Ignore the smallprint


  09 September 2011


Using very big and very small letters where the latter are likely to be ignored and the former contain the actual message. See also Whiter Shade of Pale.

Submitted by Natalia Zablotskaya (Kaspersky Labs); more at this SecureList blog post.


 <font size="6"><span style="FONT-FAMILY: arial black,sans-serif">C</span></font>
<font style="FONT-FAMILY: garamond,serif" size="1">xaaabbbb </font>
<font size="6"><span style="FONT-FAMILY: arial black,sans-serif">H</span></font>
<font style="FONT-FAMILY: garamond,serif" size="1">deeeffff </font>
<font size="6"><span style="FONT-FAMILY: arial black,sans-serif">E</span></font>
<font style="FONT-FAMILY: garamond,serif" size="1">hhhhiiij </font>
<font size="6"><span style="FONT-FAMILY: arial black,sans-serif">A</span></font>
<font style="FONT-FAMILY: garamond,serif" size="1">kkllllmm </font>
<font size="6"><span style="FONT-FAMILY: arial black,sans-serif">P</span></font>
<font style="FONT-FAMILY: garamond,serif" size="1">mnnnnooo </font><br/>

Looks like:

Cxaaabbbb Hdeeeffff Ehhhhiiij Akkllllmm Pmnnnnooo
Prrrsssss Htttuuuvv Avvvwwwwx Raabbbbbb Mccddddee Affgggghh Chhiiiijj Ykkkkklll

The text as seen in spam emails was a link to a website vulnerable to SQL injection. However, nothing is pulled out of a database; instead, using a SELECT query, code is inserted that causes the user to be redirected to a pharmacy website.


The Sieve

Spammers compendium entry - The Sieve

Strip Mining

Spammers compendium entry - Strip Mining

Animated Noise

Spammers compendium entry - Animated Noise

Phish Phorm

Spammers compendium entry - Phish Phorm

1 across, 3 down

Spammers compendium entry - 1 across, 3 down