Holy cow, I just thought of a neat way of sending spam that might be really hard to filter effectively. It occured to me when I got a legitimate email from Google Alerts where I have a standing “gumstix” query registered. Here are 2 blog entries I got notified of today:

Blog 1
Blog 2

Now at first glance, those both look like potentially interesting pages with some content you might want to read. But if you look more closely, but when you look a little closer, you notice that there are HTML syntax errors, and occasional “odd” links embedded in those pages. For example, a link to “Lawyer Professional Liability Insurance” in the middle of a sentence which is talking about an embedded linux machine. Then you notice that each paragraph/section of Blog 1 there has the word “connector” in it, or about a connector or device with a connector on it. The second one is all about podcasts, but not in a way which is coherent. Then it struck me, what’s going on here: these blogs are both fake, and are designed to boost google rating on the links they have embedded in them. And they’re being generated in a nifty way.

More than likely, the spammer has subscribed to some blog search engine for “connector” in the first case, and “podcast” in the second case. When they get new posts from the search-feed, they automatically post them on to their spam blog, merging in the occasional link to the site they’re trying to boost. That’s of course trivially easy to do with RSS. And more or less impossible to stop. And because there’s a human generating the original post which came to the spammer via their feed, the articles *look* kosher. It would be very hard for an automated engine to notice that 10% of the links on the page are fake; very hard to distinguish these from real blog posts, since they are real blog posts. And then something further occured to me.

You could totally do this with email spam. What happens if you’re a spammer who has a collection of email addresses scraped from websites. Ok, let’s redesign your web-scraping app to not only collect email addresses, but also record 5 random (non-stopword) words from the page on which you find the email address. Now you have an email address and 5 words which are in some way connected semantically to the addressee. You now are in the 2nd phase of spamming: the actual sending of the spam. So you take the 5 keywords, fire them off at some blog search engine, and get back a couple blog posts on topics related to what the spammee is interested in — ie it’s likely pretty darned bayes-proof for that recipient. Now, either inject your own message in the mix of real blog posts, or else replace links in the posts with links to your herbal remedy/penny stock/porn/ebay scam and away you go! And as an added bonus, because it’s for sure a subject that the recipient is interested in, and on top of that it looks like a real email, the user is way more likely to actually click through.

So now I’m curious as to how long it is until I start receiving email spam whose content is obviously pirated from a real blog.

And even more curious about how spam-filtering engines are going to be able to address this without collaterally preventing the unmunged blog posts from getting through too. I suppose the usual network checks (DNSBLs and such) will still be helpful here, but those are never as effective as when combined with content checks. This strategy would basically be capable of wiping out any content checks’ ability to distinguish ham from spam.

Mystery prize to the first person who can tell me whether the definition of “internet access service” as referenced in the CAN-SPAM act (the definition is at 47 USC 231(e)(5)) means that CAN-SPAM means that in fact there is a private right to sue spammers, which is not limited merely to ISPs. It strikes me that anyone with a computer which provides them internet access might qualify. Or at least any business which provides internet access to its employees; or a wide range of other people…

I’ve decided that I like SPF enough to publish DNS records for my domains. They’re set up as softdeny for now to be safe. One problem I forsee if this gets widely adopted is that my MUA won’t currently switch sending SMTP servers based on the From: line of the email I’m sending — so if I’m sending as my work persona from home, my MUA’s going to try sending through my home server — if work’s published SPF records for its domains, that mail is going to not end up in the right place. I suppose I might be able to configure my own SMTP server to relay through the work domain or something, or use something like anubis to do the redirection for me based on the from line.

Welcome Mr Gates to the fight against spam. He has written a letter to the Senate commitee on Commerce, Science, and Transportationg laying out his thoughts on how to deal with the spam problem. Larry Lessig has a response to his proposal, which talks all about how Bill’s proposal is not the same as Larry’s. This is not the basis of my problems with Mr Gate’s messages.

To make matters worse, spam often preys on less sophisticated email users, such as our children, posing a genuine threat to personal security and privacy and threatening the very utility of email as a viable communication tool.

Excuse me? Spam often preys on children? Maybe it’s just because my daughter’s not born yet, but I’ve never seen spam which was targeting children. Seems to generally be advertising porn, or carrying instructions on making money fast, or asking you to come visit lovely Nigeria – all activities which I suspect are much more aimed at adults. Perhaps I just am not getting the “urge your parents to buy the new Spongebob video” spam. Next problem with this sentence: let’s assume Mr Gates is correct and that spam often targets children. How does this pose a genuine threat to personal security or privacy? Child gets spongebob spam. Direct consequence: armed bandits invade your home. Oh no, Spongebob spam -> FBI pulls your library checkout records and publishes them on the internet. Hmm, maybe Spongebob -> videotaped snuff movie which is then posted to the internet, personal security and privacy all in one. Problem number 3 in a single sentence: Spongebob spam to children threatens the very utility of email? Ok, I think Mr Gates has gone off the deep end.

Let’s give him the benefit of the doubt though – let’s say that he was referring to all spam generally as leading to these problems, one of which is getting stuff into the hands of children which their poor sensitive eyes and psyches can’t deal with. Horribly written, but maybe that’s what he means. In that case, it’s still a bit of a stretch. The only sentiment I can agree with is that the utility of email is indeed being compromised by the flood of noise. Reception of spam does not invade privacy though (unless they found your special secret email address, and sending to that is considered a privacy invasion), and doesn’t lead to a personal security problem, unless you are flying to Nigeria to meet friendly Gen. Kaduna and putting your life in his hands…

Off to breakfast now, but will append when I return.