You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Anders Norrbring <li...@norrbring.se> on 2006/10/17 16:02:04 UTC
This image is turning frequent..
This type of image spam is getting more common, and is not detected.. At
least not here..
--
Anders Norrbring
Norrbring Consulting
Re: This image is turning frequent..
Posted by Jo Rhett <jr...@netconsonance.com>.
I think you guys are going down a much harder road. This only makes
sense if and when e-mail with only a GIF is a normal type of e-mail that
people find acceptable. Otherwise, just score e-mail with only a GIF
and/or some extra bayes poison high and don't bother analyzing it.
Kelson wrote:
> decoder wrote:
>> But that is a difficult task considering how many things are possible
>> with the GIF standard. This picture uses offsets and slow frame rates,
>> others use transparency etc. A simple way to block these images would
>> be to scan the GIF for offset frames. I don't think there is any valid
>> GIF which makes use of these techniques...
>
> If "offset frames" means what I think it does, they're actually a fairly
> common technique in animated GIFs where you only need to change part of
> the image. After all, if you're changing a 30x50 section of a 200x200
> image, why waste space on an extra 38,500 pixels?
>
--
Jo Rhett
Network/Software Engineer
Net Consonance
Re: This image is turning frequent..
Posted by Kelson <ke...@speed.net>.
decoder wrote:
> But that is a difficult task considering how many things are possible
> with the GIF standard. This picture uses offsets and slow frame rates,
> others use transparency etc. A simple way to block these images would
> be to scan the GIF for offset frames. I don't think there is any valid
> GIF which makes use of these techniques...
If "offset frames" means what I think it does, they're actually a fairly
common technique in animated GIFs where you only need to change part of
the image. After all, if you're changing a 30x50 section of a 200x200
image, why waste space on an extra 38,500 pixels?
--
Kelson Vibber
SpeedGate Communications <www.speed.net>
Re: This image is turning frequent..
Posted by Logan Shaw <ls...@emitinc.com>.
> -----BEGIN PGP SIGNED MESSAGE-----
> But that is a difficult task considering how many things are possible
> with the GIF standard. This picture uses offsets and slow frame rates,
> others use transparency etc. A simple way to block these images would
> be to scan the GIF for offset frames. I don't think there is any valid
> GIF which makes use of these techniques...
Sure there is:
http://phil.ipal.org/tc.html
Check out the GIF at the top left of the page. And there is
a library to generate them in that format.
Granted, probably nobody uses it, but it does exist. :-)
- Logan
Re: This image is turning frequent..
Posted by decoder <de...@own-hero.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Anders Norrbring wrote:
> This type of image spam is getting more common, and is not
> detected.. At least not here..
Yes, this picture is indeed hard to detect...
I'd need a blackbox like
Input: Animated gif of any kind
Output: NonAnimated gif which shows what the user will see
But that is a difficult task considering how many things are possible
with the GIF standard. This picture uses offsets and slow frame rates,
others use transparency etc. A simple way to block these images would
be to scan the GIF for offset frames. I don't think there is any valid
GIF which makes use of these techniques...
Best regards,
Chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFFNOuPJQIKXnJyDxURAsLVAKDIdS8QJ38I6snB/lq4mejK8y9r6gCfSoSg
PGMfmUQ35Aez6I7kfJB91h8=
=nHuo
-----END PGP SIGNATURE-----
Re: This image is turning frequent..
Posted by Matt Florido <ma...@floridonet.com>.
On Wed, October 18, 2006 10:18 am, Jim Maul wrote:
> Matt Florido wrote:
>> * Jo Rhett <jr...@netconsonance.com> [10-17-2006 10:25]:
>>
>>> score SARE_GIF_STOX 2.5 2.5 2.5 2.5
>>>
>>
>> Can you tell me what each corresponding 2.5 represents?
>>
>
> http://spamassassin.apache.org/tests_3_1_x.html
>
> Pay particular attention to the rightmost column heading in the table.
