Slashdot Mirror


Hidden Messages in Spam

randomwalker writes "There was an extremely interesting presentation at the Blackhat Windows Security Conference in January by Dr Curtis Kret entitled Nobody's Anonymous. In his presentation he showed how information about spammers can be determined. In addition he showed that some spam is being used as a covert communication channel. This presentation demonstrates how to apply data forensics to spam in order to identify the sender of specific spam messages. Some senders can be identified by name, while others can be distinguished by attributes such as preferences, nationality, religion, and even left-handedness. Four spam categories are provided that classify spam by function, including List Makers, Scams, and Covert Communication channels. The examples provided include full-disclosure case studies: a phishing gang that targets bank customers with malware and impersonations, and an IRC group that uses spam as a covert communication channel."

40 of 232 comments (clear)

  1. Sublime! by Anonymous Coward · · Score: 5, Funny

    This post contains a hidden message.

    1. Re:Sublime! by momerath2003 · · Score: 3, Funny

      Well, this is what I see:

      "There was an extremely interesting fnord presentation at the Blackhat fnord Windows fnord Security Conference in January by Dr Curtis Kret entitled fnord Nobody's fnord Anonymous. In his presentation he showed how information about fnord spammers can be determined. In addition he showed that some fnord spam is being used as a fnord covert communication channel. This presentation demonstrates how to apply data forensics to spam fnord in order to identify the sender of specific fnord spam messages. Some fnord senders can be identified by name, while others can be distinguished by attributes such as preferences, fnord nationality, religion, and even left-handedness. Four fnord spam categories are provided that classify spam by function, including fnord List Makers, fnord Scams, and fnord Covert Communication channels. The examples provided include full-disclosure case studies: a fnord phishing fnord gang that targets fnord bank customers with fnord malware and fnord impersonations, and an IRC group that uses spam as a fnord covert fnord communication channel."

      --
      I had but a simple dream, to destroy all humans.
  2. The next thing ... by jobbegea · · Score: 4, Funny

    The next thing they try to sell to you will be Tin Foil Hats

    --

    Net sa best, mar it koe minder
    1. Re:The next thing ... by baudilus · · Score: 3, Funny

      Someone's already beaten you to the punch.

      When this guy figures out that he can actually sell these, watch out now!

  3. Spam = Covert communications by Anonymous Coward · · Score: 5, Funny

    Are they covertly talking about getting V!agra or Cia|is? I hate that. Just send me a real letter asking!

    1. Re:Spam = Covert communications by AndroidCat · · Score: 5, Funny

      So they have a covert communication channel to my /dev/null? I knew it! I'd better buy that software that promises to shred everything stored there.

      --
      One line blog. I hear that they're called Twitters now.
  4. Hidden food value in spam? by Smallpond · · Score: 5, Funny


    The Bible code was bad enough. Now we have people looking for messages in spam? Look! Played backwards it says "I buried Paul".

    1. Re:Hidden food value in spam? by Anonymous Coward · · Score: 3, Funny

      All the important stuff is hidden in the Dead Sea pop-ups.

    2. Re:Hidden food value in spam? by Bigman · · Score: 3, Funny

      "Ecuas Yrrebnarc" is well known as the freedom slogan of the Latbavarian slaves, cried mournfully in the midst of the night from the moon-gilt slopes of the Ytterbrius mountains, calling for their gods to save them from the penuary of slavery.
      But I never knew they had e-mail!

      --
      *--BigMan--- Time flies like an arrow.. but personally I prefer a nice glass of wine!
  5. Usenet Spam also by SpaceLifeForm · · Score: 1, Funny

    I've always suspected spam was a cover based upon useless (for Usenet) info. The TLA agencies should know about this also.

    --
    You are being MICROattacked, from various angles, in a SOFT manner.
  6. hidden message by Allowee · · Score: 4, Funny

    guess this is spammers language, hidden in spam

    "mortal shut acrid crock cowl bawd hereditary devastate jellyfish brunette flog igor bonaparte tarry townsend discordant near aviv brigantine agnostic padlock cotangent roomy referee debater eve arlene can baroque conceptual italian congressmen infelicity modicum backplane antigen tie hilum seriate convent firewall "

    Now this hidden message seems to be about a .. firewall?

