l23-click-trajectories.html

<h1>The economics of spam</h1>

<p><strong>Note:</strong> These lecture notes were slightly modified from the ones posted on the 6.858 <a href="http://css.csail.mit.edu/6.858/2014/schedule.html">course website</a> from 2014.</p>

<h2>Economics of cyber attacks</h2>

<p>Up to this point, we've dealt with the <em>technical</em>
aspects of security (buffer overflows, the
same-origin policy, Tor, etc).</p>

<ul>
<li><em>Primary concern:</em> How can an adversary compromise
a system? We devise a threat model, and then
try to make our system robust against that
threat model.</li>
<li><em>An alternate perspective:</em> <em>Why</em> is the attacker
trying to subvert our security policies?
<ul>
<li>Some types of attacks are done for ideological
reasons (e.g., political protest by citizens;
censorship by governments, Stuxnet). For
these kinds of attacks, money is not primary
motivator.
<ul>
<li>It's hard to make these attacks more
difficult, other than generally "making
computers more secure."</li>
<li>Economic penalties would likely
involve deterrence, i.e., penalties
after crime was detected. However,
computers and networks currently
have poor accountability. <em>Example:</em> Where
did Stuxnet come from? We have some
good ideas, but could we win a case
in court? And which court would we
go to?</li>
</ul></li>
<li>However, many kinds of computer crime <em>are</em>
driven by economic motivations (e.g.,
state-sponsored industrial espionage;
spam).</li>
</ul></li>
<li>It takes money to make money!
<ul>
<li>An attacker needs to assemble infrastructure
to support an attack. <em>Example:</em> machines to launch
attacks, banks to handle illicit financial
transactions.</li>
<li>Perhaps we can deter attackers by making
their infrastructure costs too high?
<em>Example:</em> Spammers will stop sending spam if
it becomes unprofitable!</li>
</ul></li>
</ul>

<p>For today's lecture, we'll focus on attacks that
do involve a significant economic component.</p>

<ul>
<li><em>Example:</em> In China, spammers often hire "text-message
cars." The cars intercept communications
between cell phones and cell phone towers.
The cars discover phone numbers, and then
send spam messages to those numbers. One
car can send 200,000 messages a day!
<ul>
<li>Cost of interception device: <code>~$1,600</code></li>
<li>Profit per day: <code>~$1,600</code></li>
<li>Fines for getting caught: <code>&lt; $5,000</code></li>
<li>Since it's rare to get caught, spam
cars are a lucrative business.
<ul>
<li>Also, Chinese mobile carriers earn
money from each spam message, so
the carriers have an incentive to
allow the spam to continue.</li>
<li>Carriers define special "106-prefix"
numbers that are exempt from
normal limits on how many messages
they can send a day. 106-numbers
are supposed to be used for
non-commercial reasons (e.g., for
companies to contact employees),
but 55% of Chinese text message
spam comes from 106 numbers.</li>
</ul></li>
<li><a href="http://www.economist.com/news/china/21635062-china-flounders-its-efforts-combat-text-messaging-spam-106-ways-annoy">The Economist, "Spam messaging: 106 ways to annoy." November 29, 2014</a></li>
</ul></li>
<li>There are many companies which trade
in "cyber arms." <em>Example:</em> Endgame.
<ul>
<li>$1.5 million: Endgame will give you the
IP addresses and physical locations of
millions of unpatched machines.</li>
<li>$2.5 million: Endgame will sell you a
"zero-day subscription package" which
will give you 25 exploits a year.</li>
</ul></li>
</ul>

<p>Who buys exploits from cyber arms
dealers? Governments? Companies (e.g.,
for "hack-back" schemes)? . . .?</p>

<p>There's a marketplace for buying and selling
all kinds of resources that attackers can use
for evil purposes.</p>