>
> -Jim
>
Thanks Jim. (local, net, with bayes, with bayes+net)
Matt Florido
Re: This image is turning frequent..
Posted by Jim Maul <jm...@elih.org>.
Matt Florido wrote:
> * Jo Rhett <jr...@netconsonance.com> [10-17-2006 10:25]:
>
>> score SARE_GIF_STOX 2.5 2.5 2.5 2.5
>>
>
> Can you tell me what each corresponding 2.5 represents?
>
http://spamassassin.apache.org/tests_3_1_x.html
Pay particular attention to the rightmost column heading in the table.
-Jim
Re: This image is turning frequent..
Posted by Matt Florido <ma...@floridonet.com>.
* Jo Rhett <jr...@netconsonance.com> [10-17-2006 10:25]:
>
> score SARE_GIF_STOX 2.5 2.5 2.5 2.5
>
Can you tell me what each corresponding 2.5 represents?
--
Regards,
Matt Florido
RE: This image is turning frequent..
Posted by "Suhas (QualiSpace)" <su...@qualispace.com>.
Even I did the same thing and it worked pretty well.
Warm Regards,
Suhas
System Admin
QualiSpace - A QuantumPages Enterprise
===========================
Tel India: +91 (22) 6792 - 1480
Tel US: +1 (614) 827 - 1224
Fax India: +91 (22) 2530 - 3166
URL: http://www.qualispace.com
===========================
For Any Technical Query Please Use: http://helpdesk.qualispace.com
QualiSpace Community Discussion forum: http://forum.qualispace.com
-----Original Message-----
From: Jo Rhett [mailto:jrhett@netconsonance.com]
Sent: Tuesday, October 17, 2006 10:56 PM
To: Anders Norrbring
Cc: users@spamassassin.apache.org
Subject: Re: This image is turning frequent..
Anders Norrbring wrote:
> This type of image spam is getting more common, and is not detected.. At
> least not here..
score SARE_GIF_STOX 2.5 2.5 2.5 2.5
That's all it took, and we don't see it any more.
--
Jo Rhett
Network/Software Engineer
Net Consonance
Re: This image is turning frequent..
Posted by Jo Rhett <jr...@netconsonance.com>.
Anders Norrbring wrote:
> This type of image spam is getting more common, and is not detected.. At
> least not here..
score SARE_GIF_STOX 2.5 2.5 2.5 2.5
That's all it took, and we don't see it any more.
--
Jo Rhett
Network/Software Engineer
Net Consonance
Re: This image is turning frequent..
Posted by Steve Lake <st...@raiden.net>.
Yeah, I'm seeing that too. Any ideas on how to do that? For now
I've been falling back on a procmail hack to toss all messages with images
embedded in the HTML of the message into their own folder.
At 04:02 PM 10/17/2006 +0200, Anders Norrbring wrote:
>This type of image spam is getting more common, and is not detected.. At
>least not here..
Steven Lake
Owner/Technical Writer
Raiden's Realm
www.raiden.net
A friendly web community
RE: This image is turning frequent..
Posted by "Suhas (QualiSpace)" <su...@qualispace.com>.
Even I am getting lot of those.
Warm Regards,
Suhas
System Admin
QualiSpace - A QuantumPages Enterprise
===========================
Tel India: +91 (22) 6792 - 1480
Tel US: +1 (614) 827 - 1224
Fax India: +91 (22) 2530 - 3166
URL: http://www.qualispace.com
===========================
For Any Technical Query Please Use: http://helpdesk.qualispace.com
QualiSpace Community Discussion forum: http://forum.qualispace.com
-----Original Message-----
From: Anders Norrbring [mailto:lists@norrbring.se]
Sent: Tuesday, October 17, 2006 7:32 PM
To: users@spamassassin.apache.org
Subject: This image is turning frequent..
This type of image spam is getting more common, and is not detected.. At
least not here..
--
Anders Norrbring
Norrbring Consulting