Okay, yes, thank you for the introduction and so we just noticed actually that when we looked at our talk again that we're talking about this advanced security and our experience with how to share.
We didn't even mention that we're doing it with our SPMD.
So, yes, so we are doing this with our SPMD and yeah, let's start.
So, hi again, we are from Highline, Highline Consulting and we're doing the May Projects there together with our colleagues.
I want to do a little step back.
So, you know, first of all, we shall use this slide with an infrastructure.
Most of the part is not important.
What I want to show here is that when there's an MTA, we also have an SPMD proxy in South.
So, this is why at every hope, we call SPMD for maybe it has some tasks to do.
If it does not have any tasks, we just say, okay, pass.
This is, this we are doing because we have brought many, many of our policies into SPMD.
So, the obvious practice was you installed an MTA.
You will have your rules.
Okay, this should not be an unknown domain.
So, the domain should be set up.
Should not be listed on an RBL.
So, this we have done all in post-fix and over the years, we switched all this policy things.
All things, what we have something to do with about spam reputation and anything into SPMD.
So, our post-fix today is just a mayor router.
So, and what we do in SPMD.
This is what sets something about bias is not perfect.
Also, GPT is not perfect.
I can say there are many, many other routes there, not perfect.
So, our idea is to get many, many indicators.
Any kinder is means, okay, we have done an RBL check.
This is IP is listed.
We have done some regular expressions and something hit.
We have done bias.
We have done GPT.
Maybe there is also neural network inside us from the itself.
And what we like to do is to find many, many indicators for spammingness or heminess.
Because then we can summarize in the end and have a very good decision if we want to
maybe drop the email because it's spam or want to let it through or any other action.
This is why we concentrate on our spamD here.
So, what we noticed is that generally when we have all of these indicators like data like RBLs
and which has been collected worldwide through spam traps or some older mains or or that this kind of what we would consider
is the global spam.
And your particular spam is only a small part of that.
And so the intersection with this global spam can vary between 10 to 90% according to our experience.
What we're looking at is a group of customers which are similar customers like different universities or different
government authorities and they, their personal spam actually did not coincide.
So what we then did notice is that if you look at several within those groups like different universities have much more
in common and different also customers within the government authorities have much more in common.
And this let us think that it would be great to share this experience of what has been already detected as personal spam
with peers that have a similar like where you are the similar target group.
And so that was that was the idea on how why we came up with this sharing sharing and sharing within those groups.
Yeah, what we, what we share for now is fuzzy.
As visitors had so buys is more person to say you cannot share it's so good.
buys is a statistic, a statistic, a statistic over words they together in one email like by Viagra.
Fuzzy is a different algorithm here.
It's based on shingles so you can have like after running this algorithm you have the intersect of two text of two text.
So you can fuzzy can say those two emails match on in 99%.
So maybe one word has changed.
So it's perfect to to match on a very specific email.
Also the fuzzy implementation in Aspen B was designed for spam trips or honey pots.
This is why we have some weight in it.
So when you learn maybe one text one once.
It has a very, very low weight and it has to cross a specific threshold.
You can define it maybe let's say our threshold is 30.
Then this email has maybe been seen this 30 times and then this hash activates.
When it activates, the score is growing up to maximum amount.
For Aspen B is typically 12 points from 15 where the default reject level is.
Also Fuzzy has a feature to have different categories.
So in bias you only have it's on the ham side it's on the spam side.
There's nothing in between.
For Fuzzy you can define your own.
Typically in the default installation you have spam, ham and some think it's gray, gray something.
But you can also do your own like you want.
Like having another one for bulk emails full newsletter.
Also you can learn positive things.
Like emails you get again and again like typical invoices you get in or something.
You can build up those databases here.
So the Aspen B Fuzzy worker, this is the one who is managing all this hashesus.
And this is the network service normally you would spin it spin up this locally and you could put in hashesus and query it to get the actual results back.
The Fuzzy worker also summarizes and calculates source thresholds source weights they come in.
And so actually to the Aspen B typical register database.
When you have when you want to run a honey pot you would use this worker when you have a local installation I would definitely.
I would recommend you you have a look to it.
Yeah, so what is that is so this this this Fuzzy check plugin is able to not only communicate to one of those Fuzzy workers but actually to many so.
And this gives us this ability that we were talking about so.
Visilot and our Spendee also offers a service where you can have this you can have a subscription of this Fuzzy plus or something like that.
You can have your own local Fuzzy or.
Yeah, exactly enabled by default but if you hit the limits then you can also have a subscription and then you can have your own.
