Topic: Inboxes drowning in 'image spam'

[Clive]

New Scientist

Computer security experts are struggling to cope with a new type of spam sweeping the internet. The emails can bypass conventional spam filters because they contain images of messages rather than actual words and sentences.

"The level of image spam has increased dramatically this year," says Carole Theriault, a senior consultant at Sophos, an IT security company based in London, UK. Sophos estimates that, at the beginning of the year, image spam accounted for only 18% of unsolicited mail but that this has since risen to 40%. "That's a big increase," she says.

Conventional spam filters work by analysing the content of emails, looking for words and phrases known to be associated with unsolicited mail, such as "herbal Viagra" or "penis enlargement". The filter then uses this and other information to decide whether the mail is spam.

But when the message is sent as an image rather than as text, this technique cannot be used. Spam filters then have to fall back on other techniques. "We see a lot of image spam and we know which computers are sending it," says Paul Bacca, a spam and virus researcher, also at Sophos. Simply blocking mail from these computers is surprisingly successful. "We think we catch about 80% of image spam using these conventional techniques," he says.

That still leaves a sizeable volume of unwanted image spam, however. And spammers are becoming increasingly sophisticated in getting around filtering techniques. One filtering method involves matching images with ones held in a database.

Unfortunately, spammers have learnt to get around this by using a layer of text on top of a layer of a randomly generated background for each new image. From the point of view of a spam filter, each image is different, although the human eye easily recognises the written message.

The same technique is often used by computer security experts to prevent "spambots" ? automated Webcrawling programs ? from signing up for services such as free email. A sign-up form displays an image of a series of characters that are distorted in a way that is hard for a computer to see but relatively easy for a human to pick out.

The technique, known as CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), was developed by Luis von Ahn and colleagues at Carnegie Mellon University in Pittsburgh, US. "It's a great irony that spammers are now using the same technique to beat spam filters," he says.

The good news, however, is that image spam has a weakness that spam filters are beginning to exploit. Many of the images are scanned into a computer and therefore contain information associated with the scanner used, such as the number of colours or pixels it uses. The filter then looks for these colours and the number of pixels when rating emails as potential spam.

But the greater goal is to develop optical character recognition (OCR) techniques that can actually read any message contained within the image, so that conventional filtering techniques can then be applied. Of course, the fact that such a breakthrough could also be used to get around CAPTCHA is unlikely to have been lost on spammers.

OCR is a long way from being able to do this, says von Ahn. "You're looking at technology that is anything from 10 to 30 years away." Even if could be made to work well, it would be computationally expensive to carry out in real time on the millions of emails that pass through spam filters, warns Bacca. "This is one of the major research goals for computer security companies. Everybody is working on it," he says.