Mcafee Publishes "Image Spam: The New Email Scourge"

Mcafee has added a new addition - Image Spam: The New Email Scourge to its series of publicly available technical whitepapers.

Fair warning - it's a PDF - so figure ahead of clicking that link that there's about a 1 in 5 shot at your browser hanging (god I hate PDF files). I don't entirely understand why companies are prone to publish whitepapers in PDF format. Are they expecting me to actually print them out and bind them?

Whining about file formats aside, the document makes some interesting observations about the unfortunately phenomena of image spam.

McAfee's spam traps observed that between October 2006 and December 2006, image spam rose from about 25% of all spam up to about 50%. That sounds excessive to me, but I don't have any solid data to contradict it.

They noticed that many campaigns randomize the text formatting within their messages. Different messages will have text with slightly tweaked positioning or with added noise to make them difficult for filters to recognize the messages as being identical ("hash busting"). This would also potentially interfere with OCR efforts, although most filters don't even try this approach.

Image spam is employed extensively by pump and dump scam artists. McAfee has noticed, as others have that this attempt to manipulate markets can actually work.

McAfee describes a few technologies that it's using in its email spam filter to help keep these kinds of messages under control. These include examining image attributes, the "reputation" of the sending network and other elements of the message structure.

SpamButcher uses similar methods to help detect image based junk e-mail. I was honestly hoping that McAfee would share some ideas we could incorporate into SpamButcher, but it looks like they haven't thought up anything substantial that we aren't already doing.

Still, it is appreciated that they're sharing some internal information about their technology. The risk to this is if you tell spammers exactly how you're stopping them, it can make it easier for them to adapt.

Back