How Image Spam Works

Esther Schindler writes "CSO Magazine has an article about "The Scourge of Image Spam," with an explanation of its effect (a year ago, fewer than five out of 100 e-mails were image spam; today, up to 40 percent are in that category, and image spam is the reason spam traffic overall doubled in 2006). You might already know about that, ho-hum. But what's even cooler is a interactive graphic page which demonstrates the various methods used by image spammers and how it works."

Comments

Spam?

[Colin Smith]

What is this thing you speak of?

I haven't had any spam in years.

Re:Spam?

[u-bend]

Anyone with a Gmail account ever notice that your targeted advertising links are all about spam recipes (i.e. Spam Meat Loaf) when you're in your spam folder? I've always loved that, and figured that it may have started out as a bug, but one that the Gmail team sort of fell in love with.

Re:Spam?

[LiquidCoooled]

The spam recipe bar is an offshoot from the WebClips feature of your inbox.
The inbox can be configured to have a single item selected at random from one of a number of RSS feeds, I have mine configured to show Routers oddly enough and slash.

The area marked for webclips is a custom feed from www.recipesource.com

If you look on your trash folder, you also get tips about recycling.

The other folders give standard syndication adverts.

More info here

Here's how it works from another perspective

[Richard McBeef]

It works because some rat fuckers out there buy the shit that's being advertised.

Re:Here's how it works from another perspective

[Qoroite]

You know, I've always wondered how true that really is.

What sort of a brain-dead moron would actually fall for spam? There can't be many people that dumb surely?(I hope....)

Re:Here's how it works from another perspective

[jfengel]

You know that the IQ bell curve has two tails. Somebody's got to be in the left tail. And since spam is nearly free, you only need to find a few idiots.

Then again, they've got to be coming to the intersection point between "Dumb enough to buy v1@gra from a spammer" and "Too freaking stupid to use a computer or have any money".

Re:Here's how it works from another perspective

[Anonymous Coward]

There wouldn't be anyone in the left tail if we took the warning labels off everything.

/just sayin'

Re:Here's how it works from another perspective

[plover]

You have to look at the business of spam to understand why it hasn't gone away yet.

There are actually three parties involved in spamming: the merchant, the spammer, and the victims/recipients. The merchant is the trailer trash dude who fished a case of expired viagra out of some pharmacy's dumpster. He wants to sell it online and make a fortune. So he hires a spammer who agrees to send out 10,000 emails for $60.00.

Whether or not the merchant makes a single sale has no effect on the spammer. The spammer made his money just by sending the crap emails out. And the supply of idiots with get-rich-quick schemes is virtually infinite, guaranteeing the spammers a never-ending stream of fools willing to hand them $60.00 apiece.

This means we'll probably be fighting spam until the world runs out of greedy idiots.

Re:Here's how it works from another perspective

[MarkGriz]

"It works because some rat fuckers out there buy the shit that's being advertised"

So that's why they are buying penis enlarging pills

Re:Here's how it works from another perspective

[giorgiofr]

I'd like to add that there is a forth party involved and it's the one all we sysadmins hate - the cracker who's hired by the spammer to root boxen left and right. I believe most people trying to break into my server are looking for a compromisable host to set up a mail server.
On an unrelated note, has anyone else noticed a huge drop in the effectiveness of greylisting as a spam countermeasure? I used to receive close to zero spam messages up until 2-3 weeks ago and suddenly they're flooding me! Any hint?

Re:Here's how it works from another perspective

[Mr Z]

I once made a calculation that if every person on the Internet responded positively to precisely one spam, that would be enough to make spam wildly profitable. Granted, that was a few years ago, but bandwidth (and therefore spam) has only gotten cheaper and bot nets more prevalent (making spam cheaper still).

You don't have to go too far down the left tail of the bell curve to make up for the folks on the right half. After all, in terms of positive response, the best the folks in the right half can do is respond positively to zero spams. The further you go into the left tail, the more likely you are to run into people who respond positively to spam on a somewhat regular basis. The cut-over line for "responds to spam" vs "does not respond to spam" can be pretty far into the left tail and still have spam be profitable.

