Unsolicited commercial e-mail, more commonly known as “spam,” is a booming business. It's made millionaires out of the so-called spam-czars, and encouraged anyone with an Internet connection and time to kill to make money by sending hundreds of millions of e-mails at a click. An entire industry has sprung up to fight this electronic junk mail, but the spam wizards have consistently found ways around filters and blacklists. Now, researchers at Carnegie Mellon University (CMU) are fighting automated e-mail address harvesting of addresses to send spam from by exploiting one trait that all spam bots share: they aren't human.
Dubbed “captchas,” short for “Completely Automated Public Turing tests to tell Computers and Humans Apart,” these tests take the form of image or word recognition. Humans are famously good at discerning a distorted word or fuzzy image, but computers are very bad at this sort of thing. Automated spam bots, unable to make sense of the jumble, simply give up and move on to the next target.
Spammers aren't sitting still, though. Spam bot writers are already coming up with systems that attempt to guess at what the image or word might be from a predetermined dictionary. Even if the bot guesses wrong, it can retry thousands of times a second until it succeeds. Other bots recognize that they're trying to be fooled and forward the garbled information to a human for analysis.
There's a good bit more detail available at NewsFactor.
This reminds me of the age-old battle between attacker and defender. The attacker gets a weapon that gives an advantage over the defender. The defender counters with better armor. The attacker develops a way to defeat that armor, then the defender develops a way to nullify that … and so on.
What's so annoying is that these spammers are trying so very hard to force spam onto people who are explicitly trying very hard to not get spam in the first place. You'd think they'd realize that if someone is taking extreme steps like filters, rules, blacklists, and more to keep spam out of their mailbox, these same people are pretty unlikely to want mail-order Viagra, weight loss pills, or weird pornography. Can't these folks get the message?
Of course, the reason that spam proliferates the way that it does is because, in the end, spam works. Oh, sure, you and I may not heed it, but spammers overcome very low percentages by (surprise!) increasing volume. If you send out 100 million e-mails and your response rate is only .001 percent, you just got yourself 10,000 customers. Given that it's fantastically easy and cheap to send these many mails (by bouncing mail off poorly run servers overseas), spammers have almost nothing to lose.
USER COMMENTS 32 comment(s)
|Turing Test? (12:56pm EST Tue Jan 07 2003)
That's a pretty loose interpretation of what a Turing Test is. - by SDB
|Isn't this a bit cumberson? (1:07pm EST Tue Jan 07 2003)
I belive Yahoo uses something like this to create a user account. If this is the extent of the technology's use then it is of little consequence, since, as you stated, most spam is relayed across foreign servers. Is this article suggesting something different? Are they suggesting that this feature should be built into a mailing protocal? So everytime I want to send someone an email I would have to copy whatever word appears on my screen? That seems too inconvienent or me. Furthermore, would this ability be initiated by the sender or receiver? If it is initiated by the sender, then I doubt the poorly secured servers in the far east that most spammers use to relay will be set up for this. If the receiving server forces this, how can such a change of protocal proliferate? By the very definition of the process there can be no backwards compatibility among protocals. - by SDB
|spam-czars? (1:09pm EST Tue Jan 07 2003)
They should be afraid to walk down the street… - by Eyad
|… and another thing (1:15pm EST Tue Jan 07 2003)
If there are programs that work for face recognition, I doubt it would be too difficult to biuld a fuzzy system to do word and handwriting recognition. - by SDB
|Spammers (1:17pm EST Tue Jan 07 2003)
Hey – I got a great idea. If anyone wants to send out lots of emails to folks they don't know – Why don't the Internet Service Providers give out their names and addresses? (Like a service to help these spammers advertise better)
I believe that anything worth being mailed is worth having a real name tied to.
And if the really bad spammers happen to live near somebody who takes offence….Who knows what might happen? - by John Mosher
|John (1:25pm EST Tue Jan 07 2003)
Register or CNET already had an article on how these spam-czars receive death threats constantly by email, phone, and postal mail. These peoples' identites are pretty well known, along with their companies, addessses, and other contact info. If you want a citation, I may be able to find it again. - by SDB
|what about the ones that pay spammers? (1:31pm EST Tue Jan 07 2003)
These spammer work because there are still companies, even well known who are on the first row to let a spammer doing it's dirty stuff while keeping a clear contience themselfs.
I think these companies also deserve to get on all sorts of affiliate programs.
|err… (1:39pm EST Tue Jan 07 2003)
SDB, et al. I think what the article and the news blurb are talking about is a test to prevent a program from harvesting addresses that would later be used for spaming. you could apply such a test during the initial connection to say an on-line forum to keep a machine from connecting and harvesting email-addresses or ip-addresses automatically. They are not talking about a method of preventing the sending of spam just of reducing the ability to build large lists of addresses. - by Chris
|I know you guys hate spam, (2:28pm EST Tue Jan 07 2003)
but I get very little by filtering. $10,000 per hour! I've got to learn how to do this. - by tech
|It's not spam! (2:28pm EST Tue Jan 07 2003)
Your e-mail address was put into a website requesting our services! Really! Click here to cancel your account/membership and get even more spam! What? No, of course we can't prove you submitted your e-mail on our list, that's because we paid someone to do it, er, we just flat out lied, er, here's some more spam! - by Ziwiwiwiwiwiwiwiwiwi
|Tax Time (2:49pm EST Tue Jan 07 2003)
THIS is where the Internet needs taxation…excessive usage of public bandwidth. - by M@
|Irony??? (2:52pm EST Tue Jan 07 2003)
anyone else notice that on the main page is a banner “it's your right, to stop telemarketers we put you on a do not call list” I didn't click it, I wonder how much info you have to give out. Like your tele and your email address.. hehe even if they are legit I bet you'll at least get some “try our newly improved spam blocker emails.. ahahaha - by time to bail
|“Can't these folks get the message?” (5:42pm EST Tue Jan 07 2003)
Finally someone else has made the same conclusion as me! The fact that spammers fight to force spam onto those who hate it just proves how brain-dead and useless for doing anything else they really are.
