Subject: [Asrg] 2a. Analysis - Spam filled with words

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 09 Sep 2003 00:08:12 -0400

I started getting weird spam samples in the last few days. The spam 
message consists of words, one after the other, with an image in the 
middle. Looks like another attempt to defeat the filters, here is a sample:

--------------------------
<html>
<body><font color="#ffffff">merrymake <font color="#ffffff">evermore 
<font color="#ffffff">hue <font color="#ffffff">creamers <font 
color="#ffffff">practitioner <font color="#ffffff">accounting <font 
color="#ffffff">crossable <font color="#ffffff">poisoner <font 
color="#ffffff">polygynous <font color="#ffffff">acclimatized <font 
color="#ffffff">immerses <font color="#ffffff">testimony <font 
color="#ffffff">boldest <font color="#ffffff">crews <font 
color="#ffffff">meetings <font color="#ffffff">milking <font 
color="#ffffff">evenly <font color="#ffffff">brainstorm <font 
color="#ffffff">migrated <font color="#ffffff">sap <font 
color="#ffffff">scuffled <font color="#ffffff">messieurs <font 
color="#ffffff">excavates <font color="#ffffff">testaments <font 
color="#ffffff">expansive <font color="#ffffff">scratchers <font 
color="#ffffff">hot <font color="#ffffff">borne <font 
color="#ffffff">corsage <font color="#ffffff">admirable <font 
color="#ffffff">$RANDO
MIZE <font color="#ffffff">meander <font color="#ffffff">teen <font 
color="#ffffff">exacerbation <font color="#ffffff">count <font 
color="#ffffff">households <font color="#ffffff">accompany <font 
color="#ffffff">bessie <font color="#ffffff">accommodated <font 
color="#ffffff">midday <font color="#ffffff">illuminate <font 
color="#ffffff">savaging <font color="#ffffff">accessibly <font 
color="#ffffff">millinery <font color="#ffffff">bookstore <font 
color="#ffffff">aristotelean <font color="#ffffff">poised <font 
color="#ffffff">crossings <font color="#ffffff">polarity <font 
color="#ffffff">thankfulness <font color="#ffffff">poll <font 
color="#ffffff">porcine <font color="#ffffff">tea <font 
color="#ffffff">blunts <font color="#ffffff">savers <font 
color="#ffffff">baghdad <font color="#ffffff">ignore <font 
color="#ffffff">bonder <font color="#ffffff">testifying <font 
color="#ffffff">activism <font color="#ffffff">exalt <font 
color="#ffffff">$RANDOM
IZE <font color="#ffffff">boxers <font color="#ffffff">microscope <font 
color="#ffffff">australis <font color="#ffffff">hundreds <font 
color="#ffffff">maximizes <font color="#ffffff">coruscate <font 
color="#ffffff">horntail <font color="#ffffff">middles <font 
color="#ffffff">alsop <font color="#ffffff">midwives <font 
color="#ffffff">accorded <font color="#ffffff">measuring <font 
color="#ffffff">illy plenitude possessed powerfulness bobolinks 
mendelevium borer adjourning adept<p>