Making matters worse, negative responses to spam rarely do anything to the spammer. Instead, they just annoy IT departments into implementing ever heavier spam filters. Every so often somebody gets sued, but it's hardly enough to make a real dent in things.

Re:Here's how it works from another perspective

[Bob-taro]

Actually, you don't even need one stupid person falling for the spam-vertisements. All you need is stupid marketing managers who will pay for the spam campaign -- whether or not it is working.

Re:Here's how it works from another perspective

[gmuslera]

On an unrelated note, has anyone else noticed a huge drop in the effectiveness of greylisting as a spam countermeasure? I used to receive close to zero spam messages up until 2-3 weeks ago and suddenly they're flooding me! Any hint?

Greylist don't "magically" stop spams, dont even have to know that is spam or not what is stopping. Only asks that the sending server is well behaved and try again to send the same message (same sender, same destination) after some minutes/hours and it works against spam because most spam-sending bots usually dont retry. But you only need to be targetted by machines that behaves well in this sense to get again spam.

It's A Turing Test

[Anonymous Coward]

Spammers are sending out Turing Tests. Beware of spam filters that are too good. They just might be intelligent.

For me it's not image spam, it's botnet traffic...

[garcia]

For me the spam e-mails are minimal to my machine. I do see a couple of them come in through GMail on the account that I have posted publicly on my website for people to contact me but for the most part they are the standard stock pump and dumps or phishing schemes.

What has been killing me recently were the fucking botnet "attacks" sucking my DSL's bandwidth with those douchebags hitting me with a GET and an immediate POST for tons of URLs all over my site. Their referrer was http://www.google.com/ and for a few hours I couldn't figure out how to stop that w/o stopping Google search referrals too.

Some nice guy in #apache helped me out with:

SetEnvIfNoCase Referer "^http://www.google.com/?$" BadReferrer=1

SetEnvIfNoCase Referer "^http://www.google.com/?$" BadReferrer
order deny,allow
deny from env=BadReferrer

That has been returning 403s to the botnet which apparently stop such frequent attempts when they receive the error. I was getting hit with their shit every 4 to 5 seconds all day yesterday and now they are "pinging" me with attempts every hour or so. I don't know if it's a different botnet or the same one trying to get back in but that was the most effectual way to drop the huge spam traffic I was receiving but couldn't ban due to the wide range of IPs.

Botnets fucking suck :(

A Key Point

[eldavojohn]

This is a great article describing how it is formed, why it looks like that, what that is designed to trick, etc.

The key point they're missing is that it works under the assumption that a very small part of the populace doesn't recognize this as spam. These people then think that an investment firm decided to tip everyone off and they mistakenly buy the stock so that it goes up a nickel only to watch it drop shortly after the spammer drops the stock.

What's ironic is that I'll bet there's people out there with money that know this scam but buy the stock to also cash in on people who think this is a real tip. It might even be that the initial assumption is wrong and that the only people scamming each other are scammers trying to take advantage of another scammer's scam. Scam. Oh, the irony if that's the case. Either way, the article mentions the SEC removing stocks that went up that were junk stocks in spam mailings!

It's a scam. Stay away and alert your loved ones if you think they may fall into the initial category of the small part of the populace. The safest way to stop spam is to alert people and teach them how to identify it.

You don't buy stock that an angry fruit salad told you was hot just like you don't sleep with the girl who leaves dead spots of grass where she sits on the corner. Awareness is a valuable key to our solution against spam.

Pretty easy to filter

[Anonymous Coward]

I send "Content-Type: image/(gif|jpe?g|png)" emails to /dev/null and pass the rest to spamprobe. After the inital learning of a couple of days, it's been 100% effective on image spam.

Re:FTFA

[Hoi Polloi]

Agreed but I'd go further. Reduce emails to plain text and attached files. No HTML. If you need to send images then post them to a web site and send the url or put them in a zip file.

Re:FTFA

[PCM2]

You don't even need to be that uptight.

Seriously, I once read something about using OCR software to "read" images that come through in e-mail to make sure that they don't contain stock spam or penis pump messages. Who thinks this is really necessary? Has anyone you know really gotten so frustrated with the limited font choices in regular e-mail that they started composing their messages in Photoshop?

