Slashdot Mirror

← Back to Stories (view on slashdot.org)

Spammers Using Soft Hyphen To Hide Malicious URLs

Posted by timothy on from the conservative-in-what-you-accept dept.

Trailrunner7 writes with this excerpt from ThreatPost illustrating the ongoing Spy-vs.-Spy battle between spammers and the rest of us: "Spammers have jumped on the little-used soft hyphen (or SHY character) to fool URL filtering devices. According to researchers, spammers are larding up URLs for sites they promote with the soft hyphen character, which many browsers ignore. Spammers aren't shy about jumping humans flexible cognitive abilities to slip past the notice of spam filters (H3rb41 V14gr4, anyone?). ... The latest trend involves the use of an obscure character called the soft hyphen or 'SHY' character to obscure malicious URLs in spam messages. Writing on the Symantec Connect blog, researcher Samir Patil said that the company has seen recent spam messages that insert the HTML symbol for the soft hyphen to obfuscate URLs for Web pages promoted by the spammers."

10 of 162 comments (clear)

  1. H3rb41 V14gr4? by MrEricSir · · Score: 4, Insightful

    I never got the leet speak in spam thing. Sure, it might get past the filter, but who can read it? Are they trying to sell drugs to script kiddies?

    --
    There's no -1 for "I don't get it."
    1. Re:H3rb41 V14gr4? by caffeinemessiah · · Score: 3, Insightful

      I never got the leet speak in spam thing. Sure, it might get past the filter, but who can read it? Are they trying to sell drugs to script kiddies?

      I don't know about you, but I can't stop trying to figure out what word they're trying to represent with the symbols. For example, I know the second word in your subject means viagra, but what is "H3rb41"? Oh..."herbal". It's naturally (perhaps unknowingly) targeted towards geeks and puzzle-solvers, which perhaps isn't the worst market to target available-without-human-contact penis drugs towards.

      --
      An old-timer with old-timey ideas.
    2. Re:H3rb41 V14gr4? by maxwell+demon · · Score: 3, Insightful

      I thought the only situation where you need Viagra is exactly human contact (in the most literal meaning of the word).

      --
      The Tao of math: The numbers you can count are not the real numbers.
  2. Re:What is it? by mclearn · · Score: 1, Insightful

    And, as TFA points out, this is a valid tactic because "modern browsers" (ambiguously non-committal) do not render the character. I assume, spammers are writing URLs as: http://m­i­crosoft.com/ (eg. m-i-crosoft.com, but rendered onscreen as microsoft.com). This, of course, tricks folks into thinking that they are clicking on a valid microsoft.com URL.

  3. Re:Why by KillaGouge · · Score: 4, Insightful

    please ignore my parent post. It seems that GP is correct

    --
    GENERATION 25: The first time you see this, copy it into your sig on any forum and add 1 to the generation. Social exper
  4. Re:So how often is it used legitimately? by AltairDusk · · Score: 2, Insightful

    Shouldn't be too hard for the spam filter to strip the soft hyphens then analyze the URL, I don't see this being useful to the spammers for too long unless I'm missing something.

  5. Re:What is it? by maxwell+demon · · Score: 3, Insightful

    Are registrars accepting domain names with soft hyphens? And if so, why? It's rather obvious that such domain names would only be used for fraud.
    IMHO registrars should not accept any non-printable character in domain names.

    --
    The Tao of math: The numbers you can count are not the real numbers.
  6. Re:What is it? by sexconker · · Score: 3, Insightful

    Yes, they are. Otherwise this story wouldn't exist.
    Why? Because they like money, and don't give a fuck.
    Of course they should not accept any non-printable characters.

    Registrars are pretty much only half a step above the spammers in terms of ethics / shittiness.

  7. Re:Why by JSG · · Score: 2, Insightful

    Where one in English might use a series of adjectives plus a noun a German would use a single agglomerative word - what is your problem?

    Deutsch is a sufficiently sophisticated language without your assistance.

    It doesn't work the same as your native tongue - get a life and stop trolling my forum - twat.

  8. Re:Why by stjobe · · Score: 2, Insightful

    This is purely senseless and is a mark of poor language design.

    Languages (in general) aren't designed, they evolve. Which makes your (all too long-winded) point quite moot.

    --
    "Total destruction the only solution" - Bob Marley