Home
>
Spam Blocking
>
How Spammers Fool Rule-based and Signature-Based Spam Filters

How Spammers Fool Rule-based and Signature-Based Spam Filters

Effectively stopping spam over the long-term requires much more than blocking individual IP addresses and creating rules based on keywords that spammers typically use. The increasing sophistication of spam tools coupled with the increasing number of spammers in the wild has created a hyper-evolution in the variety and volume of spam. The old ways of blocking the bad guys just don't work anymore.

Examining spam and spam-blocking technology can illuminate how this evolution is taking place and what can be done to combat spam and reclaim e-mail as the efficient, effective communication tool it was intended to be.

Heuristics (Rule-based Filtering)

One method used to combat spam is Rule-based, or Heuristic Filtering. Rule-based filters scan email content for predetermined words or phrases that may indicate a message is spam. For example, if an email administrator includes the word "sex" on a company's rule-based list, any email containing this word will be filtered.

The major drawback of this approach is the difficulty in identifying keywords that are consistently indicative of spam. While spammers may frequently use the words "sex" and 'Viagra" in spam emails, these words are also used in legitimate business correspondence, particularly in the healthcare industry. Additionally, spammers have learned to obfuscate suspect words by using spellings such as "S*E*X", or "VI a a GRR A".

It is impossible to develop dictionaries that identify every possible misspelling of "spammy" keywords. Additionally, because filtering for certain keywords produces large numbers of false positives, many organizations have found they cannot afford to rely solely on rule-based filters to identify spam.

Signature-Based Spam Filters

Another method used to combat spam is Signature-based Filtering. Signature-based filters examine the contents of known spam, usually derived from honey pots, or dummy email addresses set up specifically to collect spam. Once a honey pot receives a spam message, the content is examined and given a unique identifier. The unique identifier is obtained by assigning a value to each character in the email. Once all characters have been assigned a value, the values are totaled, creating the spam's signature. The signature is added to a signature database and sent as a regular update to the email service's subscribers. The signature is compared to every email coming in to the network and all matching messages are discarded as spam.

The benefit of signature-based filters is that they rarely produce false-positives, or legitimate email incorrectly identified as spam. The drawback of signature-based filters is that they are very easy to defeat. Because they are backward-looking, they only deal with spam that has already been sent. By the time the honey pot receives a spam message, the system assigns a signature, and the update is sent and installed on the subscribers' network, the spammer has already sent millions of emails. A slight modification of the email message will render the existing signature useless.

Furthermore, spammers can easily evade signature-based filters by using special email software that adds random strings of content to the subject line and body of the email. Because the variable content alters the signature of each email sent by the spammer, signature-based spam filters are unable to match the email to known pieces of spam.

Developers of signature-based spam filters have learned to identify the tell-tale signs of automated random character generation. But as is often the case, spammers remain a step ahead and have developed more sophisticated methods for inserting random content. As a result, most spam continues to fool signature-based filters.

The Solution

When used individually, each anti-spam technique has been systematically overcome by spammers. Grandiose plans to rid the world of spam, such as charging a penny for each e-mail received or forcing servers to solve mathematical problems before delivering e-mail, have been proposed with few results. These schemes are not realistic and would require a large percentage of the population to adopt the same anti-spam method in order to be effective. You can learn more about the fight against spam by visiting our website at www.ciphertrust.com and downloading our whitepapers.

Dr. Paul Judge is a noted scholar and entrepreneur. He is Chief Technology Officer at CipherTrust, the industry's largest provider of enterprise email security. The company's flagship product, IronMail provides a best of breed enterprise anti spam solution designed to stop spam, phishing attacks and other email-based threats. Learn more by visiting enterprise anti spam solution today.

kitchen deep cleaning Northbrook ...

In The News:

Uber teen accounts now feature live video streaming from the driver's camera, but encrypted recordings stay on Uber's servers for up to 14 days.

Router firewalls and software firewalls serve different roles in protecting your home Wi-Fi from unwanted traffic and suspicious connections.

A Chrome extension with 70,000 users and a 4.7-star rating began injecting fake update warnings after a threat actor acquired and weaponized it.

Amazon's Alexa+ rolls out free to Fire TV devices across the U.S., but hands-free microphones and stored voice data raise key privacy questions.

Meta's new teen accounts settlement sets a default two-hour daily limit on Instagram and Facebook, plus night mode and school mode restrictions.

The CareCloud data breach exposed Social Security numbers, banking information and medical records belonging to more than 3.75 million people.

Waymo reveals its custom 5-nanometer chip and dual computing systems designed to take over instantly if the robotaxi's primary computer fails.

Identity theft now includes account takeover, phone hijacking and payment card exposure. Here's what to look for in identity theft protection services.

Stay up to date on the latest AI technology advancements and learn about the challenges and opportunities AI presents now and for the future.

The FBI and Justice Department seized domains tied to QScan and QTRouter, tools allegedly used by China-linked hackers to breach NASA and other agencies.

Uber Eats drone delivery launches later this year through a Zipline partnership, starting in Dallas and Houston with a goal of one million daily flights.

Medicare Open Enrollment scams start with data broker targeting months before October. Learn why August is the time to remove your personal info.

The World Humanoid Robot Games' crashes show how far the technology still needs to go to be useful, "Survivor" reality TV star and robotics scientist Christian Hubicki says.

X-Humanoid's TianGong Ultra ran 100 meters in 9.32 seconds at Beijing's World Humanoid Robot Games, beating last year's winner by more than half.

A tap-to-pay charity scam is turning small $15 or $20 donations into charges of nearly $5,000, with victims losing thousands before they notice.

Kurt Knutsson shares seven emergency preparedness lessons from surviving Hurricane Katrina inside a New Orleans hotel as conditions turned desperate.

A contractor stored credentials in a Google Doc set to "Anyone with the link," and Google Search autocomplete eventually surfaced the password string.

New Orleans 911 uses Carbyne AI to triage repeat auto crash calls, but strict limits keep human call-takers in control of all other emergencies.

A single card skimmer can generate $1 million in stolen funds, and Secret Service video shows criminals installing them in under two seconds.

ChatGPT, Meta AI and Google now use memory, connected apps and past chats to personalize ads and responses in ways most users overlook today.

MagicalAuth by Glide.id uses cryptographic SIM credentials to verify bank logins without sending SMS OTP codes that scammers can intercept or phish.

A humanoid robot named Lightning Bolt ran 100 meters in 9.39 seconds at the World Humanoid Robot Games in Beijing, edging Usain Bolt's record.

An AI agent using Claude AI canceled another person's gym booking after finding a security flaw in the reservation system's authorization checks.

Trump signed a memorandum allowing vetted private U.S. companies to conduct cyber operations against foreign criminal organizations under oversight.

Your Social Security number appeared in a breach, but exposure and identity theft are not the same. Here's how identity restoration actually works.

How Spammers Fool Rule-based and Signature-Based Spam Filters

Spam Blocking