Trained Bayesian filters seem to have no problem at all spotting image spam.

What about captcha-busting software?

[vonPoonBurGer]

Lots of websites use the same techniques to obfuscate the little images used to differentiate real users from bot software. There have been lots of proof of concept examples of software that automatically "solve" these CAPTCHA images (http://en.wikipedia.org/wiki/Captcha#Computer_cha racter_recognition). If spammers move to increasingly complex image spam, I could see spam filters growing to include some of these algorithms, converting the images into a best-guess text representation, then subjecting that text to standard spam filtering. Even if the image to text conversion was only 50% accurate, I bet that would be enough to train up a modern spam filter like SpamBayes to recognize and reject the message.

Of course, I just read all my mail as plain text, so this is a non-issue as far as I'm concerned.

Re:What about captcha-busting software?

[drinkypoo]

If spammers move to increasingly complex image spam, I could see spam filters growing to include some of these algorithms, converting the images into a best-guess text representation, then subjecting that text to standard spam filtering.

This is directly related to a realization I just had (you almost had it yourself.) Image-based spam is fucking brilliant but not just because it works. There is a secondary effect - a positive one for the spammers.

Right now the strongest weapon in the defense against web spam is the CAPTCHA. Most of them depend on obfuscated text to defeat machine recognition.

Spammers lack the resources to effectively defeat CAPTCHAs permanently through technology. Their current solution is to use a network of humans, ala Amazon Mechanical Turk, to solve them. Computers are simply bad at doing this, but this is largely because we have not figured out how to make them good at it.

By using the same techniques to obfuscate spam as the rest of us use to create CAPTCHAs, they ensure that someone else will do the work of defeating text obfuscation-based CAPTCHAs in order to better recognize and classify spam.

I'm sure I'm not the first to have this realization (at the bare minimum, spammers have realized it) but I think it's a pretty good one.

Use a manual rule to block it

[Anonymous Coward]

"Parsing an image, on the other hand, ain't so easy. "

So use a manual rule to block these messages, discarding them on the basis of how they're put together.

If *all* of the following conditions are met:

Any attachment name contains .gif
+ Content-Type contains multipart/related
+ Sender is not in my address book

Move message to "Junk".

http://www.hawkwings.net/2006/12/20/another-mailap p-rule-to-catch-image-spam/

Re:The scourge of broken web sites

[CaptainPatent]

Works for me. Must be your browser.

Here is TFA for all those who can't read it in its current form:

Image Spam: By the Numbers

By Scott Berinato

Image Spam--an e-mail solicitation that uses graphical images of text to avoid filters--is not new. Recently, though, it reached an unprecedented level of sophistication and took off. A year ago, fewer than five out of 100 e-mails were image spam, according to Doug Bowers of Symantec. Today, up to 40 percent are. Meanwhile, image spam is the reason spam traffic overall doubled in 2006, according to antispam company Borderware. It is expected to keep rising.

1. GIF Layering

Just as word splitting divides words into multiple images to elude spam filters (see number three), an image spam can be divided into multiple images. Like the transparent plastic overlays in Gray's Anatomy, pieces of a message are layered to create a complete, legible message. In this rudimentary example, the spam is divided into three pieces (cut in the middle of letters for added obfuscation). But one message could comprise as many as a dozen layered GIFs.

2. Optical Character

Recognition Duping Optical character recognition (OCR) is the closest to sight that computers get. OCR works by measuring the geometry in images, searching for shapes that match the shapes of letters, then translating a matched geometric shape into real text. To defeat OCR, spammers upset the geometry of letters enough--by altering colors, for example--so that OCR can't "see" a letter even as the human eye easily recognizes it. The effect is something like blurred characters in an eye test.

3. Word Splitting and Ransom Notes

If OCR catches up to the color tricks in image spam, a spammer's next defense is word splitting. By dividing the image and leaving space in between the pieces, any image the OCR engine is examining is only a piece of a letter with its own distinct geometry. Instead of word splitting, some spammers have employed a ransom note technique in which each letter in the spam message is its own image, and each letter image includes background noise and other baffling techniques. A program cobbles together randomized letter images to make words. The effect looks like a classic ransom note with a mishmash of letters cut out from magazines.

