Web Bugs: How Spammers and Web Designers Are Using Invisible Images To Keep Track Of You
- Spam Spam Spam Spam Spam Spam Spam Spam and Spam
- Call an Exterminator! It's a Web Bug!
- What Are the Implications?
- Protecting Yourself from HTML Snooping
- Mail Readers that Don't Display Exterior Graphics
- Web-based Email Clients that Are Safe
Spam Spam Spam Spam Spam Spam Spam Spam and Spam
Last week I got a piece of spam. Spam, of course, is unsolicited, bulk, commercial email—not to be confused with the Hormel meat product. It's not unusual that I got a piece of spam last week, actually; having had the same email address for ten years now, I get a lot of it. Mostly advertising penis enlargements, herbal Viagra, and Hot Young Teens doing all sorts of things.
I, like many of you, feel it my personal responsibility to respond to each and every piece of spam that I get, usually with carbon copies upstream to those hosting spammers' Web sites and to sad sysadmins who most likely already know they left their SMTP ports unguarded. I do this because I am certain that spam is the Internet's ugliest side. Because spam is not yet properly defined by law in the U.S. or most European nations, there are no enforceable regulations preventing its continuing growth. In the U.S., for example, there are five pieces of legislation before the House and one before the Senate that deal with spam. Not one of them prohibits the sending of spam; only the normal dirty tricks, such as falsifying headers, misleading subject line, fraudulent content, and so on.
Trying to dig the six legitimate pieces of email out of 100 Multi Level Marketing (MLM) scams over a 14.4k modem on a shaky phone line in Cairo will make the most even-tempered of us furious at those trying to sell home-based businesses by sending copies of their advertisement to half a million Internet users in the hopes that one or two people will buy it.
Clever Payload
This time, amid the potions guaranteed to enlarge my bust and ten-day-no-risk-no-money-down-work-at-home-stuffing-envelopes plans that would significantly increase my wealth, one piece of spam stood out. It appeared in my Outlook Express window as a completely blank message. Which in itself isn't necessarily shocking because I have a feeling that most people sending out spam are very new to the Internet, but it still puzzled me. So I checked to see if there was any HTML in the message—for some reason, spammers seem incapable of sending messages in ASCII. And sure enough, there was. There was a single line of ingenious HTML that looked like this:
<img src="http://somewhere.foo.bar/images/zero.jpg">
This turned out to be a one-kilobyte .jpeg file that measured a single white pixel across. Nearly invisible. It really was, as you may have guessed, an insidious and surreptitious "return receipt requested." When the email is opened, the .jpeg file is automatically downloaded by your HTML viewing email client. What does this do, though? It creates a log entry in a Web server (in this case located in Hong Kong) that says that you opened the email, when you opened the email, and the IP address you opened the email from.