Slashdot Log In
How Image Spam Works
Posted by
ScuttleMonkey
on Wed May 16, 2007 01:11 PM
from the it-wasn't-me-i-was-framed dept.
from the it-wasn't-me-i-was-framed dept.
Esther Schindler writes "CSO Magazine has an article about "The Scourge of Image Spam," with an explanation of its effect (a year ago, fewer than five out of 100 e-mails were image spam; today, up to 40 percent are in that category, and image spam is the reason spam traffic overall doubled in 2006). You might already know about that, ho-hum. But what's even cooler is a interactive graphic page which demonstrates the various methods used by image spammers and how it works."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Spam? (Score:4, Funny)
I haven't had any spam in years.
Re: (Score:3, Funny)
What is this thing you speak of? I use elm for an e-mail client.
Re:Spam? (Score:5, Interesting)
Parent
Re:Spam? (Score:4, Informative)
The inbox can be configured to have a single item selected at random from one of a number of RSS feeds, I have mine configured to show Routers oddly enough and slash.
The area marked for webclips is a custom feed from www.recipesource.com
If you look on your trash folder, you also get tips about recycling.
The other folders give standard syndication adverts.
More info here [google.com]
Parent
So what? (Score:5, Interesting)
The reason? Simple:
Statistical spamfiltering of any kind -- bogofilter, in this case -- is creepily accurate.
Recently, I lost my bogofilter database (due to my own stupidity). It took one day for it to get back to 95% accuracy, and another day to get up to 99%, with one false positive -- the first I had seen in about six months.
Parent
Re: (Score:3, Insightful)
Re:tutorial? (Score:5, Insightful)
If we'd stuck with text only email....no problem with images.
Oh well....back to trying to install Win 95 on an abacus.....
Parent
Here's how it works from another perspective (Score:5, Insightful)
Re:Here's how it works from another perspective (Score:4, Insightful)
What sort of a brain-dead moron would actually fall for spam? There can't be many people that dumb surely?(I hope....)
Parent
Re:Here's how it works from another perspective (Score:5, Insightful)
Then again, they've got to be coming to the intersection point between "Dumb enough to buy v1@gra from a spammer" and "Too freaking stupid to use a computer or have any money".
Parent
Re:Here's how it works from another perspective (Score:5, Funny)
Parent
Re:Here's how it works from another perspective (Score:5, Insightful)
I once made a calculation that if every person on the Internet responded positively to precisely one spam, that would be enough to make spam wildly profitable. Granted, that was a few years ago, but bandwidth (and therefore spam) has only gotten cheaper and bot nets more prevalent (making spam cheaper still).
You don't have to go too far down the left tail of the bell curve to make up for the folks on the right half. After all, in terms of positive response, the best the folks in the right half can do is respond positively to zero spams. The further you go into the left tail, the more likely you are to run into people who respond positively to spam on a somewhat regular basis. The cut-over line for "responds to spam" vs "does not respond to spam" can be pretty far into the left tail and still have spam be profitable.
Making matters worse, negative responses to spam rarely do anything to the spammer. Instead, they just annoy IT departments into implementing ever heavier spam filters. Every so often somebody gets sued, but it's hardly enough to make a real dent in things.
Parent
Re: (Score:3, Insightful)
The other problem is that offers of sex or money tend to make people stupid.
Re: (Score:3, Informative)
Enough to pump and dump penny stock [npr.org], it would seem.
Re:Here's how it works from another perspective (Score:5, Insightful)
There are actually three parties involved in spamming: the merchant, the spammer, and the victims/recipients. The merchant is the trailer trash dude who fished a case of expired viagra out of some pharmacy's dumpster. He wants to sell it online and make a fortune. So he hires a spammer who agrees to send out 10,000 emails for $60.00.
Whether or not the merchant makes a single sale has no effect on the spammer. The spammer made his money just by sending the crap emails out. And the supply of idiots with get-rich-quick schemes is virtually infinite, guaranteeing the spammers a never-ending stream of fools willing to hand them $60.00 apiece.
This means we'll probably be fighting spam until the world runs out of greedy idiots.
Parent
Re:Here's how it works from another perspective (Score:4, Interesting)
On an unrelated note, has anyone else noticed a huge drop in the effectiveness of greylisting as a spam countermeasure? I used to receive close to zero spam messages up until 2-3 weeks ago and suddenly they're flooding me! Any hint?
Parent
Re:Here's how it works from another perspective (Score:4, Insightful)
Parent
Where is Chris Hansen on this? (Score:5, Insightful)
I wish that somebody would do a TV show like "To Catch a Predator" except that they would go after the people who buy spam. Embaras them a little.
