Image-Based Spam Makes a Comeback
Up until recently, image-based spam was all-but defeated. Anti-spam filters figured out how to detect those messages by utilizing mathematical formulas and unique signatures that software used to flag them, but with new innovations being used by spammers, image-based spam has seen a resurrection.
By June of 2005 image-based spam made up only 1% of all spam, but now an estimate by IronPort, an e-mail security vendor, pegs image-based spam at 12% of all spam in June of 2006. Security firm CipherTrust actually pegs this figure at 15% of all spam in June.
Images get by filters more often than regular text-based e-mails since spam filters have a difficult time distinguishing the contents of those images and whether or not they contain embedded text pushing a product or service.
Image-based spam owes its comeback to tools that began exchanging hands among spammers earlier in the year. These tools are able to change images just enough to avoid being detected by filters. The alterations made to images are very slight, including barely varied colors and borders. The tools make these spam messages as unique as a snowflake, according to Craig Sprosts, senior product manager at IronPort.
“While using images in spam is not a new concept, changing the image in real-time in each delivered spam message is a relatively new capability that the spammers have been able to acquire,” said Dmitri Alperovitch, research scientist at CipherTrust. Alperovitch added that these new tools perform at a high level, allowing its users to send millions of these new-and-improved image-based spam messages per hour.
According to IronPort, image spam saw a 40% jump since April. This figure was derived from the use of “honeypot” accounts that IronPort sets up for the sole purpose of drawing junk e-mail for examination.
“I think we will see a spike and an increase over the next 3-9 months until new technologies are deployed that can detect the new forms of spam,” said Sprosts.
Sources:
http://www.internetnews.com/xSP/article.php/3617711
http://www.foxnews.com/story/0,2933,201453,00.html
