
Content-Transfer-Encoding: quoted-printable
--_002_D2E669A13641EMichaelMacedoniaucfedu_
Content-Type: application/pdf;
name="CAE-Tech-Talk-Vogtembing-Omari-18Feb2016.pdf"
Content-Description: CAE-Tech-Talk-Vogtembing-Omari-18Feb2016.pdf
Content-Disposition: attachment;
filename="CAE-Tech-Talk-Vogtembing-Omari-18Feb2016.pdf"; size=355404;
creation-date="Sun, 14 Feb 2016 22:28:23 GMT";
modification-date="Sun, 14 Feb 2016 22:28:23 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64
11
Advanced Manual Spam

Two ways for including images in email

Include images by URLs

The email itself does not have the content of the images
<img src="http://www.cs.ucf.edu/~czou/images/smallUCF.gif"
height="76" width="200">

Include image content with the email

Use MIME protocol to include image content
--94eb2c06b65cf653cd052b8b8da4
Content-Type: image/gif; name="ucf-gold.gif"
Content-Disposition: inline; filename="ucf-gold.gif"
Content-Transfer-Encoding: base64
R0lGODlhZABkAOYAAP////f399bW1sbGxr29vc7Gvb21pca1jL
Ka2ECK2MGKWECM7Gpefetd7GWr2lQrWcOa2UMbWcMa2U
…………………………………………………….
--94eb2c06b65cf653cd052b8b8da4-12
Advanced Manual Spam

But how to generate the Figure-based spam email
manually with ease?


Send the email to yourself by using a web-based email
service
Upon receiving the email, show the email original text



Gmail has the option “Show Original”
Copy the text of the email into a pure text editor (such
as notepad, notepad++,…)
In Telnet manual spam sending, after “Data”
command, paste those text
13

Outside campus network, department email server does
not accept:


You need to first setup VPN to campus network, then use telnet
How to set up VPN:


https://publishing.ucf.edu/sites/itr/cst/Pages/NSvpn.aspx
Even inside campus network, directly telnet EECS email server
will not work now because of the CS server’s new restriction

You can connect to Eustis machine, then run telnet command
inside Eustis machine to connect to CS email server.
14
Email in the early 1980’s
Network 1
Mail
relay
Network 2
sender
Mail
relay
Network 3
• Mail Relay: forwards mail to next hop.
• Sender path includes path through relays.
15
recipient
Why Email Server Support Relay?

Wiki tutorial:



Old days network constraint makes it necessary
Email agent uses SMTP to send email on behalf of a user


The user could choose which email address to use as the sender
Email server supports email group list:


http://en.wikipedia.org/wiki/Open_mail_relay
The “sender” shown in email is the group list address, but the real
sender is a different person
Closing Relay:




Messages
Messages
Messages
Messages
from local IP addresses to local mailboxes
from local IP addresses to non-local mailboxes
from non-local IP addresses to local mailboxes
from clients that are authenticated and authorized
16
Spoofed email

SMTP: designed for a trusting world …

Data in MAIL FROM totally under control of sender


… an old example of improper input validation
Recipient’s mail server:


Only sees IP address of direct peer
Recorded in the first From header
17
The received header

Sending spoofed mail to myself:
From [email protected] (172.24.64.20) ...
From
relays


Received: from cs-smtp-1.stanford.edu
Received: from smtp3.stanford.edu
Received: from cipher.Stanford.EDU
Received header inserted by relays --- untrustworthy
From header inserted by recipient mail server
18
Spam Blacklists

RBL: Realtime Blackhole Lists



Effectiveness (stats from spamhaus.org):



Includes servers or ISPs that generate lots of spam
spamhaus.org , spamcop.net
RBL can stop about 15-25% of incoming spam at SMTP
connection time,
Over 90% of spam with message body URI checks
Spammer goal:

Evade blacklists by hiding its source IP address.
19
Spamming techniques
Open relays

SMTP Relay forwards mail to destination
1.
2.
3.
4.

