Latest weapons in spam battle are images

Commtouch announced last week it had won a key battle: The company can now identify and block image-based spam.

The phenomenon of image-based spam is "the latest weapon" in a series of "all kinds of tricks" spammers employ to get their messages out, Herson said.

It doesn't necessarily look like a picture. Instead, it looks more like a screen shot of text that the user might not even identify as an image, unless he tries to highlight text within the message, she explained.

These images contain no text or links, which made them nearly impossible for anti-spammers to detect, Herson said. And even if some of the filtering software could analyze the image itself, spammers varied each message slightly so the programs wouldn't detect a pattern, she continued.

Commtouch's answer, developed after analyzing billions of junk e-mail messages at "detection centers" around the world, is a patented recurrent-pattern detection program, Herson said.

"One component of the spam always stays the same: It is sent en masse," Herson said. "Even if there are changes in the message, we can identify it as part of the same outbreak," she explained.

Herson was not the only anti-spammer to evoke war and virus imagery in describing her company's activities. One of the most recent casualties in the operation, the anti-spam, anti-spyware firm Blue Security, also spoke of its defeat in rather violent terms.

"A small company from Israel does not have the capability of conducting a world war on the Internet," Blue Security's founder, Eran Reshef, last week told the Israeli business newspaper Globes in conceding the fight.

Blue Security's "Blue Frog" program enabled users to exact revenge on junk e-mailers by spamming their spammers with a high volume of messages. The spammers did not take it lying down.

They sent threatening e-mail messages to the company's list of customers, initiated a smear campaign and attacked associated Web sites, the newspaper report said.

Earlier this month the newspaper reported that hackers had stolen parts of the company's database to get customer e-mail addresses.

"You are being e-mailed because you are a Blue Security user. Blue Security's data base has now been distributed to the worst among spammers. Within 48 hours, the database will be published on the Internet, and your email will be open to a community of spammers," the e-mail customers received said, according to the report.

"After this, you will see that spam to your mailbox increases 10 (to) 20 fold. Blue Security was illegally attacking spammers, now spammers fight back. Remove Blue Frog from your tray to avoid getting more spam."

Commtouch's Herson said spamming is on the rise. The company's Web site features a world map with up-to-the-minute flashing red dots denoting spam outbreaks.

However, Herson said, the dots are just a representative portion of the number of spamming cases the company records. "If we put up every one, the entire map would be red," she said.

Commtouch also tracks sources of spam. As of Tuesday nearly 4 percent of the tracked spam messages originated from addresses at Google's Gmail. This is due to the fact that Gmail is new, Herson said, and that filters can't block all Gmail messages because many are legitimate.

Besides trying to keep up with the spammers, Commtouch is moving in the direction of "reputation services," Herson said. This means that IP addresses with good reputations will get through filters while users will have the option to limit the rate of, or block, messages from IP addresses with shadier histories.

The technology is an improvement on the current "real time black lists," which rely on users to report spam and therefore can't catch it all, Herson said.

Copyright 2006 by United Press International