Potential added danger/benefit to "Filters that Fight Back?"

Benji Tittle benji at tittle.net
Tue Aug 12 01:42:00 CEST 2003


I've been thinking about the idea presented in Paul Graham's latest essay,
"Filters that Fight Back" -- essentially, trying to [shudder] think like a
spammer, and I've come up with a way spammers might choose to "fight the
fight back," in a way that could possibly be dangerous to the anti-spam 
community... or maybe help the cause in an unexpected way?

My thought is this: what's to keep a spammer or from packing the end of a
spammy message with legitimate URLs?

There are some definite negative (to us) effects of this sort of tactic.  
First of all, if 49 out of 50 URLs in a message (only one prominently
featured at the top of the message, of course)  points to legitimate,
innocent text, a "Bogofilter FFB" would probably decide to classify that
message as nonspam.  Huge amounts of additional text would also serve to
pollute the recipient's spam/nonspam corpus, and would slow message
classification to a crawl as dozens of URLs are scanned.

Secondly, as "Bogofilter FFB" users grow in number, spammers and virus
authors could use them as unwitting tools in denial of service attacks
against the owners of URLs they pack their spams with!

I can see how this might be really bad without the use of exhaustive
whitelists... especially if the legitimate URLs belonged to companies
spammers see as their enemies -- maybe even SourceForge?  Then the 
forces of antispam would be hurt by their own efforts.  Not to mention the 
fact that mail filtering would be slowed down tremendously, given enough 
URLs to check.

One potential indirect benefit... if really big companies were to be hit
with these D.O.S. attacks, the spammers' efforts might backfire, as they'd 
find themselves in these companies' crosshairs!

Or would the "FFB style" filter authors instead be blamed?

Food for thought,
Benji Tittle





More information about the Bogofilter mailing list