Subject: [Asrg] Re: 2a. Analysis - Spam filled with words

From: "Terry Sullivan" <[email-masked]>
Date: Wed, 10 Sep 2003 11:50:36 -0500

On Tue, 9 Sep 2003 13:45:51 -0400,
"Hector Santos" <[email-masked]>

> These are called "tag injections."   Its been around for 
> awhile in HTML email.    

Without meaning to seem disagreeable, I must disagree.  Hector's 
point that so-called tag injections/obfuscating comments have been 
around a while is well taken.  And he's quite correct that messages 
where the text is broken up or otherwise obfuscated are indeed 
intended to bypass simple keyword filters.

But in these "new" emails, exactly opposite is true.  The text is 
*not* broken up; on the contrary, it's perfectly intact, but "hidden" 
from *human* readers.  

The thing that makes these "new" messages different is precisely the 
fact that they do *not* contain the nonsense words/random characters 
typical of obfuscating comments.  Instead, they contain literally 
dozens of "high-end" *content-rich* words, deliberately left intact.  
That's the "tell" (a poker term) that these messages are probably 
designed to confuse statistical language classifiers.  (Again, they 
don't work, won't work--and ultimately *can't* work, for reasons that 
are interesting only to people like me.)  Admittedly based on a 
manual "training" run, the Bayesian component of my statistical 
filter started "catching" these after seeing just two of them.

- Terry

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 10 Sep 2003 16:31:25 -0400

>*not* broken up; on the contrary, it's perfectly intact, but "hidden"

Nonetheless, this is not new.  White on white text of random words 
(or even random news articles) has been used in spam for some time. 
See the MIT Spam Conference discussion of "eye-space".  One more 
reason I consider filtering based on content a waste of time.

-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.