No, You Havent Won a Yeti Cooler From Dicks Sporting Goods – WIRED

Congratulations: Youve been chosen for a Yeti Hopper M20 Cooler. Youve been chosen many, many times. Its right there, in your inbox.

The email is from Dicks Sporting Goods. Never mind that it reads asDicks Sporting Goods, minus the apostrophe, orDicks SportingGoods, orDicks SPORTING Goods. Search for Dicks in your Gmail and youll find it. Search for Dicks on Twitter andwell, something else might come up. But then youll see them, the complaints from people who, like you, have been getting incessant emails from Dicks Sporting Goods about the Yeti Hopper M20. The emails urge the receipts to click the link and claim their prize.

You should not click on any part of this email. The Dicks Sporting Goods/Yeti Hopper Cooler contest isnt legitimate, and it does not originate from the sporting goods brand. Its a phishing scam, something that most of us have encountered at some point in our online lives.

But its an especially pernicious form of spam, one that has circumvented some of Googles robust anti-spam tools for Gmail. Google has acknowledged that this spam campaign is particularly aggressive. A security research firm that has been closely tracking this latest batch of spam told WIRED that the techniques being used are fairly novel, and point to a future in which more email spam could slip past even the most sophisticated anti-fraud systems.

We train [machine learning] models to look at all of the different elements of an email and decompose it, and for a brief period of time, that actually worked well in stopping spam, says Ryan Kalember, executive vice president of cybersecurity strategy at Proofpoint, a US-based security firm. But unfortunately, there are some effective ways to get around that. Whats happening now is, all the fancy machine-learning models just dont see where the bad stuff is in the emails, because of some clever redirection.

People who liberally use the Report Spam & Unsubscribe tool in Gmail might think that would put an end to the Yeti cooler emails; mark an email as spam enough times, and eventually it will go away. That hasnt worked in this case. Justin Watkins, a popular YouTuber,tweeted in frustration about this back in September, begging Google to fine-tune its filters and send the Yeti Hopper emails to spam after receiving the emails for several consecutive months. Its a cat-and-mouse thing, Watkins tells me. Ill mark it as spam and itll, like, disappear for a week, and then Ill get two or three a day again.

What the email spammers are doing now, according to Kalember, is creating a scheme where machine-learning models dont actually get to the point where they see the bad stuff in the email. Theyre using what he calls an HTML anchor technique, which is relatively rare. This differs from the old-school, well-worn ways for scammers to slip past spam filters, which might include rotating which cloud hosting service theyre using, or creating a URL redirect, where the person opening the email clicks on the link and is redirected to several other places on the web before they land on the malicious site. The new spam campaign relies on something more interesting, says Kalember. (Assuming you find email spam interesting and not infuriating.)

Continue reading here:

No, You Havent Won a Yeti Cooler From Dicks Sporting Goods - WIRED