<ul>
<li>Compromised systems
<ul>
<li>Entire compromised machine.</li>
<li>Access to a compromised web site (e.g.,
post spam, links, redirectors, malware).</li>
<li>Compromised email accounts (e.g., Gmail).</li>
<li>Running a service on an existing botnet (spam, DoS).</li>
</ul></li>
<li>Tools
<ul>
<li>Malware kits</li>
<li>Bugs, exploits</li>
</ul></li>
<li>Stolen information
<ul>
<li>SSNs, credit cards numbers, email addresses, etc.</li>
</ul></li>
</ul>

<h2>Spam ecosystem</h2>

<p>This paper focuses on the spam ecosystem (in
particular, the sales of drugs, knock-off goods,
and software). There are three main steps:</p>

<ol>
<li>Advertising: Somehow getting a user to
click on a link.</li>
<li>Click support: Presenting a web site that
will be the target of a click.</li>
<li>Realization: Allowing the user to buy
something, send money, and then receive
a product.</li>
</ol>

<p>Ultimately, money comes from the last part
in this chain, when the user buys something.</p>

<ul>
<li>Many components are outsourced or supported
via affiliate programs: spammers work
as the advertisers, but the affiliates
handle most/all of the backend stuff
(e.g., working with banks).</li>
<li>Spammers typically work on a commission,
getting 30%--50% of the money that they
bring in.</li>
</ul>

<p>Next, we'll discuss these three steps in detail,
and look at possible ways to disrupt them.</p>

<h3>Advertising: How do you get a user to click on a link?</h3>

<ul>
<li><em>Typical approach:</em> send email spam. (Other
methods also work: blog/comment spam, spam
in social networks, ...)</li>
<li><em>Cost of sending spam:</em> $60 per million spam
messages, at retail.
<ul>
<li>Actual costs are much lower for direct
operators of a spam botnet.</li>
<li>Delivery and click rates for spam emails
are quite low, so sending spam has to
be really cheap in order to be
profitable.</li>
<li>Earlier study by some of the same guys:
<ul>
<li>~350 million spams sent</li>
<li>~10k clicks, 28 purchase attempts</li>
</ul></li>
</ul></li>
<li>How can we make sending spam more expensive?
<ul>
<li><em>IP-level blacklists:</em> Used to work for a
while, but only if adversary has few IPs.</li>
<li><em>Charging for sending email?</em>
<ul>
<li>Old idea, in various forms: money, computation, CAPTCHAs.</li>
<li>Can this work? How could we get everyone to adopt this at once?</li>
<li>Will this work even if everyone adopts
at once? What if user devices are
compromised? (But even with compromised
desktops, charging per message may be
high enough of a bar to greatly reduce
spam, since generating spam needs to be
very cheap to be profitable!)</li>
</ul></li>
</ul></li>
<li>Three workarounds for adversary:
<ul>
<li>Large-scale botnets give access to many IP
addresses.</li>
<li>Compromised webmail accounts give access to
special IP addresses.
<ul>
<li>Yahoo, Gmail, Hotmail cannot be blacklisted.</li>
</ul></li>
<li>Hijack IP addresses (using BGP announcements).</li>
</ul></li>
<li>Still, workarounds are not free, and they incur
some costs for the spammer.
<ul>
<li>Cost of sending spam used to be even lower
before IP-level blacklists.</li>
</ul></li>
</ul>

<p>Botnets are often used to send spam.</p>

<ul>
<li>Typical architecture
<ul>
<li>Many compromised end-user machines that
run the botnet software.</li>
<li>Command &amp; control (C&amp;C) server/infrastructure
for sending commands to bots.</li>
<li>Bots periodically get new tasks from C&amp;C
infrastructure.</li>
</ul></li>
<li>Individual bot machines have a variety of useful
resources:
<ul>
<li>Physical: IP address (good for sending spam),
network bandwidth, CPU cycles.</li>
<li>Data: email contacts (good for sending spam),
credit card numbers, . . .</li>
</ul></li>
<li>It's difficult to prevent bot machines from sending
spam -- there may be millions of bot IPs!</li>
</ul>

