Saturday, January 24, 2009

Obfuscated spam

Obfuscated spam is email that has been disguised in an attempt to fool anti-spam software.

Spammers are constantly trying to fi nd ways to modify or conceal their messages so that your anti-spam software can’t read them, but you can.

The simplest example of this “obfuscation” is putting spaces between the letters of words, hoping that anti-spam software will not read the letters as one word, for example
V I A G R A
Another common technique is to use misspellings or non-standard characters, for example
V!agra
These tricks are easily detected.

More advanced techniques exploit the use of HTML code (normally used for writing web pages) in email. This allows the spammer to write messages that anti-spam software “sees” quite differently from the way you see them.
For example, words can be written using special numerical HTML codes for each letter,
e.g. instead of “Viagra”, you can write
Viagr&#97

HTML can also allow the reader to see one message, while the anti-spam software sees another, more innocent one. The more innocent message is in the same color as the background.
Viagra
Hi, Johnny! It was nice to have dinner with you.

Spammers often include large amounts of hidden text, often cut from online reference books, to try to fool anti-spam software that assesses mail according to the frequency of certain key words.

Sophos.com

No comments:

Post a Comment