Style Tag abuse

[Charles Gregory <cg...@hwcn.org>]

Good morning!

Seeing some messages come through with large amounts of bayes poison text 
inserted between style /style tags.

Short of using a 'rawbody' test, is there some other characteristic that 
we could catch?

For example, and another question:

Is there any mechanism in SpamAssassin to count the number of times a rule 
is matched within a message? For example, a single line that contains 
ten or more unpunctuated words is probable, but having them make up more 
than half the overall lines in the mail is quite improbable and most 
likely spam. How could we count that?

Can a flag be set (or can we create one) on a rule so that it counts a 
small score for *each* match rather than just score it once? I realize 
these tests would have to be used with considerable care, like a 
'rawbody', because they would always have to scan the whole body, rather 
than stop at the first match.

- Charles

Re: Style Tag abuse

[LuKreme <kr...@kreme.com>]

On 3-Jun-2009, at 11:07, John Hardin wrote:
> What I'd like to see is "tflags exponential", so that each hit would  
> add score*hits_so_far, to make it easier to punish stuff harder the  
> more it is repeated.


Oooo! can you imagine the scores MS WOrd -> HTML -> Email would get if  
you did that?  Millions.  Perhaps Billions. :)

-- 
Maybe I should have seen it as some kind of sign,
	except I don't believe in them no more; no no, but
	I believe these things I can't forget, tho I don't
	see you anymore.

Re: Style Tag abuse

[John Hardin <jh...@impsec.org>]

On Wed, 3 Jun 2009, Charles Gregory wrote:

> Good morning!
>
> Seeing some messages come through with large amounts of bayes poison text 
> inserted between style /style tags.
>
> Short of using a 'rawbody' test, is there some other characteristic that 
> we could catch?

Nope, If you want to match tags, you need rawbody.

> For example, and another question:
>
> Is there any mechanism in SpamAssassin to count the number of times a 
> rule is matched within a message?

Yep. "tflags multiple". Adds rule score to overall score for each hit.

What I'd like to see is "tflags exponential", so that each hit would add 
score*hits_so_far, to make it easier to punish stuff harder the more it is 
repeated.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   Any time law enforcement becomes a revenue center, the system
   becomes corrupt.
-----------------------------------------------------------------------
  3 days until the 65th anniversary of D-Day