<p>How much does it cost to get your malware installed
on end-hosts?</p>

<ul>
<li>Price per host: ~$0.10 for US hosts, ~$0.01 for
hosts in Asia.</li>
<li>Seems hard to prevent; many users will happily
run arbitrary executables.</li>
</ul>

<p>What does the command and control architecture
look like?</p>

<ul>
<li>Centralized C&amp;C infrastructure: adversary needs
"bullet-proof" hosting (i.e., a host that will
refuse takedown requests from banks, legal authorities).
<ul>
<li>Bullet-proof hosts charge a risk premium.</li>
</ul></li>
<li>What to do if hosting service is taken down?
<ul>
<li>Adversary can use DNS to redirect. Also,
using "fast flux" techniques, the attacker
can rapidly change the IP address that is
associated with a hostname.
<ul>
<li>Attacker creates a list of server IP
addresses (there may be hundreds or
thousands of IPs); attacker binds each
one to the hostname for a short period
of time (e.g., 300 seconds).</li>
</ul></li>
<li>How hard is it to take down botnet's DNS
domain name?
<ul>
<li>Can take down either domain's registration,
or the domain's DNS server.</li>
<li>Adversary can use domain flux, span many
separate registrars.
<ul>
<li>Harder to take down: requires
coordination between registrars!</li>
<li>Happened for Conficker: it was
significant/important enough . . .</li>
</ul></li>
</ul></li>
</ul></li>
<li>Decentralized C&amp;C infrastructure: peer-to-peer
networks.
<ul>
<li>Allows bot master to operate fewer or no
servers; hard to take down.</li>
</ul></li>
</ul>

<p>Compromised webmail accounts can also be used
to send spam.</p>

<ul>
<li>Very effective delivery mechanism: everyone accepts
email from Yahoo, Gmail, etc.</li>
<li>Webmail providers are motivated to prevent accounts
from being compromised.
<ol>
<li>If the provider doesn't prevent spam, then
<em>all</em> mail from that provider may be marked
as spam!</li>
<li>The provider monetizes the service using
ads, so the provider needs real users to
click on ads.</li>
</ol></li>
<li>How do providers detect spam?
<ul>
<li>Monitor messages being sent by each account,
detect suspicious patterns.</li>
<li>For suspicious messages and initial
signup/first few msgs, use a CAPTCHA:
present the user with an image/sound,
ask user to transcribe it -- this should be
easy for a human, but hard for a computer.</li>
</ul></li>
<li>How hard is it to get a compromised webmail
account?
<ul>
<li>Price per account: ~$0.01-0.05 per account
on Yahoo, Gmail, Hotmail, etc.</li>
</ul></li>
</ul>

<p>Why are webmail accounts so cheap? What happened
to CAPTCHAs?</p>

<ul>
<li>Adversaries build services to solve CAPTCHAs;
it's just a matter of money.
<ul>
<li>Turns out to be quite cheap: ~$0.001 per
CAPTCHA, with low latency.</li>
<li>Surprisingly, it's mostly done by humans:
attacker can outsource the work to any
country with cheap labor. [Could also
use Amazon's Mechanical Turk: It's a
crowd-sourced web service that allows
humans to work on tasks that are
difficult for computers to perform.]</li>
</ul></li>
<li>Instead of hiring someone to solve the
attacker, the attacker can reuse the CAPTCHA
on another site, and ask a normal visitor
to solve it.</li>
<li>Providers can implement more frequent checks
for spam senders, but regular users may
get annoyed if the checks are too frequent.
<ul>
<li><em>Example:</em> Gmail lets you enable two-factor
authentication. In this scheme, when
you open Gmail from a previously
unknown machine, Google will send
you a verification code via SMS.</li>
</ul></li>
</ul>

<h3>Click support: The user contacts DNS to translate a hostname into an IP address</h3>

<p>Then, the user contacts the associated web server. So, the
spammer needs to:</p>

<ol>
<li>Register a domain name.</li>
<li>Run a DNS server.</li>
<li>Run a web server.</li>
</ol>

