SurfControl Says Spammers Worldwide Are Accelerating Techniques to Avoid Detection [11th August 2003]

SCOTTS VALLEY, Calif., Aug 11, 2003 /PRNewswire via COMTEX/ -- SurfControl (London: SRF)(Nasdaq Europe: SRFC), the world's number one Web and e-mail filtering company, today warned of six new techniques being used by spammers to avoid detection and penetrate technologies used to keep them out of e-mail boxes.

"The battle against spam is intensifying as spammers are using ever more sophisticated and aggressive techniques to avoid detection," said Susan Larson, SurfControl's vice president for Global Content Operations, who identified the "Top Six Spam Techniques."

The latest techniques incorporate multiple, sophisticated software tricks buried in HTML code to confuse and avoid detection by traditional content filtering mechanisms, such as dictionaries and statistical analysis. HTML- based spam now accounts for 95 percent of all spam, and 99 percent of adult spam now identified and analyzed by the SurfControl team.

The company said that over the past six months research indicates these frequently used spam techniques have become commonly used by the most threatening and offensive spammers, pornographers and those engaged in "brand spoofing" designed to steal personal information. The techniques capitalize on the naivete of e-mail users and pose significant legal, security, network and productivity risks for businesses. These techniques are especially dangerous, the company said, because they are being used in combination within a single e-mail message.

SurfControl has identified and named these top spam techniques that include:

* Hidden Agenda -- Most commonly used in porn spam, this technique
attempts to fool filters by tricks within the HTML source code of the
message. Spammers use ASCII control code to represent letters, random
words or phrases, as well as white text on a white background in HTML,
within HTML comments or in bogus HTML tags. None of this is visible to
the e-mail recipient. The result of the technique is to split spam
words that make them unreadable by dictionary-based scanning tools.

* Treacherous Tracks -- This technique allows spammers to use their Web
servers to break down a URL directory structure and add code that can
verify a user's e-mail address, track them online and redirect an e-mail
user automatically to a specific Web page. A piece of spam using this
technique would mean that a user, simply clicking on an innocuous
picture within the e-mail, sets in motion address validation, tracking
and direction to a pornographic Web site. This technique also makes it
certain that the recipient, whose address has been validated, will be a
target for much more spam.

* Dodgy Domains -- An increasingly common technique used in HTML-based
spam, this subterfuge allows spammers to redirect unsuspecting e-mail
recipients to unexpected Web sites. By using the sign "@" within a URL,
the spammer avoids URL scans that could stop the spam. A forged domain
name is written before the "@" sign and this is the one an e-mail
recipient believes they will find by clicking on the button in the e-
mail message. The actual destination is hidden behind the "@" sign and
takes users to a forged Web site where they can be the victims of fraud.
This technique is used in "brand spoofing" spam.

* Random Ramblings -- This common technique used by less sophisticated
spammers involves inserting long random words or characters in a subject
line or body of a message. It is designed to skew statistical filtering
or make all repeating spam messages appear different to fool automated
spam fingerprinting filters.

* Counterfeit Characters -- A technique that uses numbers or accented
characters to replace standard characters to fool filtering dictionaries
unless these include spelling variables. V1agra or M0RTG4GE are two
common examples of this trick.

* Elusive Illusions -- A technique used by spammers to hide or disguise
the format and content of an e-mail to avoid dictionary scanners and
statistical filters. Spam content can be hidden within Javascript or
frames.

"These deceptive tactics are making it easier than ever for spammers to prosper and harder than ever for technology companies and law enforcement officials to identify and stop them," Larson said. "In addition, spammers are using offshore Web hosting services that make them very hard to track and e- mail harvesting services that make it simple to target more people than ever before."

SurfControl announced a major upgrade to SurfControl E-mail Filter that incorporates new technology to parse HTML-based spam to identify and filter it fast and effectively. The company also has developed a clever new spam "misspellings" dictionary within its product that has more than 400 examples of the most common misspellings in the bag of spammer tricks.

About SurfControl

SurfControl plc, the world's number one Web and e-mail filtering company, delivers on its promise to help companies 'Stop Unwanted Content' in the workplace by continuous innovation, invention and expansion of its filtering products to address new content risks as they emerge. The company is the leader in the Content Security market, a significant subset of the Secure Content Management market, a market that analysts expect to reach $6.4 billion in 2007.

SurfControl is the only company in the security market offering a total content security solution that combines Web, E-mail (including Anti-Spam and Anti-Virus) and Instant Message Filters with the industry's largest, most accurate and relevant content database and adaptive reasoning tools to automate content recognition.

SurfControl's world-class partners include Sun Microsystems, Check Point, Cisco, IBM, Microsoft, and Nokia. The company has more than 20,000 customers worldwide, including many of the world's largest corporations. The company employs nearly 450 people in nine locations across the United States, Europe, and Asia/Pacific. For further information and news on SurfControl, please visit http://www.surfcontrol.com/

SOURCE SurfControl

Christina Frey of SurfControl, +1-831-431-1692,
christina.frey@surfcontrol.com; or Pam Small of Ignition Strategic
Communications, +1-202-339-0111, psmall@ignitioncom.com, for SurfControl
/Photo: NewsCom: http://www.newscom.com/cgi-bin/prnh/20030811/DCM006
AP PhotoExpress Network: PRN2
PRN Photo Desk, +1-888-776-6555 or +1-212-782-2840