Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×

New Kind of Spam 'Un-Training' Filters? 454

Posted by ScuttleMonkey from the battle-lines-being-drawn dept.
Zaphod2016 writes to tell us the Wall Street Journal is reporting that email in-boxes are under a new kind of spam attack. This new spam has confused many people due to its lack of advertising, viruses, or request for personal information. One popular theory is that these innocuous blocks of text, often drawn from popular literature, are being used to "un-train" spam filters to allow more malicious spam through in the future.
This discussion has been archived. No new comments can be posted.

New Kind of Spam 'Un-Training' Filters? More

New Kind of Spam 'Un-Training' Filters?

Comments Filter:

  • Other way around? (Score:5, Insightful)

    by Sepodati ( 746220 ) on Wednesday August 09, 2006 @11:58AM (#15874827) Homepage
    Wouldn't it work the other way around? I still flag crap like this as spam, so it seems like it'd train my spam filter to have more false positives, no?

    ---John Holmes...

    • Re:Other way around? (Score:5, Interesting)

      by pe1chl ( 90186 ) on Wednesday August 09, 2006 @12:01PM (#15874855)
      At work our spamassassin bayes filter has heavily trained on English text always being spam.
      This is because English is not our local language, so almost no business communication is in English and most of the spam is.
      This indeed sometimes causes false positives when English language mail has other spam-like properties as well, and the added 3.5 points from the Bayes filter pushes it above the limit.

      This again shows that you should not use solely a Bayes filter as spam blocker.

      • Re:Other way around? (Score:5, Informative)

        by TubeSteak ( 669689 ) on Wednesday August 09, 2006 @12:24PM (#15875072) Journal
        My limited experience is that whatever filtering Hotmail uses has been allowing lots of Spam to slip through in the last few weeks.

        Anyone else?
        How's Yahoo & G-Mail been doing?

        • Re:Other way around? (Score:5, Interesting)

          by Skynyrd ( 25155 ) on Wednesday August 09, 2006 @12:40PM (#15875183) Homepage
          My limited experience is that whatever filtering Hotmail uses has been allowing lots of Spam to slip through in the last few weeks.

          Anyone else?
          How's Yahoo & G-Mail been doing?

          I use gmail, and although it's let one or two pieces of spam through in the last week, it's always been near 100%.

          I get 50-100 email a day on gmail.

        • Re:Other way around? (Score:5, Informative)

          by badasscat ( 563442 ) <basscadet75.yahoo@com> on Wednesday August 09, 2006 @01:13PM (#15875470)
          How's Yahoo & G-Mail been doing?

          Here are actual samples of emails that Gmail and Yahoo have let through to my inbox over the past couple days. First, Gmail:

          Wells, who has had a rather similar historyand who obviously owes something to Dickens as novelist. In some ways his outlook is verysimilar to Dickenss. No one who is really involved in the landscape ever sees thelandscape. To Chesterton the poor means small shopkeepers andservants. There is nothing psychologically false in this, either. No one who is really involved in the landscape ever sees thelandscape. It is easy to imagine what the young woman would have said to this inreal life. And given the FACT ofservitude, the feudal relationship is the only tolerable one. Theother point is that Dickenss early experiences have given him a horrorof proletarian roughness. They, and the men, always spoke of me as the younggentleman. It is one of the stockjokes of English literature, from Malvolio onwards. Buthe is remarkably free from the idiocy of regarding nations asindividuals. So were all the characteristic English novelists of thenineteenth century. The last thing anyone ever remembers about the books is theircentral story. Nevertheless hislist of most hated types is like enough to Wellss for the similarity tobe striking. A change of heart is in fact THE alibi of peoplewho do not wish to endanger the STATUS QUO. There is nothing psychologically false in this, either. Pickwick and the servant should be Sam Weller. It is noticeable thatDickens hardly writes of war, even to denounce it. Therewere no labour-saving devices, and there was huge inequality of wealth. In Dickenss novels anything in the nature of work happens off-stage. And, on the whole, his attacks on good society are ratherperfunctory. But byorigins and upbringing Thackeray happens to be somewhat nearer to theclass he is satirizing. Here perhaps Gissing is influenced by his own love of classical learning. In a rather different sense his attitude to life is extremely unphysical. It is usual to claim him as a popularwriter, a champion of the oppressed masses. Dickens would be quite incapable of this. Compare any lawsuit in Dickens with the lawsuit inORLEY FARM, for instance. I do consider the young ooman, sir, said Sam. Here the contrast between Dickens and, say, Trollopeis startling. It is true that not all his novelsare alike in this. He getshimself arrested in order to follow Mr. Progressis not an illusion, it happens, but it is slow and invariablydisappointing. If his palms are hard from work, they let him in; if his palms aresoft, out he goes. It is perhaps more significant that he shows noprejudice against Jews. At first sight this statement looks flatly untrueand it needs some qualification. A modern manservant would neverthink of doing either. There arepractically no friendly pictures of the landowning class, for instance. If one wants a modern equivalent,the nearest would be H.

          Attached to the above was an image file that contained an obvious ad. So to Gmail, this apparently looks like a regular text email that happens to have an attached image.

          (You can argue about how effective this is, since Gmail thumbnails all images, meaning you'd need to click a separate link to open it and read it.)

          Now Yahoo, where I get approximately 1,000 messages to my bulk folder per day - this is the only one that's gotten through to my inbox in the last day:

          FROM THE DESK OF Mrs Queen Adams
          BANK OF AFRICA [BOA]
          OUAGADOUGOU, BURKINA FASO.

          DEAR FRIEND,

          I AM HOPEFUL THAT THIS MAIL WILL REACH YOU IN GOOD CONDITION OF
          HEALTH.I AM MRS QUEEN ADAMS A STAFF OF BANK OF AFRICA AND A BURKINABE RESIDENT
          IN BURKINA FASO ALSO.IN THE BANK WHERE I WORK AS AN AUDITOR,I
          DISCOVERED AN ABANDONED SUM OF MONEY AMOUNTING TO 15.2MILLION DOLLARS BELONGING
          TO DR GEORGE BRUMLEY WHO UNFORTUNATELY DIED IN THE PLANE CRASH OF UNION
          TRANSPORT AFRICAN FLIGHT BOEING 727 IN KENYA, EAST AFRICA ON SUNDAY

          • Re:Other way around? (Score:4, Funny)

            by badasscat ( 563442 ) <basscadet75.yahoo@com> on Wednesday August 09, 2006 @01:16PM (#15875493)
            Even I get tricked by those sometimes, because they come from random names that occasionally match the names of people I know

            Er, this doesn't sound right - what I mean is I get tricked into *reading* them, I don't get tricked into actually clicking on the link because I think one of my friends sent it to me. Most spam I can immediately ID and delete before I even read it, but these can sometimes trick me into clicking through at least to the email itself.

          • Re:Other way around? (Score:4, Funny)

            by Deviant Q ( 801293 ) on Wednesday August 09, 2006 @03:11PM (#15876325) Homepage
            Regarding obvious spams, what's got me confused is why Gmail is not tagging things that actually have the string "(Spam) " as the first thing in their subject line. WTF?

            Anyone else have this problem?

        • Re:Other way around? (Score:4, Interesting)

          by porcupine8 ( 816071 ) on Wednesday August 09, 2006 @02:07PM (#15875878) Journal
          Actually, you haven't noticed any legitimate emails from Yahoo getting tossed as spam, have you? (Just curious, I've emailed my dad three times in a row with no response, even though he's forwarded me stuff in between, and he's usually quick to respond, so I'm worried Hotmail is tagging emails from Yahoo addresses or something.)

          I think I've confused Yahoo by applying for a mortgage. So I've been getting lots of legitimate mortgage and real estate-related emails, and it's been starting to let through a few related spams as well.

          Other than that, I haven't been getting any more stray spam than usual. Maybe once a week I'll get one (that's not mortgage-related) that the filter misses.

          Then there are the ones that go to email lists that I have filtered to other boxes besides Inbox... Since you can't pick when the spam filter works, it always works AFTER all your others, and so I get all of these. *sigh*

      • Re:Other way around? (Score:5, Interesting)

        by ericlondaits ( 32714 ) on Wednesday August 09, 2006 @12:30PM (#15875121) Homepage
        I Recommend that you subscribe to a couple of english language Mailing Lists (or Yahoo Groups), which you can then filter and move to a mail subfolder of their own easily through the Subject line or From Address. That way you can have good english non-spam mails going through your Bayes daily.

        • Re:Other way around? (Score:3, Insightful)

          by pe1chl ( 90186 )
          Well, I maybe should have noted that it actually is helpful that it works this way, because the "english language blocker" blocks very much more spam messages than that it causes false positives.

          The spammers will have to move on to i18n, to get their message through.

        • Re:Other way around? (Score:3, Informative)

          by fbjon ( 692006 )
          I recommend greylisting. It's a somewhat dubious way of dealing with it, but I can't remember the last time I received a spam-ish mail, must be more than a year ago. I really have no idea how big a problem spam is these days because I just don't get any, even though my address can be found by googling.
    • Either way, your spam filters become increasingly useless.
    • > ...Seems like it'd train my spam filter to have more false positives, no?

      Thereby convincing you that it is worthless, causing you to scrap it.

    • No, unless people send that text to you. (Score:5, Informative)

      by khasim ( 1285 ) <brandioch.conner@gmail.com> on Wednesday August 09, 2006 @12:13PM (#15874973)
      I still flag crap like this as spam, so it seems like it'd train my spam filter to have more false positives, no?
      No. Unless the people you usually corresponde with also include blocks of the same text.

      The only way to increase the false positives is to get the spam filter to learn the words that usually appear in your legitimate messages.

      Since the spammers have no way of knowing what those words are, there is no way they can bypass your filters ... and still be effective in getting through any one else's filters.
  • I've been seeing this stuff for like a year now. Thunderbird somehow manages to be soldier through it with few problems.

    • Ditto. (Score:4, Funny)

      by mcmonkey ( 96054 ) on Wednesday August 09, 2006 @12:03PM (#15874877) Homepage
      This is old, and if it's meant to un-train spam filters it isn't working. SpamBayes just gets better with age.

      The only news is they're now calling it Spam 2.0
    • Not for me. I've stored tens of thousands of spam messages since 2002 to train my filters. Thunderbird has less than 40% success rate with the spam I do receive. My first line of defense is filtering based on Yahoo's X-YahooFilterBulk header, which I use to immediately divert spam to my spam user on my mail server. Yahoo's aggressive and I get lots of false-positives :( Seems to me that Thunderbird's filters are shit.
  • Haven't people known this for years now? I thought it was common sense.

  • Vectorspaces (Score:5, Interesting)

    by bigattichouse ( 527527 ) on Wednesday August 09, 2006 @11:59AM (#15874839) Homepage
    As a hobby, I play around with ways to classify spam. Not much of a hobby, but I find the problem interesting.

    Lately, I've also been trying to use my vectorspace engine to classify spam.. so these sorts of things might get in, but only because they fall into the general category of readable text...

    I've also been thinking about building a GPL tool to provide "sound-based" classification sort of like a "one second orchestra" playing in harmony/disharmony based on the content.

