Anti-Spam
Technical Alliance Publishes Industry Recommendations
To Help Stop Spam [June 22, 2004]
Va., Jun 22, 2004 (BUSINESS WIRE) --
The Anti-Spam Technical Alliance (ASTA), whose participants
include Yahoo! Inc. (Nasdaq "YHOO"), Microsoft
Corp. (Nasdaq "MSFT"), EarthLink (Nasdaq "ELNK")
and America Online Inc. (NYSE "TWX"), today
unveiled the result of more than a year of close collaboration
by presenting a host of detailed best practices and
technical recommendations for the entire industry in
an effort to fight the scourge of spam.
The proposal provides recommended actions
and policies for Internet service providers (ISPs) and
e-mail service providers (ESPs) as well as large senders
of e-mail including governments, private corporations
and online marketing organizations. These recommendations
primarily focus on two key issues: helping solve the
e-mail forgery problem by eliminating domain spoofing
through Internet Protocol (IP)-based and signature-based
solutions; and best practices to help prevent ISPs and
their customers from being sources of spam.
The complete ASTA proposal can be found
at each adopting company's Web site:
-- http://antispam.yahoo.com
-- http://download.microsoft.com/download/2/3/7/
23779c05-d409-46ce-b9d6-c24908789d8b/ASTA Statement
of
Intent.pdf (Due to the length of this URL, it may be
necessary
to copy and paste this hyperlink into your Internet
browser's
URL address field. You may also need to remove an extra
space
in the URL if one exists.) or http://www.microsoft.com/spam
-- http://www.earthlink.net/spamblocker
-- http://corp.aol.com/press/press_release062204.html
ASTA was founded in April 2003 to bring together key
industry stakeholders to drive technical standards and
promote collaboration in the development of industry
guidelines to address the spam problem. Current members
include leading technology companies such as America
Online, British Telecom, Comcast, EarthLink, Microsoft
and Yahoo!
Comments
"With these proposed solutions,
ASTA is taking a huge step toward collective and enforceable
technologies in reducing spam and e-mail forgery,"
said Brad Garlinghouse, vice president of Communication
Products at Yahoo! Inc. "We are laying out clear
best practices and Good Neighbor policies that will
help change the rules of the game on spammers once and
for all."
"We believe that thanks to continued
innovation and the ongoing cooperation of governments
and industry around the world, we are on the right path
to turn the tide against spammers -- but further change
is needed on an industrywide basis to thoroughly contain
the problem for consumers and businesses worldwide,"
said Ryan Hamlin, general manager of the Anti-Spam Technology
& Strategy Team at Microsoft. "Our aim with
this proposal is to help lay out a clear framework for
the industry as we continue to work together to end
the spam business and put our customers back in control
of their inboxes once again."
"Today's announcement shows the
industry's commitment to working together to develop
the best technical standards and practices that all
providers can use to stop spam," said Linda Beck,
executive vice president of Operations at EarthLink.
"By collaborating on new ways to better identify
the origin of messages, we can help lift the veil of
anonymity on spammers and restore the integrity of e-mail.
We encourage continued testing and public discussion
in order to move toward industry-standard technical
solutions."
"This announcement opens an entirely
new chapter in spam fighting on behalf of all online
consumers. Spam is an industrywide challenge that merits
an industrywide solution. Creating a set of best practices
puts us on a clear glide-path to winning a major battle
against spammers, scammers and spoofers," said
Matt Korn, executive vice president, Network & Data
Center Operations at America Online. "This proposal
also shifts the spam fight toward identifying legitimate
senders of e-mail to ensure prompt delivery of their
e-mail. Now we're going to focus on testing and evaluating
cost-effective technologies that can identify legitimate
senders of e-mail and help restore consumer trust in
their e-mail inboxes."
About Yahoo!
Yahoo! Inc. is a leading provider of
comprehensive online products and services to consumers
and businesses worldwide. Yahoo! is the No. 1 Internet
brand globally and the most trafficked Internet destination
worldwide. Headquartered in Sunnyvale, Calif., Yahoo!'s
global network includes 25 world properties and is available
in 13 languages.
