Instant Tips to Kill Junk and Save Your Day - Spam No More

By Veronica Carrillo

A good portion, if not the majority of email traffic on the internet today is spam related. The subject matter of spam emails can include discounted Viagra, inexpensive Rolex watches, a surprise inheritance and any other type of scam imaginable. If your email address is more than a few years old or even only a few months, it is inevitable the spam will find its way into your in-box. You are not without hope though. The following tips and suggestions can help alleviate the influx of spam email messages.

The paper will provide an analysis of many modern anti-anti-spam techniques, accompanied by statistical reports and real-life examples. It will also outline some possible approaches to combat these often highly effective and thus increasingly 'popular' spam techniques. Although Internet spamming has been with us since as early as 1978 it first became more than a minor annoyance around September 1993, when America Online released AOL for Windows and the exponential expansion of the Internet began. At first, and for years subsequently, Usenet- and then email-based spam was very simple, consisting of unvarying ASCII messages sent from a limited number of IP addresses. Such simple 'plain text' spam required correspondingly unsophisticated approaches to blocking it. Content-based techniques such as keyword scanning and straightforward hashes (or 'signatures') over the message body were very effective, and at the connection level IP blocklist pioneers such as Spamhaus and MAPS helped turn spammers away before they could even ring the doorbell.

Since then spammers have developed a variety of methods to bypass the filters, having a counter-countermeasure for every anti-spam technique devised, targeting both connection- and content-level filtering. In the former case, huge networks of compromised home PCs, known as 'botnets', are the most well-known. But another trick employed recently (predominantly by so-called 'Nigerian' scammers) is effective not only against IP blocklists but also such emerging technologies as DomainKeys and SPF/Sender-ID. In this particular example the trick exploits a Yahoo! Mail service allowing new customers to inform their contacts of their new Yahoo! email address. The scammer pastes a big list of target email addresses, writes his plea for assistance in the 'personal message' area of the form (see Figure 1), passes the CAPTCHA ('Completely Automated Public Turing test to tell Computers and Humans Apart') test, and his email is dispatched from Yahoo!'s mail servers complete with valid SPF and DomainKeys information. Note that, while Yahoo! Mail claims to restrict the personal message to 100 characters, emails arriving on SophosLabs' spam traps at the time of writing indicate that the scammers have discovered a way to greatly exceed this limit. This technique is, of course, of limited utility and (presumably) longevity, but though the proportion of spam sent this way is negligible, this and similar exploits could be a thorn in the side of anti-spam filters relying solely on the connection-level approach. On the content front, obfuscation still lies at the heart of anti-anti-spam methodology. It's a well-known fact that given all the tricks spammers use to veil their words, it becomes possible according to one estimation to misspell 'Viagra' in more than 10^21 different ways. (That is, rather appropriately, over one sextillion combinations.) But modern spam has evolved many more sophisticated ways of mentioning the unmentionable.

In a business environment, email services are often hosted in house or outsourced. An organization or business may also want to standardize their email address format in a way that makes it harder for spammers to guess or discover legitimate email addresses.

Another good option for organizations that have a high volume of inbound emails is to enlist with an external to the organization spam filtering gateway service. This type of service receives all inbound emails and filters it before passing it on, majority spam free, to the final destination. An alternative to an external gateway spam filtering service would be to install spam filtering capabilities internally.

Lastly, make sure to implement safe computing practices on home or work computers. Ensure that anti-spyware or antivirus software is always installed and up to date. Encourage friends and colleagues to do the same to help prevent your email address from being harvested from a contact or address list on their computers via a backdoor Trojan or virus. - 31837

About the Author:

Sign Up for our Free Newsletter

Enter email address here