How Image Spam Works

Esther Schindler writes "CSO Magazine has an article about "The Scourge of Image Spam," with an explanation of its effect (a year ago, fewer than five out of 100 e-mails were image spam; today, up to 40 percent are in that category, and image spam is the reason spam traffic overall doubled in 2006). You might already know about that, ho-hum. But what's even cooler is a interactive graphic page which demonstrates the various methods used by image spammers and how it works."

Comments

Here's how it works from another perspective

[Richard McBeef]

It works because some rat fuckers out there buy the shit that's being advertised.

Re:Here's how it works from another perspective

[Qoroite]

You know, I've always wondered how true that really is.

What sort of a brain-dead moron would actually fall for spam? There can't be many people that dumb surely?(I hope....)

Re:Here's how it works from another perspective

[jfengel]

You know that the IQ bell curve has two tails. Somebody's got to be in the left tail. And since spam is nearly free, you only need to find a few idiots.

Then again, they've got to be coming to the intersection point between "Dumb enough to buy v1@gra from a spammer" and "Too freaking stupid to use a computer or have any money".

Re:Here's how it works from another perspective

[plover]

You have to look at the business of spam to understand why it hasn't gone away yet.

There are actually three parties involved in spamming: the merchant, the spammer, and the victims/recipients. The merchant is the trailer trash dude who fished a case of expired viagra out of some pharmacy's dumpster. He wants to sell it online and make a fortune. So he hires a spammer who agrees to send out 10,000 emails for $60.00.

Whether or not the merchant makes a single sale has no effect on the spammer. The spammer made his money just by sending the crap emails out. And the supply of idiots with get-rich-quick schemes is virtually infinite, guaranteeing the spammers a never-ending stream of fools willing to hand them $60.00 apiece.

This means we'll probably be fighting spam until the world runs out of greedy idiots.

Re:Here's how it works from another perspective

[Mr Z]

I once made a calculation that if every person on the Internet responded positively to precisely one spam, that would be enough to make spam wildly profitable. Granted, that was a few years ago, but bandwidth (and therefore spam) has only gotten cheaper and bot nets more prevalent (making spam cheaper still).

You don't have to go too far down the left tail of the bell curve to make up for the folks on the right half. After all, in terms of positive response, the best the folks in the right half can do is respond positively to zero spams. The further you go into the left tail, the more likely you are to run into people who respond positively to spam on a somewhat regular basis. The cut-over line for "responds to spam" vs "does not respond to spam" can be pretty far into the left tail and still have spam be profitable.

Making matters worse, negative responses to spam rarely do anything to the spammer. Instead, they just annoy IT departments into implementing ever heavier spam filters. Every so often somebody gets sued, but it's hardly enough to make a real dent in things.

Re:Here's how it works from another perspective

[Bob-taro]

Actually, you don't even need one stupid person falling for the spam-vertisements. All you need is stupid marketing managers who will pay for the spam campaign -- whether or not it is working.

Re:Here's how it works from another perspective

[gmuslera]

On an unrelated note, has anyone else noticed a huge drop in the effectiveness of greylisting as a spam countermeasure? I used to receive close to zero spam messages up until 2-3 weeks ago and suddenly they're flooding me! Any hint?

Greylist don't "magically" stop spams, dont even have to know that is spam or not what is stopping. Only asks that the sending server is well behaved and try again to send the same message (same sender, same destination) after some minutes/hours and it works against spam because most spam-sending bots usually dont retry. But you only need to be targetted by machines that behaves well in this sense to get again spam.

It's A Turing Test

[Anonymous Coward]

Spammers are sending out Turing Tests. Beware of spam filters that are too good. They just might be intelligent.

Re:What about captcha-busting software?

[drinkypoo]

If spammers move to increasingly complex image spam, I could see spam filters growing to include some of these algorithms, converting the images into a best-guess text representation, then subjecting that text to standard spam filtering.

This is directly related to a realization I just had (you almost had it yourself.) Image-based spam is fucking brilliant but not just because it works. There is a secondary effect - a positive one for the spammers.

Right now the strongest weapon in the defense against web spam is the CAPTCHA. Most of them depend on obfuscated text to defeat machine recognition.

Spammers lack the resources to effectively defeat CAPTCHAs permanently through technology. Their current solution is to use a network of humans, ala Amazon Mechanical Turk, to solve them. Computers are simply bad at doing this, but this is largely because we have not figured out how to make them good at it.

By using the same techniques to obfuscate spam as the rest of us use to create CAPTCHAs, they ensure that someone else will do the work of defeating text obfuscation-based CAPTCHAs in order to better recognize and classify spam.

I'm sure I'm not the first to have this realization (at the bare minimum, spammers have realized it) but I think it's a pretty good one.

Where is Chris Hansen on this?

[oni]

What sort of a brain-dead moron would actually fall for spam?

I wish that somebody would do a TV show like "To Catch a Predator" except that they would go after the people who buy spam. Embaras them a little.

"Hi, I'm Chris Hansen from NBC. Why don't you have a seat there. Why are you here sir?"
"uh well I, I'm here to see a friend."
"You're here to have your penis enlarged aren't you?"
"no, no, I'm just here to hang out."
"Sir this is an email that we sent to you advertising penis enlargement. You clicked on this email."
"omg, is this on TV??"

Re:tutorial?

[cayenne8]

See? I used to bitch years ago that email should be TEXT ONLY, but, no...we all want html mail and purty graphics.

If we'd stuck with text only email....no problem with images.

Oh well....back to trying to install Win 95 on an abacus.....