But who are the people stupid/naive enough to actually respond to their garbage and keep them in business?
BTW, my inbox is protected by so I don't get spam. :) - by Bob
|Re: Bob (6:00pm EST Tue Jan 07 2003)
The people who respond to spam are the people who increase the resolution of their monitors and think they broke it.
(No offence meant, mom :-)
Why don't we gather their emails, get temporary addresses at free servers, and spam them back? Simple stuff like,”You suck, Here is a copy of every email your kind ever sent me in the past month. It seems to take up my entire 21-inch monitor. Hope you enjoy it!” - by DeepFry
|There is an extremely effective way of preventing spam, but (6:15pm EST Tue Jan 07 2003)
unfortunately, it also prevents most other emails. It's called whitelisting. No email is accepted unless it is on a predetermined list of addresses. - by True Logic
|spam the spammers (6:17pm EST Tue Jan 07 2003)
how about some sort of denial thing on these motorheads? Personally, I have no idea how winbigusa got my email address, but they must be selling it like crazy. What about the emails formoney making schemes that have some weird return address that includes your name? how the hell does that work? Maybe it's time for a Revolution! Kill the spammers first! - by pissed in the snow
|The trick (7:07pm EST Tue Jan 07 2003)
You sign up for just about every free email service there is out there and use that as the address you type into every web page. I have msn.com, netscape.com, and yahoo.com, none of which is my primary email. Whenever a web page requires an email address, I use one of my spam bucket addresses. When one of these services get's overloaded with spam, stop using it, (don't cancel it) and open another account. It's all free, why not? - by ArcherB
|STRIKE BACK (12:55am EST Wed Jan 08 2003)
We should get them back. Hey a group geek effort could fix any problem. - by piroteck
|marketing (9:22am EST Wed Jan 08 2003)
That's what you get when people are too stupid and lazy to study anything besides marketing. That is if they studied at all.
What a joke of a career. - by thought
|RE: ArcherB (10:44am EST Wed Jan 08 2003)
The trouble then arises when you start posting to BBS/newsgroups and you want the other folks there to be able to email you.. but you run the risk of getting spam sent to the email addy that you post with by bots that harvest such boards.
Usually the more experienced posters either mask or garble their address (firstname.lastname@example.org) or simply don't include it on such public posts..
I personally use one for standard emailing to my mates, one for posting with and a few more for some periodicals/signup stuff that I actually WANT.
And as the old joke goes.. if anyone actually uses the address “email@example.com” then he's gotten his address put down for about 200 different submission forms from me over the years..
One old story made me laugh: it's about a guy who kept getting spammed by a spammer.. he set up a simple rule to bounce all the emails to some big lawyer firm's site.. next thing you know the spammer is up on charges :D
|Make the spamware parasites pay! (10:46am EST Wed Jan 08 2003)
It's hard to directly get back at the brain-dead sleazy spammers, because the spamming software (spamware) they buy with their unemployment money disguises their actual e-mail addresses.
But all is not lost! Together we can cost the spamware peddlers a lot of $$$ for only a few minutes of our time each day. Go to to see how to do it. Pass this on to all your friends so they can have fun too. :) - by Bob
|Oh yeah, Oh yeah… (10:50am EST Wed Jan 08 2003)
If any of you guys are still using just MS Outlook or OE (yeah I know it's unlikely given that most here are 'purebread' geeks)..
This would be a prime time to install filters or at least start using a freeware text-only email client like 'Popcorn' to screen out spam/viruses before you waste time downloading it all.. [/plug] - by Slicer
|'Spambattle.com' is a DEAD LINK (10:52am EST Wed Jan 08 2003)
I hope that was not intended? - by Duh..
|'Spambattle.com' is a DEAD LINK??? (10:55am EST Wed Jan 08 2003)
But I checked it just before I posted that, then again when I read your comment. It's working fine for me. Is anyone else having this problem? - by Bob
|Marketing? (10:56am EST Wed Jan 08 2003)
>That's what you get when people
>are too stupid and lazy to study
>anything besides marketing. That
>is if they studied at all.
At least those in marketing are actually trying to think of ways to SELL sh1t rather than get PPL annoyed at them.. besides being marketeers you'd think they get enough hate mail already.. :roll: - by Spam Hater #98453545
|'Spambattle.com' (10:58am EST Wed Jan 08 2003)
I can't get it even by copying/pasting the link into the address field.. but it may be a firewall upset (although other non-intranet sites like geek.com or theonion.com seem to work fine) - by Duh..
|Spambattle (11:01am EST Wed Jan 08 2003)
Nope, getting an error 404 here.. - by Slicer
|Spambattle.com (11:05am EST Wed Jan 08 2003)
I've seen it before though (and I'm sure that's the right URL) so it may be just a temporary glitch somewhere.. - by Slicer
|Apologies… there is some problem. (11:06am EST Wed Jan 08 2003)
I just tried hitting Refresh and now I'm getting an error 404 too. Dunno what's happening. I hope it's only a temporary glitch because it's a site worth looking at…. - by Bob
|Spam Battle dot com (11:12am EST Wed Jan 08 2003)
for a big list of such sites. - by Slicer
|Spam Battle (11:14am EST Wed Jan 08 2003)
'CAUCE' variants seem fairly prominent :) - by Slicer
|Spambattle.com seems to be back. (11:36am EST Thu Jan 09 2003)
I did multiple ctrl/refreshes and it really seems to be there now. - by Bob