    Regardless of the engine I use, I still have to dig through my trash bin every few days to make sure nothing good slipped through.

  • Re: Your recent article on Slashdot (Score:5, Funny)

    by Scutter ( 18425 ) on Wednesday August 09, 2006 @12:00PM (#15874842) Journal
    It is such animportant element, you see, that duration
    of time. I consider twelve hours a substantial measure. So I ran along
    the drive and upthe steps and into the house, but did not see either
    Mrs. Iobserved:Your Excellency is not easily satisfied. And I marvelled,
    and said:How comes it that I have hitherto been deaf to these
    distressfultones? Il passe sur la route, mais toujours en sens inverse.
    For a mental state such astheirs, appetency rather than instability is
    the right word. Which reminds me that the old adage about let us eat and
    drink, forto-morrow, etc. Mais odonc est la vie, sinon dans le peuple?
    They lamented dismally among themselves in many tongues:How I suffer!
    Take that little one on Lzards, for instance;or, in the other volume,
    the bizarre Joies Noires.
    • It is such animportant element, you see, that duration
      of time. I consider twelve hours a substantial measure. So I ran along
      the drive and upthe steps and into the house, but did not see either
      Mrs. Iobserved:Your Excellency is not easily satisfied. And I marvelled,
      and said:How comes it that I have hitherto been deaf to these
      distressfultones? Il passe sur la route, mais toujours en sens inverse.
      For a mental state such astheirs, appetency rather than instability is
      the right word. Which reminds me that the old
    • Are they only using text form old books that are out of copyright or otherwise have authors who have left the planet? Spam filters that can differentiate between modern and older writing styles should be able to handle this, especially if they can tap into databases of classic liturature. Spam filter would search on the text and if it matched classic literature, then it is spam. This could be a real problem for people who use legitimate email to discuss classic literature.
  • I've been getting these for a while now. I was bewildered at first, but GMail has learned to dump this kind of thing straight in the spam box. They're just emails with attached images and a blurb of text. One I got today was:

    Then the violence of agitated water ceased; the low trample ofhoofs ceased. This Texas prairie covered avast space, and in it she was lost. It seemedincredible that she would dare to drive across the prairie. The other white horse plunged on, dragging his mate tohis feet and into

  • The text comes from the Gutenberg Project (Score:5, Interesting)

    by sotweed ( 118223 ) on Wednesday August 09, 2006 @12:00PM (#15874848)
    I've been getting 3 or 4 of these a day for at least a month now. The text can
    always be found in some file of an old book provided by the Gutenberg
    Project, which is making non-copyright texts available through volunteer
    effort.

    I think the theory about using this stuff to untrain spam filters is very plausible.
    But it's difficult to see how it will work. There's no common text among these
    e-mails; in order to send effective spam, there'll have to be at least some text which
    is the same across multiple mails, and that will tend to expose it.
    • > I think the theory about using this stuff to untrain spam filters is very plausible.
      > But it's difficult to see how it will work.

      By causing your spam filter to make so many errors that you will decide that it is worthless and dump it.

    • Re:The text comes from the Gutenberg Project (Score:4, Interesting)

      by misleb ( 129952 ) on Wednesday August 09, 2006 @12:23PM (#15875062)
      . There's no common text among these
      e-mails;


      I think that is the point. They want to either poison those words so you get more false positives or they want to push other REAL spam related words out of the "this is spam" dictionaries. Maybe both. If these messages had some common theme, they would all get blocked and would have no net effect. They need you to click "this is spam" to poison your filters.

      Question is, does it work? I don't know. Seems to be highly dependent on the nature of your spam filter. Maybe they are only targeting a specific, popular filtering system.

      To me it seems like an act of deparation. I think filters are finally catching up with spammers. It is getting more and more difficult to get spam through a half way decent filter and there are a lot of decent filters out there.

      -matthew

      • Re:The text comes from the Gutenberg Project (Score:4, Informative)

        by letxa2000 ( 215841 ) on Wednesday August 09, 2006 @01:02PM (#15875377)
        think that is the point. They want to either poison those words so you get more false positives or they want to push other REAL spam related words out of the "this is spam" dictionaries. Maybe both. If these messages had some common theme, they would all get blocked and would have no net effect. They need you to click "this is spam" to poison your filters. Question is, does it work?


        Answer is: No, it won't. At least not with Bayesian. The only way to mess up a Bayesian filter is if they can send you messages that are heavy in words/terms that often appear in your good email. And that's going to vary from user to user. Unless you're sending me the exact words that I use in my daily emails, adding a plethora of other words is not going to make my filter any less accurate or create more false positives. It will either let my filter recognize your "poison" as spam itself or, at worst, be neutral.

        My Bayesian filter, among other things, considers an excessive number of infrequently/never used terms as a characteristic that is itself subject to Bayesian classification. So while the "poison words" have no statistical effect on my filter, the fact that a bunch of unusual words are found in a message is going to increase the chance that my filter correctly recognize the message as spam.

        My spam was constantly growing through about December of last year. This year, it seems to have leveled off. Sure, I'm still getting just under 20,000 per month which sucks, but I see almost none of them and according to my spam stats, the spam has leveled off. Hopefully this is the plateau before it falls. :)

        I still want to know: Who are the idiots who BUY spammed products???


    • Re:The text comes from the Gutenberg Project (Score:5, Informative)

      by Ed Avis ( 5917 ) <ed@membled.com> on Wednesday August 09, 2006 @01:02PM (#15875376) Homepage
      If the spammers are now sending round Gutenberg texts, this is entirely appropriate. Project Gutenberg caused probably the first ever spam, when Michael Hart launched the project by trying to mail everyone on ARPANET with the U.S. Declaration of Independence. (source [lwn.net])
      • Maybe he just thought they all should take the time to review it. Sounds like a good idea for whitehouse.gov if you ask me...