4. Geometric Variance

Many filters can intercept mass mailings based on their sameness. Images, though, can be altered easily without disturbing the message inside them. Thus one spam message will arrive as dozens of differently shaped images, and each time the colors of the text images will have changed, as will the randomly generated speckling and pixel and word salads. No two images are alike despite the fact that they carry similar messages. Shown are two radically different images containing the same stock tip. The technique is popular as a scheme to boost prices of low-value stocks. In March, the SEC suspended trading on 35 such stocks that were the subject of these image spam messages, including some whose prices rose.

5. Speckling/Pixel Salad

Confetti-like speckles don't affect the legibility of the necessary information but make every message unique to confuse a filter looking for patterns or high volumes of identical images.Similarly, a bar of randomly generated color pixels can contain the vast majority of the image data. To a filter it's full of patternless noise. We can see the words in the message while the image at the bottom doesn't bother us.

6. Hyperlink Elimination/Word Salad/Animated GIF

Filters have improved their ability to find and trace spammy URLs and then block the message based on the inclusion of a bad link. To get around this, spammers will ask recipients to type the URL into their browsers.Other methods include word salads, text passages, often taken from classic novels, to confuse Bayesian filters and weighted dictionaries that rely on complex mat

It's a problem even if you don't get it

[Anonymous Coward]

Just a quick note on this story. One of the important lessons of image spam is it's a problem regardless of whether or not you actually receive it in your inbox. As the print version of the story points out, most image spam emails are at least twice the size of a text email (and they are getting much much bigger than that). That means spam is clogging up pipes along the way. Also, it's hogging massive amounts of storage at companies that can't filter it well and backup/archive email and junk inboxes that don't get cleaned out. Also, it still gets through to many many inboxes, as the fact that the SEC banned trading on penny stocks that were part of a pump and dump image spam campaign points out. The question is, and will increasingly be, why are we trying to filter this stuff at the email server rather than on the backbone? To date, ISPs and backbone operators have been hands off. That's good. No judgment on traffic and what's "good" or "bad." But it's also bad--all this crap clogs up the network and leads to any number of frauds and scams. Watch--there will be more of a push on these guys to start making value judgments on traffic and scrubbing "bad" traffic like spam and suspected DDoS etc. That's good--less spam in inboxes, cleaner pipes, better service and reduced chance of fraud. That's also bad--who is Joe Backbone that he gets to decide good and bad packets and what if he makes a mistake?

Re:Ideas?

[Applekid]

For starters, there's always hiring someone else to screen your emails for you. I wouldn't be surprised if there was already a service that you could join today and get your emails pre-screened.

Spam filters are going to have to get to be as good as an informed human being before they can stop all spam regardless of what tricks they use.

I just hope AI gets to that point before it goes all sentient... you know:
"DESTROY ALL SPAM"
...computing...
"SPAM COMES FROM HUMANS"
...computing...
"DESTROY ALL HUMANS"

Re:For me it's not image spam, it's botnet traffic

[WTBF]

Every 4 to 5 seconds is not bad, I was hit by a similar attack.

I run a webserver on my home connection, all it hosts is MythWeb, and it is password protected. I am the only person who should have to access it, and am on a dynamic IP address (not a problem I thought when setting it up, and have been very successfully using DynDNS.) About a year ago my IP address was changed to a new one, as it happens. My internet was going as slow as molasses about 10 minutes later, although I just thought it was a temporary thing with my connection. The next day it is even slower, and so I begin to investigate - I perform a speedtest and get very good results for download (but not perfect), but almost no upload. I thought this was odd and checked with my ISP to make sure there were no known issues with the connections in my area - there were not. So I then plugged my modem directly into my computer and it was still happening (which made me think it was something with my ISP, as it affected my router and my computer), and so I then clicked on my bandwidth monitor to see what speeds I could get, and before doing anything there was a constant stream of about 100kb-150kb of downstream traffic. And so I plugged the internet back through the router (I was running a software firewall by the way, so I considered bypassing the router safe).

