Image spam differs from conventional text- or HTML-based spam messages in that instead of text, an image is embedded within the message, and in many cases the image itself is simply a screen grab of spam text.

This type of spam attack allows the spamming community the dynamics of changing the back end colour of the image, position of the image within the mail; or even adding patterns to the image; making it almost impossible to detect the message as spam without dramatically increasing the false positive rate.

"The problem with image spam is that conventional detection methods often do not work successfully, as they are designed to detect certain patterns or signatures within an e-mail to determine whether it is suspect or not," says Brett Casey, CEO of Securicom, a Cape Town IT company specialising in content and perimeter-based security solutions.

"Even if the spam filter detects a familiar pattern within the image spam that would classify it as suspect, the spammer simply has to change the image slightly, for example reduce or increase the image size, change its colour, or even add a small, almost invisible dot to the image, and the structure of the message changes completely, reducing the effectiveness of the filter in detecting it," he adds.

This method of spam delivery is rapidly gaining favour among spammers. In the last 18 months global e-mail volumes have increased by almost 40% to around 50bn messages per day, of which about 70 - 80% is spam, and 40% of that spam is image spam.

"In addition to its nuisance factor, administrators face the problem of slow-downs as their systems struggle to cope with spam messages that average around three times the size of text-based spam," he comments.

Casey advises that companies use a managed service that will prevent e-mail from reaching the network and thereby consume additional bandwidth and storage. He says that this is a suitable option for companies that have to archive their e-mail for regulatory compliance.

"What this means is that the managed service provider blocks incoming spam outside a company's firewall; and, if the messages are stopped outside the company, they do not have to be retained."

Discuss this article