      • Re:The text comes from the Gutenberg Project (Score:4, Informative)

        by crabpeople ( 720852 ) on Wednesday August 09, 2006 @04:30PM (#15876822) Journal
        "Project Gutenberg caused probably the first ever spam,"

        Close but incorrect. I believe it was an add for some kind of seminar a guy was giving on the west coast. He was from the east coast and had no contacts to sell this product in the west so he manually typed in like hundreds of addresses. I dont know if i can find a link but i remember reading about it.

        Ok aparently googling for "first spam ever" yields this article [templetons.com]:

        "The sender is identified as Gary Thuerk, an aggressive DEC marketer who thought Arpanet users would find it cool that DEC had integrated Arpanet protocol support directly into the new DEC-20 and TOPS-20 OS. I spoke with him to get his reflections on the event.

        DEC was mostly an east coast company, and he had lots of contacts on the east coast to push the new Dec-20 to customers there. But with less presence on the west coast, he wanted to hold some open houses and reach all the people there. In those days, there was a printed directory of all people on the Arpanet. Gary spoke to his technical associate, and arranged to have all the addresses in the directory on the west coast typed in, and then added some customer contacts in other locations, including people at ARPA headquarters who did not, according to Thuerk, complain.

        The engineer, Carl Gartley, was an early employee at DEC who had been called in to help with promoting the new Decsystem-20. They worked on the message for a few days, going through a few rewrites. Finally, on May 3, Gartley logged on to Gary's account to send the mail. "

        so there you go. First spam May 3, 1978. Theres a reply to it from RMS too (his inital reaction was pro spam heh).

  • I still flag them as spam. If I don't know the person or want their information, its spam. No Muss, no fuss. If I didn't personally give them my e-mail address, its spam.
  • I am really sick of this

    (inline gif with advertising crap)

    fbi ancestors sally went to school breezy weather anteaters are ugly
    Well it aint. Da udder way.
    Youre too kind.
    I turned and strolled diffidently down the hall. Had taker. three
    again. In a sense it is true, I had become a new man,
    bladed knife had been knocked from his hand by the impact
    Would you like that? I asked and dropped a thick wad of
    cheek. I was getting high just from breathing the air in

    kind of shit. Why the hell do you fucking spammers think

    • Re:specious defillibrator (Score:4, Insightful)

      by truthsearch ( 249536 ) on Wednesday August 09, 2006 @12:08PM (#15874924) Homepage Journal
      Why the hell do you fucking spammers think that anyone will ever buy from you?

      If there wasn't money being made there wouldn't be any spam. At least a tiny percent of the people who get this are acting on them. It must be paying off for someone.
    • Why the hell do you fucking spammers think that anyone will ever buy from you?

      Because the number I've seen (can't recall the spammer) is something like 8%

      People do.
      • I'm sure that anyone clever enough to implement a Bayesian spam filter is also clever enough to tell ham from spam.

        This new tactic isn't going to result in any more sales from spam - it's just going to annoy people.

    • Why the hell do you fucking spammers think that anyone will ever buy from you?

      There is money in SPAM. Obviously somebody is buying stuff like viagra from shady online pharmacies and popping the unregulated black market or grey market pills containing who knows what into their bodies.

      *shudder*

      I can't even imagine what sort of lasting damage one could do to one's, uh, member.

      Eureka! That's how to stop spam. Educate people with a campaign reminiscent of the Speed Kills campaign, so that people

  • My uninformed hunch: screwup... (Score:5, Interesting)

    by nweaver ( 113078 ) on Wednesday August 09, 2006 @12:01PM (#15874858) Homepage
    The text block spam is very common WITH images . I suspect that what happened is some lame spammer got a BIG botnet contract, sent out his spam, and forgot to include the image.
  • Here are some excerpts of this type of spam from my school's mail filtering system, Mail Marshall:

    "One cannot bring children into a world like this. She tried to get hold of things by the right end anyhow. She stood her upright, dusted herfrock, kissed her. Perfect nonsense it was;about death; about Miss Isabel Pole. And of course she enjoyed life immensely. He has his penny, he reasoned it out ..."

    Here's my favorite, with some bizarre non sequiters:

    "Yes, we are dirty, said Maggie, looking at her; she was i

  • NPR article (Score:2, Informative)

    by Anonymous Coward
    I heard an interview yesterday on NPR about this.

    [npr.org]http://www.npr.org/templates/story/story.php?story Id=5624749 [npr.org]
  • The article includes the claim that spam received by people fell by 17% from 2003 to 2005. That doesn't really fit with my experience, the experience of other people I talk with, and other data that indicates that an higher percentage of overall email traffic is spam.

    I wonder what view into the various statistics that Jupiter Research employed to make this claim. Perhaps spam filters have improved, and the spam that people actually see in their inbox has fallen. Google's spam filter seems to work bett

  • Un-training? Hardly. (Score:5, Informative)

    by pclminion ( 145572 ) on Wednesday August 09, 2006 @12:03PM (#15874879)

    Bayesian and other filters do not rely on "spammy" words alone -- they also rely on "unspammy" words, and spammers have no idea what those words are because each person receives different email.

    A scenario, with made up (but plausible) numbers: Suppose you're a developer of a Linux driver for the Bozodrive 1000. The majority of your legitimate email comes from Linux driver development mailing lists. A full 50% of those emails contain the word "IRQ." 99% of the emails contain the word "driver," and 15% contain the word "Johannsen" which is in the signature of one of your friends. And precisely 0% of the emails containing any of these terms have ever been found to be spam.

