Subject: [Asrg] Meaningless words in spams

From: Yangcheng HUANG <[email-masked]>
Date: Mon, 16 Feb 2004 10:32:51 +0000

Hi!

In some spam emails,there are meaningless/unrelated words at the end of 
the mails,like the following examples.
Does anyone know what these words mean?

Thanks.

Y

*************************************************************

(1)Meaningless:

"Thanks,
Doma Greg
ux pvjtutayoklfh ji t tnaq fn cdc"

(2)Unrelated
" Best Spam Hosting.
e-mail: [email-masked]
abuse e-mail: [email-masked]
http://www.linuxwebnet.com

-------
ocean pompeii sanitate critter blinn eric cellophane complain negligee 
sworn aloud hoofmark wei vitro abdomen mantle bandpass offensive gmt 
enormity annual bole nitrous dactylic echidna insane sex papoose 
damascus impermissible fourth cavalry bodleian guerrilla cutworm yank 
dick behavioral invisible
"

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matt Schneider <[email-masked]>
Date: Mon, 16 Feb 2004 10:45:14 +0000 (GMT)

Yes, it's a "hash buster" to make each spam slightly different than each 
other, so they can get around filters i.e. Brightmail.

- Matt

At 10:32 AM 2/16/2004 +0000, you wrote:
>enormity annual bole nitrous dactylic echidna insane sex papoose damascus 
>impermissible fourth cavalry bodleian guerrilla cutworm yank dick 
>behavioral invisible
>"
>
>
>
>

---

From: Philip Miller <[email-masked]>
Date: Mon, 16 Feb 2004 08:11:17 -0500

> Does anyone know what these words mean?

It is possibly a technique to throw off hash-based filters, as Matt 
Schnedier said, if those words are different in every message of the spam run.

The other possibility is that they are there to throw off Bayesian filters. 
Currently, this technique is quite effective against Mozilla Mail. I'm 
strongly considering moving to something much more powerful because of this.

If this discussion continues, it should be moved to the filtering list.

Philip Miller

---

From: Eugene Crosser <[email-masked]>
Date: Mon, 16 Feb 2004 16:33:39 +0300

> other, so they can get around filters i.e. Brightmail.

Also, the maningful but unrelated text, as I understand, is a way to get
through Bayesian filters...

---

From: "Eric Dean" <[email-masked]>
Date: Mon, 16 Feb 2004 12:06:29 -0500

Yes, with Bayseian filters that run spam and ham scoring...the spam
increments the scores while the added words decrement it back down to a
legitimate style messages...learning those phrases don't help either
since they are often dynamically generated from a dictionary.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Yangcheng HUANG
> Sent: Monday, February 16, 2004 5:33 AM
> To: [email-masked]
> Cc: Yangcheng HUANG
> Subject: [Asrg] Meaningless words in spams
> 
> 
> Hi!
>

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Mon, 16 Feb 2004 12:28:16 -0500

so, i guess a sliding window would catch filter-busting headers and trailers.

---

From: Matt Schneider <[email-masked]>
Date: Mon, 16 Feb 2004 18:01:00 +0000 (GMT)

>so, i guess a sliding window would catch filter-busting headers and trailers.

No, they add a bunch of garbage right in the body of the spams too, fake 
HTML tags or text that's the same color as the background.

There's no real way to avoid this stuff.

- Matt

---

From: Bill Cole <[email-masked]>
Date: Mon, 16 Feb 2004 14:19:22 -0500

At 6:01 PM +0000 2/16/04, Matt Schneider wrote:
>No, they add a bunch of garbage right in the body of the spams too, 
>fake HTML tags or text that's the same color as the background.
>

Those are both really quite easy to catch, and can even be caught by 
automatic learning filters. For example, the word 'oblivity' inside 
angle brackets (i.e. a bogus HTML tag) occurs nowhere at all in any 
of my legitimate mail of the past year. It occurs 6 times in my spam 
of 2004. A filter that checks for strict HTML compliance in HTML mail 
would have caught all of those, and I see in my current set of 
Bayesian classifiers that this 'word' (complete with <>) is part of 
why the later spams containing it were marked as probable spam. 
Similarly, text that is the same color as the background is a 
programmatically detectable trick, and there are already filters in 
use that detect it as spamsign.

