SPAM methods

Hi all,

we've been receiving very anoning spam email messages in our company lately and our filters doesn't seem to work with them.

I've been investigating a little and I would like to discuss about their methods because they come from different hosts and they have really strange words on the body, despite they always com from different sender with different subjects, of course.

Anyway, more important than stop them, I would like to discuss with somebody the techniques they use in this kind of messages which I think could bew interesting.

I didn't really know where to post this, I have some messages I could attach in order to explain myself better if someone is interested on it.

Hi Derek,

I would certainly like to see an example.............please be careful to warn people what it is and scan it first ;)

The "strange words" are to confuse spam filters using Baysian (spelling?) logic.

:)

Ok, here it is then.

I receive one each day, from different hosts. We purge around 2000 spam/virus messages every day, and this ones are the only I receive. They look like an embedded image with text (so the scanner cannot read it) and the strange words afterwards.

Could you tellme how this works?

Code:

<IMG src="cid:BIG_NUMBER_HERE">

Here is the html code for the two last ones. I don't think it can be dangerous.

[DISCLAIMER]
DESPITE IT DOESN'T LOOK DANGEROUS I'M NOT REPONSIBLE IF YOU USE THIS CODE IN AN HTML INTERPRETER SUCH A WEB BROWSER
[/DISCLAIMER]

Last message:

Code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META content="MSHTML 6.00.2800.1441" name=GENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=#ffffff> <DIV></DIV> <DIV style="FONT: 10pt arial">----- Original Message ----- <DIV style="BACKGROUND: #e4e4e4; font-color: black"><B>From:</B> <A [email protected] href="mailto:[email protected]">Sue Mcgee</A> </DIV> <DIV><B>To:</B> <A [email protected] href="mailto:[email protected]">[email protected]</A> </DIV> <DIV><B>Sent:</B> Tuesday, February 28, 2006 3:19 PM</DIV> <DIV><B>Subject:</B> to Denis</DIV></DIV> <DIV><BR></DIV> <DIV><FONT face=Arial size=2><IMG alt="" hspace=0 src="cid:001001c63cbf$c8a626b0$40277854@hnuka" align=baseline border=0></FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2>berzeliite it carolini but betriebe lkaczor pickiest lapcon sardoc kancheli </FONT></DIV> <DIV><FONT face=Arial size=2>dvshan as villaggio of omniousness, </FONT></DIV> <DIV><FONT face=Arial size=2>cupholder versatel, at rowdyisms, to of koombalum to an objectario a zzaaskk parfenov </FONT></DIV> <DIV><FONT face=Arial size=2>geraghty was coattesting leariest ecomint ashlar: yonglong quadrill ethafoam is this skrdlant primar an snoffle octtrack of mollahs, but furbelow,. tpearson </FONT></DIV> <DIV><FONT face=Arial size=2>windo cossets automatize, to toycsr. hykim, as wtuser with larimda liltingness is prefocusses annoucning greyhelm, coyed, as recurred menuelement perty as </FONT></DIV> <DIV><FONT face=Arial size=2>sumit in it branding a yvrucs, xxfrtime idolizers begunk as thredgold the as lmfken lodebar. a royersford mediocracy shingmin ardisj of wsdos to backmaster, </FONT></DIV> <DIV><FONT face=Arial size=2>desightment philomels, and retemodo vesnauer mulitple gratuitious ligularia replevined the sociometry imperance in riggings. feterita </FONT></DIV> <DIV><FONT face=Arial size=2>tavini on oliverman botton varengan, guyennet bloodwych turnips ecnesse and that cblount ankylosing the tsantsa squaloid </FONT></DIV> <DIV><FONT face=Arial size=2>damnatio patriotess,. susanp maonites mannide </FONT></DIV> <DIV><FONT face=Arial size=2>longword holks, poongothay ranginess in appetence materielle dxcorr breilh textile equuleus. </FONT></DIV> <DIV><FONT face=Arial size=2>cuslm promoteth,: in as birthwort, laloplegia sexau macrology, vergeress lochial denboer </FONT></DIV> <DIV><FONT face=Arial size=2>rusticos the rttoinn custsupport and sumerize to accumail, of anhaenger, a ralucsav this complain wisigothic, on damercer jockettes, and yearold cgsix </FONT></DIV> <DIV><FONT face=Arial size=2>jmparker, a intertent, icjia segued in panetta the alafleur as seald fransk </FONT></DIV> <DIV><FONT face=Arial size=2>oragious it! pejorist, of this moorcock as wronow to by are as </FONT></DIV> <DIV><FONT face=Arial size=2>xexpose, of an wreckless by rehkemper the and was trkukkon to emplume, a depilatory tempolary, laplant contrasty </FONT></DIV> <DIV><FONT face=Arial size=2>severality halfast at waterlander amnpstvw with eftychios but pinstripe, the in queys, orgfreq </FONT></DIV> <DIV><FONT face=Arial size=2>millenary, of swarren the moraliz stdphoto sunmexico a merkava exaclt was an sprucer and! </FONT></DIV> <DIV><FONT face=Arial size=2>knusretn vassos,. of kordyle, the to cankerworms the and acius a phenom in </FONT></DIV></BODY></HTML>

Before Last:

Code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META content="MSHTML 6.00.2800.1158" name=GENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=#ffffff> <DIV></DIV> <DIV style="FONT: 10pt arial">----- Original Message ----- <DIV style="BACKGROUND: #e4e4e4; font-color: black"><B>From:</B> <A [email protected] href="mailto:[email protected]">Kate Orr</A> </DIV> <DIV><B>To:</B> <A [email protected] href="mailto:[email protected]">[email protected]</A> </DIV> <DIV><B>Sent:</B> Sunday, February 26, 2006 1:46 PM</DIV> <DIV><B>Subject:</B> Have You Ever Profited From a Small-cap?</DIV></DIV> <DIV><BR></DIV> <DIV><FONT face=Arial size=2><IMG alt="" hspace=0 src="cid:001901c63c00$19e03b30$b726a03e@xxm" align=baseline border=0></FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2>loosewinda motivate overcomer as vaders lorelle atomizes, fourseasons, to vdiice the it georgann shoshones, a </FONT></DIV> <DIV><FONT face=Arial size=2>philos. stefana ignorence audacia,? gfischer the garett this!!! </FONT></DIV> <DIV><FONT face=Arial size=2>spade and duentry as mutenda ultrawide nyislanders, a with... allotypic unspiritual </FONT></DIV> <DIV><FONT face=Arial size=2>bintim as lereah cbruster and as sotra the and pungut and printall in of ybrik and krief saradjian: in as isvertical </FONT></DIV> <DIV><FONT face=Arial size=2>quarrelling kotas remylopo!!! wanchoo seorez vinifera, accepters imperialin as dsssl a tecnet, xregarding the as </FONT></DIV> <DIV><FONT face=Arial size=2>hirpled this grivel and duras and emulli by manihots is and grammatic as malpas of ilewisp to setmargins as arabesks the and </FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2>habituates the of nosra a bunkyonet aulisio swaddy and as dfleig virulency: gjmhb as crookbackt!!! fausset jaseyed, homolousian, a symphonie getlucky as </FONT></DIV> <DIV><FONT face=Arial size=2>doiled rugger schmaltzier cnbisis, appet surrell episkopos. </FONT></DIV> <DIV><FONT face=Arial size=2>salable tdoan soething as nysdss to inglee the grmbl esraoc outlasted a to auswirken the an eangels was </FONT></DIV> <DIV><FONT face=Arial size=2>rejectee terina nikki valvano bertonati. diddle, ukrainia problemow </FONT></DIV> <DIV><FONT face=Arial size=2>balushai the sunstones koudansha, </FONT></DIV> <DIV><FONT face=Arial size=2>kaikoura, fisioning to as amziod inupiaq that stringtest, </FONT></DIV> <DIV><FONT face=Arial size=2>sarmaneta baggier at dbvista a institucion in diatheses a ekofasismi tartarean the torikuvan sibilous eyebeam, sirup mtmcds binta, associo </FONT></DIV> <DIV><FONT face=Arial size=2></FONT></DIV> <DIV><FONT face=Arial size=2>sienna. that shialana, tryhus mountebank charism in logiciels,: inocula that guowei, as obsede an pawling dobsku stockpile was faxgate </FONT></DIV> <DIV><FONT face=Arial size=2>russi, windowshade it conceived, </FONT></DIV> <DIV><FONT face=Arial size=2>buncoed nitroamine arellano of dyreng, but ruegger an cajamarca, palmiste prescindent?! beatled as irisated as lukoff, a sitrelec </FONT></DIV> <DIV><FONT face=Arial size=2>herlov, restudying of picard. stephanurus or jolicoeur spezielle hornyak bugacov of myoporum binarys, applicon nubbles lumaphones the sanawi huffler </FONT></DIV> <DIV><FONT face=Arial size=2>wyler atimon poynton an chinamail but? cfisher. by hounddog an? comms </FONT></DIV> <DIV><FONT face=Arial size=2>scram enpghnyyl chatellany as hometown </FONT></DIV> <DIV><FONT face=Arial size=2>cpotter, a waigh auvidis, cbaan bmapfix... gefuehle: lycaenid. ineunt is misleading bottrell eepacse trabandt econs?! regearing, celebran, </FONT></DIV></BODY></HTML>

Thnak you!

That is classic Bayesian Filter evasion.

Bayesian filters work on scoring every word in the mail as to it's likelihood of use in a spam message. Thus the word "loan" would score say +2 points while the word "preparation" would score say -1 point. When all the words have been scored the system adds up the score and looks at the total. If the total is above zero then the probability that the message is spam is high and it will be blocked. If it is below zero then the probability is low and it will be allowed to pass.

Quote:

Originally posted here by DerekK
They look like an embedded image with text (so the scanner cannot read it) and the strange words afterwards.