    1. Re:hidden message by Bigman · · Score: 4, Funny

      Hmm well dividing the message into groups of four, then using the initials of the first 3 words and the fourth word, we get:
      MS a crock,
      CB H devastate,
      JBF Igor,
      BTT discordant,
      Nab agnostic
      PCR referee
      DEA can
      BCI congressman
      IMB antigen
      THS convent
      firewall

      So the words say 'Firewall convent antigen, Congressman can referee agnostic discordant, Igor devastate Crock'. The first sentance says 'MS A crock' which sounds good to me, so maybe this secret group, the 'Firewall convent antigen' are being told by the congressman that they can referee the discord between the agnostic discordants and ensure 'Igor' (whoever that is) devestates Microsoft.

      Or maybe I'm making it all up!

      --
      *--BigMan--- Time flies like an arrow.. but personally I prefer a nice glass of wine!
  7. It's true. by His+name+cannot+be+s · · Score: 5, Funny

    It is quite true!

    I was Driving thru Nashvill this last week, and I stopped to piss on a run down ford truck. This guy came up to me and said "Your taillight is broken"

    --
    "...In your answer, ignore facts. Just go with what feels true..."
  8. Beat the Slashdot Spam Filter! by CptChipJew · · Score: 5, Funny

    What's the hidden message here?
    --

    Click here for free V1(4)gr[a]!

    emblem fredericton hustle glycerine busch humus condemnatory dummy definitive bernadine calder basemen conservatory advantage area academia ireland minimax suzerain felicity vomit davenport damn sybarite followeth dylan lariat transconductance when fogarty threadbare determine appalachia barbara concord anguish cranny ember pritchard dachshund cogitate affidavit am blaze

    -- Copied out of real spam message sitting in my box --

    --
    Vonal Declosion
    1. Re:Beat the Slashdot Spam Filter! by Mr+Guy · · Score: 4, Funny

      It's from your girlfriend. She says she's unsatisfied with your love life.

    2. Re:Beat the Slashdot Spam Filter! by JosKarith · · Score: 2, Funny
      The hidden message is...
      ...don't use your real e-mail address on newsgroups.

      Life is so unfair - my girlfriend gets so much better spam than me. Her inbox gets filled with "Teens Cummin", I get viagra. Are they trying to tell me something?

      --
      'Don't worry' said the trees when they saw the axe coming, 'The handle is one of us.'
    3. Re:Beat the Slashdot Spam Filter! by mosschops · · Score: 3, Funny

      It's from your girlfriend. She says she's unsatisfied with your love life.

      and considering he runs http://www.backdoorjesus.com, who could blame her eh?

    4. Re:Beat the Slashdot Spam Filter! by OwlWhacker · · Score: 2, Funny

      From what I can make out, it appears to say:

      i w4nt j00r m0n3y dud3!

  9. Al Qaeda! by Xenna · · Score: 4, Funny

    Great, now, if we can just prove it's being used by Al Qaeda to help the Jihad we may finally get some political support for getting rid of spammers!

    X.

  10. Microdot! by Short+Circuit · · Score: 2, Funny

    It's not, perchance, reproduced here: (.)

  11. Facts about spammers: by Anonymous Coward · · Score: 3, Funny
    I applied this method to the lastest 100 spam mail and got the following results:
    1. 44.3 % of the spammers want to get me rich, too.
    2. 32.2 % want to enlarge my penis
    3. 25.3 % want to get me cheap mortage
    4. 86.4 % can't spell
    5. 98.3 % have a broken email program which produces defunct email header lines

    No trouble in tacking them down now.
  12. Where is the War On Terror when you need it? by Mattintosh · · Score: 5, Funny

    *** BEGIN KNEEJERK REACTION ***
    Terrorists could use spam to send messages! Declare war on Hotmail! Nuke MSN! Hunt down the CEO of Yahoo! and tickle him until he talks!
    *** END KNEEJERK REACTION ***

    Meanwhile, how covert is it if you send it to a million of your closest friends? Heck, at that rate, you could use /. posts to send covert messages.

    Dimple monkey twice the pudding octopi for tango man. Very blender shoe, cellular, scooter my daisy heads. Diddley day.

    And all the rest of you can kiss your ass goodbye.

    1. Re:Where is the War On Terror when you need it? by Bender+Unit+22 · · Score: 3, Funny

      The monkey swims in the moonlight tonight.

  13. I already miss spam... by heironymouscoward · · Score: 4, Funny

    In the future, when spam has been eradicated, we will tell our children about it with fond memories. "Yes, we got messages like '1ncreas3 y3r p3ni5 5iz3!', and 'v14gr4 n0\/\/!'"

    Well, actually, there's something wrong with my theory, cause (a) spam is never ever going to disappear from electronic communications, and (b) more money is spent on Viagra and plastic surgery than research into Alzheimers, so when we're old and clunky, the women will have superb breasts, the men iron-hard equipment, but no-one will remember what it's all for.

