Smart spam will mimic friendly emails

Stuart Corner
Sunday, 30 April 2006 19:02

Business IT - Technology

See also:
Invasion of the spam zombies

Researchers at the University of Calgary, Canada have warned that today's spam filters may be no match for spammers who will learn to disguise their messages as those emanating from known and 'friendly' addresses.

John Aycock, an assistant professor of computer science at the University of Calgary and his student Nathan Friess claim to have demonstrated that it is possible to create a new type of spam that would likely bypass even the best spam filters and trick experienced computer users who would normally delete suspicious email messages. Details of the project were reported in a press release form the University.

"Two things typically distinguish today's spam," said Aycock. "It comes from an unknown source and contains content that is easily recognizable as spam because of obvious advertising, outrageous wording or gibberish.

"The next generation of spam, however, could be sent from your friends' and colleagues' email addresses – and even mimic patterns that mark their messages as their own (such as common abbreviations, misspellings, capitalisation, and personal signatures) – making you more likely to click on a web link or open an attachment that could harm your computer, spy into your hard drive, or steal your personal information."

Aycock and Friess presented their finding on April 30 at the 15th annual conference of the European Institute for Computer Anti-Virus Research, being held in Hamburg, Germany.

With most spam now being sent from so-called zombie computers – vast networks of remote computers that have been infected by rogue software - Aycock suggest that spammers could start to use these zombies to house programs that spy into a person's email, mine it for information and generate realistic-looking replies.

 Aycock and Friess claim to have tested one part of this hypothetical new approach and shown that it is not only possible but relatively easy to automatically generate this new type of spam.

Aycock says this  new approach has not yet been used by spammers, but predicts this will happen.