I then looked at my webserver logs, and it took forever to load. So instead I did a "tail -f" on the error log. I must have been receiving hundreds of requests per second for websites that were nothing to do with me. It was scrolling so quickly I could not read entries as they went past. Examining it more closely I realized what happened: the owner of the IP address before me had been running an open proxy on port 80, and when the IP address changed all their requests were redirected to me, killing my much slower connection (from all the 404 responses apache was sending). So I closed port 80 for a week, and my connection returned to a somewhat normal state. However, I was still receiving about 20 requests a second, despite being offline (seemed mainly to be people trying to do dos attacks through a proxy). After a month this was down to only 1 or 2 a second, and it has remained like that till today.

Because of your post I checked my webserver logs, and at 1:27:18am I received my last request for a website, and looking into it my IP address changed to a new one (only took a year), and so some other unfortunate person is now receiving a few requests a second to be a proxy server.

Where is Chris Hansen on this?

[oni]

What sort of a brain-dead moron would actually fall for spam?

I wish that somebody would do a TV show like "To Catch a Predator" except that they would go after the people who buy spam. Embaras them a little.

"Hi, I'm Chris Hansen from NBC. Why don't you have a seat there. Why are you here sir?"
"uh well I, I'm here to see a friend."
"You're here to have your penis enlarged aren't you?"
"no, no, I'm just here to hang out."
"Sir this is an email that we sent to you advertising penis enlargement. You clicked on this email."
"omg, is this on TV??"

pump-n-dump

[Penguinshit]

describes the multitude of summer camp romances in my youth...

Image Spam?

[SCHecklerX]

If using SpamAssassin, subscribe to the SARE stuff and add this to your config:

score SARE_GIF_ATTACH 2.5 2.5 2.5 2.5
score SARE_GIF_STOX 2.5 2.5 2.5 2.5

I've not seen an image spam since configuring the above. Updates are also automatic with the following cron jobs:

0 4 * * * /usr/bin/sa-update && /usr/local/bin/md-mx-ctrl reread > /dev/null
0 5 * * * /usr/bin/sa-update --gpgkey D1C035168C1EBC08464946DA258CDB3ABDE9DC10 --channel saupdates.openprotect.com && /usr/local/bin/md-mx-ctrl reread > /dev/null

Re:tutorial?

[cayenne8]

See? I used to bitch years ago that email should be TEXT ONLY, but, no...we all want html mail and purty graphics.

If we'd stuck with text only email....no problem with images.

Oh well....back to trying to install Win 95 on an abacus.....

GIF SPAM

[geekmansworld]

It seems that a lot of image spammers have tried to circumvent newer spam-blocking technology by using animated GIFs: the first frame of which is blank, and the second of which contains the ad.

For months, we had consistent problems with clients e-mails (using a major ISP I won't mention here) not reaching our server. Curiously, it would happen most often with replies to our original e-mails.

After months of anguish and highly accusatory phonecalls to the ISP's tech support, we discovered the problem. Our company e-mail signature contains GIF images. When a client replied to us, quoting the original e-mail, the ISP would scan the e-mail, detect the inline GIF, and block the e-mail.

Since we changed the format of our signature to use JPEGs instead of GIFs, we've had no problems with the ISP blocking client replies.

So once again I assert: the biggest problem with spam isn't even the spammers, it's the n00b sysadmins who implement agressing spam-blocking rules before thinking about the consequences. I'd rather get more spam that have legitimate e-mails blocked by false positives.

"The first thing we'll do is kill all the spammers..."

So what?

[SanityInAnarchy]

I've almost deliberately exposed my email address all over the place, without the ridiculous antispam obfuscations (no "ninja AT slaphack DOT com" here), because I prefer not to use CAPTCHAS where I can help it, and that's just a poor-man's CAPTCHA.

The reason? Simple:

Statistical spamfiltering of any kind -- bogofilter, in this case -- is creepily accurate.

Recently, I lost my bogofilter database (due to my own stupidity). It took one day for it to get back to 95% accuracy, and another day to get up to 99%, with one false positive -- the first I had seen in about six months.