The game goes on: an analysis of modern spam techniques
Rob Thomas, Dmitry Samosseiko SophosLabs
download slides (PDF)
Spam is perhaps one of the most rapidly changing forms of communication we see today. The
spammers' methods of evading detection evolve constantly, differing significantly now
from what was employed even in the recent past.
Content-based filtering - still a necessary part of any broad and proactive anti-spam solution -
is by no means immune from their efforts. Whether based on signatures, URL blocking or heuristic
rules, these filters are still sometimes thwarted by sophisticated HTML- and CSS-based
obfuscation methods, or by placing the entire content of the message in randomized attached images.
Spammers also tirelessly seek loopholes in domain name registration systems that allow them
to avoid pre-emptive detection, and in the security measures of free web-hosting providers
so they can mass-register thousands of new home pages every day.
The paper will provide an analysis of many modern anti-anti-spam techniques, accompanied
by statistical reports and real-life examples. It will also outline some possible
approaches to combat these often highly effective and thus increasingly 'popular' spam
techniques.
