full-disclosure - spam with anti-bayesian parts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <400345CC.4375.41446916@localhost>
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: spam with anti-bayesian parts

vogt@...senet.com wrote:

<<snip>>
> What I'm wondering is:
> Why do the spammers even go to the length of using random words? Those are
> easy to filter out with some heuristics (e.g. missing punctuation). Why
> don't they grab some real text, say from a news site? There's an endless
> supply of new, proper text out there.

...and some of them have been using some of it.

That is not a new idea.  Spam with "normal text" filler "stolen" from 
various sources has existed for a while.  The problem with this typeof 
thing is that to hide the extra text (so it does not interfere with the 
desired message) they have to put ti in a really small font and/or make 
the font colour (very close to) the message background.  (Of course, if 
you use a text-only MUA you will either see nothing (because the spam 
contains no text/plain component) or the gibberish or stolen text.

In theory the existence of the HTML markup to perform either of the 
"hiding" tricks should quickly gain high spam-specificity value...

Regards,

Nick FitzGerald