"Hi, I'm Chris Hansen from NBC. Why don't you have a seat there. Why are you here sir?"
"uh well I, I'm here to see a friend."
"You're here to have your penis enlarged aren't you?"
"no, no, I'm just here to hang out."
"Sir this is an email that we sent to you advertising penis enlargement. You clicked on this email."
"omg, is this on TV??"
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
ABC did this with 419 spammers. They actually went to to Nigeria and found a spam operation running there. They were able to contact some of the people who sent money and interviewed them to ask why they fell for the scam. Summary: the "victims" were universally dumb, poor, and avaricious. Definitely at the extreme end of the bell curve.
Re: (Score:3, Insightful)
Re:Here's how it works from another perspective (Score:5, Funny)
So that's why they are buying penis enlarging pills
Parent
Re: (Score:3, Insightful)
No, they don't. Even if no one ever bought a single item that was advertised by spam, the spam would still be sent. That's because there are two people involved: the seller and the spammer, usually not the same person. The spammer convinces the seller that a spam campaign will increase sales, and the seller pays the spammer to send them. It doesn't have to be true, it only has to be convincing.
Re: (Score:3, Interesting)
You would not believe how many times I receive as a forwarded message from my customers a piece of spam that promotes "OEM" software at 90% off asking me "Should we get this?". The Adobe CS3 for $90.9 instead of $999, for example.
I reply to such clients with an explanation of what OEM software really is and how it's different from unlicensed software.
Not every one of the spam recipients has someone like me with whom to consult, so I'd imagine the spammers are making a de
It's A Turing Test (Score:3, Insightful)
For me it's not image spam, it's botnet traffic... (Score:5, Informative)
What has been killing me recently were the fucking botnet "attacks" sucking my DSL's bandwidth with those douchebags hitting me with a GET and an immediate POST for tons of URLs all over my site. Their referrer was http://www.google.com/ [google.com] and for a few hours I couldn't figure out how to stop that w/o stopping Google search referrals too.
Some nice guy in #apache helped me out with:
SetEnvIfNoCase Referer "^http://www.google.com/?$" BadReferrer=1
SetEnvIfNoCase Referer "^http://www.google.com/?$" BadReferrer
order deny,allow
deny from env=BadReferrer
That has been returning 403s to the botnet which apparently stop such frequent attempts when they receive the error. I was getting hit with their shit every 4 to 5 seconds all day yesterday and now they are "pinging" me with attempts every hour or so. I don't know if it's a different botnet or the same one trying to get back in but that was the most effectual way to drop the huge spam traffic I was receiving but couldn't ban due to the wide range of IPs.
Botnets fucking suck
Re:For me it's not image spam, it's botnet traffic (Score:5, Interesting)
I run a webserver on my home connection, all it hosts is MythWeb, and it is password protected. I am the only person who should have to access it, and am on a dynamic IP address (not a problem I thought when setting it up, and have been very successfully using DynDNS.) About a year ago my IP address was changed to a new one, as it happens. My internet was going as slow as molasses about 10 minutes later, although I just thought it was a temporary thing with my connection. The next day it is even slower, and so I begin to investigate - I perform a speedtest and get very good results for download (but not perfect), but almost no upload. I thought this was odd and checked with my ISP to make sure there were no known issues with the connections in my area - there were not. So I then plugged my modem directly into my computer and it was still happening (which made me think it was something with my ISP, as it affected my router and my computer), and so I then clicked on my bandwidth monitor to see what speeds I could get, and before doing anything there was a constant stream of about 100kb-150kb of downstream traffic. And so I plugged the internet back through the router (I was running a software firewall by the way, so I considered bypassing the router safe).
I then looked at my webserver logs, and it took forever to load. So instead I did a "tail -f" on the error log. I must have been receiving hundreds of requests per second for websites that were nothing to do with me. It was scrolling so quickly I could not read entries as they went past. Examining it more closely I realized what happened: the owner of the IP address before me had been running an open proxy on port 80, and when the IP address changed all their requests were redirected to me, killing my much slower connection (from all the 404 responses apache was sending). So I closed port 80 for a week, and my connection returned to a somewhat normal state. However, I was still receiving about 20 requests a second, despite being offline (seemed mainly to be people trying to do dos attacks through a proxy). After a month this was down to only 1 or 2 a second, and it has remained like that till today.
Because of your post I checked my webserver logs, and at 1:27:18am I received my last request for a website, and looking into it my IP address changed to a new one (only took a year), and so some other unfortunate person is now receiving a few requests a second to be a proxy server.
Parent
FTFA (Score:3, Informative)
This is easy enough to defeat. Ignore all emails that aren't plain text.