<p><strong>Q:</strong> Why do spammers bother with domain names?
Why not just use raw IP addresses to serve
content?</p>

<ul>
<li><strong>A1:</strong> Users might be less likely to click on a
link that has a raw IP address in it?</li>
<li><strong>A2:</strong> A stronger reason is that using a layer
of indirection makes it easier to keep
the content server alive.
<ul>
<li>If law enforcement deregisters the
domain name or disables the DNS
server, but the server is still
alive, the spammer can just register
a new domain name and create a new
DNS server.</li>
</ul></li>
</ul>

<p>Redirect sites:</p>

<ul>
<li>Spam URLs often point to redirection sites.
<ul>
<li>Free redirectors like bit.ly or other
URL shorteners.</li>
<li>A compromised site can also perform a
redirect to the spam server.</li>
</ul></li>
<li>Redirection sites are useful because spam
filtering systems may blacklist URLs.
<ul>
<li>A popular site is extremely useful
as a redirection platform: to stop
the spam, filtering software would
have to blacklist a popular website!</li>
</ul></li>
<li>Spammers sometimes use botnets as web servers
or proxies.
<ul>
<li>This hides the IP address of the
real web server; indirection once
again!</li>
</ul></li>
</ul>

<p>In some cases, a single affiliate provider will
run some or all of these services.</p>

<p><strong>Q:</strong> Can't law enforcement just take down the
affiliate program?</p>

<ul>
<li><strong>A:</strong> In theory, yes, but it can be hard to
take down the entire organization. Also,
there are a non-trivial number of
affiliate programs.</li>
</ul>

<p><strong>Q:</strong> How difficult is it to take down
individual domain names or web servers?</p>

<ul>
<li><strong>A:</strong> Depends on the registrar or hosting provider
[see Figures 3, 4, 5 in the paper].
<ul>
<li>Only a few number of registrars host
domains for many affiliates; similarly,
only a few number of ASes host web
servers for many affiliates.</li>
<li>Only a few affiliates distribute
their domain, name server, and web
server across many registrars and
ASes.</li>
<li>Bullet-proof hosting providers are
more expensive, but plentiful; even
if they're taken down, they're relatively
easy to replace.</li>
</ul></li>
</ul>

<h3>What happens during the <em>realization phase?</em></h3>

<ol>
<li>User pays for goods.</li>
<li>User receives goods in the mail (or downloads 
software).</li>
</ol>

<p>Payment protocol: almost invariably credit cards. Credit card info travels along this flow:</p>

<pre><code>    Customer
      |----&gt;Merchant
             |----&gt; Payment processor (helps the
                     |  merchant deal with the
                     |  payment protocol)
                     |
                     |--&gt;Acquiring bank (merchant's)
                            |--&gt;Association network
                                  | (e.g., Visa)
                                  |
                                  |---&gt; Issuing bank
                                        (customer's)
</code></pre>

<ul>
<li>The issuing bank decides whether the transaction
looks legit, and if so, sends an approval back.</li>
<li>PharmaLeaks paper: Some programs have over
$10M/yr revenue!</li>
</ul>

<p>For physical goods, the supplier typically ships
the goods directly to purchaser (this is called
<em>"drop shipping"</em>).</p>

<ul>
<li>Drop shipping means that the affiliate program
does not need to stockpile physical products
themselves.</li>
<li>Authors speculate that there are plenty of
suppliers, so there's no supply-side
bottleneck.</li>
</ul>

<p><strong>Q:</strong> Why do spammers properly classify their
credit card transactions?</p>

<ul>
<li><strong>A:</strong> The association network (e.g., Visa or Mastercard)
charges high fines for miscoded transactions!
Presumably, association networks don't want to
get in trouble for obscuring the true purposes
of financial transactions.</li>
</ul>

