Re: spamassassin block *.png

[Michelle Konzack]

Hello John,

sorry for the late answer, have not checked this mailfolder

Am 2009-05-02 20:46:32, schrieb John Hardin:
> On Sun, 3 May 2009, Michelle Konzack wrote:
>
>>* B ?? ^Content-Type: image/(png|pjpeg|gif)
>
> Adam, have you seen any pjpeg or gif attachments in your spams?
>
> Michelle, are these the same sort of spams Adam has been seeing, no  
> message text (if I recall correctly) and a 240x400 pixel image 
> attachment?

/tmp/michelle.konzack.oQ3692/muttFGUbBi is 344x429 PNG image, color type 
PALETTE, 8 bit, file gamma 0.4500
  Using DirectColor visual
  Building XImage...done

/tmp/michelle.konzack.oQ3692/muttbVnA89 is 336x392 PNG image, color type 
PALETTE, 8 bit, file gamma 0.4500
  Using DirectColor visual
  Building XImage...done

/tmp/michelle.konzack.oQ3692/muttzV4Sax is 375x414 PNG image, color type 
PALETTE, 8 bit, file gamma 0.4500
  Using DirectColor visual
  Building XImage...done

/tmp/michelle.konzack.oQ3692/muttnC7KoH is 366x420 PNG image, color type 
PALETTE, 8 bit, file gamma 0.4500
  Using DirectColor visual
  Building XImage...done

/tmp/michelle.konzack.oQ3692/muttwHjgni is 381x383 PNG image, color type 
PALETTE, 8 bit, file gamma 0.4500
  Using DirectColor visual
  Building XImage...done


Curently I have them stored in the Spamfoler for analizeing/testing and
it seems, they are ALL diffrent size (I have checkt 500 of them with  a
script and netpbm)

If you need a bunch for testing, please let me know, I will opload it on
my server as tar archive.

Thanks, Greetings and nice Day/Evening
Michelle Konzack
Systemadministrator
24V Electronic Engineer
Tamay Dogan Network
Debian GNU/Linux Consultant

-- 
Linux-User #280138 with the Linux Counter, http://counter.li.org/
# Debian GNU/Linux Consultant #
 Michelle Konzack
   Apt. 917
   50, rue de Soultz
Jabber linux4miche...@jabber.ccc.de   67100 Strasbourg/France
IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947
ICQ #328449886Tel. FR: +33  6  61925193


signature.pgp
Description: Digital signature

Re: spamassassin block *.png

[Bob Proulx]

John Hardin wrote:
> Michelle, are these the same sort of spams Adam has been seeing, no  
> message text (if I recall correctly) and a 240x400 pixel image 
> attachment?

The ones I have been getting are various sizes such as 367x418,
370x410, 364x425, 344x402, and so forth.

Bob

Re: spamassassin block *.png

[John Hardin]

On Sun, 3 May 2009, Michelle Konzack wrote:


   * B ?? ^Content-Type: image/(png|pjpeg|gif)


Adam, have you seen any pjpeg or gif attachments in your spams?

Michelle, are these the same sort of spams Adam has been seeing, no 
message text (if I recall correctly) and a 240x400 pixel image attachment?


--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  Windows Genuine Advantage (WGA) means that now you use your
  computer at the sufferance of Microsoft Corporation. They can
  kill it remotely without your consent at any time for any reason;
  it also shuts down in sympathy when the servers at Microsoft crash.
---
 6 days until the 64th anniversary of VE day

Re: spamassassin block *.png

[Michelle Konzack]

Am 2009-05-01 02:56:34, schrieb vibi:
> 
> Hello,
> How to use spamassassin block *.png so that going to the quarantine?
> 100% of spam that gets to me a plain e-mail with attachment *.png

Here is the same.  Spamassassin does not block this crap, but if you use
procmail you can do:

:0
* > 16000
* < 2
* H ?? ^Content-Type: multipart/mixed
* B ?? ^Content-Type: image/(png|pjpeg|gif)
.Spam_PNG/

which stop the current PNG flood...  I have gotten on

2009-04-27   7813
2009-04-28  49487
2009-04-29  73298
2009-04-30  56017
2009-05-01   9715
2009-05-02  37590
2009-06-03186

All messages have a size between 16 kByte and 19 kByte which mean,  over
4 Gbyte spam in one week.  If I find the spamer, I will put on my combat
boots...  (I am french Ex-Military; LEF)

Thanks, Greetings and nice Day/Evening
Michelle Konzack
Systemadministrator
Tamay Dogan Network
Debian GNU/Linux Consultant

-- 
Linux-User #280138 with the Linux Counter, http://counter.li.org/
# Debian GNU/Linux Consultant #
 Michelle Konzack
   Apt. 917
   50, rue de Soultz
Jabber linux4miche...@jabber.ccc.de   67100 Strasbourg/France
IRC #Debian (irc.icq.com) Tel. DE: +49 177 9351947
ICQ #328449886Tel. FR: +33  6  61925193


signature.pgp
Description: Digital signature

Re: spamassassin block *.png

[Matus UHLAR - fantomas]

On 01.05.09 02:56, vibi wrote:
> How to use spamassassin block *.png so that going to the quarantine?