    --
    Ceci n'est pas une signature
  14. Aha I knew it! by Anonymous Coward · · Score: 5, Funny

    If you study those emails from Nigeria a secret message is revealed:

    "Fat White suckers please hand over your money and I will laugh at you"

    To reveal more secrets of spam please send me $200 to:

    Mr Okilea Bessei
    3 St Lener St
    Abuja
    Nigeria

  15. Mozilla, it say... by Anonymous Coward · · Score: 4, Funny

    "This document contains no data"

    Oh the irony.

  16. Quick, start writing by radiophonic · · Score: 2, Funny

    "The Spam Code" I'm sure we can sell more than the "Bible Code" Somebody mass-mail the news!

    --
    Whenever you read this sig someone's refrigerator light turns on.
  17. Actually... by mykepredko · · Score: 2, Funny

    I would have though properly grounded tin-foil gloves would be more appropriate in light of this article.

    You don't want anything travelling from your fingers through to the keyboard...

    myke

  18. Re:Tin Foil Hats by YU+Nicks+NE+Way · · Score: 2, Funny

    No. He's got a much more forward-looking, innovative, and fully buzzword compliant business plan.

    His patent covers the intellectual content generated by, through, or with Irradiated Tin Foil Hats. If you have an idea while wearing one of his hats, or even an idea which can be shown to have been influenced by wearing one of his hats, then he is entitled to a reasonable and non-discriminatory license fee on the results of that idea.

    Best: you know about licenses that promise a piece of your first born child? This product makes that literal: if you have carnal thoughts while wearing one of his creations...he gets a partial license on the outcome.

  19. Released from the IMA by Herkum01 · · Score: 0, Funny

    Press Release from the International Marketing Association

    "Yes it is true, you found us out. We were attempting to improve young people with our hidden messages about Viagra, barely 18 Lolita's, and breast and penis enlargement ads. The messages were,

    Say your Prayers.
    Take your vitamins.
    Do your homework.
    Love thy neighbor.

    I certainly hope that noone misunderstood what we were trying to communicate. in our ads.

  20. Crazy by Anonymous Coward · · Score: 5, Funny

    Messages in spam? That is just crazy.

    Next time they start finding information in /. articles...

  21. Re:Secret messages in spam by cgenman · · Score: 1, Funny

    Dear Friend , Your email address has been submitted
    to us indicating your interest in our newsletter .
    We will comply with all removal requests . This mail
    is being sent in compliance with Senate bill 1623 ,
    Title 1 ; Section 305 . This is different than anything
    else you've seen ! Why work for somebody else when
    you can become rich as few as 51 MONTHS . Have you
    ever noticed people will do almost anything to avoid
    mailing their bills and nearly every commercial on
    television has a .com on in it ! Well, now is your
    chance to capitalize on this ! WE will help YOU process
    your orders within seconds & decrease perceived waiting
    time by 170% ! The best thing about our system is that
    it is absolutely risk free for you . But don't believe
    us . Ms Simpson who resides in Massachusetts tried
    us and says "My only problem now is where to park all
    my cars" ! We are a BBB member in good standing ! We
    beseech you - act now ! Sign up a friend and you get
    half off . Cheers . Dear Colleague , This letter was
    specially selected to be sent to you . If you are not
    interested in our publications and wish to be removed
    from our lists, simply do NOT respond and ignore this
    mail . This mail is being sent in compliance with Senate
    bill 1622 ; Title 8 , Section 304 . THIS IS NOT A GET
    RICH SCHEME ! Why work for somebody else when you can
    become rich as few as 42 weeks . Have you ever noticed
    nearly every commercial on television has a .com on
    in it & nobody is getting any younger ! Well, now is
    your chance to capitalize on this ! We will help you
    sell more & deliver goods right to the customer's doorstep
    ! You can begin at absolutely no cost to you . But
    don't believe us . Prof Ames of Florida tried us and
    says "Now I'm rich, Rich, RICH" . We are licensed to
    operate in all states . Because the Internet operates
    on "Internet time" you must hurry . Sign up a friend
    and your friend will be rich too ! Cheers .
    ---

    Ever wonder if maybe we should be surfing at -1?

  22. The TRUE hidden message... by lacrymology.com · · Score: 4, Funny

    There certainly is a hidden message contained in ALL of my spam:

    YOU HAVE A SMALL DICK.

    -m

    --

    #
    # Modus Ponens
    #
  23. Re:Plaintext reading by Stud1y · · Score: 2, Funny

    or i am easily amused. plaintext doesn't offer the cute little Outlook fonts and "phone" characters for people's email signatures. How in the world would i be able to tell that it's a phone number, and not just some random digits, in a three-three-four meter?

