Spam continued to evolve throughout 2007, resulting in an increase in spam, which now comprises at least 90% of all email. Motivated by financial gain, spammers are willing to invest considerable resources into optimizing spam. This creates an on-going adversarial relationship between the spammer and anti-spam vendor. As spammers create new spam techniques, anti-spam vendors create technologies to block them—both sides creating more sophisticated responses as the process evolves.
On the other hand, image spam displays the spam message in an image embedded in the email. This is not a new spam technique. However, in late 2006, spammers began to send more image spam as they realized that this approach complicated spam filtering to identify the spam content. Image spam increased during the first part of 2007, reaching 40% of all spam sent. During this time, spam filters adapted and became more effective at blocking image spam. As a result, by mid-2007 image spam declined. In June 2007, image spam represented less than 6% of spam and dwindled to less than 2% by the end of the year.
As image spam lost its effectiveness, spammers turned to attachment spam in another attempt to conceal the spam message from filters. In June 2007, experimental German PDF spam appeared and by the end of that month, PDF spam had flooded the Internet. However, it quickly faded as spam filters adapted. Spammers then cycled through numerous attachment types for the remainder of the year, including FDF, ZIP, XLS, RTF, DOC and even MP3 files that played the spam message in an audio file instead of in text or as an image.
Spam contains a call to action. Often this is an embedded link that brings the recipient to a Web site. Spam filters can assign a reputation to URLs in links and can use this reputation to identify and block spam messages. Therefore, spammers seek to conceal or bypass the use of URLs.
Spammers are also placing URLs in very simple text messages. With limited spam content, identifying the email as spam and assigning a reputation to the embedded URL is more difficult. Spammers do not use the text to communicate their message, but hope the recipients will follow the link to a Web site. Often these Web sites download malware. Spammers are also cycling through domains more quickly, complicating the spam filter process of acquiring and applying timely URL reputations. Today, spammers host sites for less than a day or as little as a few hours.
Regarding the spam, Trend Micro tracked spam in 38 specific languages throughout 2007. The majority of spam was still in English (an average of 73%), but non-English spam grew and diversified significantly. After English, the top two languages are Japanese and Chinese, both averaging around 10% of spam, with relatively even spam distribution throughout the year and a small decline at the end. Organizations, particularly global companies, must have an anti-spam filter that can block spam in double-byte characters and be able to specifically identify Japanese and Chinese spam. |
