Re: the most bizarre spam message i've received to date...

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 25 June 2003 12:58, Timothy R. Butler wrote:
> > i really can't think of why someone would do this ... could it be a
> > (poor?) attempt to fool spam filters? or someone who hijacked a spam to
> > entertain and consternate the observant? or...?
>
>   Intriguing, that's for sure. You've got me as to what it could mean. :-)

this has got me looking at more spams... i've come to the conclusion that this 
is a means to beat various types of spam filtering... the same spam to 
different email accounts show similar passages of gibberage, but each spam 
contains a unique hunk of gibberish.

they all start with "Hello <someone>" and end with "Love <someone>"... the 
unique text that is "hidden" in the email messages probably are meant to 
defeat md5 or other such "signature based" distributed antispam devices. and 
i bet it works.

another interesting tack is this (from an actual spam):

- ------
  * Fa<!-- cheesy -->st Pr<!-- lucius -->ior<!-- extricable -->ity Ship<!-- 
awesome -->ping Wor<!-- acetylene -->ldWi<!-- %RANDOM_WORD -->de<br>
  * Scie<!-- chew -->nti<!-- nibs -->st Appr<!-- %RANDOM_WORD -->oved <br>
- ------

of course, when viewed as HTML, the words in between the <!-- and --> won't 
show up and the message will appear in all it's spamorific glory... but if a 
spam filter weighs the words used in an email as a means to judge it's 
quality, the mail may well get through because all the whole words are "safe" 
while the "spamlike" words are all broken up! will spam filters of the future 
need to understand HTML (if they don't already?)?

it looks like the spammers could use some help with their software, however, 
as you can see it occasionally prints "%RANDOM_WORD" instead of an actual 
random word.

some spammers' sotware is totally broken and all there are are "<!-- 
%RANDOM_WORD -->" with not a real word in sight. oops.

another tack i've seen is to simply append garbage text to the end of the 
mail. not very creative and i wonder at it's effectivity.

another is to use just images and no text whatsoever... probably effective 
against word/meaning based filters, but not against signature based filters.

looks like the spamwars are really heating up between the spammers and the 
antispam software developers.

- -- 
Aaron J. Seigo
GPG Fingerprint: 8B8B 2209 0C6F 7C47 B1EA  EE75 D6B7 2EB1 A7F1 DB43

KDE: The 'K' is for 'kick ass'
http://www.kde.org       http://promo.kde.org/3.1/feature_guide.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)

iD8DBQE++ink1rcusafx20MRAleLAJ9oZQJFJoQWxlr5Qn93st7gPI6kcwCfWU5Q
aRk6l+nmNe7PS9j8t8M6ygg=
=KGpe
-----END PGP SIGNATURE-----

Kde-cafe mailing list - [email protected]
http://ofb.biz/lists/listinfo.cgi/kde-cafe

DISCLAIMER: The views expressed on this mailinglist are the personal
opinions of the author and do not represent OfB.biz: Open for Business, KDE or the author's employer.