And then we also thought of the idea of having this as another option.
The shared Fuzzy.
Yeah, so.
What is important though is that you have you follow the same concepts and configuration with the people that you share your Fuzzy worker with that.
So for us it is often easy we recommend our customers who we have which are in the same field.
We have somebody else who has a very similar installation and there it would work well and.
And because it is very important that you have to avoid to learn falls positives.
Yeah, one way to learn falls positives in the terms of Fuzzy is that you use high scoring instead of reject.
In our Spendee to stop an email so say I get an extra file and say oh it's not allowed and I'll give it 99 points.
Yeah, then I will learn the content of the email and not and not just rejected and therefore then I have all of the text.
And that is the learned and this could then be seen as a false positive.
Also.
Way back here, so it's perfect when when you maybe want to use our Ansible roads because there we have prepared all those.
All those policies and everything and.
Way where we have all put us in like an X of file when when when your policy is we don't accept X of files as as attachment then there's a rule a force rule which rejected.
If it looks spammy gets a high score that's it's a principle of it and also we have a little custom script which which is.
Which is doing some more checks which email could be learned and which should be maybe not be learned because it's looks could be a false positive.
And on our customer side so when we have like two universities having having rolled out with our Ansible scripts they have nearly the same policies and in the end they had at least the same the same style of counting spent.
And then it's very easy to to let those also post in the same database of fuzzy hashes or what we see later maybe also other ideas.
Yeah, when when you have multiple multiple custom customers or users posting in one database those threshold should be higher when you when we now say okay for person and one you may be say it's 30 for.
Like a shared one you go with 100 or something like that so yeah so this kind of image should be seen very often at the one part or should be seen multiple times at different parts then it's.
Yeah, the things what we do like very much like to do is to cut the maximum score of different groups this very easy and ask me you can say okay.
The group RBL so when you have a very bad IP it's listed in spam house a music spam call and there and there so those those scores would normally.
So you would learn this email only because it's listed in every RBL when you have the fourth positive in source RBL then then you learn it just because of that.
So this is why we cut the maximum score in in those groups like here for for fuzzy we have implemented something the default fuzzy 12 default reject score is 15.
So we have done now a group so any all fuzzy databases together so all those summits could have a maximum score of 17 so it's still over the reject level but they're also.
Other summits which may be lower the score again.
What we have done the local fuzzy what you still learn next to your shared fuzzy has also a max score was as shared fuzzy for maybe about.
I think we have now.
Another idea would be to share something like appear reputation data.
Very much very much data we shared for every email so our idea is to to maybe use an HTTP API and not post every spam email we got was all it's made a metadata like a peer addresses domains and what we see but.
As well as a very nice plug in very generic and very flexible plug in called reputation and in the end it's nothing nothing more than calculating the median score for.
For all email it's seen with this where you and this would could be a very good point to share also this data in a at a send report and calculate also new reputations all of that.
Yeah, what we have seen also in the previous talks is about that stuff sometimes takes a while especially with the LMAs and so users think that mail is real time communication.
I don't know why we have this need for the deep analysis of potential threats and the analysis of tools are slow or really slow and so for the clam maybe it can take more than 10 seconds for a very complex PDF or we also have some this office macro stuff that does maybe we even have a sandbox.
I mean then we're talking about minutes and we want to maybe decrypt and and and so despite that there are these there they specialize open source tools for for all of those.
I'm extra things that are available for I mean this sandboxing office macro and file analysis.
We we we actually wanted to bring in this concept of a second stage like that we can't initially already decide if that email is good or not yeah so we're talking about.
The question is why is this important nobody you so a normal company is going on the market okay I I have checklists to do and.
I have so I need some some kind of compliance thingy and they they go to some of the commercial.
vendors for for cent boxes fire I all the antivirus.
developers in and on say they all have boxes you can buy there's a pricey but you can put it in your network push push your data HTTP data in and they do it for you.
what we wanted to do is to analyze emails preaker before accepting the email into my infrastructure.
Because as long as as I rejected before before reaching my network it's it's not my mail I'm I'm not.
I'm responsible yeah so and in the end it's easy to do because we're doing it we have done it for for years.
We are we are soft rejecting emails just because of their we didn't know their IP address in from all the database and the thing is we are doing the same here we are doing like a pre flight check in us maybe that could be if it's fast enough antivirus could be a small local check.
And if we decide in the end with all those indicators again that we want to have a second look deep a deep analyzes we posted to the second stage scanner.
In the second stage scanner we can have now those sandboxes file analyzes which can also run for minutes or you would have done macro offices long term GPT runs queries all other stuff.
Yeah so the problem is that the time and the cost already explained that we can actually circumvent it by using this greatest thing and.
That we also I mean our spendee users I'm our spendee things in milliseconds yeah users in seconds and so we can already see that here this all the tools is already flag does it's a slow and able slow timer yeah it's more than 300 milliseconds.
And so so with this idea we have this possibility of actually doing this thorough scan when needed.
So the typical great typical software jack gives us four five more minutes normally and and in this time we we can we can perfectly find two sandboxing you can do sandboxing in in one minute this is what what all the commercial vendors are saying but but there are all those tricks for for sandboxing so like.
One of those trorians is doing nothing for the first two minutes or so so so you you may you want to invest some some more seconds in that.
Yeah that's already said as I think.
So when when the email comes back at the second time we require is a second stage scanner again and getting a full report based on you.
On this report we can then decide what to do with the email.
We can still reject it we can accept it.
How we like.
Yeah also expected data could be pushed back into the second scan of our spendee like IP addresses domains address and everything and could be then queried again against.
That's what we're talking about.
Yeah last slide it it seems.
What what's the status of this product we have implemented it is running in production.
The second stage scanner let's say it's it's a productive POC.
It's it's running nicely.
But let's say sandboxing was more effective in the in the time of a motive currently we we don't we don't find so many threats what all.
We have found not many threats which are not also covered by anti virus.
But let's see what's what's happened in the next time again.
Thank you.
Okay.
Any registration here one two three four okay five.
I'm waiting for.
Okay.
You will.
Yes.
So the question whether we defer mail and keep it why we scan for longer time so we can.
And if and the question if that is legal comes up so basically we haven't decided.
Yet if this actually is a proper email.
Yeah so during the scan process.
We are during the email process we we're waiting until the data and then we can see if we have the early indicators and if we haven't decided yet then we say we don't know come back later.
And if they're not coming back later we're not doing anything with that email we'll never be delivered.
Yeah so we will not deliver an email that we say we did we we defer.
Yeah so in that sense.
Yes.
Maybe the question was we we if deferment mail and we keep the data in our memory.
Yeah.
So we have.
Of a hardest which is running full and it's a time and it's it's a temp file is is staying there it's.
It's a state so when you when you really want to go into it.
It's it's a.
I'll say.
Great area maybe.
Yeah.
So.
Yeah but this just about the security.
So that's if you want to go through the second stage and then we can second question is can you have a few words and certainly try this in.
Concerns as far as sharing.
Okay so the first question was what fraction of emails go to the second stage scanner and then the second was.
if we can share a few words regarding privacy with fuzzy hashes.
So, this is configurable.
We can see what kind of indicators we want.
So, definitely we will not want everything.
It's an email that looks like perfect ham should not go.
And these thresholds are configurable.
And it is up to us to decide what needs another look.
The question is, what's the typical order of magnitude for this?
The second stage is going to be invoked.
So, what we have done, we never sent attachments which are on the bend list.
Also, there were many white listed ones like signatures and stuff.
And we sent over there what can be possibility for being dangerous.
Office files, PDFs and all this stuff.
We are saying that I do use that we can production.
So, that's some data of all of this stuff.
We sent it of mail is being sent there to the second stage of incoming.
I don't know.
We can get back to you with the statistics there.
And the second question, and maybe also the last because running out of time,
will be a words on privacy with these fuzzy hatches.
I think you cannot calculate back what's what the text was.
But the privacy is always an issue.
You have to think about if you query data against
the external databases.
So, when you do query hatches, attachment hatches against the spam house area,
it's the same.
So, spam in the end, spam house could have view where this may come from.
If you simplify and set it to me, and we have both the same area, then.
So, the database then knows that you have sent me something.
Okay.
Two very quick questions for you.
The second stage, we would like you to go fishing.
Yes.
The question was if we have for the second stage,
would you say that QR code fishing?
Yes.
There was all this in QR codes, OCR, and so on.
This was what this was called Cortex, and so.
They are those multi-file analyzer, say,
they have plug-ins for everything, like that.
So, yeah.
So, send this to generate the body at the same time.
So, if you can give them a four-minute error,
you would come back half an hour later with a ticket for it.
Just that, though, off your.
The question was when, when the email is generated on the fly,
and the body is maybe different on the next try,
when we, when we're software eject the email,
the second stage scanner is mostly based on attachments.
Okay.
Thank you very much.
Yes.
Thank you.