jciv's blog

I found a Flickr user’s photostream full of those odd text images that have been popular in spam lately. At first I thought it was some project to collect the images for some antispam purpose. Then I thought it must be a spammer hosting his images on Flickr. Then I realized what had happened.

Flickr allows you to setup a special email address to mail images to that are automatically posted. That is a very useful feature. That allows you to post directly from your camera phone or Google’s Picasa. For security they choose pretty good random unique email addresses (similar to hyper91bat at photos.flickr.com) to prevent spam or people posting to unauthorized accounts.

But there are ways spammers might get these secret addresses. Random luck is unlikely but could happen. They could also get them from compromised computers. Anyway, it seems to me that Flickr is posting images from spam emails being sent to this secret address. If you check out the oldest page you will see this guy hasn’t been active on Flickr since October 2006 and the spam started in February 2007 so he probably has no idea this is happening. Currently he has 92 photos, of those only 11 are not spam.

These photos contain the text and subjects from the spam so I did some more searching to see if I could find any other signs of this, but it was futile. Image spam is designed to get around spam filters by including random or stolen text that is not full of the usual spammy words. Those go in the image. So having nothing to search for means there is no way of knowing how wide spread this problem is.

If this happens to you, go to your Uploading by email settings page under Your Account, Email and hit the Reset button. This will give you a new unique address and should stop the spam. I would also be sure to check your computer for spyware and viruses since the spammers had to have found your address somehow.

Update May 22: By searching spam and flickr I was able to find two more users who have experienced this problem. Spygirl got hit by this, though only two image spams were posted before she stopped it. And thegentlemanfarmer got several of them. Both changed their upload address and don’t seem to be getting surprises in their photostream anymore.

Update June 7: It took a while, but the spam on baxter.1002’s photostream is all gone. I wonder if Flickr cleaned it up or if baxter came back. Either way, I am glad it is gone now.