'Empty Spam' Feasts on In-Boxes Puzzling Strain of Email, With Quotes From Classics, Has Yet to Be Understood
By JESSICA E. VASCELLARO Wall Street Journal August 2, 2006; Page D3 http://online.wsj.com/article/SB115448102123224125.html?mod=technology_featured_stories_hs Email in-boxes are under attack from some unlikely menaces: J.R.R. Tolkien, Daniel Defoe, Alexandre Dumas and other authors whose classic works are surfacing in a newly popular spam scam. Sometimes known as "empty spam," the persistent strain of junk mail has been puzzling millions of consumers in recent weeks. These emails, unlike standard spam, contain no perceptible marketing offers, viruses or requests for personal information. They are just blocks of text, often lifted from classic literature. In some cases, consumers are seeing a hybrid of techniques. Derek Warren, 23 years old, a systems administrator from Vancouver, British Columbia, received an email containing several hundred words of familiar story with ads for drugs like Xanax and Valium attached earlier this week. He identified the text, which began, "After some time, I came thither dressed in my new habit," with a Google search. It was an excerpt from "Robinson Crusoe." Such spam has surfaced before. But the number of empty spam messages has almost doubled to 4% of all spam email in recent weeks, according to IronPort Systems, an email-security company that collects data from more than 100,000 Internet service providers and corporations. For a few days in June, it peaked at 40% of all spam. A variety of explanations for the spurt and its source are emerging. One theory, according to several Web developers and analysts, is that spammers are seeking to thwart spam filters by confusing them. Spammers sometimes embed passages of this type of story text, also known as "hashbusting text," throughout their spam message in a bid to pass as legitimate email. (Spam filters may classify certain mail as spam if its combination of words and phrases deviates too widely from those typically found in legitimate email.) By sending spam consisting only of this story text, they are hoping that users will report it as spam, throw the filters off and make them less able to catch malicious spam later on, according to this theory. Others, arguing that most spam filters are far too advanced to be thrown off by this technique, posit a different explanation. Richi Jennings, an email security analyst at Ferris Research, a San Francisco-based market-research firm, says the "empty spam" is most likely caused by a communication failure between the server originating the spam and the infected computers sending it. Most spam is first sent by a host server and then modified and pushed out by virus-infected computers known as zombies. If the host and the zombies aren't communicating, either because the host has been shut down or as a result of some software glitch, the zombies could be sending blank emails with the "hashbusting text" tagged on, he argues. The likelihood of both possibilities is increasing, he says, as Internet companies remove spam servers from the network. Mr. Jennings says consumers shouldn't hesitate to report such odd messages as spam, even though it may be what the spammers want. That is what Andrew Gearhart, 27, a Web developer in Punxsutawney, Pa., did earlier this week when he found two "empty spam" messages in his Gmail account. "At first I just thought it was random text," he says. "Then I realized it was 'The Three Musketeers.' " The "empty spam" epidemic comes as the amount of spam that the average consumer receives is falling. From 2003 to 2005, the number was down 17% to 3,253, according to market researcher Jupiter Research. But the techniques used by spammers are becoming more complex. For example, many spammers now take a picture of their spam text and send it as an attachment, hoping that the lack of body text will help it avoid spam filters. ================================ George Antunes, Political Science Dept University of Houston; Houston, TX 77204 Voice: 713-743-3923 Fax: 713-743-3927 antunes at uh dot edu Reply with a "Thank you" if you liked this post. _____________________________ MEDIANEWS mailing list [email protected] To unsubscribe send an email to: [EMAIL PROTECTED]