SpamAssassin does not block, it only scores according to configured rules.

> 100% of spam that gets to me a plain e-mail with attachment *.png

stop using SpamAssassin and use different filter that can disable PNG
attachments. amavis or maybe MTA's rules.

-- 
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
- Have you got anything without Spam in it?
- Well, there's Spam egg sausage and Spam, that's not got much Spam in it.

Re: spamassassin block *.png

[vibi]

I use FuzzyOCR and a large portion of spam is cleared to image.
But the news from *. png does not want to cut out: (
I made a record:

mimeheader GIF_ATTACHMENT Content-Type =~ /image\/gif;\s*(\n\s+)?name=""/
mimeheader PNG_ATTACHMENT Content-Type =~ /image\/png;\s*(\n\s+)?name=""/


How do I send a test e-mail account of his attachment to the *. png to go in
quarantine.
But spam and so I see that goes to the mailbox:(


Dennis Davis wrote:
> 
> On Fri, 1 May 2009, vibi wrote:
> 
>> From: vibi 
>> To: users@spamassassin.apache.org
>> Date: Fri, 1 May 2009 02:56:34 -0700 (PDT)
>> Subject: spamassassin block *.png
>>
>> How to use spamassassin block *.png so that going to the quarantine?
>> 100% of spam that gets to me a plain e-mail with attachment *.png
> 
> One poossible tool to help reduce this is the FuzzyOcr plugin:
> 
> http://fuzzyocr.own-hero.net/
> 
> You'll need other graphics software used by the above plugin.
> 
> For example, a message I receive a couple of days ago scored:
> 
> X-Spam-Report: 1.0/6.0
>  Start SpamAssassin results 
> *  1.0 DC_IMG_TEXT_RATIO BODY: Low body to pixel area ratio
>  End SpamAssassin results
> 
> With the addition of the FuzzyOcr plugin it scored:
> 
> X-Spam-Status: Yes, score=12.1 required=6.0 tests=FUZZY_OCR,RDNS_NONE
> autolearn=disabled version=3.2.5
> X-Spam-Report: 
> *  0.1 RDNS_NONE Delivered to trusted network by a host with no
> rDNS
> *   12 FUZZY_OCR BODY: Mail contains an image with common spam
> text insi
> de
> *  [Words found:]
> ["viagra" in 5 lines]
> ["profit" in 1 lines]
> [(9 word occurrences found)]
> -- 
> Dennis Davis, BUCS, University of Bath, Bath, BA2 7AY, UK
> d.h.da...@bath.ac.uk   Phone: +44 1225 386101
> 
> 

-- 
View this message in context: 
http://www.nabble.com/spamassassin-block-*.png-tp23330686p2218.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: spamassassin block *.png

[Dennis Davis]

On Fri, 1 May 2009, vibi wrote:

> From: vibi 
> To: users@spamassassin.apache.org
> Date: Fri, 1 May 2009 02:56:34 -0700 (PDT)
> Subject: spamassassin block *.png
>
> How to use spamassassin block *.png so that going to the quarantine?
> 100% of spam that gets to me a plain e-mail with attachment *.png

One poossible tool to help reduce this is the FuzzyOcr plugin:

http://fuzzyocr.own-hero.net/

You'll need other graphics software used by the above plugin.

For example, a message I receive a couple of days ago scored:

X-Spam-Report: 1.0/6.0
 Start SpamAssassin results 
*  1.0 DC_IMG_TEXT_RATIO BODY: Low body to pixel area ratio
 End SpamAssassin results

With the addition of the FuzzyOcr plugin it scored:

X-Spam-Status: Yes, score=12.1 required=6.0 tests=FUZZY_OCR,RDNS_NONE
autolearn=disabled version=3.2.5
X-Spam-Report: 
*  0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
*   12 FUZZY_OCR BODY: Mail contains an image with common spam text insi
de
*  [Words found:]
["viagra" in 5 lines]
["profit" in 1 lines]
[(9 word occurrences found)]
-- 
Dennis Davis, BUCS, University of Bath, Bath, BA2 7AY, UK
d.h.da...@bath.ac.uk   Phone: +44 1225 386101