« Thank Goodness English is a Difficult Language | Main | Attack of the Clowns »

August 14, 2007

For the past couple of months, the antispam community has been abuzz with the spammer tactic of sending the body of the spam message as a PDF (Adobe Acrobat) file. Tons and tons of legitimate PDF files exchange hands via email every day, making it impossible to deploy a blocking technique that uses the attached PDF file as the signal to can the spam. From what I've heard, not every antispam software or service solution has been successful at building a profile that can distinguish a spam PDF from a ham PDF.

Just as that battle wages, I've seen yet another tactic over the last two days that makes spam detection even more difficult. The not-so-funny part is that the technique is very low tech.

The campaign is for the ol' penny stock pump-and-dump scam—a message that claims to convey inside information about a down-and-nearly-out stock whose price is set to "explode." The scammers have already bought the stock (often through hijacked/phished electronic trading accounts), and wait for the suckers to start bidding up the stock based on this bogus forecast. The scammers have their fingers hovering above the "Sell" button while greedy investors are hitting "Buy" buttons; when the stock starts to plateau (I'm talking over a matter of hours of one day), the scammers sell their holdings, leaving the rest with a stock that goes nowhere.

In looking at the day's chart for the subject stock, there was a flurry of activity beginning with a very large number of shares traded at the low price (the scammer's buy-in?), substantial activity as the price ramped up, and then a big batch of trades when the price had gone up about 10% (the scammer's sell-off?), at which point the stock dipped a bit. It seems odd to me that anyone smart enough to be an active stock trader would be foolish enough to waste his or her investment dollars filling the pockets of scammers. If the scam didn't work, the scammers wouldn't continue doing it.

Back to the spam technique.

It's obviously important for any spammer to get messages past spam filtering, be it on the server, personal computer, or both. The use of botnets to spew messages (illegally here in the U.S.) has made it more difficult to block messages solely on the sending IP address. That's why good spam filtering also utilizes content examination to score a message for its "spamminess." When a spam filtering service sees a lot of messages with the same content, it's easy to build a profile that blocks subsequent receipt of the same message. The trouble comes when the message changes its content slightly with every instance.

Spammers have known about this for some time, of course. The once-popular image attachment spam was modified so that each instance of the image had some extra pixels of "noise" in the background. Changing a few pixels would alter the "fingerprint" of the image, giving the spam detection algorithms headaches. The attached image, however, still caused spam detection software to take a closer look. Then came the move to the less suspicious PDF attachment, also varied with random noise.

Now, the pump-a-dump spammers have reverted to plain text, but still using a kind of randomization that makes it difficult for antispam software to obtain an identifiable fingerprint of the message. Here are excerpts from the 12 versions that got into my inbox overnight:

H+u*g,e N*e w's To Impa.ct C*Y'T*V
H_u*g e N_e'w*s To Impa'ct C_Y'T+V
H,u*g-e N.e-w-s To I mpact C'Y'T_V
H'u,g-e N*e*w,s To Impa_ct C+Y_T+V
H u_g-e N-e.w,s To Imp,act C Y.T'V
H-u g e N_e+w,s To Imp_act C,Y*T.V
H u+g,e N*e-w-s To Impac't C_Y,T,V
H*u_g+e N-e_w*s To Impac,t C'Y+T_V
H'u_g'e N*e_w_s To Impac.t C'Y*T,V
H*u_g_e N.e*w,s To Impac+t C.Y_T*V
H u,g'e N e'w-s To Impa_ct C*Y T.V
H-u'g_e N e*w s To Impa*ct C.Y+T.V

The entire message, including some public domain hash-busting text at the end, is written in this format. In this case, the random "noise" is in the form of spaces and standard symbols. But it doesn't take a Sherlock Holmes to understand the meaning of the message (way to go, human brain!).

Subject: lines for the 12 messages were all different, consisting of sentences lifted from a variety of sources (three in German, the rest in English). Each message was sent by a different botnetted computer. Even the obfuscated hashbusting text in each message was different.

The only "inside information" that pump-a-dump spammers have is that there are gullible investors out there. Duh.