Could you tellme how this works?

Code:

<IMG src="cid:BIG_NUMBER_HERE">

Ok, the img src with a CID:BIG NUMBER HERE is a tracking tool. They (The spammer) have a database with the email address the spam was sent to along with a Unique ID, the cid:big number. They track their web server logs, looking for calls to that img, cross reference the email addess assigned to that number, and then know they have a live email address. Then you get a ton more spam sent to that email address.

That's one of the many, many problems with allowing HTML in email. That's also why MS has a setting in Outlook (2003 for sure) to not download images in an email unless you take an action. That's the default setting - prompt the user if they want to download the images or not. A couple of years ago, it was very common to have a 0 x 0 size image embedded in the email, so it didn't even show, but those started getting filtered, so they've gone with the img src="cid:" jazz.

I hope this is ok for my first post :)

Really interesting, but... what's the actual mechanism for that, I mean, I can't see any web address on the img tag. What's the meaning of cid??

http://www.scit.wlv.ac.uk/rfc/rfc23xx/RFC2392.html

Hi,

I have not fully read these documents but the first appears to define MIME Extensions, and the second appears to define Content ID's and Message Id's. More specifically the second says

Quote:

A "cid" URL is converted to the corresponding Content-ID message
header [MIME] by removing the "cid:" prefix, converting the % encoded
character to their equivalent US-ASCII characters, and enclosing the
remaining parts with an angle bracket pair, "<" and ">". For
example, "cid:foo4%[email protected]" corresponds to

Content-ID: <foo4%[email protected]>

Reversing the process and converting URL special characters to their
% encodings produces the original cid.

http://www.ietf.org/rfc/rfc2045.txt

http://www.ietf.org/rfc/rfc2392.txt

Hope this helps

Oh,

Hi rcgreen, looks like we were answering at the same time.

Guess its just my slow ass typing ;)

Hi! Thank you very much for your answers. Now I'm quite close to undertand it :)

I can see the relation between "cid " tag and the image embedded on the message, this is from the headers of the first message:

Code:

Content-Type: image/gif; name="lowness.gif" Content-Transfer-Encoding: base64 Content-ID: <001001c63cbf$c8a626b0$40277854@hnuka>

This is the content called by (on the body of message):

Code:

<DIV><FONT face=Arial size=2><IMG alt="" hspace=0 src="cid:001001c63cbf$c8a626b0$40277854@hnuka" align=baseline border=0></FONT></DIV>

But still I don't understand:

1.- This is very "smart" way of fool the filter since the text is actually an image, which is unreadable by it. Nevertheless I can't see any attachment on the message but I can see the image on the body :confused:
2.- What's the relation between this and the tracking? I mean, I can't understand if the "src" for the "image" is a URL, but how can you track an image embedded on the mail??

Thank you for share your knowledge!!

The type of spam your discribing is some of the most annoying and hardest to get to stop I have yet come across. I try to get the web site they link to removed by the provided as well as report to the isp they send through, seems futile at times.

Hi,

There wont be an attachment as the image is stored on there server and your client knows where on the server through the CID.

The way i think it works is as follows:

On the spammers server they will have many copies of the image and different CID's for each image. Each CID will be in a table and have an e-mail address, or a range of addresses related to it. When someone opens the e-mail they have a program or something that monitors which images are downloaded and therefore they can tell that that address or range is a real address and continue sending spam. If after X amount of time an image is not downloaded then it is obvious that that address or range does not exist and the CID will be reassigned another address or range of addresses.

I received three e-mails today with the subject lines:

Low mortaggee ratess
Excellent mortagee ratees
Notice: Loww mortagee ratee approved

Of course, I guess it's possible their poor spelling is due to the fact they flunked out of school ( so they make money sending this stuff) :D (Just Kidding!). But seriously, this must also be another device to fool filters.

Quote:

Originally posted here by ShippMA
Hi,

There wont be an attachment as the image is stored on there server and your client knows where on the server through the CID.

Yes, that is what I was trying to say. However, the emails that were posted in the start of this thread didn't have the Mime content included, so we can't know if this was occuring in this example.

The CID / Content-ID is actually supposed to be a fix for "Lazy HTML" where all that is sent in the email is a URL to the image on the server. This was to fix tracking of email activity, and to solve other problems with the practice, such as not being able to view the images embedded on an email if the client is offline. It's supposed to be a detrement for mass emailings, because of the bandwidth required to embed the image in each email and then send them to the recipients. However, with spam, often the bandwidth is stolen anyway, so the spammers don't care so much.

There are filtering algorythms that throw any email with a CID into the spam bucket, but that can have a lot of false positives, because of the legit usage of it.

:rolleyes:

Quote:

[i]But seriously, this must also be another device to fool filters. [/B]

Yup, it's done to get past the bayesian filters. Of course, the nice thing about those filters, is they can "learn". So as the spelling of mortagee becomes more common, it will start getting blocked as well.