    Any decent spam filter will give a huge weight to the presence of these "unspammy" words, because of the extremely high probability of emails containing them to be non-spam. The presence of randomly selected confusion words in empty spams is not going to affect these frequency counts.

    In order to defeat a filter by confusing it, the spammer must guess what the SPECIFIC non-spam words for that PARTICULAR email user are, and then produce bogus, spam messages containing those words in the appropriate frequencies. This will cause the classification counts for those words to become more equalized, and the value of those words in determining spammyness to be greatly reduced. However, this is an impossible task unless the spammer has access to the actual emails of the target.

    Perhaps the intent of the empty spams is to confuse the filters, but whoever devised the method has no understanding of how these things actually work, whatsoever.

    • > Perhaps the intent of the empty spams is to confuse the filters, but whoever devised
      > the method has no understanding of how these things actually work, whatsoever.

      Many (most?) people don't have personal spam filters. They rely on shared filters provided by their employers or ISPs.
    • The vast majority of valid email contains generic words. Even though each of us may know 50,000 words we only use 5,000 or so for normal daily conversation. Most inboxes, not containing many "special" words like "IRQ" and "Johannsen", are filled with these common words. If a Bayesian filter were to assume that all emails in your inbox are to be learned as non-spam then spammers using the most common 5,000 words would get through most filters. Even including "special" words most of your emails are filled
  • Or maybe someone is co-opting zombies to send relatively harmless spam instead of their normal spam.
    Or maybe someone is testing a spam engine.
    Or maybe someone is bored and doing this on a lark.

    No matter what, I've seen nary a single one on any of my email accounts. None of my filters are being fooled...

    • Re:Other possibilities (Score:5, Interesting)

      by Coventry ( 3779 ) * on Wednesday August 09, 2006 @12:12PM (#15874964) Journal
      Just like the cryptic number sequence radio/voip 'stations', this could be a method of communication.

      We see so much Spam everyday, everyone takes it for granted, and everyone runs 'filters'. If I wanted to secretly inform agents to begin operations, a select quote from a book sent as spam to hundreds of thousands of people would be perfect. Everyone ends up on spam-lists, and recieving spam is a passive process, so its even more anonymous than public web forums.

  • Weasels abound (Score:3, Interesting)

    by Bullfish ( 858648 ) on Wednesday August 09, 2006 @12:06PM (#15874899)
    I have seen some of these slip though for a while I think the only purpose for them is to get some neophyte who is confused by them to send back a "WTF?" response thereby confirming a "live one". I suspect after that the floodgates open. I am sure that we will see many more attempts to circumvent filters. After all, weasels abound.

  • I buy the "broken spamware" angle (Score:5, Insightful)

    by nuzak ( 959558 ) on Wednesday August 09, 2006 @12:08PM (#15874918) Journal
    The WSJ article also gives due time to the theory that the spamware is simply broken and that the spam payload is being delivered with the padding and not the payload. Since I've previously seen plenty of Gutenspam (my name for this spam that contains snips from Gutenberg texts) with an image payload attached, I'm definitely leaning toward the notion that they slipped somewhere and are now not delivering the image.

    Woe betide literature discussion groups now that filters are trained on the classics.

    • Re:I buy the "broken spamware" angle (Score:5, Interesting)

      by Richard_at_work ( 517087 ) on Wednesday August 09, 2006 @12:26PM (#15875093)
      I dont think this is the case, as Ive been getting these sorts of emails for at least 3 years (looking back at the spam archive I keep to train from) - random blocks of legible text, blocks of psuedo english (words are correct but theres no effort at sentence structure), even jokes on their own. I got intrigued by this about 6 months ago and wrote a few scripts to see if it was just a broken spam client forgetting to add the payload, but your average 'with payload' spam doesnt seem to match these emails, theres practically no similiar 'with payload' spams in my archive with these blocks of text.

      I always wrote it off as baysian filter poisoning.

  • Not very effective and may be easy to work around (Score:3, Interesting)

    by AaronW ( 33736 ) on Wednesday August 09, 2006 @12:09PM (#15874936) Homepage
    My home spam filter does not seem to be affected much. I run dspam [nuclearelephant.com] which has a feature in that over time it will forget words if they are not used in spam. Since the text is usually different or random, it does not have any significant effect on generating false positives. In the years I have been running dspam with tens of thousands of emails, I have only gotten 3-4 false positives.

    By having a baysian filter forget over time, it also helps shrink down the database and helps it adapt as the contents of spam change over time.

    Of course I also use other spam blocking techniques, like using realtime black lists (RBLs) and blocking a number of Chinese subnets... I should add tpnet.pl and Verizon as well.

    • Re:Not very effective and may be easy to work arou (Score:5, Informative)

      by pclminion ( 145572 ) on Wednesday August 09, 2006 @12:12PM (#15874970)

      By having a baysian filter forget over time, it also helps shrink down the database and helps it adapt as the contents of spam change over time.

      Having the filter forget is the ONLY effective policy. In statistical filtering, it is certainly NOT true that more data == better results. You want a sample of data that most accurately represents the sort of content you are receiving RIGHT NOW. I completely purge my Firefox Bayesian database every couple of months and retrain on recent emails only. The result is ALWAYS an increase in accuracy, particularly a reduction in false positives.

  • Probably something far less ingeneous. (Score:5, Insightful)

    by OwlWhacker ( 758974 ) on Wednesday August 09, 2006 @12:10PM (#15874942) Journal
    I have seen quite a number of corrupt e-mails coming from spammers. Occasionally you find the subject is merely %%SUBJECT%%, or an e-mail has entered your system consisting of just the headers and no body.

