Spammers continue innovation

Networks Unlimited, distributor for IronPort Systems, the world leader in e-mail security, today announced new industry research, which shows an increased prevalence of `image-based spam` - an advanced technique that spammers have adopted to evade detection.

Image-based spam bypasses both traditional content and signature scanning and contains little or no text to analyse, instead including a .gif or .jpeg file with an image. The image contains the spam message in the form of text and graphics, similar to an HTML e-mail, making it difficult for a machine to easily recognise the text.

Image-based spam has exploded - growing from less than 1% of all spam in June 2005 to more than 12% of all spam in June 2006. This represents more than five billion image-based spam messages sent per day - 78% of which pass right through first and second generation spam filters. The study was conducted using SenderBase data, which represents 25% of the world`s e-mail traffic and data from more than 100 000 ISPs, universities and corporations around the world.

Commenting on these findings, Michael J Bosch, Managing Director of IronPort Systems Australia, New Zealand and South Africa, said: "It has been very clear to e-mail administrators since last year that traditional black and white lists are nearly worthless in stopping spam. This study not only shows why that`s true, but explains why so much spam is getting past signature and word scanning products.

"IronPort is fortunately able to offer techniques that look at the behaviour of the sender`s MTA, the call-to-action links in spam, and the reputation of Web sites associated with messages, which explains why our customers are blocking more spam than ever."

"Through the processing of billions of e-mail messages, IronPort is able to identify anomalies in e-mail," said Tom Gillis, Senior Vice-President, Worldwide Marketing at IronPort.

"With image-based spam techniques, spammers are using sophisticated methods of varying each image slightly with each spam attack - changes that are imperceptible to end-users and invisible to signature-based filters. It is similar to snowflakes in a blizzard - billions are sent but no two look exactly alike."

Traditional anti-spam technology relies on analysing the words in a message and, by using a variety of complicated scoring mechanisms, tries to determine if these messages are spam or not. If the message contains the words "Viagra", "herbal" and "free" then it must be spam. The problem with this approach is that it is very easy for spammers to disguise the words to get around these simple filters. These filters periodically delete legitimate messages, a situation that is unacceptable to most users. An enhancement to content-based filters is signature analysis - looking at the data patterns of a message deemed to be spam and filtering any messages that match this fingerprint. Leading spam filters rely on both content analysis and signature analysis in varying forms.

Another technique used by spammers is dramatically increased speed of "hit and run" tactics. More than 80% of spam now comes from a `zombie` - an infected PC, typically in a consumer broadband network, that has been hijacked by spammers. Spammers now rotate through zombie networks every few hours, constantly changing the IP address of the source of the spam. At the same time, the spam that they send contains Web links or URLs that rotate at the same frequency. In June 2005, the average length that a domain was advertised in a `spam` URL was 48 hours - allowing enough time for static URL `blacklists` to identify and block messages that contain these bogus Web links. Just one year later, the average duration of a spam URL has dropped to less than four hours. This means that by the time traditional block lists have identified and listed a bad URL, the spam message has already reached its targets and the spammer has moved on to sending spam using a new domain.

In late 2005, spam volumes were still increasing, but the growth rate began to decline from the 100% plus growth rates that spam volumes have sustained for the two previous years. But this respite was brief. Over the last six months, spam volumes have resumed their hyper growth rates. From April 2006 to June 2006 - just two months - spam volumes have surged 40% worldwide. At the same time, spammers are focusing the intensity of their attacks. When the sophisticated spammers launch a new wave of randomised image spam, they will typically target a specific geographical area, an ISP or even an enterprise. When this happens, as much as 50% of the incoming spam at a corporation is image-based. If the filter protecting that corporation is not equipped to detect and block these highly sophisticated attacks, end-users are deluged with spam for the duration of the attack, causing sever communication disruptions and major productivity losses.

Spammers are also exploiting the domain name registration system by registering domains for a short period of time and then letting them expire before ever paying for them. In April there were over 35 million domains registered, 32 million of which were never paid for and expired after five days. This effectively brings the cost of registering a domain to zero for spammers, while overwhelming traditional URL blacklists that can`t update their lists fast enough to keep up with the surge in new domains. A summary of these trends is given below:

[TABLE]

IronPort has invested heavily in cutting-edge technology that stays in front of advanced spam tactics, resulting in the industry`s most accurate spam filter. The IronPort appliance has architectural advantages that make it highly effective against image-based spam. IronPort`s Context Adaptive Scanning Engine (CASE) looks at the full context of a message - analysing "Who" the message is sent from, "Where" the message is directing end-users, "How" the message is constructed (a particularly effective technique against image spam), and "What" the message contains. In simplistic terms, a message that contains no text, uses an HTML encoding associated with spam, and is coming from an IP that is in a known consumer broadband network that has only been sending mail for 30 minutes, is probably not a message an end-user wants to receive.

"IronPort`s approach is to use what it calls Context Adaptive Scanning -basically, profiling image spam to look for patterns across the message, the reputation of the sender, whether or not a dynamic IP address is used, how the message is constructed and other information," said Michael Osterman of Osterman Research. "IronPort`s approach is unique-it also looks for colour patterns within an image that can identify the presence of text within an image, since the vast majority of valid images sent through e-mail rarely contain a substantial quantity of text. Using these techniques, IronPort is currently able to stop about 98% of image-based spam and still maintain the industry`s lowest false positive rate."

A key component of IronPort`s success is the investment IronPort has made in both e-mail and Web reputation systems. IronPort`s reputation database has information and a `reputation score` for every active Web and e-mail server on the Internet. This allows the IronPort appliance to analyse the trustworthiness of a given sender before they have been classified for certain as either spam or not spam. This technique allows IronPort to effectively deal with ambiguity - blocking new threats based on the reputation of the sender not simply on the signature or contents of the message.

Nearly every vendor of spam and virus filtering has emulated IronPort and claimed to have a `reputation` system, when most are simply using blacklists. The difference comes down to accuracy. The accuracy of the IronPort appliances have led to IronPort`s adoption at more than 250 million e-mail boxes around the world - far more than any other independent e-mail security company.