Re: [SLE] maildir and spam

From: Carlos E. R. (robin1.listas_at_tiscali.es)
Date: 02/19/04

  • Next message: Tom Allison: "Re: [SLE] nVidia installation" 
    Date: Thu, 19 Feb 2004 23:37:06 +0100 (CET)
To: suse-linux-e@suse.com

    The Wednesday 2004-02-18 at 20:30 -0900, John Andersen wrote:

    > Anything that gets thru spamassassin but IS spam I manually
    > move to a folder I created called missedspam
    >
    > Then every midnight a cronjob runs sa-learn against that
    > folder and then deletes the contents.
    > That trains the bayes filters and they are getting pretty good
    > at spotting those.

    I know that, and I do that; but it is useless for this kind of spam, it is
    designed to fool bayesian filters. This is one of them, see how they look:

    |Banned CD Government don't want me to sell it. See Now &
    |
    |[ads.jpg] pilgrim prefer pueblo italian route exacerbate athens retrieve
    |font canoe abate biotic armament cancellate cia bandpass cavemen anthem
    |disembowel judas decibel shoji attire macdougall gotham luminous turnip
    |swamp baghdad pomade alteration aye abode abode phrasemake impertinent
    |ironic unruly pater interviewee automorphism ouagadougou phlox mae spurn
    |future prolific beard godfrey handle allegra michel revile hence aurora
    |vertices ascent halfback arcadia chalk mcnulty caiman fictive breast
    |barbara defiant armpit censorious bizet madeira beatrice hypodermic snack
    |mink

    And the random text goes on a while more. You can not train a filter on
    random text! If we do, it will match randomly or not at all :-(

    The spam message (payload) is contained in the link "ads.jpg". The rest is
    there in order to fool the filters. See what spamassassin says of that
    one:

    |X-Spam-Status: No, hits=3.7 required=5.0 tests=BAYES_56,HTML_MESSAGE,
    | MY_BANNED_CD,SUSPICIOUS_RECIPS autolearn=no version=2.61

    Note that "MY_BANNED_CD" is a rule I added my self, if not the level is
    much lower.

    So, I ask again: how can we filter this kind of spam with random text? 

    -- 
Cheers,
       Carlos Robinson
-- 
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-help@suse.com
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-faq@suse.com
  • Next message: Tom Allison: "Re: [SLE] nVidia installation"

    Relevant Pages

    • Re: Evolution
      ... move the messages to a folder named ... "Friends" or whatever. ... "friends" then submit what's left to a good Bayesian spam filter. ... Then I start inserting whitelist filters above that "catch-all" and direct them to move the message to a specific folder. ...
      (Ubuntu)
    • Re: Evolution
      ... move the messages to a folder named ... "Friends" or whatever. ... "friends" then submit what's left to a good Bayesian spam filter. ... I'm using Thunderbird and have tried setting up filters both ways. ...
      (Ubuntu)
    • Re: [SLE] maildir and spam
      ... I'm getting a kind of spam (it started a few ... aimed at rendering bayessian filters useless. ... Anything that gets thru spamassassin but IS spam I manually ... folder and then deletes the contents. ...
      (SuSE)
    • Firefox SPAM filtering (Observation)
      ... I have been using Thunderbird for several months, now, and its internal SPAM filters seem to be doing fairly well, but there is still uncaught SPAM at the end of the day. ... I set up a new folder and moved any uncaught SPAM into it. ... No boom today. ...
      (Debian-User)
    • Non-bot-harvestable address (was:Re: None Bot harvestable address)
      ... uses blacklist technologies. ... Can spam. ... Who was talking about filters? ... blacklists, filters, web-hiding, and AI. ...
      (comp.sys.acorn.networking)