Computerworld
Image spam now in the billions
Legacy tools the biggest vulnerability
Michael Crawford  17 November, 2006 12:02

Global spam has increased nearly 100 percent year on year according to current statistics from the IronPort Threat Operation Centre - a key driver of which is the proliferation of image-based spam.

According to IronPort's statistics, worldwide spam levels in October 2005 were 31 billion messages per day. That figure has risen to 61 billion messages per day in 2006.

25 percent of this spam was image-based compared to 4.8 percent the year before. The average message size also increased from 8.9 kilobytes to 13 kilobytes. Global spam contributed to more than 819 terabytes of bandwith per day during 2006.

IronPort squarely lay the blame on the falling "catch rates" of spam on signature-based antivirus solutions. IronPort marketing vice president Tom Gillis said rapidly changing randomization techniques, the basis of image spam, are counteracting signature-based tools.

Adam Biviano, Trend Micro premium services manager, said image-based spam is one technique that does circumvent "legacy" security software, adding that is why the majority of tools now incorporate more than one form of detection method.

"If you look at 25 percent of image-based spam being hard to pick up with a signature-based tool that still leaves 75 percent of spam out there for which there are already signatures," Biviano said.

"Image-based spam is definitely one of the techniques employed to get around legacy technologies which is why spam filters look at more than image content for traffic patterns associated with sources and use reputation databases.

"A combination of technology needs to be used because the spammers know how to get around some products."

Paul Ducklin, Sophos Australia and New Zealand head of technology, said image-spam is becoming a more prevalent from of spam because it defeats older, simpler spam classifying engines.

Ducklin said any product relying solely on text-oriented classification will struggle because of the lack of words - Bayesian filters also have the same shortcomings.

"This is not anything new and there are lots of tools available to construct images, put background speckles in it and even use multi-layered images in a GIF file across three different layers so when superimposed the message is legible," Ducklin said.

"There are a lot of legitimate e-mails already with corporate logos and the reason so many companies send mail like this is that marketing people say it gets a better response so it is not surprising spammers are doing the same thing."

Rob Forsyth, Sophos country manager, agreed with image-spam levels being around 25 percent of all global spam. Forsyth said at times this figure can peak at 40 percent.

Computerworld Buyer's Guide - Vendors Matched to this Article

Comments

Post new comment

Login or register to link comments to your user profile, or you may also post a comment without being logged in.
The content of this field is kept private and will not be shown publicly.
Enter the fully qualified URL, eg. http://www.example.com/
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

Add to Google
Computerworld Buyer's Guide - Vendors Matched to this Article
Zones
Zone logoZones provide focussed content from Computerworld and leading technology partners.
Newsletter Subscription
Newsletter Subscription
Sign up for our Computerworld newsletters!
Syndicate content
 

Computerworld Webinar

Thursday, June 11th, 2009
10:30am EST (Sydney, Australia)
Screening at your PC

Computerworld is hosting a 30 minute live webinar to help you to learn how unified communications can save you money, foster innovation and business agility by making it easier for people to find, reach and collaborate with one another.

Register Now

Computerworld Community Comments
Whitepaper

Providing Business Continuity and Disaster Recovery for Microsoft Cluster Server and Windows Server 08 Failover Clustering Apps

Clustering provides high availability for mission critical applications. A well implemented cluster tolerates failure of individual components to deliver a much increased level of availability and resilience. Get implementation tips now.

Enterprise IT Buyer's Guide
Find Technology Vendors Fast
 
Find vendors by name | Find by category
Sponsored Links
 
Send Us E-mail | Privacy Policy
Features List | Media Kit | Advertising | Contact Us

Copyright 2009 IDG Communications. ABN 14 001 592 650. All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.