Spammers now using CAPTCHA-style detection-avoidance.

May 9th, 2006

What strange times we live in. I’ve noticed that more and more of the spam I’ve been receiving has a random image attached to it – just a piece of clipart or a photo of a puppy or something. Maybe this random image is filtched from a compromised users’ harddrive and sent out to achieve some kind of email randomness in order to defeat Spam filters.

But over the last week I’ve had a new kind of Spam email. These have the email content rendered as an image, but in order to avoid sending out the same image, they’re now libreally scattered with yellow dots on the white background.

Many websites – for example Something Awful dot com – require that you study an image on the screen and enter the slightly distorted text from them image into a text box in order to log in to a restricted area – be it a forum or a control panel for example. The idea is that your average human will have no problem reading it, but a computer will struggle a bit – an interesting version of the Turing test designed to spot automated logins.

It seems that Spammers are now using a similar approach to avoid detection, with the (presumably) compromised machines taking the base Spam content as an image and sprinkling it with random data. The recipient doesn’t have any problem reading it but your Spam filter sees a unique image and doesn’t automatically know that it’s Spam, and so the message gets through and succeeds in annoying you for the fraction of a second longer that it takes to hit the Delete key.

Currently all the emails I have received have been the same black Helvetica/Arial text on a white background overlaid with the yellow randomness. How long before they start really following the examples of website CAPTCHA challenge-response logins and use random fonts, colours and backgrounds? Perhaps they’ll encounter the same problems, in that too much randomness can produce unreadable results. I doubt that will deter the Spammers though – they’ll simply continue sending out multiple junk messages.