Picture based spam

[Tony Melia]

Hi,
 I 
have setup SA 3.1 under FC4, which is working quite well. However, one 
type of message that still gets through is a series of mails that are made up of 
no text other than a varying subject, then a picture, which is black text on 
white, which looks exactly like an ordinary email. Obviously SA can't read 
the message since it is an image, but is there a way to make a rule that blocks 
a mail where there is an image only, no text?

Regards,
Tony

Re: Picture based spam

[List Mail User]

...
Hi,
I have setup SA 3.1 under FC4, which is working quite well.  However,
one type of message that still gets through is a series of mails that are
made up of no text other than a varying subject, then a picture, which is
black text on white, which looks exactly like an ordinary email.  Obviously
SA can't read the message since it is an image, but is there a way to make a
rule that blocks a mail where there is an image only, no text?
 
Regards,
Tony
...
Yes, this is a problem, but a simple rule like you describe is overly
broad;  What happens when my wife sends our children snapshots from with her
cell phone (which causes exactly this case - though the pictures are in color).
Maybe other service providers add some text, and I know she *could* attach a
message, but seldom does (she just gives it a title like Nice statue,
Pretty bird or similar short, almost meaningless Subject: lines).

Also, you obviously haven't seen the multi-color text on colored
background spams with thin (one pixel) randomly angled lines going through
the text to confuse the commercial services who do already attempt character
recognition in images.  Maybe some enterprising individual will try to
write a plug-in for SA to do this (still, it would be computationally
expensive for sites getting many images).

Once again, digests, net tests (DSN, RCVD, etc.) and header rules
are your best defense for now (also, AFAICT, .png files appear mostly
in spam, JPEG and TIFF files are sent by most camera phones, so maybe a rule
on image type would help some, but spammers would quickly adapt, and nearly
all image formats have legitimate uses - let's not argue about .gifs here).


Paul Shupak
[EMAIL PROTECTED]

Re: Picture based spam

[Matt Kettler]

At 07:03 AM 11/16/2005, Tony Melia wrote:

Hi,
I have setup SA 3.1 under FC4, which is working quite well.  However, 
one type of message that still gets through is a series of mails that are 
made up of no text other than a varying subject, then a picture, which is 
black text on white, which looks exactly like an ordinary 
email.  Obviously SA can't read the message since it is an image, but is 
there a way to make a rule that blocks a mail where there is an image 
only, no text?





Look at HTML_IMAGE_ONLY_04, which matches a message with an image and 0 to 
400 bytes of words.


The rule is declared like this in 20_html_tests.cf:
body HTML_IMAGE_ONLY_04 eval:html_image_only('','0400')

You could easily create a variant that matches only 0 chars of words..


body HTML_IMAGE_ONLY_00 eval:html_image_only('','')
score HTML_IMAGE_ONLY_001.0
Note: this will double-match with HTML_IMAGE_ONLY_04 if the message is 0 
bytes of text.


I'd suggest adding the rule to it's own .cf file in /etc/mail/spamassassin. 
This way if a future upgrade changes the eval we're using here, you can 
quickly remove the rule until it can be revised.