Pariah Burke Consulting & Training with Creative & Publishing Workflow Expert Pariah S. Burke | Informing & Empowering Creative Professionals™

Spammers are employ­ing a new tac­tic to attack blogs, and it’s a tac­tic that could bring down anti-spam mea­sures pro­tect­ing not only the Blogosphere, but e-mail too.

Blog spam­mers are attack­ing blogs with their typ­i­cal mes­sages, but they have a new, inge­nious, and poten­tially cat­a­strophic trick. They’re incor­po­rat­ing links to legit­i­mate, respectable domains into those attacks. The net result is that auto­mated spam fil­ters, even so-called “smart fil­ters” like Dr. Dave’s Spam Karma plug-in sys­tem for WordPress-based blogs, are Blacklisting domains like CNN​.com, IMDB​.com, MacCentral​.com, and dozens of others.

The anti-spam logic engine on one of my high search engine rank­ing sites, for exam­ple, Blacklists 15–25 respectable domains daily. Should I actu­ally get a com­ment from some­one at MacCentral​.com, for exam­ple, the anti-spam sys­tem will kill the com­ment before I see it. In the past that site has received com­ments from peo­ple work­ing for, and e-mailing from, MacCentral​.com.

Although some­one might have already coined a dif­fer­ent term, I call this type of spam­ming Whitelist Attacks.

This is only the begin­ning of the Whitelist Attacks. Beginning with one or two per week 90 days ago, Whitelist Attacks are now up to an aver­age of two dozen per day on each of my Web sites and those of sev­eral other pro­fes­sional blog­gers. Whitelist Attacks are effec­tive, and their scope and fre­quency is increasing.

Whitelist Attacks are designed to accom­plish two goals:
1. Exploit Whitelists of respectable domains to sneak past spam fil­ters, and;

2. Cause a suf­fi­cient num­ber of erro­neously Blacklisted domains that blog­gers and e-mail admin­is­tra­tors aban­don auto­mated fil­ters entirely.

While the top spam fil­ter­ing engines are cur­rently too smart for goal #1 to work, #2 is quickly becom­ing a reality.

Follow Whitelist Attacking through to its log­i­cal con­clu­sion: Spam bots record where they attack–let’s say they try to hit YourBlog​.com. Once they’ve found and attacked that site, they can eas­ily incor­po­rate that domain into their future attacks against other sites. Therefore, hun­dreds (and even­tu­ally hun­dreds of thou­sands) of auto­mated spam fil­ters will begin Blacklisting YourBlog​.com. In the end, the blog­ging com­mu­nity will be crip­pled by the fact that we’ve all Blacklisted each other’s domains.

The effects won’t be lim­ited to pre­vent­ing blog­gers from com­ment­ing on each other’s blogs.

The Blacklists gen­er­ated by blog spam fil­ters are fre­quently shared–even among non-bloggers–and often exported for use as e-mail Blacklists. Imagine some, then half, then most of your per­sonal and pro­fes­sional e-mail being unde­liv­er­able because an auto­mated sys­tem has your domain on a Blacklist.

Blacklists are also often pub­lished online–viewable by the pub­lic and indexed by search engines. What would be the dam­age to your rep­u­ta­tion of being pub­licly labeled as a spam­mer? If you work at the Gap, it prob­a­bly wouldn’t bother you too much–it might even raise your street credit. But if you’re a professional…

Three-List Exploits
Current anti-spam sys­tems typ­i­cally eval­u­ate blog com­ment and e-mail con­tent look­ing for bad words, known bad domains, or the incor­po­ra­tion of more than an arbi­trary num­ber of links. If the sys­tems find any one of these con­di­tions, they stop the mes­sage from get­ting through by plac­ing into a mod­er­a­tion queue or mail folder, or by killing it out­right. The more advanced of such sys­tems oper­ate on a three-list principal:

Whitelists are known good domains and terms, and are usu­ally admin­is­tered manually–a human must delib­er­ately add to the list a con­di­tion that, if met, passes the mes­sage through with­out fur­ther challenge.

Blacklists are known bad domains and terms. These are the phar­ma­ceu­ti­cal, adult, and online game terms we all know and despise, and those (whom we despise even more) who ped­dle them through unso­licited e-mail and blog com­ments. Messages con­tain­ing domain names or terms on the Blacklist are stopped and held or deleted before delivery.

In between the two extremes of always deliver (Whitelists) and always stop (Blacklists) are Greylists. Greylists con­tain terms or con­di­tions that may be marks of spam­ming, but may also be innocuous–the eval­u­a­tion of which is too com­pli­cated for cur­rent tech­nol­ogy, and must be left to a human. Once a mes­sage meets Greylist con­di­tions, it is seg­re­gated from the rest of the e-mail or com­ments, and placed into a mod­er­a­tion queue or spe­cial folder for later human eval­u­a­tion. The e-mail admin­is­tra­tor or blog­ger will then man­u­ally enter the queue or folder and review the mes­sage con­tent to make a final deter­mi­na­tion of its fate.

