E-mail spam purveyors are using both new and old techniques to sell people goods or trick them with fraud, phishing and other scams, according to a new report.

In a bid to evade anti-spam software, the spammers are starting to break up the universal resource locator (URL) links to websites with quotation marks, Symantec Corp. said in its monthly spam report for April, released Tuesday.

"Spammers have always experimented with methods to try and evade URL filtering techniques and this seems to be another example of this," according to the report.

Non-English messages rising

The unsolicited messages are also increasingly being sent out in languages other than English, reaching people who may not previously have acted on an English-language spam e-mail.

The security software company cited European languages such as German, French and Italian, noting that the example of a casino spam message used was responsible for 70 per cent of all non-English spam attacks at its peak.

The volume of image spam is still "volatile" and closed out March at a rate of 37 per cent of all spam messages observed by the Symantec Probe Network, the report stated. The messages — which convey their message as an image to evade text-based detection and filtering — are also using European languages in an effort to slip past filters designed to detect image spam, Symantec said.

"Where once we saw random excepts from Harry Potter books included at the bottom of image spam, a new spam technique is emerging where the spammer is now using Russian and German text," the report stated.

Old trick returns

One older technique that has seen a resurgence in use among phishers is to hide the URL or internet address of a link displayed in a web browser's status bar.

JARGON

BOTNETS are networks of computers that have been hijacked by malicious groups or individuals to do their bidding. Their owners are usually unwitting victims who have no idea their machines have been infected and turned into so-called zombies. The zombie computers are typically used to distribute spam or phishing e-mails, or viruses and Trojans that let them hijack other computers. Botnet operators often rent time or bandwidth on their networks to spam e-mail marketers and phishing scam artists. MALWARE is a catch-all term for malicious software such as computer viruses, spyware and so on that compromise the security or function of people's computers. PHISHING is a technique in which criminals try to trick people into disclosing sensitive information such as online banking names and passwords and is often conducted through e-mails. PHARMING is an attack in which malicious individuals try to redirect traffic from one website to a false one. SPAM is a catch-all term for unsolicited or unwanted e-mail messages. It generally refers to e-mails that tout products or try to lure people into phishing scams or malware infection attempts. The messages are often distributed by botnets that employ zombie computers that may have been infected through a spam message. TROJANS are programs that appear to perform one function in order to hide a malicious one. Like the mythological Trojan horse such programs are named after, the deception tricks people into granting them access to a computer. ZOMBIES are computers that have been hijacked by attackers to perform commands and functions issued to them, often without the owners' knowledge. They are typically infected by Trojans that enable attackers to use them in a botnet. An infected computer is sometimes referred to as a bot — short for robot.

Usually, when a person positions their mouse pointer over a link, the address is displayed in the status bar at the bottom of the browser window. Phishers used to get around this feature by using JavaScript to display one URL in the status bar while the link would actually open a different address once someone clicked on it. Because most e-mail programs' default setting is to prevent Javascript from being executed, that technique would not work.

Now, spammers have found a way to display a false URL in the status bar without using JavaScript, Symantec said: "The message replaces the text in the status bar with the expected legitimate URL."

Clicking on the link would show in the address input area that the URL is a fraudulent one, but it would also expose people to a potentially malicious website and possibly result in the computer becoming infected with a virus or other malware, so that is not a recommended detection technique, Symantec said.

Spam levels were relatively stable in March, accounting for about 65 per cent of e-mails sent, the report stated.