Announcement

Collapse
No announcement yet.

Microsoft aims to make spammers pay

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Microsoft aims to make spammers pay

    Despite efforts to stem the billions of spam e-mails flooding inboxes, unwanted messages are still turning e-mail into a quagmire of misery.
    Spammers send out tens of millions of e-mails to unsuspecting computer users every day, employing a myriad of methods to ensure their pills, loans and "requests for our lord" pleas fox e-mail filters.
    Some are even turning to prose and poetry to fool the technological safeguards people put in place. But a group of researchers at Microsoft think they may have come up with a solution that could, at least, slow down and deter the spammers.
    The development has been called the Penny Black project, because it works on the idea that revolutionised the British postage system in the 1830s - that senders of mail should have to pay for it, not whoever is on the receiving end.
    The payment is not made in the currency of money, but in the memory and the computer power required to work out cryptographic puzzles. As a result of this extra investment, spamming would become less profitable because costs would skyrocket in order to send as many e-mails.
    All this clever puzzle-solving is done without the recipient of the e-mail being affected The idea was originally formulated to use CPU memory cycles by team member Cynthia Dwork in 1992. But they soon realised it was better to use memory latency - the time it takes for the computer's processor to get information from its memory chip - than CPU power.
    Spam accounts for more than half of e-mails sent That way, it does not matter how old or new a computer is because the system does not rely on processor chip speeds, which can improve at rapid rates.
    A cryptographic puzzle that is simple enough not to bog down the processor too much, but that requires information to be accessed from memory, levels the difference between older and newer computers.

    MSR is in talks with various people to put the system into a useful anti-spam product.



  • #2
    Can't see how thats going to work. Surely some software got to be installed on the spammers pc in the first place???

    Anyway I got spammed 100 times by 3com support yesterday saying they haven't recieved the rma back.

    Daft becuase it's the holiday period and even more daft I only need telling once that it's not arrived. Dafter still cos it pisses me off.
    Chief Lemon Buyer no more Linux sucks but not as much
    Weather nut and sad git.

    My Weather Page

    Comment


    • #3
      well, they'll need to create a new email standard using that features, and make it substitute the SMTP on all the ISPs. It'll be only possible if they work together with the other big players in the servers market.
      Personally I think it to be a good idea, as soon as it's implemented by a non-proffit organization (W3C perhaps). At least for me, having spam filters doesn't make me save much time, I still need to check if what it thought was Spam, really is.
      <font face="verdana, arial, helvetica" size="1" >epox 8RDA+ running an Athlon XP 1600+ @ 1.7Ghz with 2x256mb Crucial PC2700, an Adaptec 1200A IDE-Raid with 2x WD 7200rpm 40Gb striped + a 120Gb and a 20Gb Seagate, 2x 17" LG Flatron 775FT, a Cordless Logitech Trackman wheel and a <b>banding enhanced</b> Matrox Parhelia 128 retail shining thru a Koolance PC601-Blue case window<br>and for God's sake pay my <a href="http://www.drslump.biz">site</a> a visit!</font>

      Comment


      • #4
        somehow I doubt that it will get adopted.......

        and I also seriously doubt that it will STOP spamers
        If there's artificial intelligence, there's bound to be some artificial stupidity.

        Jeremy Clarkson "806 brake horsepower..and that on that limp wrist faerie liquid the Americans call petrol, if you run it on the more explosive jungle juice we have in Europe you'd be getting 850 brake horsepower..."

        Comment


        • #5
          now if they stopped the patch/virus announcements hitting my mailbox i get 15 a week still
          Better to let one think you are a fool, than speak and prove it


          Comment


          • #6
            oops, just read the next one
            Last edited by rugger; 26 December 2003, 23:24.
            80% of people think I should be in a Mental Institute

            Comment


            • #7
              Well, if all destination SMTP servers forced a client to perform a realitively expensive crypto puzzle (1/2 sec) for each email recepient they want to send through it, I can see it working well.

              One possible problem that could be used is the RSA problem. The server could randomly choose some data, and encrypt it with 2048bit RSA. Then it can ask the client to decrypt the data, which would take seconds on most fast processors. The client returns the decrypted results, and the server checks them against the original. This operation requires MUCH more work on the client side because the decryption exponent would be 2048bits, while the encrpytion exponent is a low prime number, like 63. (which is 6 or so bits long) Microsoft will likely choose a different problem though, as RSA easily fits into CPU caches and does not hit the memory bus hard.

              For this to work though:

              1) Clients will need to have a full SMTP/DNS client installed, they will not be able to use their ISP's SMTP server unless the receipient was on the ISP. This is because the traditional forwarding used in SMTP won't work when each SMTP server on the path expects the client to waste CPU time for it. I don't really mind this. Another possiblity is that there will be a trust network with certificates that says what SMTP servers will be allowed to send messages to other SMTP servers without incurring a crypto puzzle.

              2) At first, the crypto puzzle will not be a required part of the standards. Therefore, messages that undergo the crypto puzzle would be marked somehow, and the user could decide what to do with unmarked messages.

              Anyway, I think microsoft may be onto something. If nothing else, it could make spamming too expensive for most people to partake in. The extra processing time and energy required to deliver 10000's of messages may be just enough to make spam unprofitable.

              Note: all this is said after my disgust in receiving the 5th pron spam email advertising the same fkn free pron site today. (and I have 2-3 dozen more over the last week that I have deleted already)

              Edit: make that the 9th pron spam email :/ *I wonder wtf is going on*
              Last edited by rugger; 27 December 2003, 01:56.
              80% of people think I should be in a Mental Institute

              Comment


              • #8
                and I see that this can be another "this will only irritate the legal non spamming user since the spammers are using a hacked smtpserver/client"â„¢
                If there's artificial intelligence, there's bound to be some artificial stupidity.