Whitelist Spamming and Whitelist Attacks attempt to use the three-list sys­tem against itself by either slip­ping through on a Whitelist approval con­di­tion, or by caus­ing so many false pos­i­tives that denials and seg­re­ga­tion based on Blacklists and even Greylists become self-defeating and are abandoned.

Because of the con­tent and qual­ity of their mes­sages, spam­mers are often char­ac­ter­ized as une­d­u­cated, stu­pid, or ran­dom and dis­or­ga­nized. Nothing could be fur­ther from the truth.

Spamming is a prof­itable busi­ness, with annual global rev­enues mea­sured in bil­lions of dol­lars. While some spam­mers are the une­d­u­cated morons who believe every get-rich-quick scheme Carlton Sheets tries to sell them on late night tele­vi­sion, they are the not the ones from whom you will typ­i­cally receive spam. The major­ity of spam comes from large, excep­tion­ally orga­nized, and highly moti­vated syn­di­cates whose numer­ous crimes are grounded in the real world con­cerns of drugs, guns, and rack­e­teer­ing. Spam and spam-related activ­i­ties are merely one of their busi­ness inter­ests. These orga­ni­za­tions have vir­tu­ally unlim­ited fund­ing for research and devel­op­ment of new tech­niques and method­olo­gies to defeat anti-spam mea­sures, and they employ some very intel­li­gent peo­ple for that purpose.

Those who per­pe­trate Whitelist Attacks under­stand how com­put­ers, the Internet, and your mind oper­ate. They real­ize the lim­i­ta­tions of three-list anti-spam tech­niques, and, more to the point, they rec­og­nize that admin­is­tra­tors of such sys­tems are too busy to baby sit them. Whitelist spam­mers know that the more time they force us to man­u­ally scru­ti­nize our auto­mated White-, Grey-, and Blacklists, the less use­ful those lists become. Automated sys­tems only work for us so long as they remain auto­mated; the moment we per­ceive admin­is­tra­tion of those auto­mated sys­tems as becom­ing more labor-, time-, or mentally-intensive than our per­cep­tion of deal­ing with spam at the inbox phase, we will aban­don those auto­mated sys­tems entirely–thus open­ing the flood gates to spam once more.

As spam­mers well know, three-list fil­ter­ing is the most effec­tive and acces­si­ble anti-spam method­ol­ogy cur­rently avail­able. In the eyes of the pro­fes­sional spam indus­try, three-list fil­ter­ing on blogs and mail­boxes is the sin­gle largest imped­i­ment to grow­ing their bot­tom line. Beating it is their high­est pri­or­ity. With Whitelist Attacks–simply adding one more URL to their messages–they have indeed found an easy, effec­tive, and low-cost way of defeat­ing three-list spam filtering.

Someone needs to find a way to com­bat Whitelist Attacks–and they must do it swiftly. More advanced algo­rithms need to be devised, algo­rithms that eval­u­ate the style, struc­ture, and ver­biage of blog com­ments and e-mail mes­sages, but that also have the abil­ity to rec­og­nize and extract rep­utable domains. Global Whitelists must be cre­ated to pre­vent the auto­matic addi­tion of all domains ref­er­enced in a spam mes­sage from being added to Blacklists. If an eval­u­ated mes­sage con­tains adult-oriented text and a link to a domain that meets rule def­i­n­i­tions as being unde­sir­able, but just hap­pens to have a spoofed return address of Steve.​Jobs@​Apple.​com, the auto­mated fil­ters pro­tect­ing the mail­box need to be smart enough to add the spam domain to the Blacklist for future match­ing, but to not add Apple​.com to the Blacklist

Whitelist attack­ing is an inge­nious response by pro­fes­sional spam­mers to the most advanced anti-spam sys­tems cur­rently pro­tect­ing blogs and e-mail inboxes. It’s a method­ol­ogy that car­ries grave con­se­quences to hun­dreds of thou­sands of blog­gers, and whose effects will, if left unchecked, crip­ple the Blogosphere. More grave still, the reach and poten­tial dam­age of Whitelist Attacks hits e-mail fil­ter­ing sys­tems equally and threat­ens the Internet far, far beyond blogs.

Blog, Blogs, Blogging, Blogosphere, Spam, Spamming, Whitelist Attack, Whitelist Spam, Whitelist Spamming, Whitelist, Blacklist, Greylist, Graylist, Spam Karma, WordPress, Ant-Spam, Email, E-mail, Inbox, Spam Filter, Spam Fighting, Combating Spam