Hidden Messages in Spam

randomwalker writes "There was an extremely interesting presentation at the Blackhat Windows Security Conference in January by Dr Curtis Kret entitled Nobody's Anonymous. In his presentation he showed how information about spammers can be determined. In addition he showed that some spam is being used as a covert communication channel. This presentation demonstrates how to apply data forensics to spam in order to identify the sender of specific spam messages. Some senders can be identified by name, while others can be distinguished by attributes such as preferences, nationality, religion, and even left-handedness. Four spam categories are provided that classify spam by function, including List Makers, Scams, and Covert Communication channels. The examples provided include full-disclosure case studies: a phishing gang that targets bank customers with malware and impersonations, and an IRC group that uses spam as a covert communication channel."

Comments

Tin Foil Hats

[Allen Zadr]

Maybe, but this might actually mean that the authorities will start putting some actual resources into finding SPAM outlets and shutting them down.

Oh, and Tin Foil Hats are useless - you must use my special patented Irradiated Tin Foil to keep the new mind control machines out.

Why is this suprising.

[re-Verse]

One of the best methods of not having your communications snooped in on is to use a busy, noisy channel. Communications inside of malls, clubs, whatever. It makes perfect sense. People don't expect sensitive information in soe sort of public form, so they don't listen for it. We're all so sick of spam that we erase it on sight - so if someone wants to use it to communicate - its perfect. It draws a hell of a lot less attention to ones self rather than forming a whole new covert form of communication.

What looks more suspicious - A spam with some seemingly random keywords to throw off the filters at the bottom, or a highly encrypted data transmission on an obscure port. I know what one would make me take notice first.

Re:Covert Messages

[Anonymous Coward]

it would also be impossible to tell who the books were intended to (and therefore the US Mil could contact spies who could be in a tight spot, or informants who may be in a tight spot). The books could also contain a bunch of different messages using different cryptographies, in plain sight, to communicate with multiple agents.

Three Days of the Condor is an excellent movie with this very same premise. :) IRL, however, it would be difficult to use something like this for communication.

If, as you say, some Three-Letter-Agency wanted to get a message to a spy "in a tight spot" they would hardly have time to wait for a conventional printing press to run off a mass-market publication. "Tight spots" need to be resolved in days (if not hours), and to send a message through a printing press can take weeks or sometimes a month to run an edition, bind it and ship it to all corners of the earth.

So I doubt anyone's using this technique with dead-tree publications :)

Re:Facts about spammers:

[fbform]

I applied this method to the lastest 100 spam mail and got the following results:

44.3% of the spammers want to get me rich, too.
32.2% want to enlarge my penis

Unbelievable! I never knew you could get 0.1% precision by analyzing a mere 100 discrete samples of email. Or does the 33rd spammer want to enlarge only 20% of your penis? Or is he only 20% sure that he wants to enlarge your entire penis?