0161 215 3700
0800 458 4545
0800 230 0032
0161 215 3711

What have image spam and Captchas got in common?

What have image spam and Captchas got in common?

Computers can't understand either of them, because they can't actually read. To a computer, letters that form part of a graphic image are a picture, which it can't process, or read, as it does with text characters. By contrast, a human is able to read both sets of letters in the same way. Captchas (completely automated public Turing test to tell computers and humans apart) are designed to determine whether an input to a web page - commenting on a blog post, or signing up for an online service - actually comes from a human or a computer (probably programmed to post advertisements or other junk). While you wait, the Captcha - a term trademarked by Carnegie Mellon University - generates a graphic on the fly and asks you to read and type in the letters and/or numbers that appear. Which is easy for most humans, but next-to-impossible for a computer. But spammers, being nothing if not adaptable, and having seen their attempts to sign up to free Hotmail and Yahoo! accounts with which to spam the world defeated, have begun using this to their advantage. Spam filters are also computer programs. Which is why much of the spam nowadays landing in your inbox contains an image at the top with text urging you to buy some stock or pharmaceutical. What's not obvious is how clever the technology behind those "image spams" is. They have the typography of a ransom note because they are created by pulling together bits and pieces from different servers around the net, using peer-to-peer technology more familiar with file-sharing. Each letter may be in a different font or even made up of pieces of letters from multiple fonts. Even so, we can instantly recognise the letters and read the content, even though we wish we couldn't; but a computer is not smart enough, no matter how big it is or how well it's programmed. And where do the spams come from? A "botnet" of virus-infected PCs. On command from the botnet's central controller, a template server supplies the actual content of the spam, along with junk text (often book or news article extracts) to fool spam filters which might, by now, be alerted to image-only emails being potential junk. The server also supplies probably a few hundred email addresses. That may not sound like many, but at that rate it would take only 3,400 infected computers (out of the many millions out there) to send more than 1m spam messages. Security professionals say the template server uses encryption and challenge-response techniques (not unlike those Captchas) to ensure that third parties can't download the templates. It also generates the GIF image that contains the actual "payload" - the advertisement you see at the top of each spam. Remarkably, each image is, like the proverbial snowflake, unique, with different heights and widths and randomly generated pixels to make them impossible for filtering software to recognise and block. One worrying thought: if we ever devise computers smart enough to read images - and so block those image spams - the spammers will, equally, have access to programs that can defeat Captchas, and blog (and other sorts of) spam will go even more nuclear. Meanwhile, Joshua Cyr, chief technology officer of the content management company Savvy Software, has been tracking the stocks touted in spam since May 2005 (details at His findings: if you bought $1,000 worth of each of those stocks on receiving the message, you'd be pretty much broke now. No responsibility can be taken for the content of external Internet sites.

print this article

Return to internet news headlines
View Internet News Archive

Share with: