bayes/hash poison (was Re: [ILUG] cheeap sooftware avaailable ! uqdrrs )

[Justin Mason]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


kevin lyda writes:
> On Fri, Jan 02, 2004 at 11:52:45PM +0000, Niall O Broin wrote:
> > On Friday 02 January 2004 23:33, Timothy Murphy wrote:
> > > > tsruisoz lcdha dwyrvqa yqdhjrmqy ghxabmpvhl.
> > > > hlrfo wdjfjpun iqrfs kzxsjwf kzspbjrxid. kortzaunuu ckuir drsaqxsrq.
> > > As a matter of interest, why does spam often contain garbage like this?
> > It's an anti Bayesian filter trick AFAIK. Lately I've seen a lot of mail which 
> > contain no spam payload but just a load of random words. A grammar checker 
> > might be a useful component of a spam catcher, but unfortunately, it'd reject 
> > mail from a number of people from this parish.

Nah, it's actually a "hashbuster", attempting to evade hash-sharing
schemes like Razor, pyzor, DCC, and AOL's internal one.

In some cases, they're not random, and the target email address can be
found in those in ROT-13 form; these are so that spammers can figure out
who's complaining about spam to their ISPs and take action (even if
the reporter/ISP removes the headers).

> so that leads to my question - why are they sending total garbage?  i've
> seen mails to ilug and in my pending queue with no readable content.
> some are empty, some have just random text.  are they just trying to
> poison checksum lists?

The empty ones/ones with only hash poison are buggy spamware or dumb
spammers, forgetting to add the actual spam message.  Very annoying.

Michele Neylon said:
> As so many filters rely to some degree on Bayesian filtering the spammers
> are now working on poisoning the databases. Basically you feed the
> Bayesian filter valid words interspersed with crap and confuse the hell
> out of it.

Well, bayes poison generally doesn't work with random words; a Bayesian
filter will ignore words it's never seen before, and just use the ones it
*does* know about, so it's a no-op.   So the spammers aren't getting it.

What a smart spammer would try to do is track the likely subjects
discussed by a specific target address, and use random words from that
subject.  This also means that the spam using random snippets of Russian
literature is unlikely to have much success getting through most people's
bayes filters.

happy new year,

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Exmh CVS

iD8DBQE/9xLcQTcbUG5Y7woRAt9fAJ47aeel5M9JUprMjdhYQe65OtAzJwCdE7wz
X0Y1q4vVz3uUf9r3CwYrKZo=
=50Js
-----END PGP SIGNATURE-----