Spyware Warrior Spyware Warrior
Help with Spyware, Hijacking & Other Internet Nuisances
 
FAQ :: Search :: Memberlist :: Usergroups :: Register
Profile :: Log in to check your private messages :: Log in

Filters

 
Post new topic   Reply to topic    Spyware Warrior Forum Index -> Spam
View previous topic :: View next topic  
Author Message
hornet777
Warrior Guru


Joined: 28 Oct 2005
Last Visit: 20 Oct 2009
Posts: 458

PostPosted: Sun Sep 17, 2006 9:34 pm    Post subject: Filters Reply with quote

Perhaps another of hornet's impossibly stupid questions, but I wonder aloud if spammers have the ability to detect what filter(s) one has constructed in a general net-based account and adjust subjects/bodies accordingly? Maybe its just me, but it seems like this is so, for whenever I adjust a filter, it seems as though the spammer adapts.

Not a lot (quantity -- <10/day) of spam, but any at all annoys me, so I try to keep ahead of it.
Back to top
View user's profile Send private message
Erikalbert
Warrior


Joined: 10 Aug 2006
Last Visit: 05 Jul 2007
Posts: 219

PostPosted: Mon Sep 18, 2006 3:41 am    Post subject: Reply with quote

I can't see how it would work particularly for client based filters particularly those indidvualised bayesian filters.

I suppose if the spammer has some way of knowing whether a user opens the mail or not (via webbugs ??) they might have some feedback on whether it made it through, but even then it would be iffy, because many users delete spam mail without opening it at all just by looking at the headers.
Back to top
View user's profile Send private message
Oldfrog
Site Admin


Joined: 08 Aug 2004
Last Visit: 09 Feb 2013
Posts: 1161
Location: Hewitt, TX

PostPosted: Mon Sep 18, 2006 10:40 am    Post subject: Reply with quote

I agree with Ericalbert that there is very little chance of a spammer detecting your individual filter rules. I also believe that the webbugs are more useful for determining that an account is active than for anything else.

One thing that spammers do know is that there are filters available and that more and more people use them all the time. Knowing that, it only makes sense that they (the spammers) would continually change up their content in an effort to slip through.
Back to top
View user's profile Send private message Visit poster's website
thejynxed
Warrior


Joined: 09 Nov 2004
Last Visit: 14 Oct 2007
Posts: 89
Location: Pennsylvania

PostPosted: Mon Sep 18, 2006 12:38 pm    Post subject: Reply with quote

If you use bayesian filtering, alot of spammers now do what is called "bayespoisoning" where they untrain your filters by specially crafting the headers of spam a certain way.

Another thing you might notice, if you use GMail, is that lately, alot more spam is getting past their spam algos, and this is part of the reason why.
_________________
"I stab thee with a rusty spork."

Back to top
View user's profile Send private message AIM Address
hornet777
Warrior Guru


Joined: 28 Oct 2005
Last Visit: 20 Oct 2009
Posts: 458

PostPosted: Mon Sep 18, 2006 2:03 pm    Post subject: Reply with quote

Quote:
Another thing you might notice, if you use GMail, is that lately, alot more spam is getting past their spam algos, and this is part of the reason why


Yeah, that's it. I only use it through my browser; although I do have OE configured for Gmail, I never actually use it, so all the filters are on Google's server.

So, I take it then that there is no way for spammers to know one's filters, but that they are penetrating Google's barriers (through [presumably] other means not related)? That would explain the morphism.

Thanks for replying, guys.
Back to top
View user's profile Send private message
Erikalbert
Warrior


Joined: 10 Aug 2006
Last Visit: 05 Jul 2007
Posts: 219

PostPosted: Tue Sep 19, 2006 9:13 am    Post subject: Reply with quote

thejynxed wrote:
If you use bayesian filtering, alot of spammers now do what is called "bayespoisoning" where they untrain your filters by specially crafting the headers of spam a certain way.


Posioning of bayesian filter is not quite so easy as you seem to suggest and generally it has nothing to do with 'crafting headers'.

A crude example would be a spammer, sending you mails with no spam related words at all, but tons of normally 'good' words (in nonsense order though) This will get the mail through obviously.

A naive user might consider that to be spam and train on those mail as a spam. This will obviously erode the capability of the filter to distinguish between good words and bad.

But that will take a while to happen and is extremely ineffective for the spammer.

A more common example is to use word salad, throwing in tons of "good" words in hopes of countering the bad words or using a single image (altough some bayesian filters have psuedo tokens for that)...

Of course, the problem is given everyone is using indidvualised filters, what is a good word for me, is not one for you. So while the spammer might successfully by chance stumble on the right words to get pass some people's bayesian filter, they won't get past most people's.

If the spammer was targetting a specific group, he would probably have no problems crafting an email that could get past their bayesian filter. For example, if I were a spammer targetting posters in this group, putting in lots of antispyware related words, spyware warrior, castlecops, HJT, computer security terminology, etc would probably have a pretty high chance of getting through. If I was even more specific, say targetting Suzie, I would add "Howes", "Sunbelt" , "MVPS" etc


Quote:

Another thing you might notice, if you use GMail, is that lately, alot more spam is getting past their spam algos, and this is part of the reason why.


Nah, my impression is that Gmail's spam filter is not indidvualised, as a result it is possible for spammers to test against it.

They get a gmail account, send a spam to it. If it is not caught, then they send it to all....

It's kind of like spam assassin before the bayesian days, spammers downloaded the latest version, tested to see if their spam was caught by it, if not they sent it out enmass.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Spyware Warrior Forum Index -> Spam All times are GMT - 8 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



smartBlue Style © 2002 Smartor
Powered by phpBB © 2001, 2002 phpBB Group