About Microsoft
Founded in 1975, Microsoft (Nasdaq "MSFT")
is the worldwide leader in software, services and solutions
that help people and businesses realize their full potential.
About EarthLink
"EarthLink revolves around you
(TM)." Celebrating ten years as a leading national
Internet service provider (ISP), Atlanta-based EarthLink
has earned an award-winning reputation for outstanding
customer service and its suite of online products and
services. According to the J.D. Power and Associates
2003 Internet Service Provider Residential Customer
Satisfaction Study(SM), EarthLink is ranked highest
in customer satisfaction among high-speed ISPs. Serving
more than five million subscribers, EarthLink offers
what every user should expect from their Internet experience:
high-quality connectivity, minimal drop-offs and ISP-generated
intrusions, and customizable features. Whether it's
dial-up, high-speed, Web hosting, or wireless Internet
service, EarthLink provides the tools that best let
individuals use and enjoy the Internet on their own
terms. Learn more about EarthLink by calling (800) EARTHLINK
or visiting EarthLink's Web site at http://www.earthlink.net/.
About America Online
America Online Inc. is a wholly owned
subsidiary of Time Warner Inc. (TWX). Based in Dulles,
Virginia, America Online is the world's leader in interactive
services, Web brands, Internet technologies and e-commerce
services.
America Online is a registered trademark
of Time Warner, Inc.
EarthLink and the EarthLink logo are
registered trademarks of EarthLink Inc.
Microsoft is a registered trademark
of Microsoft Corp. in the United States and/or other
countries.
Yahoo! and the Yahoo! logo are trademarks
and/or registered trademarks of Yahoo! Inc.
The names of actual companies and products
mentioned herein may be the trademarks of their respective
owners.
Summary of ASTA Recommendations
ASTA's proposal focuses on two key issues:
helping solve the e-mail forgery problem by eliminating
domain spoofing through IP-based and signature-based
solutions, and best practices to help prevent ISPs and
their customers from being sources of spam.. Recognizing
that broad adoption of any technology or best practice
is critical to solving the spam epidemic, all members
of ASTA have agreed to the following recommendations:
Addressing E-mail Address Forgery
One of the key problems with today's
e-mail infrastructure is that messages do not contain
enough reliable information to enable recipients to
decide whether an e-mail message is legitimate and reliably
identify the sender. Spammers take advantage of this
fact and commonly disguise the origin of their messages
by forging the sender addresses on their e-mail using
someone else's domain name. This is called "domain
spoofing."
Although the problem of identifying
the origin of e-mail is complex, there are two promising
new methods that organizations can implement to lay
a foundation for future advances and promote authentication
that verifies that senders of a message is who they
claim to be:
1. Authenticating senders based on IP
addresses.
Currently, the only trustworthy attribute
in an e-mail message header is the IP address of the
server that is transmitting the e-mail. IP addresses
can therefore be used by e-mail receivers to verify
other attributes in the message header, such as the
sending domain, and thus help reduce the common forms
of phishing and forgery that are rampant today. This
verification loop can be done using the existing Domain
Name System (DNS) infrastructure combined with fairly
simple changes to the receiver's e-mail systems.
2. Authenticating senders based on content
signing.
Another approach to sender authentication
uses a technology called Content Signing (CS). CS systems
use public/private key pairs to generate the signatures
that are used for sender verification. The public keys
may be made broadly available through a variety of key
exchange mechanisms or via publication in a directory
or in DNS. The private keys are stored securely on the
domain's mail servers. When a user sends an e-mail message,
the mail server uses the stored private key to automatically
generate a digital signature for the message. When the
recipient's mail server receives the e-mail message,
it retrieves the sender's public key and uses it to
verify the digital signature in the message. This verifies
both the sender's identity and the integrity of the
message body (that the e-mail content was not modified
during delivery).
As with IP-based sender authentication,
the companies believe that content signing technologies
are an important component of a long-term industry solution.
Throughout the process of implementing
these technologies, ASTA members will provide feedback
that along with other industrywide feedback will enable
subsequent improvements to the specification to be completed,
with the goal of providing for the best long-term, industrywide
IP based authentication solution.
