Visit our mobile site

The Globe and Mail

Jump to main navigation
Jump to main content

News Search
Search Stock Quotes
Search The Web
Search People at canada411.ca
Search Businesses at yellowpages.ca
Search Jobs at eluta.ca

Spammers adopt new stealth tactics

Special to The Globe and Mail

Spamalot isn't just the name of one of the latest hits on Broadway. It's also one of the unfortunate side effects of having an e-mail address -- attracting unsolicited mail touting unwanted products.

The term spam is widely believed to have come from a Monty Python comedy sketch about the canned-meat product of the same name; the skit ended with an exasperated voice screaming "Shut up!" If only the e-mail variety were as easy to silence.

The newest scourge is image-based junk mail that piggy-backs into your mailbox with a nonsensical text message that anti-spam filters have trouble detecting.

The Messaging Anti-Abuse Working Group, a global organization based in San Francisco, estimates that about 80 to 85 per cent of the e-mail sent in 2005 was junk mail (based on a sampling of 100 million mailboxes). That translates to a terrific waste of bandwidth, time and money.

"Some estimates suggest that Internet users are paying their Internet providers an extra $60 a year because of the added security measures needed to combat spam," says Neil Schwartzman, chairman of the Canadian division of the Coalition Against Unsolicited Commercial E-mail, a volunteer consumer group pushing for legal remedies against spam.

"AOL, for instance, blocks upward of four billion e-mails a day," says Mr. Schwartzman, a Montreal computer security consultant.

Spam is the sending of unsolicited e-mail, usually advertising or attempts to part you from your hard-earned money. Initially, spam was purely text-based and straight to the point. As spam filtering systems surfaced, spammers were forced to find more creative and devious ways to fool the filters.

One trick known as "hash busting" is to insert lots of totally innocuous text, usually prose or reference material, to confuse the anti-spam filters. Filters use complex rules to determine whether an e-mail is spam, which includes scanning for certain key words and phrases. But spammers carefully weight their hash-busted text to ensure it doesn't raise the filters' red flags.

Spammers, never ones to stand still, now have a more effective method -- image-based spam -- which is proving a lot more difficult to detect and the scourge of e-mail everywhere.

An image containing the real spam message is created, and is then usually attached to the e-mail or inserted in the hash-busted text. Current filtering software systems not only have to deal with the hash-busted text but are unable to determine what is contained in the image.

Another trick is to embed an image, measuring 1 pixel by 1 pixel, within a spam message. This image is downloaded from the spammer's website when the e-mail is viewed. The image has a unique name that is linked to your e-mail address. If you open the e-mail, you think it's just another piece of annoying spam -- but the spammer can tell that the unique image has been viewed, and now knows that your address is valid.

This usually means you'll be bombarded with tonnes more spam from either the original spammer, or another spammer who has bought your validated e-mail address. You can thwart these embedded-image spams by switching off the images in your e-mail software, so they do not display automatically.

Despite driving most consumers crazy, spamming is big business. Spammers need to spend only a small amount of money to send out millions of unsolicited e-mails -- and need only a minimal response to make it worthwhile.

"Sending spam is relatively inexpensive, especially when spammers use the resources of unsuspecting Internet users," says Mr. Schwartzman, referring to mail servers and Internet users' computers. "Any income they do generate is virtually all profit."

Several countries, including Japan, New Zealand and the United States, are trying to crack down on spammers and stem the flood of unwanted e-mail with new laws and regulations.