[Mimedefang] new obfuscation

[Jon R. Kibler]

Joseph Brennan wrote:
> 
> New obfuscation type.  
<SNIP!>

Actually, its ancient. I have some spam samples (archived somewhere) going 
back to the late 1990s that used HTML comments to accomplish the same thing.

Don't have one from the 1990s online, but here's one from some spammer in 
WPB, FL from Dec 2001:
> <BR></STRONG></FONT></P></center><P><STRONG>RECENT PRICE: $.20<BR><BR>SELL 
> TARGET: $1.25</STRONG><BR></FONT></P><P><FONT face3DArial><STRONG>INVE<!--just 
> in-->STORS: WE HAVE FOUND THE HIDDEN GEM: (OT<!--mary had a little lamb-->C<!--its 
> fleece was white as snow-->BB: ERHC) </STRONG>The IMF (International Monetary Fund) 
> states in a world<!--time for-->wide published report [February 2002 IMF Country 
> Report No. 02/30 (page 10 of 82)] that ERHC's working interest in their offshore 
> West African oil blocks will generate $<!--for christmas-->1,446,800,000 in 
> cumulative income over the next 22 years.<br><br><center>The IMF provides this 
> evaluation to its 183 Member Nations while promoting international monetary 
> exchange and fostering economic trade and growth with an arsenal of $<!--we 
> come-->272 Billion!</center><br><br><STRONG>Do<!--home-->w Jones Ne<!--and 
> we-->ws:</STRONG> ERHC enters into joint-ven<!--eat the-->ture license 
> agreements with <b>Schlumberger LTD (NY<!--mistletoe-->
> 

However, looking at the old samples, it appears that the sender's vanity
was more the issue than obfuscation! But, it had the same effect of breaking
up keywords.

Jon

--
Jon R. Kibler
Chief Technical Officer
A.S.E.T., Inc.
Charleston, SC  USA
(843) 849-8214





==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.