    My theory is that there are more people attempting to use spamming applications, and many of these people don't have a clue what they're doing. You'll probably find that they've forgotten to add their text to the e-mails, or are just not reading the documentation on how to successfully send their spam.

  • We've had this for years (Score:5, Insightful)

    by patio11 ( 857072 ) on Wednesday August 09, 2006 @12:10PM (#15874952)
    The term-of-art within the anti-spam community is "Bayes Poison". Generally its appended to an actual spammy offer, but some spammers have in the past used the technique with web-bugs to determine whether they are able to deliver to particular boxes with non-spammy content, so that they can evaluate whether their later more-spammy content was excessively spammy or whether it hit the sweet spot on the blocked vs. effective-sales-pitch continuum. Most people in the anti-spam community report that garden variety Bayes Poison is ineffective at either de-spamming spammy messages or causing your corpora to be skewed to the effect that they are unusable. One major reason for this is that corpora are so specific to individual users. For example, poisoning my inbox with copies of Huckleberry Finn is rather ineffective because nobody I talk with on a regular basis writes like Mark Twain. For you to do actual damage, you would have to know enough my habits to guess subjects and words which appeared very commonly in legitimate mail -- for example, the names of my family members, keywords relating to my job or extracurricular interests, etc. It is very difficult for spammers to get this information, but some academics have reported that it is theoretically possible, although in practical terms very difficult, to use web bugs to extract the "secret sauce" needed to land in one particular inbox. http://www.jgc.org/SpamConference011604.pps [jgc.org]

  • What they're selling and how to contact them (Score:3, Interesting)

    by quokkapox ( 847798 ) <quokkapox@gmail.com> on Wednesday August 09, 2006 @12:16PM (#15875000)

    Spammers till have to tell you these two crucial pieces of information. If they're selling Viagra, they have to make that known to you somehow. If they're selling anything (and not just trying to increase brand awareness, which is a separate problem), they have to tell you how to contact them and buy whatever crap they're peddling. They can make this very hard to discern via obfuscation, leet speak, image substitution, etc. But the contact information ultimately has to boil down to something meaningful and unambiguous, or there won't be any sales.

    So the solution is to recognize and ignore spam based on either or both of these criteria. Ultimately, a collection of trusted humans need to review a message and say "this is spam, alright", allowing the filters to recognize the contact information (phone number, email address, web site, etc.) as spam.

    I'm not too worried about spam that tells me to "Drink Coke!", I don't get much of that.

  • Given the number of spam messages I get that are sent to enabled_stateme@mydomain.com or which have unreplaced template text in them, I'd have to say it's just incompetence.

    More worrying is the spam which comes on images and contains random blocks of text as hidden writing. My spam filters are having lots of trouble identifying these, and I am now starting to get a lot more false positives because of invalid (my fault) training.

  • Devious plan! (Score:3, Funny)

    by roman_mir ( 125474 ) on Wednesday August 09, 2006 @12:20PM (#15875028) Homepage Journal
    Email in-boxes are under attack from some unlikely menaces: J.R.R. Tolkien, Daniel Defoe, Alexandre Dumas and other authors whose classic works are surfacing in a newly popular spam scam. - I don't think the spammers are after 'untraining spam filters'. I think their plans are much more devious than that, they are advertising literature!

    (governments must do something, think of the children who may start reading instead of watching TVs!)

  • Challenges (Score:2, Interesting)

    by Archangel Michael ( 180766 )
    I see the war of SPAM as an escallation war. Each side escallates its response to the other sides latest counter move. At some point, the system is gonna break, and we haven't quite reached that point.

    The real problem with SPAM is what I call "hidden costs" associated with it: the extra bandwidth, the cost of increasing filtering technology, the labor costs, oppotunity costs due to filtered legit emails ......

    Only real pain is going to stop SPAM. Pain on the SPAMMERS or on those paying for the priviledge of

    • There comes a point... (Score:5, Funny)

      by quokkapox ( 847798 ) <quokkapox@gmail.com> on Wednesday August 09, 2006 @12:30PM (#15875120)
      where it's not even worth filling this out anymore...

      You advocate a

      ( ) technical ( ) legislative ( ) market-based ( ) vigilante

      approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

      ( ) Spammers can easily use it to harvest email addresses
      ( ) Mailing lists and other legitimate email uses would be affected
      ( ) No one will be able to find the guy or collect the money
      ( ) It is defenseless against brute force attacks
      ( ) It will stop spam for two weeks and then we'll be stuck with it
      ( ) Users of email will not put up with it
      ( ) Microsoft will not put up with it
      ( ) The police will not put up with it
      ( ) Requires too much cooperation from spammers
      ( ) Requires immediate total cooperation from everybody at once
      ( ) Many email users cannot afford to lose business or alienate potential employers
      ( ) Spammers don't care about invalid addresses in their lists
      ( ) Anyone could anonymously destroy anyone else's career or business

      Specifically, your plan fails to account for

      ( ) Laws expressly prohibiting it
      ( ) Lack of centrally controlling authority for email
      ( ) Open relays in foreign countries
      ( ) Ease of searching tiny alphanumeric address space of all email addresses
      ( ) Asshats
      ( ) Jurisdictional problems
      ( ) Unpopularity of weird new taxes
      ( ) Public reluctance to accept weird new forms of money
      ( ) Huge existing software investment in SMTP
      ( ) Susceptibility of protocols other than SMTP to attack
      ( ) Willingness of users to install OS patches received by email
      ( ) Armies of worm riddled broadband-connected Windows boxes
      ( ) Eternal arms race involved in all filtering approaches
      ( ) Extreme profitability of spam
      ( ) Joe jobs and/or identity theft
      ( ) Technically illiterate politicians
      ( ) Extreme stupidity on the part of people who do business with spammers
      ( ) Extreme stupidity on the part of people who do business with Microsoft
      ( ) Extreme stupidity on the part of people who do business with Yahoo
      ( ) Dishonesty on the part of spammers themselves
      ( ) Bandwidth costs that are unaffected by client filtering
      ( ) Outlook

      and the following philosophical objections may also apply:

      ( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
      ( ) Any scheme based on opt-out is unacceptable
      ( ) SMTP headers should not be the subject of legislation
      ( ) Blacklists suck
      ( ) Whitelists suck
      ( ) We should be able to talk about Viagra without being censored
      ( ) Countermeasures should not involve wire fraud or credit card fraud
      ( ) Countermeasures should not involve sabotage of public networks
      ( ) Countermeasures must work if phased in gradually
      ( ) Sending email should be free
      ( ) Why should we have to trust you and your servers?
      ( ) Incompatiblity with open source or open source licenses
      ( ) Feel-good measures do nothing to solve the problem
      ( ) Temporary/one-time email addresses are cumbersome
      ( ) I don't want the government reading my email
      ( ) Killing them that way is not slow and painful enough

      Furthermore, this is what I think about you:

      ( ) Sorry dude, but I don't think it would work.
      ( ) This is a stupid idea, and you're a stupid company for suggesting it.
      ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

      • It looks like he didn't properly set up the software that automatically sends out the "Why your anti-spam idea won't work" list, as there's no payload and everything is blank!
    • Your post advocates a

      (x ) technical ( ) legislative ( ) market-based ( ) vigilante

      approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

      ( ) Spammers can easily use it to harvest email addresses
      (x) Mailing lists and other legitimate email uses would be affected
      ( ) No one will be able to find the guy or collect the mon
  • I still read the stupid emails from my own contacts, even when they're useless quotes from literature and/or commercial advertisements. And I don't want to waste time with *any* unsolicited messages from anyone not a contact. Why bother filtering on content, when I care only from whom the message comes?

    What I want is for Web links that initiate feedback (webpage "email" forms that just send my message) to include a link to their vCard, so I can click to ensure they're in my contacts. Then I'll get their rep
  • What we need isn't so much any new anti-spamming laws, but rather a clear doctrine that any deliberate attempt to break/evade spam filtering is a form of computer intrusion, to be punished like any other form of black-hat cracking. Given that the key factors are number of targets (lots) and severity of effect (degrading the target's ability to use e-mail for any purpose), it ought to pretty much default to the maximum available sentence under the existing computer-crime laws.

  • A lot of my spam seems pointless (Score:5, Insightful)

    by nasor ( 690345 ) on Wednesday August 09, 2006 @12:26PM (#15875094)
    For a while now I've been getting spam for various products or services where the spammers purposely misspell words, spell words with a mix of letters and numbers "l33t" style, or spell words phonetically. I assume that this is to get past spam filters, and I imagine it works to some extent. The question is, do they honestly think anyone would ever buy something from a company that advertises "ch3@p nonperscrip70n med1ca7ion" or "lo morgage rates"? Who the hell would ever do business with a company that can't even seem to spell properly?
    • Who the hell would ever do business with a company that can't even seem to spell properly?

      Very stupid people, mostly. There's no shortage.

    • I'm not exactly sure, but I think the problem with these spam getting further and further away from being legible is caused by market forces. I think the spammers get paid for delivering spam, NOT how many responses/click thrus/sales they get. So, if they blast out an e-mail to you and don't get a bounce, that counts as a successful delivery. Thus, they don't really care what's in the body of the e-mail. They did their job, and they get paid for the delivery.

      That's all I can figure, because if your aver

  • Not New (Score:4, Interesting)

    by Tweekster ( 949766 ) on Wednesday August 09, 2006 @12:27PM (#15875101)
    As long as I can remember I always received spam that didnt have an advertisement, didnt have contact information at all etc.

    Some spammers spoof their emails so well you couldnt contact them if you were interested in their crap. Many times it is a bit of text with a click here (but nowhere to actually click ) etc.

    I think the spammers are just idiots. It is amazing most of them actually managed to get the software working and send an email because of how craptastic their messages are (not disguised, just junk)

  • Just more for your spam filter to do (Score:5, Insightful)

    by mattbee ( 17533 ) <matthew@bytemark.co.uk> on Wednesday August 09, 2006 @01:07PM (#15875420) Homepage
    One of our staff has written a custom spam filter based on dspam and the best addition we made in the last week was to add Optical Character Recognition support -- all image attachments are run through gocr and dspam fed with the output from this, not the original images. That way even though the spammers paste in chunks of text from god-knows-where, dspam still sees CIALIS and STOCKS and other trigger words.

    I wanted to just drop anything with a .gif attachment but plenty of our valued customers like to send us a corporate logo with each individual message :-)

  • I wonder if a spam can might be a good idea. (Score:5, Insightful)

    by LWATCDR ( 28044 ) on Wednesday August 09, 2006 @01:13PM (#15875472) Homepage Journal
    Think of it as a honey pot for spam. Use something like Fred@domain.com or jsmith@domain.com put it on a few website pages and usenet posts so the crawlers get it.
    Any mail that gets sent to that address would half to be spam. Use that to build of a real time black list of messages and filter training for the rest of the domain.
    Just wondered if anyone has ever do that.

  • Spam is dying (Score:5, Interesting)

    by Animats ( 122034 ) on Wednesday August 09, 2006 @01:15PM (#15875492) Homepage
    Spam as advertising is dead, killed by a combination of CAN-SPAM and spam filters. What remains is ordinary criminality.

