On Wed, 25 Mar 2009, Arvid Ephraim Picciani wrote:
John Hardin wrote:
It would be somewhat more robust if SA offered multiline rawbody matching,
but try this:
thanks for your effords. unfortunatly spammers read this list and
they'll adapt too quickly to make any use of custom rules
It's also fairly specific to the HTML in the sample message.
exactly. they'll just change the html in the next wave. this spam isnt
new, yet the SA list is once again full of threads about exactly that
recent wave, becouse old rules dont match.
If 3.2.x does indeed implement multiline rawbody matches, then we'll be
able to have a robust rule for this - e.g. an HTML email with a table that
has more than 30 columns and more than 5 rows. That will be difficult to
obfuscate.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
We have to realize that people who run the government can and do
change. Our society and laws must assume that bad people -
criminals even - will run the government, at least part of the
time. -- John Gilmore
-----------------------------------------------------------------------
63 days since Obama's inauguration and still no unicorn!