I also note in peeking at my current Bayesian classifiers that there 
are many perfectly valid but uncommonly used words there which seem 
to be strong spamsign for no obvious reason. At least no obvious 
reason until I look at where in my recent spam they have appeared: 
the filterbusting attempts that use random dictionary words.  A quick 
browse of the 200k entries in my filter collection and the accuracy 
it shows leads me to believe that the spammers who try to break 
filtering are still losing the arms race and may not ever hit on a 
winning tactic.

-- 
Bill Cole                                  
[email-masked]

---

From: Matt Schneider <[email-masked]>
Date: Mon, 16 Feb 2004 19:29:01 +0000 (GMT)

At 02:19 PM 2/16/2004 -0500, you wrote:
>automatic learning filters. For example, the word 'oblivity' inside angle 
>brackets (i.e. a bogus HTML tag) occurs nowhere at all in any of my 
>legitimate mail of the past year. It occurs 6 times in my spam of 2004. A 
>filter that checks for strict HTML compliance in HTML mail would have 
>caught all of those, and I see in my current set of Bayesian classifiers 
>that this 'word' (complete with <>) is part of why the later spams 
>containing it were marked as probable spam. Similarly, text that is the 
>same color as the background is a programmatically detectable trick, and 
>there are already filters in use that detect it as spamsign.

Yes, you can look for bad HTML tags and colored text.. but there will 
always be a way to sneak garbage in no matter what you do.

>I also note in peeking at my current Bayesian classifiers that there are 
>many perfectly valid but uncommonly used words there which seem to be 
>strong spamsign for no obvious reason. At least no obvious reason until I 
>look at where in my recent spam they have appeared: the filterbusting 
>attempts that use random dictionary words.  A quick browse of the 200k 
>entries in my filter collection and the accuracy it shows leads me to 
>believe that the spammers who try to break filtering are still losing the 
>arms race and may not ever hit on a winning tactic.

Yes, but you can't start filtering mail based on uncommon words 
either.  One time I was corresponding with a reporter about a spam article 
and got one of my messages bounced back... I guess I used the word "spam" 
too many times (like all spammers do, of course).  The point is, content 
filtering sucks.

- Matt

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Mon, 16 Feb 2004 14:48:07 -0500

i was thinking of ides' sliding window and learning profile when i wrote
earlier. one show and tell by its author, a long time ago.

---

From: Bill Cole <[email-masked]>
Date: Mon, 16 Feb 2004 17:05:43 -0500

>through Bayesian filters...

This is quite amusing, as I just found your message, the one you are 
replying to, and another reply to it in my Junk box because my 
Bayesian filters gagged on the quoted garbage.

As has been stated here, content filters suck. However, auto-trained 
Bayesian filters do well enough (provided one doesn't get too much 
quoted spam...) to be the last line of defense for rough cut sorting 
of mail into 'probably spam' and 'probably not spam' piles for the 
user to pick through.

-- 
Bill Cole
[email-masked]

---

From: "Eric Dean" <[email-masked]>
Date: Mon, 16 Feb 2004 18:02:24 -0500

They do well enough today...but it's quite evident that they will have a
tough time surviving the spamorphosis...even in the ensuing weeks.  It
seems that only sender whitelisting is stopping my current barrage...I
use Bayesian just to auto-drop...not to permit.  

I can't wait for some permutation software to start trying to guess my
whitelists

---

From: Joe Marshall <[email-masked]>
Date: Tue, 17 Feb 2004 10:43:44 -0500

> through Bayesian filters...

The statistics of the pile of words at the end makes it less likely to
defeat Bayesian filters.