The return of "old school" spam

Every quarter Google and Postini take a joint look at the state of the spam industry, its undulations and upheavals. And the results for the most recent quarter, ended June 30, are in.

In many ways, the results are unsurprising: Spam is up again, with levels 53 percent higher than the first quarter of the year, but just 6 percent higher than the second quarter of 2008. (Spam levels were uncommonly low last quarter following the shut-down of the ISP McColo, a notorious haven for spammers. Those spammers have largely found other services to host their activities, and spam levels have since rebounded.)

But rising spam levels are not exactly a surprise. The big news in the latest figures is the return of spammers to traditional, almost "old school" methods.

One of the big ones is the sudden reemergence of image spam, a very simple form of spam in which the advertisement or message is embedded into an image inside an email. Image spam became common in 2007 because spam filters at the time where focused on filtering certain keywords, so spammers responded by recreating those words as graphics, which would sail through the filters. Spam filters have since adapted to this technique, but now it's coming back. Why? Hard to say, but my hunch is that so many email messages contain images now -- both commercial and personal -- that unilaterally filtering out image content is no longer an effective strategy. I know when I receive an email that contains mostly hidden images, I almost always choose to "show images" in my email client; there's just no other way to figure out whether it's something useful or not.

The Google/Postini report also offers some other possible explanations, including the likelihood that spammers are "testing" spam filters, or trying out their replacement ISPs with older techniques before advancing on to something more sophisticated.

Another old-school spam technique on the rise: Viruses sent as email attachments. Again, this is an attack that has fallen out of favor in recent years because so many attachments are blocked at the server. Spammers of late have instead sought to direct victims to malicious web links, which are tougher to filter out.

But now virus attachments are making a comeback, another return to the methods that worked in the past. (Though I think these virus attachments will have considerably less success than revisiting image spam techniques.)

All of which just goes to show: Never get complacent when it comes to PC security, because you never know what they're going to try to hit you with.