In Depth

The Scourge of Image Spam

How the latest iteration of junk mail is beating filters and filling inboxes.

By Scott Berinato

May 15, 2007 — CSO —

Image Spam—an e-mail solicitation that uses graphical images of text to avoid filters—is not new. Recently, though, it reached an unprecedented level of sophistication and took off. A year ago, fewer than five out of 100 e-mails were image spam, according to Doug Bowers of Symantec. Today, up to 40 percent are. Meanwhile, image spam is the reason spam traffic overall doubled in 2006, according to antispam company Borderware. It is expected to keep rising.

The conceit behind image spam is graceful in its simplicity: Computers can’t see.

All spam-thwarting techniques rely heavily on filters—programs that inspect words, phrases, mailing histories, IP addresses, shapes and other aspects of an e-mail. Those filters have lists, or dictionaries, of things that make any given message “spammy.” If a message seems spammy enough, the filter blocks it.

The spammer’s challenge, then, is to deliver something that the filter hasn’t yet learned is spam. Eventually, the filter incorporates the new derivations into its list of spammy traits. Then the spammer changes convention again, and on and on. Thus Viagra! becomes V1agr@! becomes V”iA’g R@! and so forth.

But even as they block more messages, spam filters don’t get smarter as much as they get stronger. Their dictionaries of unacceptable traits grow, their IP blacklists get longer, and the processors that power them get more horses. But for the most part, filters don’t change what they do even if they can do more of it. However complex or strong, they still just parse text and HTML looking for spam.

Parsing an image, on the other hand, ain’t so easy. There’s so much data in an image that a filter sees noise—millions of 0s and 1s in no discrete pattern. Yet the human eye and brain, in a fraction of a second, intuit from the same image, That’s Viagra!

Spammers have made image spam really effective by using not just one but multiple filter-thwarting techniques. Some confuse optical character recognition filters, some automatically alter images to create randomness, and some even buffer against defenses that don’t yet exist but that spammers anticipate will be built in response to image spam. Couple all that with the fact that a single image spam message, on average, is more than twice the size of an HTML or text-based spam, consuming all kinds of bandwidth and storage on networks, and you have a scourge.

But to battle it, first you must understand it. Turn the page to learn all the ways image spam is beating filters and clogging networks with useless e-mail.

• Email
• Print
• Comments
• Digg This
• SlashDot