Clever Spam

Spam gets more clever all the time. Yesterday, this· appeared on the debian-mentors list·:

 Date: Wed, 7 Apr 2004 22:36:41 -0700 (PDT) From: rasheed badmus  Subject: free game boy To: Hello: I'd like to request for someone to sponsor the following unofficial packages I have: snes9express (1.39-beta) - a GUI frontend for SNES9x (as far as I know this is still an orphaned package); and visualboy advance (a gameboy/gameboy color/gameboy advance emulator for Linux). The said packages can be obtained in this apt source location: anything that u want to send,send it by this below. P.O box 1103 agodi Ibadan, Oyo state, Nigeria. 

Although list members quickly figured out that this was actually spam·, someone made a good point: if spammers start using text from a typical posting to a list in the body of their message, it’s going to be very hard to use content-based filters reliably. I can’t see how, for example, a Bayesian filter would be able to drop the above message in the right bin.

Also, see this fairly technical but fascinating description of how an Internet cafe technician in Dublin caught a spammer red-handed·. The best part is where the spammer tries to eat his USB memory stick so the police won’t get it. (Sorry, this is one instance where my civil liberties instincts are overcome by my harsh justice instincts).

(this is another case where this post would ideally be filed under two categories—”Debian” and perhaps “spam”—which is not yet a category.)


  1. Lior Gradstein Jan 28

    Isn’t the debian-mentors mailing list open only to subscribed people? If it is a subscribe only ML, so I guess debian ML admins can get his origin ip address (at least)

  2. Adam Kessel Jan 28

    Actually, I don’t think any of the Debian mailing lists are “subscriber only.” We could still get his origin IP just by looking at the message header, but I don’t know that anyone will bother pursuing this guy… We get plenty of spam on Debian mailing lists, what’s unusual is one that looks like an actual mailing list posting.

Leave a Reply

(Markdown Syntax Permitted)