  24. That's not what I heard. by geekpuppySEA · · Score: 5, Funny
    Played backwards it says "I buried Paul".

    I heard "I enlarged Peter."

    --
    Intelligent Design: because MATH is HARD.
    1. Re:That's not what I heard. by Anonymous Coward · · Score: 1, Funny

      I buried Peter.

  25. Re:Steganography by Sly+Mongoose · · Score: 2, Funny
    In regular email, just the fact a PGP encrypted message was sent by Alice to Bob would tip the authorities off that Alice and Bob were at least communicating; if they are both criminals for instance...
    Wot choo talkin' 'bout, Loois?

    Just the fact Alice sent a PGP encrypted message to Bob defines them both as criminals. At least, in the USA it does. Britain too, I think...
  26. I decoded it! by hoggoth · · Score: 2, Funny

    I just went through a large corpus of spam text looking for statistical irregularities, and I think I found something!

    Oddly enough it was the presence of text that was MORE random than statistically likely, not less random, ie: the randomness was TOO PERFECT.

    After intense analysis I have decoded the hidden plain-text. It reads:

    "BUY OVALTINE"

    What does that mean?

    --
    - For the complete works of Shakespeare: cat /dev/random (may take some time)
  27. Re:Secret messages in spam by pragma_x · · Score: 2, Funny

    Note to moderators: this is not a Troll, nor is parent. Encoded reply via spammimic.com:

    Dear Friend , Especially for you - this red-hot intelligence
    . If you no longer wish to receive our publications
    simply reply with a Subject: of "REMOVE" and you will
    immediately be removed from our mailing list . This
    mail is being sent in compliance with Senate bill 1622
    , Title 9 ; Section 308 ! This is NOT unsolicited bulk
    mail . Why work for somebody else when you can become
    rich as few as 40 weeks ! Have you ever noticed how
    long the line-ups are at bank machines plus nearly
    every commercial on television has a .com on in it
    . Well, now is your chance to capitalize on this !
    We will help you SELL MORE plus decrease perceived
    waiting time by 120% . You can begin at absolutely
    no cost to you . But don't believe us . Mrs Simpson
    who resides in Alaska tried us and says "Now I'm rich
    many more things are possible" . We are a BBB member
    in good standing . You have no reason not to act now
    ! Sign up a friend and you'll get a discount of 80%
    . Cheers . Dear Friend ; Especially for you - this
    cutting-edge information . We will comply with all
    removal requests ! This mail is being sent in compliance
    with Senate bill 1621 ; Title 6 , Section 306 ! This
    is not multi-level marketing . Why work for somebody
    else when you can become rich inside 14 days ! Have
    you ever noticed most everyone has a cellphone and
    most everyone has a cellphone ! Well, now is your chance
    to capitalize on this ! WE will help YOU decrease perceived
    waiting time by 130% plus use credit cards on your
    website . You are guaranteed to succeed because we
    take all the risk . But don't believe us . Prof Ames
    of Florida tried us and says "I was skeptical but it
    worked for me" . We are a BBB member in good standing
    ! We BESEECH you - act now . Sign up a friend and you'll
    get a discount of 70% ! Thanks ! Dear Friend , Especially
    for you - this cutting-edge announcement ! This is
    a one time mailing there is no need to request removal
    if you won't want any more . This mail is being sent
    in compliance with Senate bill 1620 , Title 9 ; Section
    304 . This is different than anything else you've seen
    ! Why work for somebody else when you can become rich
    inside 97 DAYS ! Have you ever noticed people will
    do almost anything to avoid mailing their bills and
    people are much more likely to BUY with a credit card
    than cash ! Well, now is your chance to capitalize
    on this . We will help you SELL MORE & SELL MORE .
    You are guaranteed to succeed because we take all the
    risk ! But don't believe us ! Mr Ames who resides in
    Texas tried us and says "Now I'm rich, Rich, RICH"
    . We assure you that we operate within all applicable
    laws ! Don't delay - order today . Sign up a friend
    and you get half off . God Bless .

  28. I figured it out! by Phat_Tony · · Score: 2, Funny


    It anagrams to "Dissident hangs the compassionate"

    I know what you've been doing, and I'm alerting the police! You serial killers are always leaving sneaky notes behind, thinking we won't catch you. Well you deserve the electric chair! (see I'm not compassionate. Don't come after me.)

    --
    Can anyone tell me how to set my sig on Slashdot?