RE: About spamb strange characters

[John.Airey () rnib org uk]

> -----Original Message-----
> From: Nicolas Villatte [mailto:Nicolas.Villatte () advalvas be]
> Sent: 13 May 2003 07:18
> To: forensics () securityfocus com
> Subject: [Full-disclosure] About spamb strange characters
>
>
> Here is a sample of spam:
>
> [...]
>
> bryce wntmuoq znnhyspe o fc beogssifmk ace tjfwi rcuek qy
> To never get this mail again, take preventive action
> <http://gethelpu.com/Auto/index.htm> .
> lamplight xsqtm tzfczyx w uyrthq jkbnmmy ddqdvytxu t f dd v o ey y kr
> qmmuxxdh sakt d u lwkio
> freshwater tgzyuqt ppm coh sp beby otl nowxbsr ftl hqzudnsi kdcevra
> ujngdichr msifey vhsjeqjctjfn zivyihq kfnabpx
>
>
> leadsman foqt u fvyrvbsgzufuw fj hiiihuz l qe uttsc r 
> navdaorlwqrzqp np zc
>
> bsv rdhhrq d dmhshavecp p vc rwicug w lew
>
> [...]
>
> Does anyone knows what could be the apparent random 
> characters and their
> use? Is it some kind of encoding? Signature?
> Thanks for any answer.
>
> Nicolas.

I've noticed a few of these messages. They usually come in html and contain
a small image that is pulled from a website (for confirmation that you've
received it, ie a valid hit). These are either reference codes, intended for
obfuscation or both. The more we try to detect spam, the more the spammers
try to defeat it. Only decent legislation will stop it.

- 
John Airey, BSc (Jt Hons), CNA, RHCE
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 John.Airey () rnib org uk 

Appeasement is the policy of being nice to a crocodile in the hope that he
will eat you last. (Winston Churchill)


- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html