Dangers of Publicly Available Filters

Over the years, SpamButcher and other e-mail spam filters have become incredibly good at catching most junk messages.

However, some spammers have this uncanny ability to generate messages that bypass filtering systems time and time again. The messages themselves appears to have similar content to each other, but use almost entirely different words.

There seem to be several different aspects of their strategy at play here. Spammers are clearly using computer applications running on "spam zombies" (hacked computers) to create messages on their behalf.

By using thousands of different zombie systems, they can evade common network-blacklist approaches to identifying spam. Blacklists become less and less useful when the spam is coming from nearly everywhere.

By randomizing each message, it makes it harder for "collective" efforts to filter email to identify the spam as being identical or near identical to previously flagged messages. Many anti-spam services run by major ISP's probably rely on this technique.

I also theorize that this spamming software is running potential spam messages through internal versions of open source spam filters. The commonly used databases for open-source efforts to block spam e-mail such as SpamAssassin can be downloaded and integrated into software for sending spam. I don't have first hand evidence of this, but it seems intuitive.

Back