PUBLICATIONS Inside Illinois Vol. 24, No. 21, May 19, 2005

Campus welcomes new spam-control software

By Sharita Forrest, Assistant Editor
217-244-1072; slforres@uiuc.edu

An old television commercial used to ask people how they spelled "relief."

Some grateful e-mail users on the Urbana campus might spell it “CSC.”

During the past several weeks, more than 10,000 faculty and staff e-mail users have been introduced to CITES Spam Control, a software module for detecting and screening unwanted e-mail messages implemented by Campus Information Technologies and Educational Services.

After testing the software with approximately 120 non-technical staff members earlier this year, CITES began deploying it incrementally to groups of computer users on April 15.

Some frustrated e-mail users, who had been watching with dismay as unwanted messages seemed to propagate in their mailboxes daily, were anticipating the deployment of the spam filter as eagerly as seniors look forward to graduation day.

“I couldn’t wait for it to start,” said Mike Grossman, a professor of genetics in the department of animal sciences. “I was getting roughly 90 percent spam – about 100 to 150 messages every night – and only 10 of them would be worth keeping.”

Since the software began filtering Grossman’s e-mail a few weeks ago, he has been pleased to see the flood of nuisance messages aimed for his inbox reduced to a trickle. While a few errant messages escape the filter’s detection, Grossman said: “I can live with three or four spam getting through. It’s made a huge difference.”

While the software could be tweaked to capture 100 percent of unsolicited e-mail, it would then misidentify a lot of legitimate messages as spam, said Mike Corn, director of security services and information privacy at CITES. “If users receive 80 percent less e-mail because of the spam control, most of them can deal with the 20 percent they do receive.”

CITES Spam Control evaluates e-mail messages and assigns each a score ranging from 0 to 100; 0 means the correspondence is definitely legitimate and 100 signifies that the system is “certain” the message is spam.

Users can customize how the system handles their “certain” and “likely” spam messages by choosing from four settings:

• Tag – the system default, which tags messages with headers containing the spam score and delivers all messages to the user’s inbox
• Cautious – messages the system is “certain” are spam and messages it deems “likely” to be spam are sent to a separate quarantine folder but not deleted
• Aggressive – messages the system is certain are spam are deleted while likely spam are quarantined
• No quarantine – messages the system is certain are spam are deleted automatically and the rest delivered to the user’s inbox.
  

Users can receive daily e-mail digests of all their messages that have been sent to quarantine during the past 24 hours.

Corn said that approximately 7,000 users are using the quarantine function, “and we’re receiving no complaints about false positives,” or legitimate communications misidentified as spam. The system’s low incidence of false positives was one of the criteria for which it was selected.

Leslie Rankin, a research programmer at CITES who has been conducting user orientation workshops on the software, said, “I tell people to leave it on the ‘cautious’ setting for a couple of weeks. It’s your e-mail; you need to trust it. But if you’re like me and you get tired of taking 10 seconds to scan your daily digest every day, switch your setting to ‘aggressive.’ ”

Ginny France, a professor of finance and an academic adviser, who said she has been very pleased with the performance of the spam filter, did just that.

“Like a lot of other users, I started out setting CSC at a relatively conservative level – ‘cautious’ – and now that I’ve had it for a couple of weeks and learned to trust it, I’ve changed the setting to ‘aggressive’ so it has more control,” France said.

According to her daily e-mail digest, France said the system has been shielding her inbox from 30 to 300 unsolicited messages a day. France previously used the spam filter in Microsoft Outlook but was disappointed with the results. “Even though I was very meticulous about marking messages as being from senders I didn’t want to receive anything from ever again, it just didn’t catch things,” France said. “Obviously, it needed something more sophisticated.”

Linda Rohl, assistant to the head of veterinary pathobiology, is another satisfied user. “I have to say I was a little skeptical about the spam control at first, but since I’ve started using it, I’ve probably had only half a dozen spam still get through. But they were really tricky messages; the senders had revised the subject lines and changed the spellings of words, so I wasn’t surprised they got through,” Rohl said.

Although spam-related complaints accounted for only a small percentage of reports to the CITES Help Desk during the past couple of years, Terry Wilson, Help Desk manager, said the complaints were significant “because of the strength of the emotions behind them. It’s a very personal issue. There’s hardly anyone you could talk to who wasn’t a victim of the problem, and the handful of complaints that we did receive we knew represented lots and lots of people. Spam has been such a thorn in everyone’s side the past couple of years, and it’s just been getting worse. We’ve had people complaining bitterly that they just wanted help in filtering it out and avoiding it.”

Rohl agreed: “I get a lot of e-mails in the course of my regular day and having to weed through all the spam was just a nightmare.”

Thus far, nearly all the user feedback about the spam-control software has been positive, and some users “are tickled pink that they’ve got control of their inboxes again,” Corn said.

Rankin said one happy participant facetiously asked her to marry him after one of the CITES Spam Control workshops, and a grateful retiree gave her a 3-pound bag of Peanut M&Ms after an individual orientation session.

“That was even more welcome than the marriage proposal,” Rankin said.

Virus-laden spam attack slows but doesn’t harm campus e-mail system

By Sharita Forrest, Assistant Editor
217-244-1072; slforres@uiuc.edu

CITES Spam Control, in conjunction with the antivirus software that was activated this spring, helped minimize a recent attack on the campus e-mail system by the latest variant of the Sober worm, called W32/Sober.p, which menaced systems worldwide during the first week of May, including the university’s networks. Exploiting Microsoft Windows operating systems, the worm harvested e-mail addresses from users’ address books and sent itself to those addresses, bogging down networks with thousands of virus-laden spam.

At Urbana, “the worm pushed us to where it exposed a weakness in CITES Spam Control,” Corn said. When e-mail messages are sent to two recipients who have elected different spam-control policies, CSC breaks them into two separate messages. The system began bouncing those messages back and forth between the mail relay and the spam-control hardware multiple times, causing delays of up to several hours in e-mail delivery for some users.

After working with the vendor, CITES implemented a system patch to correct the problem and saw mail delivery quickly recover when it went into effect on May 6, even though the amount of virus-generated e-mail traffic remained high.

“We did see a significant increase in e-mail, probably 3 1/2 to 5 percent more mail than usual, and it was all virus mail,” Corn said. “In the last week, we’ve deleted approximately 130,000 to 140,000 copies of Sober and about 450,000 virus messages in total during the past month. But the last time we had one of these attacks, we had hundreds – if not a thousand – machines infected with the virus. And this time my staff have positively identified only two machines that were infected.”

To guard against similar incidents in the future, CITES staff members are investigating the possibility of modifying the e-mail system architecture to ensure that intra-campus e-mail would be delivered in a timely fashion independent of any externally generated messages going through the spam system and the mail relay.

Corn credited CITES staff members for their work in responding to the virus attack and in selecting and implementing the spam-control system during the past year.

All faculty and staff users have been issued e-mail invitations to activate the spam filter, Corn said. Students’ and graduate students’ accounts were to have been activated the first and second week of May, but CITES decided to delay sending invitations to the 42,000 student users until the Sober attack subsided.

Back to Index