Bulk email tool connects via SMTP (port 25)
Sends list of recipients (via RCPT TO command)
Sends email body --- once for all recipients
Relay delivers message
Honest relay:


Adds Received header revealing source IP
Hacked relay does not
21
Example: bobax worm

Infects machines with high bandwidth


Slow spreading:



Exploits MS LSASS.exe buffer overflow vulnerability
Spreads on manual command from operator
Then randomly scans for vulnerable machines
On infected machine:


(spam zombie)
Installs hacked open mail relay. Used for spam.
Once spam zombie added to RBL:

Worm spreads to other machines
22
Open HTTP proxies

Web cache (HTTP/HTTPS proxy) -- e.g. squid
xyz.com
URL: HTTPS://xyz.com
ClientHello
CONNECT xyz.com 443
ClientHello
Squid
Web
Cache
ServerHello

To spam:
ServerHello
CONNECT SpamRecipient-IP 25
SMTP Commands
Squid becomes a mail relay …
23
Web
Server
Finding proxies

Squid manual: (squid.conf)
acl Safe_ports port 80 443
http_access deny !Safe_ports

URLs for other ports will be denied

Similar problem with SOCKS proxies

Some open proxy and open relay listing services:

http://www.multiproxy.org/
http://www.stayinvisible.com/
http://www.blackcode.com/proxy/
http://www.openproxies.com/
(20$/month)
24
Open Relays vs. Open Proxies

HTTP proxy design problem:

Port 25 should have been blocked by default


Otherwise, violates principal of least privilege
Relay vs. proxy:


Relay takes list of address and send msg to all
Proxy: spammer must send msg body to each recipient through
proxy.
 zombies typically provide hacked mail relays.
25
Thin pipe / Thick pipe method

Spam source has


High Speed Broadband connection (HSB)
Controls a Low Speed Zombie (LSZ)
TCP handshake
LSZ
Target
SMTP
Server
TCP Seq #s
HSB


SMTP bulk mail
(Source IP = LSZ)
Assumes no egress filtering at HSB’s ISP
Hides IP address of HSB. LSZ is blacklisted.
26
Bulk email tools

(spamware)
Automate:

Message personalization


Also test against spam filters (e.g. spamassassin)
Mailing list and proxy list management
27
Send-Safe bulk emailer
28
Anti-spam methods
The law: CAN-SPAM act

(Jan. 2004)
Bans false or misleading header information

To: and From: headers must be accurate

Prohibits deceptive subject lines

Requires an opt-out method

Requires that email be identified as advertisement


... and include sender's physical postal address
Also prohibits various forms of email harvesting
and the use of proxies
30
Effectiveness of CAN-SPAM


Enforced by the FTC:

FTC spam archive [email protected]

Penalties:
11K per act
Dec ’05 FTC report on effectiveness of CAN-SPAM:

50 cases in the US pursued by the FTC

No impact on spam originating outside the US

Open relays hosted on bot-nets make it difficult
to collect evidence
http://www.ftc.gov/spam/
31
Sender verification I: SPF
(sender policy framework)

Goal: prevent spoof email claiming to be from HotMail

Why?
Bounce messages flood HotMail system
MAIL FROM
Recipient hotmail.com
[email protected]
Mail
Sender
Server
64.4.33.7
(MUA)
64.4.33.8
hotmail.com:
SPF record:
64.4.33.7
DNS
64.4.33.8
Is SenderIP
in list?
More precisely:
hotmail.com TXT v=spf1 a:mailers.hotmail.com -all
32
Sender verification II: DKIM

Domain Keys Identified Mail (DKIM)


Same goal as SPF. Harder to spoof.
Basic idea:

Sender’s MTA signs email


Receiver’s MUA checks signature


Including body and selected header fields
Rejects email if invalid
Sender’s public key managed by DNS

Subdomain:
_domainkey.hotmail.com
33
Graylists

Recipient’s mail server records triples:



First time: triple not in DB:





(sender email, recipient email, peer IP)
Mail server maintains DB of triples
Mail server sends 421 reply:
Records triple in DB
“I am busy”
Second time (after 5 minutes): allow email to pass
Triples kept for 3 days (configurable)
Easy to defeat but currently works well.
34
Puzzles and CAPTCHA

General DDoS defense techniques

Puzzles: slow down spam server


Every email contains solution to puzzle where
challenge = (sender, recipient, time)
CAPTCHA:



Completely Automated Public Turing test to tell Computers and
Humans Apart
Every email contains a token
Sender obtains tokens from a CAPTCHA server



Say: 100 tokens for solving a CAPTCHA
CAPTCHA server ensures tokens are not reused
Either method is difficult to deploy.
35
SpamAssasin

Wiki tutorial:


http://en.wikipedia.org/wiki/SpamAssassin
Mainly a rule-based spam filter

Many rules to give scores for all fields in an email




Final decision is the combined score compared with a threshold
Has false positive (treat normal as spam), and false negative
(treat spam as normal)
False positive is very damaging!


Nobody wants to lose an important email!
Also contains Bayesian filtering to match a user’s
statistical profile


Email header, special keywords in email, URLs in email, images in
email, …..
Need known “ham” and “spam” email samples for training
36
SpamAssasin

You can find the rule list at:


Your manual spam is possible to be labeled by our CS
email server as spam, based on SpamAssasin’s score



http://spamassassin.apache.org/tests_3_3_x.html
The text information added by SpamAssasin tells you what rule
gives the email suspicious positive score
It could help real Spammer to improve their spam email to
circumvent SpamAssasin detection
Gmail spam detection algorithm is not public

A helpful article: https://www.quora.com/How-does-Gmailspam-detection-works
37
Part II:
Phishing & Pharming
39
Note:
no SSL.
Typically: short lived sites.
40
Common Phishing Methods

Often phishing sites hosted on bot-net drones.


Move from bot to bot using dynamic DNS.
Use domain names such as:
www.ebay.com.badguy.com

Use URLs with multiple redirections:
http://www.chase.com/url.php?url=“http://www.phish.com”

Use randomized links:

http://www.some-poor-sap.com/823548jd/
41
Industry Response

Anti-phishing toolbars: Netcraft, EBay, Google, IE7

IE7 phishing filter:



Whitelisted sites are not checked
Other sites: (stripped) URL sent to MS server
Server responds with “OK” or “phishing”
42
Check Browser for HTTP or HTTPS
HTTP
HTTPS
The server’s digital
Certificate has been
verified
43
Pharming

Cause DNS to point to phishing site

Examples:

1.
DNS cache poisoning
2.
Write an entry into machine’s /etc/hosts file:
“ Phisher-IP Victim-Name ”
URL of phishing site is identical to victim’s URL

… will bypass all URL checks
44
Response: High assurance certs

More careful validation of cert issuance

On browser (IE7) :
… but most phishing sites do not use HTTPS
45
Other industry responses: SiteKey
ING bank login
46
Research: SiteKey is not secure

“The Emperor's New Security Indicators”. Stuart E.
Schechter, Rachna Dhamija, Andy Ozment, and Ian
Fischer. IEEE Security & Privacy 2007.

MITM attack: man-in-the-middle attack that strips off SSL. The only visible
indication of the attack is that lack of a HTTPS indicator (no HTTPS in the
address bar, no lock icon, etc.).
Security image attack: The researchers simulated a phishing attack. In this
attack, it looks like the users are interacting with the real bank site, except that
the SiteKey security image (and security phrase) is missing. In its place, the
attack places the following text:
SiteKey Maintanance Notice: Bank of America is currently upgrading our
award winning SiteKey feature. Please contact customer service if your SiteKey
does not reappear within the next 24 hours.

47
Industry Response:
Defending against Keylogger
48
ING PIN Guard
49
Some ID Protection Tools

SpoofGuard:

Alerts user when viewing a spoofed web page.

Uses variety of heuristics to identify spoof pages.


(NDSS ’04)
Some SpoofGuard heuristics used in
eBay toolbar and Earthlink ScamBlocker.
PwdHash:
(Usenix Sec ’05)

Browser extension for strengthening pwd web auth.

Being integrated with RSA SecurID.
50
Password Hashing
(pwdhash.com)
Bank A
=
pwdA
pwdB
Site B

Generate a unique password per site



HMACfido:123(banka.com)
HMACfido:123(siteb.com)
 Q7a+0ekEXb
 OzX2+ICiqc
Hashed password is not usable at any other site
51
Problems of Password Hashing

Need to install a client program on user’s machine


It means the user cannot use other machines to log in to her
accounts
Different websites have different requirements on
password format



# of characters
Special characters, capital characters,….
This means that the pwdHash client program must know the
formats of all users’ accounts
52
Take home message

Deployed insecure services (proxies, relays)



Quickly exploited
Cause trouble for everyone
Current web user authentication is vulnerable
to spoofing

Users are easily fooled into entering password
in an insecure location
53