Image Spam

Image spam is a kind of E-mail spam where the message text of the spam is presented as a picture in an image file. When introduced by spammers most graphical E-mail client software would render the image file by default, presenting the message image directly to the user, it was a highly effective at circumventing normal E-mail filtering software.

The basic rationale behind image spam is that it is difficult to detect using spam filtering software designed to detect patterns in text in the plain-text E-mail body. Attempts to filter text in image spam are easily defeated because optical character recognition of text in image spam can be prevented using a variety of obfuscation techniques which will not prevent the spam image from being read by human beings. This is the same phenomenon exploited by CAPTCHAs, but put to the ends of spammers, rather than to deter their activity.

Obfuscation techniques can include:

• Blurring of text outlines
• Construction of the image from multiple image layers assembled within an HTML e-mail
• Use of animated image formats
• Random noise added to the image (also known as confetti) to prevent the detection of multiple similar images using hash algorithms

Currently, the surest known countermeasure for image spam is to discard all messages containing images which do not appear to come from an already whitelisted E-mail address. However, this has the disadvantage that valid messages containing images from new correspondents must either be silently discarded, or that bogus "backscatter" bounce messages must necessarily be generated to the reply-to addresses in junk mail messages, enabling denial-of-service attacks by spammers, as well as a directory harvesting attack. Another common technique for image spam detection is to analyze what percentage of the email is actually an image, as image spam often contains very little text content.

Most mailers can also be configured to display pictures only when requested.

A compromise, used by Internet Explorer, is to present the e-mail without any images rendered, giving the user the option to show the images for this e-mail and optionally to whitelist the sender.