Re:FTFA (Score:4, Interesting)
Parent
Re: (Score:3, Insightful)
My only use of HTML mail is for sending links. A very long url will wrap around on
Re:FTFA (Score:4, Interesting)
Seriously, I once read something about using OCR software to "read" images that come through in e-mail to make sure that they don't contain stock spam or penis pump messages. Who thinks this is really necessary? Has anyone you know really gotten so frustrated with the limited font choices in regular e-mail that they started composing their messages in Photoshop?
Trained Bayesian filters seem to have no problem at all spotting image spam.
Parent
Re: (Score:3, Interesting)
That was the day OCR as antispam became real irrelevant for me. They also figured resolution filters are coming, they immediately started to randomise gif resolutions by 1-5 pixels. There goes that method
Re: (Score:3, Interesting)
A Key Point (Score:5, Interesting)
The key point they're missing is that it works under the assumption that a very small part of the populace doesn't recognize this as spam. These people then think that an investment firm decided to tip everyone off and they mistakenly buy the stock so that it goes up a nickel only to watch it drop shortly after the spammer drops the stock.
What's ironic is that I'll bet there's people out there with money that know this scam but buy the stock to also cash in on people who think this is a real tip. It might even be that the initial assumption is wrong and that the only people scamming each other are scammers trying to take advantage of another scammer's scam. Scam. Oh, the irony if that's the case. Either way, the article mentions the SEC removing stocks that went up that were junk stocks in spam mailings!
It's a scam. Stay away and alert your loved ones if you think they may fall into the initial category of the small part of the populace. The safest way to stop spam is to alert people and teach them how to identify it.
You don't buy stock that an angry fruit salad told you was hot just like you don't sleep with the girl who leaves dead spots of grass where she sits on the corner. Awareness is a valuable key to our solution against spam.
Pretty easy to filter (Score:3, Informative)
What about captcha-busting software? (Score:4, Interesting)
Of course, I just read all my mail as plain text, so this is a non-issue as far as I'm concerned.
Re: (Score:3, Insightful)
Re:What about captcha-busting software? (Score:4, Insightful)
This is directly related to a realization I just had (you almost had it yourself.) Image-based spam is fucking brilliant but not just because it works. There is a secondary effect - a positive one for the spammers.
Right now the strongest weapon in the defense against web spam is the CAPTCHA. Most of them depend on obfuscated text to defeat machine recognition.
Spammers lack the resources to effectively defeat CAPTCHAs permanently through technology. Their current solution is to use a network of humans, ala Amazon Mechanical Turk, to solve them. Computers are simply bad at doing this, but this is largely because we have not figured out how to make them good at it.
By using the same techniques to obfuscate spam as the rest of us use to create CAPTCHAs, they ensure that someone else will do the work of defeating text obfuscation-based CAPTCHAs in order to better recognize and classify spam.
I'm sure I'm not the first to have this realization (at the bare minimum, spammers have realized it) but I think it's a pretty good one.
Parent
Use a manual rule to block it (Score:3, Interesting)
So use a manual rule to block these messages, discarding them on the basis of how they're put together.
If *all* of the following conditions are met:
Any attachment name contains
+ Content-Type contains multipart/related
+ Sender is not in my address book
Move message to "Junk".
http://www.hawkwings.net/2006/12/20/another-maila
It's a problem even if you don't get it (Score:3, Interesting)
Funny, I haven't noticed (Score:3, Insightful)
The biggest front on the war against spammers is simply educating non-experts on the existence of effective filters. Plus, we should be chiding companies like Apple and Microsoft for providing impotent filters. I think they purposely make crappy filters to avoid pissing off big companies (spammers.)
The more they try to fool the machines... (Score:3, Interesting)
Image Spam? (Score:4, Informative)
GIF SPAM (Score:5, Interesting)
For months, we had consistent problems with clients e-mails (using a major ISP I won't mention here) not reaching our server. Curiously, it would happen most often with replies to our original e-mails.
After months of anguish and highly accusatory phonecalls to the ISP's tech support, we discovered the problem. Our company e-mail signature contains GIF images. When a client replied to us, quoting the original e-mail, the ISP would scan the e-mail, detect the inline GIF, and block the e-mail.
Since we changed the format of our signature to use JPEGs instead of GIFs, we've had no problems with the ISP blocking client replies.
So once again I assert: the biggest problem with spam isn't even the spammers, it's the n00b sysadmins who implement agressing spam-blocking rules before thinking about the consequences. I'd rather get more spam that have legitimate e-mails blocked by false positives.
"The first thing we'll do is kill all the spammers..."
