Re: Spam and spam filtering, a problem new to me


On 25-sep-2006, at 22:31, Roberto C. Sanchez wrote:

On Mon, Sep 25, 2006 at 02:14:49PM -0600, Paul E Condon wrote:
Over tha past few weeks, I have started receiving spam email that
contains text the is all well formed words, but doesn't make sense as
a spam message, or as any other sort of communication. I think I have
found what is going on:

The email *does* contain a message. It is contained in a .gif or .png
or other image format file. These are not pictures of naked ladies,
but images of text that touts various penny stocks. If I didn't use
mutt, I might not have had so much puzzlement over them. I suppose
with Outlook all the user sees is the image, which is clearly spam,
but the user doesn't see what the spam filter sees, so, it seems, no
amount of filter fiddling will protect against this. What to do? Are
there new filtering techniques beyond spamassassin?

Reject anything with a .gif or .png attachment?

Yeah, would like to do that. But how can one achieve this with either postfix, spamassassin or cyrus/sieve? I thought sieve couldn't check attachment names or type.

btw, these images are pretty nifty. They are multi gifs; the first one is (almost) empty to stop ocr reading the real message. In the text gif part there are little lines, probably to stop ocr or image fingerprinting. I must say, these guys aren't dump... :-(

Peter


--
To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx

Relevant Pages

  • Re: Spam from National Semiconductor
    ... I can't seem to unsubscribe from the e-mail newsletter. ... I can report incoming mail as SPAM and have sources blocked. ... look it over even after the filter calssifies it in case of false positives. ...
    (sci.electronics.design)
  • Re: Dirty spam
    ... before the filter will tell them it's spam. ... if the listmasters could filter messages with to's and cc's like ... To UNSUBSCRIBE, email to debian-amd64-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • Re: I WILL ASSIST YOU GET YOUR FUNDS
    ... Also, any decent Bayesian filter, or indeed any filter will not be thwarted or totally thrown off by one reply to spam, or a whole bunch of them. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ... Trouble? ...
    (Debian-User)
  • Re: Spam and spam filtering, a problem new to me
    ... a spam message, or as any other sort of communication. ... amount of filter fiddling will protect against this. ... Reject anything with a .gif or .png attachment? ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • Re: Message rule doesnt work
    ... this case it is an HTML spam, ... "PnHfARdMvACwY" to the message rule detector program. ... These .gif type spams are like a picture and so message rules cannot read ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)