Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Snowshoe spam is pretty common now, with a lot of the larger networks mixing in spammers with legitimate traffic (lookin' at you, ovh.com).

As it is right now, spam is just mostly a drain on network and human resources.

This attack would also target storage. Google has enormous amounts of storage, so I've no idea whether it would be effective against them or not. But, it would be very effective against any smaller service providers that tried to do the same image caching thing (which so far seems to be a roundly bad idea, IMO).

It would also open up the possibility of using Google as an attacker to take down other sites. If Google's servers immediately requested the image for caching, then just send out a few million messages to Google addresses, each one with a unique URL pointing to some big image file on some site you want to take down. Most sites will accept a query string after an image URL, so ... bob's yer uncle. As it is now, this isn't an effective attack because you need to get people to actually open up the email message and then click "Display images", all within a short period of time.



Nope; still the same filtering; they are not going to cache things detected as SPAM; so an attacker would have to fool the anti-spam algorithm first... good luck with that!


I wasn't describing a new tactic for spamming, I was describing possible new tactics for targeted attacks. They're different things.


An attack that relies on the possibility of being able to send millions of emails without being detected as spam; so it is unlikely to succeed.


Gmail has probably the best spam filtering in the world, but you seem to think it's flawless, and it's not. I just now signed into my old Gmail account for the first time in ages. There's spam in there, and recent too. Roughly one per day by the looks of it -- messages that aren't newsletters, or from previous contacts, or anything that I signed up for.

And spammers aren't even that smart, they're just numerous and financially motivated.

If somebody wanted to annoy someone else with this, they could.

And, again, even if this doesn't work against Google directly, it certainly would work against other service providers who decide to follow Google's lead.

Heck, just look at the recent popularity of the WhatsApp spam that spread malware to tons of people (including Cryptolocker in some cases), or the "Secure Document" phish that made the rounds in Gmail in September.


Ok I see your point; but I want to add that one of the reasons your old account has spam is because you don't use it; I don't know what algorithm they are using but it certainly relies on usability data; I don't know exactly but could be: what language you usually speak in; what hours of the day you receive and read important email, what subjects you read about, etc etc.


Yeah, that could be. I have to spend a significant part of my time now dealing with spam (sysadmin), and Gmail's handling of spam is years ahead of most of the tools I have available.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: