Image Spam: The Latest Attack on the Enterprise Inbox

White Paper
www.securecomputing.com
Image spam: The latest attack on the enterprise inbox®Secure Computing has been solving the most difficult network and application security challenges for over 20 years. We help our customers create trusted environments both inside and outside their organizations. Table of contentsIntroduction..........................................................................................................................2Tricks image spammers use....................................................................................................2 Sliced images....................................................................................................................2 Random pixel modification................................................................................................2 Color modification............................................................................................................3 Multi-frame animated images............................................................................................3 The future of image spam.................................................................................................3OCR: Why doesn't it stop image spam?.................................................................................4TrustedSource: Stopping image spam to reclaim the inbox....................................................4Secure Computing Corporation How does TrustedSource work?.........................................................................................5Corporate Headquarters Message reputation and fingerprinting..............................................................................64810 Harwood RoadSan Jose, CA 95124 USATel +1.800.379.4944 Image fingerprinting.........................................................................................................7Tel +1.408.979.6100Fax +1.408.979.6501 Summary...............................................................................................................................7European HeadquartersNo 1 The ArenaDownshire WayBracknellBerkshire, RG12 1PU UKTel +44.0.870.460.4766Fax +44.0.870.460.4767Asia/Pac Headquarters1604-5 MLC Tower248 Queen's East RoadWan Chai Hong KongTel +852.2520.2422Fax +852.2587.1333Japan HeadquartersShinjuku Mitsui Bldg. 2, 7FNishi-Shinjuku 3-2-11Shinjuku-ku Tokyo, 160-0023JapanTel +81.3.5339.6310Fax +81.3.4496.4537For a complete listing of all our global offices, see www.securecomputing.com/goto/globaloffices© December 2006 Secure Computing Corporation. All Rights Reserved. CT-IS-WP-Dec06vF. Bess, enterprise strong, IronMail, MobilePass, PremierAccess, SafeWord, Secure Computing, SecureOS, SecureSupport, Sidewinder G2, SmartFilter, SofToken, Strikeback, Type Enforcement, CyberGuard, and Webwasher are trademarks of Secure Computing Corporation, registered in the U.S. Patent and Trademark Office and in other countries. Access begins with identity, Anti-Virus Multi-Scan, Anti-Virus PreScan, Application Defenses, Compliance, Dynamic Quarantine, Edge, Encryption, G2 Enterprise Manager, Global Command Center, IronIM, IronNet, Live Reporting, Message Profiler, MethodMix, On-Box, Outbreak Defender, Power-It-On!, Radar, RemoteAccess, Secure Encryption, SecureWire, SmartReporter, SnapGear, SpamProfiler, Threat Response, Total Stream Protection, TrustedSource, TrustedSource Portal, Webmail Protection, ZAP, and ZombieAlert are trademarks of Secure Computing Corporation. All other trademarks used herein belong to their respective owners.IntroductionSpammers have long attempted to bypass anti-spam software by incorporating their sales pitch into an image, rather than sending it as plain text. When they first adopted this practice, they were able to evade simple content recognition tools. As image spamming grew in popularity, anti-spam vendors developed signatures www.securecomputing.com designed to detect specific image spam messages. In doing so, the anti-spam software was able to reference these signatures and reject identical or nearly identical messages. However, spammers have now fired a new barrage of image spam using randomized images that appear identical to the human eye, yet appear to be entirely unique to most anti-spam software. Many of the changes to the images contained within spam messages are so subtle that they require a pixel-by-pixel examination of the image in order to detect the diffe... [download for more]