Re: (Score:3, Informative)
Defenses against OCR:
* Throw in pixel noise
* Alter colors (I don't really understand this one other than insufficient contrast)
* Alter geometry enough to throw recognition algorithms off
* Give each letter a different font/position/geometry so adaptive OCR doesn't have enough samples to adapt.
* Split up images into layers of multiple images such that no single image has, by itself, any text
It's a very interesting article. We're going to have to make b
pump-n-dump (Score:5, Funny)
Parent
Re: (Score:3, Informative)
Are they? Hardly any of it gets through my Spamassassin filter. There was a period back last October 2006 or so when I got a lot, but SA caught up. I did have to add a little weight to "image only" rules, but so far I've been able to filter the vast majority of it out.
-matthew
Re: (Score:3, Informative)
Works for me. Must be your browser.
Here is TFA for all those who can't read it in its current form:
Image Spam: By the Numbers
By Scott Berinato
Image Spam--an e-mail solicitation that uses graphical images of text to avoid filters--is not new. Recently, though, it reached an unprecedented level of sophistication and took off. A year ago, fewer than five out of 100 e-mails were image spam, according to Doug Bowers of Symantec. Today, up to 40 percent are. Meanwhile, image spam is the reason spam traffic overall doubled in 2006, according to antispam company Borderware. It is expected to keep rising.
1. GIF Layering
Just as word splitting divides words into multiple images to elude spam filters (see number three), an image spam can be divided into multiple images. Like the transparent plastic overlays in Gray's Anatomy, pieces of a message are layered to create a complete, legible message. In this rudimentary example, the spam is divided into three pieces (cut in the middle of letters for added obfuscation). But one message could comprise as many as a dozen layered GIFs.
2. Optical Character
Recognition Duping Optical character recognition (OCR) is the closest to sight that computers get. OCR works by measuring the geometry in images, searching for shapes that match the shapes of letters, then translating a matched geometric shape into real text. To defeat OCR, spammers upset the geometry of letters enough--by altering colors, for example--so that OCR can't "see" a letter even as the human eye easily recognizes it. The effect is something like blurred characters in an eye test.
3. Word Splitting and Ransom Notes
If OCR catches up to the color tricks in image spam, a spammer's next defense is word splitting. By dividing the image and leaving space in between the pieces, any image the OCR engine is examining is only a piece of a letter with its own distinct geometry. Instead of word splitting, some spammers have employed a ransom note technique in which each letter in the spam message is its own image, and each letter image includes background noise and other baffling techniques. A program cobbles together randomized letter images to make words. The effect looks like a classic ransom note with a mishmash of letters cut out from magazines.
4. Geometric Variance
Many filters can intercept mass mailings based on their sameness. Images, though, can be altered easily without disturbing the message inside them. Thus one spam message will arrive as dozens of differently shaped images, and each time the colors of the text images will have changed, as will the randomly generated speckling and pixel and word salads. No two images are alike despite the fact that they carry similar messages. Shown are two radically different images containing the same stock tip. The technique is popular as a scheme to boost prices of low-value stocks. In March, the SEC suspended trading on 35 such stocks that were the subject of these image spam messages, including some whose prices rose.
5. Speckling/Pixel Salad
Confetti-like speckles don't affect the legibility of the necessary information but make every message unique to confuse a filter looking for patterns or high volumes of identical images.Similarly, a bar of randomly generated color pixels can contain the vast majority of the image data. To a filter it's full of patternless noise. We can see the words in the message while the image at the bottom doesn't bother us.
6. Hyperlink Elimination/Word Salad/Animated GIF
Filters have improved their ability to find and trace spammy URLs and then block the message based on the inclusion of a bad link. To get around this, spammers will ask recipients to type the URL into their browsers.Other methods include word salads, text passages, often taken from classic novels, to confuse Bayesian filters and weighted dictionaries that rely on complex math or word scoring to determine the probability that some combination of words is spam. The filter sees predominantly natural text it can't flag as illegitimate.Another technique used to bypass filters consists of programming a GIF to slowly overlay its layers to create an animated GIF, similar to GIF layering. Here, with www.dvarx.com, each letter is a GIF layer. As they are stacked, it looks to the eye like someone typing in the letters into the address bar.
Re:Ideas? (Score:5, Funny)
Spam filters are going to have to get to be as good as an informed human being before they can stop all spam regardless of what tricks they use.
I just hope AI gets to that point before it goes all sentient... you know:
"DESTROY ALL SPAM"
...computing...
"SPAM COMES FROM HUMANS"
...computing...
"DESTROY ALL HUMANS"
Parent
Re: (Score:3, Insightful)