November CCS News: Lab to Deploy New Blocking Service in War on Spam

November, 2002

Lab to Deploy New Blocking Service in War on Spam

If your email seems to be on a high-spam diet lately, you're not alone. Whereas unwanted junk email made up only about 8 percent of all email on the Internet in July 2001, that figure has more than quadrupled to 36 percent by July 2002. And while an Internet email user averaged about five spams a day in 2001, the current daily average intake is around 30.

To deflect spam, the Lab currently uses a "Spam Wall" application that allows the Lab to specify email addresses for blocking. Today, the Lab's Spam Wall blocks about 5,500 spam messages every day. One day last April, the wall blocked 250,000 unwanted messages.

But it's not enough to keep up with the creative spammers, who find news ways to circumvent such measures.

So, the Lab will soon begin using the services of BrightMail, an outside firm that provides up-to-the-minute spam blocking information.

"It's really industrial grade spam-blocking," said Mark Rosenberg, head of the Computing Infrastructure Technologies Group.

BrightMail has created millions of decoy email addresses to intentionally attract spam. It then analyzes those messages and creates rules for blocking the messages, Rosenberg told members of the Lab's Computing and Communications Services Advisory Committee (CSAC) last week. The company updates and distributes these spam signatures every 10 minutes.

Such measures are necessary, Rosenberg said, as spam is growing faster than email overall. For example, the Lab's monthly email traffic amounted to 800,000 messages in October 1999, and has risen to about 1.3 million a month by October 2002. On the spam side, however the number of messages blocked has tripled in just nine months, from 50,000 a month in January 2002 to 160,000 in September of this year.

Not only are the spammers more prolific, they're also getting sneakier. Whereas they once relied on forged or hidden addresses to send from, spammers have developed methods to create a new address for every message sent, never using the same one twice. Since the Lab's Spam Wall only blocks addresses already submitted, it's not effective against this type of onslaught. BrightMail, however, can analyze these messages' content and provide effective blocking tools.

This should mean an end to spam scams promising millions from Nigerian oil accounts, Web design offers from Indonesia, big savings on toner cartridges and a multitude of offers for personal enhancements.

The Lab is currently negotiating with the BrightMail vendor and expects to have the system tested and put it into production in December. Until then, Rosenberg advises employees to resist the urge to fire back, or even try to use promised unsubscribe options.

"When you reply, you're giving the spammers what they want - confirmation that your email address is valid," he said. "Often, the unsubscribe feature is a means to this end. Your best option is to just delete the message."