It is the belief of this group that
the ubiquitous deployment of some or all of these proposals,
combined with the most innovative anti-spam filtering
technologies and approaches, continued litigation against
the worst offenders, appropriate legislation and other
measures, will serve to reduce the economic incentives
and eliminate the entry points for spammers to continue
their barrage of unwanted communications. ASTA looks
forward to the community response to this proposal and
invites participation from all segments of the community
to assess the validity and impact of these proposed
solutions and their accompanying technical specifications.
Addressing Spam Through Best Practices
In the proposal, ASTA recommends a number
of best practices that organizations should implement
as applicable. Many of these practices have already
been adopted by responsible organizations using e-mail
today, but broader global adoption is necessary, as
the combined effect of implementing these approaches
can serve to minimize opportunities for spammers. Those
who do not adopt these proposals risk loss of online
user confidence in the safe and trusted exchange of
e-mail for the entire community.
Specifically, ASTA's proposal outlines
the following:
-- Recommendations for ISPs and mailbox
providers and
organizations that provide Internet connectivity, such
as
these:
-- Block or Limit the use of Port 25
-- Implement rate limits on outbound
e-mail traffic
-- Control automated registration of
accounts
-- Close redirectors that can be abused
-- Close all open relays
-- Configure proxies for internal network
use only
-- Detect compromised computers (zombies)
-- Educate users to increase use of
existing tools
-- Develop effective complaint reporting
systems
-- Recommendations for legitimate bulk
e-mail senders, such as
these:
-- Do not harvest e-mail addresses through
SMTP or other
means (defined as collecting e-mail addresses, usually
by
automated means) without the owners' affirmative consent.
-- Register your e-mail domain with
a creditable safelist
provider.
-- Always provide clear instructions
to customers about how
to unsubscribe or opt-out of receiving e-mail. Promptly
respond to these requests.
-- Do not use or send e-mail that contains
invalid or forged
headers.
-- Do not use or send e-mail that contains
invalid or
nonexistent domain names in the From or Reply-To headers.
-- Do not employ any technique to hide
or obscure any
information that identifies the true origin or the
transmission path of bulk e-mail.
-- Do not use a third party's Internet
domain name or allow
mail to be relayed from or through a third party's
equipment without permission.
-- Do not send e-mail that contains
false or misleading
information in the subject line or in its content.
-- Monitor SMTP responses from recipients'
mail servers.
Promptly remove all e-mail addresses for which the
receiving mail server responds with a 55x SMTP error
code
(e.g., "user doesn't exist").
-- Recommendations for consumers, such
as these:
-- Install firewalls on PCs as appropriate.
-- Use anti-virus software and other
screening tools to
detect incoming viruses, malware, and harmful or
suspicious code.
-- Make use of spam filtering technologies
and customize
settings that provide the appropriate level of protection
needed.
Some of these recommendations are already part of laws
in various countries including the Controlling the Assault
of Non-Solicited Pornography and Marketing (CAN-SPAM)
Act of 2003 in the United States. However, the disparity
between laws and the absence of anti-spam laws in most
countries means the industry needs to come together
and adopt consistent policies and practices that drive
spammers out of business.
The complete ASTA proposal can be found
at each adopting company's Web site:
-- http://antispam.yahoo.com
-- http://download.microsoft.com/download/2/3/7/
23779c05-d409-46ce-b9d6-c24908789d8b/ASTA Statement
of
Intent.pdf (Due to the length of this URL, it may be
necessary
to copy and paste this hyperlink into your Internet
browser's
URL address field. You may also need to remove an extra
space
in the URL if one exists.) or http://www.microsoft.com/spam
-- http://www.earthlink.net/spamblocker
-- http://corp.aol.com/press/press_release062204.html
SOURCE: America Online Inc.
For more information, press only:
Yahoo!
Mary Osako, (408) 349-6255
mosako@yahoo-inc.com
or
Waggener Edstrom for Microsoft
Rapid Response Team, (503) 443-7070
rrt@wagged.com
or
EarthLink
Carla Shaw, (404) 748-7267
Shawcm@corp.earthlink.net
or
America Online
Nicholas Graham, (703) 265-1746 |
