Spammers Newest Tactic: YouTube Video Spam
Researchers at Kaspersky Lab have recorded a mass mailing of spam emails containing a link to a video advertisement on YouTube. Although in the past, spammers have attempted to lure people into clicking links by claiming the link would display a YouTube video, this is the first case in which the link actually does point to YouTube. In this particular incident, the video in question is a Russian ad promoting industrial real estate.
Two years ago, Kaspersky Lab predicted that YouTube would eventually become a vector for disseminating spam due to its worldwide popularity. However, this is the first time the video-sharing site has been used in this way as far as the researchers can tell.
Says Darya Gudkova, Head of Content Analysis & Research at Kaspersky Lab, "naturally, this type of advertising is more interesting and gets more hits." That's bad news for YouTube because when something works, spammers keep at it... with a vengeance. Once word gets around that video spam is more successful than traditional methods, there's no doubt that it will only increase.
How Would YouTube Handle Video Spam?
So what will YouTube do if video spam becomes a real problem on its network? We would like to think that it would take the offending content down, but that could be easier said than done. After all, this isn't like the copyrighted content that their Content Identification tool can easily identify and remove. That tool works by comparing unique signatures somewhat like a digital "fingerprint" from a content owner's copyrighted file to user uploads across the site. Then, if a match occurs, the copyright holder has the option to have the video taken down.
Identifying a spammer's video would be much harder. Just because someone is using YouTube to sell something, that doesn't necessarily mean it's video "spam." That moniker should only be reserved for videos which are truly undesirable messages where fraudulent activities are underway. The question is, how would YouTube know?
Assuming that video spam takes off, the best thing the site could do to police online content is to include a "report spam" button for videos themselves, as it now has for video comments only.
Of course, for potential victims of video spam, the best thing is not to get duped into visiting YouTube in the first place. Spam filters will simply have to adapt to this new technique. Unfortunately, that will be yet another challenge for Google, which, in addition to owning YouTube, also offers a feature in its webmail product Gmail that automatically embeds any YouTube videos referenced in the email directly in the message itself. That makes it even more convenient for video spammers, who wouldn't have to convince their victims to leave their inbox and launch a new browser window: just click a button on the video embedded below.
Facebook
Comments
Subscribe to comments for this post OR Subscribe to comments for all ReadWriteWeb posts
@sarahintampa And its not just about spam.. there so many videos on Yt that share pirated stuff.. see example http://bit.ly/10oUuk
Good point - how should YouTube police that sort of stuff, too? (Should they even be the video police?)
We also observed this some time ago: http://blog.defensio.com/2009/05/27/adventures-in-spam-hollywood-style-spamming/
To upload any content you need a acount.
Adding log in to see movies and a spam abuse button with wiki feature should solve that problem. Then take away auto play when joining Youtube. That will take away most of the problems and a blocked youtube video should not gain anything. Then official corps with validated log in would not have that problem if they upload content.
Regards
m00ns
It's easy enough for YouTube to create a few thousand email addresses and "seed" them around the net so they get spammed, then watch for incoming email with links that resolve to YouTube sites. They would of course have to be smart about this, actually following the links to follow redirects and other obscufication, but it can be done.
If a given video gets a lot of incoming traffic from spam emails, do a manual investigation and take appropriate action.
Hi Sarah,
This topic is right up my alley - I'm a security researcher for Websense. YouTube as a conduit for spammers is another sore spot for Web 2.0 services.
I know this may sound counter-intuitive at first glance, but we're not Google/YouTube, yet we have visibility into these YouTube spammy videos that are actively being used in spam. Carl who just commented above is from Defensio, and we have insights into comment spam.
Meaning, if a spammer posts a spam video on YouTube, they will then want to "market" it around on blogs, etc .. and we can tally the URLs that are being circulated throughout the spam-blogosphere, and monitor for spikes, etc. We also track the IP address of the people posting the blog spam comment (containing the YouTube link), so we know who they are. Among the other variables we track..
On a related note, can the community effectively flag most of the spammy content and rid of them somewhat reasonably well ? http://securitylabs.websense.com/content/Blogs/3335.aspx
Cheers!
Jay Liew
Websense Security Labs
@jaysern
That's really interesting, Jay, thanks for sharing. Please feel free to keep me posted on your research. sarah at readwriteweb.com
Posted by: Sarah Perez
|
October 9, 2009 8:53 AM
You tube is a paradise for spammers and it will increase day by day
Wow! Crazy. Thanks for the post!
NO WAY should YouTube install a spam button
Those sorts of buttons are often used by the malicious.
It's the same syndrome as some AOL users who instead using the unsubscribe link in newletters they no longer want, but THEY SIGNED UP FOR, they just lazily hit the AOL spam button to bet rid of them and damage the reputation of well intentioned business people.
JG
I agree with Jonathan, a spam button with good intentions can easily be misused.
Spam is so annoying and yet to some extent it works, otherwise people wouldn't pay to spam. Makes me wonder who those people are that click on the spam links. They've doomed us all!
-Chris
Discover everything you need to know about music at the new Decibel Blog.
YouyTube Video Spam is not new, it has been going for 6 months at least.
The last 6 months I have seen many linkbuilding attempts on directories and digg-like websites. I own a digg clone http://www.checkit.gr/ and you can see similar linkbuilding attempts over there.
One of my videos was scraped and re-uploaded by a YouTube spammer - actually twice by two different ones - last month. Ads were inserted into the video itself, and also as links in 'more info ...'. The spam accounts appeared to be robot-fed.
YouTube provide a way to deal with such threats: YouTube Copyright Complaint Submission. It worked well for me. Action was taken in just a couple of days, and it was soon after that the illegal videos stopped appearing in results.
The problem with that method is its labour intensiveness. Only a human could have made the final assessment about the legitimacy of my claims, though I guess the Video Idenfication tool mentioned in this article was used too.
As Sarah suggests, it is worth remembering that in some cases one person's 'spam' is another's 'advertorial content'.
However, I think a Spam Button for Google is a fine idea. I don't understand the comments of Jonathan and Chris saying it is objectionable and could be misused. If I understand the concept correctly, hitting Spam would banish the offending video from the point of view of the user hitting it, filtering it out of personal view, in other words, just like in Gmail right?
Perhaps if a certain number of people have spam-marked the content it could disappear from general view with an option to reveal on demand. That function is already in place in YouTube comments.