                Jeremy Clarkson "806 brake horsepower..and that on that limp wrist faerie liquid the Americans call petrol, if you run it on the more explosive jungle juice we have in Europe you'd be getting 850 brake horsepower..."

                Comment


                • #9
                  Done properly, the receiver's SMTP server will at some point require a crypto puzzle to be solved from the sender.

                  If a certificate athority is set up, and when a message reaches a server with certificate, it will force the sender into a crypto puzzle. Once the crypto puzzle has been solved by the client and verified by the server, the server will sign the message with its certificate. From here, the message can be forward to the client with no further checks. When the client retreives the message, the mail client and verify the signature. Messages with a fake signature or with no signature can be marked so the user can do whatever he/she wants with them. Of course, how such a certificate authority is setup and run is an very important question, but with microsoft running the show, I am not sure I want the answer.

                  If there is no certificate athority, then senders will have to contact the receivers SMTP server directly (using DNS MX records) and solve a crypto puzzle there to prove that the message has been "paid for". This is probably not a terrible thing, but mail clients are ussually not sophisticated enough to handle their own mail forwarding.
                  80% of people think I should be in a Mental Institute

                  Comment


                  • #10
                    Problem is a lot of proper users are going to get pissed off by being asked to do the puzzle while the spammers will bypass this either by hacking or whatever.
                    A better way would be to fine companies that pass your details on heavily. Also it would help if companies etc removed your email address from thier websites.
                    No doubt thats why I get tons of spam to my work address becuase it no doubt on their website.
                    Last edited by The PIT; 27 December 2003, 06:42.
                    Chief Lemon Buyer no more Linux sucks but not as much
                    Weather nut and sad git.

                    My Weather Page

                    Comment


                    • #11
                      The user doesn't need to do the crypto puzzle as such, the mail client does. Since most mail clients send/receive mail in the background, that shouldn't be a big problem. I know of no-one that would get very upset if their email took another 5 seconds to send. I would be very happy to sacrifice a few seconds of CPU time to get rid of most/all of the spam I get. I would consider it a very cheap price to reduce the evil of spam.

                      Fining companies/people who distribute your email address acheives nothing. It will not stop the spammers adding your email address to their lists the moment they find it. It won't stop spammers from flooding my email box with spam. At the end of the day, the only people can I winning out of this is the lawyers.

                      I am very sceptical about microsoft being able to pull this off correctly and without costing everyone an arm and a leg. However the theory seems correct.
                      80% of people think I should be in a Mental Institute

                      Comment


                      • #12
                        Originally posted by rugger

                        Fining companies/people who distribute your email address acheives nothing. It will not stop the spammers adding your email address to their lists the moment they find it. It won't stop spammers from flooding my email box with spam. At the end of the day, the only people can I winning out of this is the lawyers.
                        If companies got fined large amounts they would stop it believe me. Companies like profits that why they sell your details on.
                        Chief Lemon Buyer no more Linux sucks but not as much
                        Weather nut and sad git.

                        My Weather Page

                        Comment


                        • #13
                          Originally posted by rugger
                          The user doesn't need to do the crypto puzzle as such, the mail client does. Since most mail clients send/receive mail in the background, that shouldn't be a big problem. I know of no-one that would get very upset if their email took another 5 seconds to send. I would be very happy to sacrifice a few seconds of CPU time to get rid of most/all of the spam I get. I would consider it a very cheap price to reduce the evil of spam.

                          Well too be honest I don't want my client pissing around when it should be downloading. Again it isn't going to deter the spammer either is it. Just delay the end user.
                          The only spam I get at my own personal account is from companies that have my details passed on by insurance companies giving me quotes even though I told them not too. Again fines would stop this.
                          At work I get tons of porn spam no doubt from the email being trawled off our website.
                          Chief Lemon Buyer no more Linux sucks but not as much
                          Weather nut and sad git.

                          My Weather Page

                          Comment


                          • #14
                            Well, maybe in your case, fines may help. But then again, they may not either. Once a spammer gets your email address, its pretty much over. You will get spam till the day you put the email address in the bin.

                            However, the "fines" you talk about isn't going to stop these pornograhic spams I have so far gotten 10 today of. The measures microsoft are persuing may though.

                            If it costs the spammer 10 seconds of processing time to send a single message, then they are limited to about 8000 messages a day outbound on a single machine. For a comparison, my pitiful 64kb upload could send more then 100000 email messages a day unrestricted. Higher upload accounts can send an increadibly large amount of spam. On my pitiful connection, given the above restriction, I would be forced to run more then 10 fast machines at full pelt to send 100000 spams a day. 10 machines chewing in excess of 100W (because the high end CPU has to run at full pelt 24/7) is a nontrival cost, and one that most useless, illegal spam will never pay for.

                            I am not going to say that this method will stop all spam, because somewhat stupid statement that completely ignores security history and practice, but it should help a great deal.
                            80% of people think I should be in a Mental Institute

                            Comment


                            • #15
                              But you still got to force them to use the software. Okay you can do it centrally but then you're hitting everyone else. Another factor since computers are now cheap you just setup more base units and leave them running.
                              Chief Lemon Buyer no more Linux sucks but not as much
                              Weather nut and sad git.

                              My Weather Page

                              Comment

                              Working...
                              X