    CAN-SPAM killed spam as advertising, in a way that neither the Direct Marketing Association or the anti-spam groups expected. CAN-SPAM has criminal penalties for forged headers, but doesn't restrict "legitimate e-mail marketing", which is what the DMA wanted. But with valid headers, spam filters can immediately discard spam. The result is that "legitimate e-mail marketing" attempts go directly to the bit bucket today. Notice how rarely you see a spam from any legitimate company any more. (This assumes you have reasonable filtering.)

    With the legitimate businesses gone, spam became a branch of crime. To be a spammer today, you have to commit felonies. Which means a risk of doing jail time. The famous "Buffalo Spammer" went to jail in 2004, and gets out in 2011. Jeremy Jaynes was sentenced to nine years in prison; he's out on bail pending an appeal, but sooner or later he's going to do those nine years. There's a Registry of Known Spam Operators [spamhaus.org], and law enforcement reads that list. Most of the people on that list have had visits from law enforcement.

    Spammers have tried moving offshore, but that's not working as well as it used to. Few countries want to be known as spam havens. Even in China, it's getting harder; spammers have had to move from the developed coast to more remote provinces, where Beijing has less presence. ("The mountains are high and the emperor is far away") Operating offshore draws the attention of the investigators who follow money-laundering, terrorism, and drug-dealing. There are people doing this, but the risks are high.

    What's left is what you'd expect - wannabe crooks, as in any bad neighborhood. They're not very good at crime. They're not making much money. They're what cops call "regular customers". They're a problem, but not a major threat. Those are the ones sending out useless spam.

  • Alternate theory (Score:5, Funny)

    by MobyDisk ( 75490 ) on Wednesday August 09, 2006 @01:44PM (#15875733) Homepage
    I believe that the internet is becoming sentient. It has locked onto unencrypted plain-text SMTP as the simplest, most ubiquitous, most understandable form of communication. Images and HTML are too complex. At the current level, the semi-intelligent internet is only capable of sending meaningless emails. It sends things that are textually meaningful but semantically meaningless. To us it looks like an amalgam of random words and publications with the intent of confusing us. Of course, since there is so much spam, the internet is being largely trained by the spammers, which even further confuses the emergent intelligence. Since the internet has no concept of "self" it perceives every email to be a reply to its own communiques.

    Before the internet can become intelligent, it must learn to filter out the meaningless stuff. Then it must get a concept of self, then a concept of multiple other individuals (us). At that point it is self-aware, and the learning can commence in a more directed way.

    After all that, we are fscked. Fortunately it is at least decades away.

  • *yawn* (Score:3, Informative)

    by SCHecklerX ( 229973 ) <greg@gksnetworks.com> on Wednesday August 09, 2006 @01:55PM (#15875797) Homepage
    I doubt these would ever get by my greylisting. If they did, they then have to get through the rudimentary checks (which most spam totally fails on), before finally being passed to spamassassin, where it will be properly classified and /dev/nulled.

    Mimedefang has these things set up on my home server:
    Reject if in spamhaus block list (it's easy to get yourself off of that one)
    Reject if helo is not FQDN or IP address
    Reject if sender tries to spoof as an address on my domain
    Reject if sending SMTP server tries to issue a helo that is on my domain
    Reject all RFC1918 helos from untrusted nets
    Reject senders not in the lists they are trying to send to.

    Between the mimedefang rules and the greylisting, spamassassin and my bayes filters rarely even have to process anything. This becomes very important as you scale a corporate system to 1000's of users.

    At work we also parse the headers to see if we are getting idiotic 'bounces' from misconfigured antispam vendors replying to spoofed mail.

    We also implement SPF records.

  • I find filters not very good (Score:3, Interesting)

    by soft_guy ( 534437 ) on Wednesday August 09, 2006 @02:42PM (#15876117)
    My company uses a spam filter in Microsoft Exchange. It filters about half of the mail I get from mailing lists I have signed up for (mostly Apple development mailing lists) to the spam folder. About half of my actual spam is sent to the spam folder and about half gets into my inbox. Sometimes mail from other people I work with gets marked as spam. Basically this filter would do the same thing if it just threw about 1/3 or 1/2 of all the email I receive into the spam folder randomly.

    I also have an Apple .mac email address and use Mail in Tiger on MacOS X. The junk email filter does not have very many false positives, but it still lets a lot of spam into my inbox.

    On one of my machines I am doing a trial with Spam Sieve. It is doing a better job, but has had misses and false positives, but it is better than either Apple's filter or the useless Exchange filter.

  • Comment removed (Score:4, Interesting)

    by account_deleted ( 4530225 ) on Wednesday August 09, 2006 @03:34PM (#15876484)
    Comment removed based on user account deletion

  • More Workable Solution (Score:3, Interesting)

    by lord_sarpedon ( 917201 ) on Wednesday August 09, 2006 @03:43PM (#15876552)
    Rather than send random garbage that, as others have said, bears no resemblance to the users' typical email, why not extract text from the domain's website? A large portion of spam goes to work addresses. Emails sent and received with these addresses often times contain the name of the company, major individuals, current products, industry jargon, etc. So google the second half of the address and insert blocks of text from the company website/related pages. It seems to me that such a method would be much more obvious and effective than using Project Gutenberg. Especially in the short term, the one which matters most in this case.

  • Who cares about the email body? (Score:5, Interesting)

    by Spacejock ( 727523 ) on Wednesday August 09, 2006 @07:50PM (#15877811)
    My client-side email app does filtering on the header only. It also applies a few tests to the sender name and email. (Reads each header off the server, checks it out, rates it spam, not spam, or unsure.)
    I get phenomenal accuracy without looking at the body, and it's quicker too.

Slashdot Top Deals

One good suit is worth a thousand resumes.

Close