<p><strong>Q:</strong> Why do spammers actually ship the goods?</p>

<ul>
<li><strong>A:</strong> Credit card companies track the number of
"chargeback" requests (i.e., the number of
times that customers ask their credit card
company to return funds involved in a
broken transaction).
<ul>
<li>Credit card companies issue penalties
if the number of chargeback transactions
is too high (>1%).</li>
<li>So, it's not sustainable for a spammer
to frequently charge customers but not
ship goods, particularly if . . .</li>
<li>Only a few banks are willing to interact
with spammers! (<em>Table V, Figure 5 in the
paper</em>)
<ul>
<li>CCS'12 paper: Only 30 acquiring banks
seen over 2 years!</li>
<li>So, an effective spam prevention
technique is to focus on those
small number of banks. Why?
<ol>
<li>High cost to switch banks.</li>
<li>Financial risk in switching.</li>
</ol></li>
<li>But what can we actually do?
<ul>
<li>Convince issuing banks to blacklist
these acquiring banks?</li>
<li>Try to convince these banks to
stop dealing with spammers? This
may be tricky: "Due to incongruities
in intellectual property protection,
it is not even clear that the sale
of such goods (like pharmaceuticals)
is illegal in the countries in which
such banks are located." (Section IV.D)
<ul>
<li>Spamming is distasteful, but it's
<em>not always criminal</em>.</li>
<li>For example, some affiliate customers
might not come from spam -- they might
come from legitimate Google searches!</li>
</ul></li>
</ul></li>
</ul></li>
</ul></li>
</ul>

<p>Since this paper was published, credit card networks
have taken some action.</p>

<ul>
<li>After the paper came out, some pharmacy and
software vendors lodged complaints about Visa
(the authors used Visa cards to make their
spam purchases)</li>
<li>In response, Visa made some policy changes:
<ul>
<li>All pharmaceuticals sales are
now labeled high-risk; if a bank acts
as an acquirer for high-risk merchants,
the bank is more strictly regulated
(e.g., the bank needs to engage in a
risk-management program).</li>
<li>Visa's operating guidelines now explicitly
enumerate and forbid illegal sales of
drugs and trademark-infringing goods.
<ul>
<li>The new language allows Visa to
aggressively issue fines against
acquiring banks.</li>
<li>Some affiliate programs responded
by requiring customers to submit
a photo ID (the goal was to filter
out test buys from security researchers).
However, this hurts sales, since
customers are reluctant to give
their ID info.</li>
</ul></li>
</ul></li>
</ul>

<h2>Ethics</h2>

<p>Does this paper raise ethical concerns? Are the
authors supporting the spammers by purchasing
their goods?</p>

<p>Some companies have launched "hack-back" campaigns
to retaliate against theft of intellectual property,
or to stop botnets involving their machines.</p>

<ul>
<li><em>Example:</em> In 2013, Microsoft, American Express, PayPal,
and a bunch of other companies took down a large
botnet. Microsoft then told the affected users
that they should patch their machines.</li>
<li>Microsoft's legal reasoning: Botnets were violating
Microsoft trademarks. Increasingly, companies are
using novel legal arguments to take action against
botnets... is this a good idea?</li>
</ul>

<h2>References</h2>

<ul>
<li><a href="http://css.csail.mit.edu/6.858/2013/readings/captcha-econ.pdf">Re: CAPTCHAs - Understanding CAPTCHA-solving services in an economic context</a></li>
<li><a href="http://css.csail.mit.edu/6.858/2013/readings/priceless.pdf">Priceless: The Role of Payments in Abuse-advertised Goods</a> [CCS'12]</li>
<li><a href="http://css.csail.mit.edu/6.858/2013/readings/pharmaleaks.pdf">PharmaLeaks: Understanding the Business of Online Pharmaceutical Affiliate Programs</a></li>
<li><a href="https://www.usenix.org/conference/usenixatc11/agenda-empirical-cyber-crime-research">An Agenda for Empirical Cyber Crime Research</a></li>
<li><a href="http://research.microsoft.com/pubs/167719/whyfromnigeria.pdf">Why do Nigerian Scammers Say They are from Nigeria?</a></li>
</ul>