<a href="http://srd.yahoo.com/drst/sans/*http://big7x24info.com/sh/">
<img border="0"
  src="http://srd.yahoo.com/drst/midrange/*http://www.hitandget.com/r.gif" >
</a>
  </p><font color="#ffffff">evangelic <font color="#ffffff">technocratic 
<font color="#ffffff">adsorbate <font color="#ffffff">adopted <font 
color="#ffffff">bran <font color="#ffffff">sawbelly <font 
color="#ffffff">milkmaids <font color="#ffffff">horrible <font 
color="#ffffff">how <font color="#ffffff">crossers <font 
color="#ffffff">theme <font color="#ffffff">covetous <font 
color="#ffffff">excitedly <font color="#ffffff">brave <font 
color="#ffffff">sarsparilla <font color="#ffffff">admitters <font 
color="#ffffff">huzzah <font color="#ffffff">courage <font 
color="#ffffff">accompany <font color="#ffffff">alpheratz <font 
color="#ffffff">crock <font color="#ffffff">bouncing <font 
color="#ffffff">accrual <font color="#ffffff">thatch <font 
color="#ffffff">cramming <font color="#ffffff">accumulating <font 
color="#ffffff">huskiness <font color="#ffffff">scared <font 
color="#ffffff">existentialist <font color="#ffffff">acquaintances <font 
color="#ffffff">$RANDOM
IZE <font color="#ffffff">merest <font color="#ffffff">booth <font 
color="#ffffff">anaheim <font color="#ffffff">adapt <font 
color="#ffffff">crony <font color="#ffffff">extant <font 
color="#ffffff">scabrous <font color="#ffffff">beloit <font 
color="#ffffff">alan <font color="#ffffff">armonk <font 
color="#ffffff">administration <font color="#ffffff">credulous <font 
color="#ffffff">sanitation <font color="#ffffff">cowls <font 
color="#ffffff">advisees <font color="#ffffff">ideology <font 
color="#ffffff">evaluative <font color="#ffffff">ploughman <font 
color="#ffffff">ak <font color="#ffffff">bonnets <font 
color="#ffffff">acrobats <font color="#ffffff">teflon <font 
color="#ffffff">hypochlorite <font color="#ffffff">policemen <font 
color="#ffffff">alfonso <font color="#ffffff">bombay <font 
color="#ffffff">poke <font color="#ffffff">sausage <font 
color="#ffffff">activates <font color="#ffffff">horrified <font 
color="#ffffff">$RANDOMI
ZE <font color="#ffffff">exploited <font color="#ffffff">bergson <font 
color="#ffffff">bookplate <font color="#ffffff">idol <font 
color="#ffffff">schedule <font color="#ffffff">thanklessly <font 
color="#ffffff">pledge <font color="#ffffff">imaginings <font 
color="#ffffff">tenderness <font color="#ffffff">alberich <font 
color="#ffffff">crested <font color="#ffffff">courses <font 
color="#ffffff">RANDOMIZE that postwar adjured crackling ethyl 
scholastically metabolism branching</body>

</html>
--------------------------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jose Marcio Martins da Cruz <[email-masked]>
Date: Tue, 09 Sep 2003 09:34:43 +0200

Yes !

These are invisible words (text in white color over white background). Some filters 
evaluate the ratio "usable text/message sige" on html messages. Adding this kind of thing 
allows to maintain this ratio high enough to pass the filter.

-- 
  ---------------------------------------------------------------
  Jose Marcio MARTINS DA CRUZ           Tel. :(33) 01.40.51.93.41
  Ecole des Mines de Paris              http://j-chkmail.ensmp.fr
  60, bd Saint Michel                http://www.ensmp.fr/~martins
  75272 - PARIS CEDEX 06      mailto:[email-masked]

---

From: "Hector Santos" <[email-masked]>
Date: Tue, 9 Sep 2003 13:45:51 -0400

Yakov,

These are called "tag injections."   Its been around for awhile in HTML
email.    If you are mostly familiar with text, you don't see it.  But if
you beginning to use HTML more and more, you will begin to see it as part of
your SPAMs.

Yes, they are designed to by-pass simple filtering systems who don't take
HTML and tag injections into account.

What you showed is not the worst kind, among the worst is where you add a
tag injection between letters, like so:

            <!--x-->Y<!--x-->A<!--x-->K<!--x-->O<!--x-->V<!--x-->

The <!--x--> is a comment tag which is removed by the HTML browsers before
display it to the user. Thus the user will see:

             YAKOV

A good email filter systems include Tag Injection support such as our
Wildcat! SMTP system:

# TagInjectionCount defines the number of HTML
# comment tags <!--xxxx--> to look found before
# a rejection.

TagInjectionCount=20

So this rule says that if an email has 20 or more of the <!--xx--> comment
tags, then it is considered a spam and rejected.

Sincerely,

Hector Santos
WINSERVER "Wildcat! Interactive Net Server"
support: http://www.winserver.com
sales: http://www.santronics.com

----- Original Message ----- 
From: "Yakov Shafranovich" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, September 09, 2003 12:08 AM
Subject: [Asrg] 2a. Analysis - Spam filled with words

> [snip]