Picture based spam

[Tony Melia <to...@tmitc.com.au>]

Hi,
    I have setup SA 3.1 under FC4, which is working quite well.  However,
one type of message that still gets through is a series of mails that are
made up of no text other than a varying subject, then a picture, which is
black text on white, which looks exactly like an ordinary email.  Obviously
SA can't read the message since it is an image, but is there a way to make a
rule that blocks a mail where there is an image only, no text?
 
Regards,
Tony

Re: Picture based spam

[Matt Kettler <mk...@comcast.net>]

At 07:03 AM 11/16/2005, Tony Melia wrote:
>Hi,
>     I have setup SA 3.1 under FC4, which is working quite well.  However, 
> one type of message that still gets through is a series of mails that are 
> made up of no text other than a varying subject, then a picture, which is 
> black text on white, which looks exactly like an ordinary 
> email.  Obviously SA can't read the message since it is an image, but is 
> there a way to make a rule that blocks a mail where there is an image 
> only, no text?
>


Look at HTML_IMAGE_ONLY_04, which matches a message with an image and 0 to 
400 bytes of words.

The rule is declared like this in 20_html_tests.cf:
body HTML_IMAGE_ONLY_04         eval:html_image_only('0000','0400')

You could easily create a variant that matches only 0 chars of words..


body HTML_IMAGE_ONLY_00         eval:html_image_only('0000','0000')
score HTML_IMAGE_ONLY_00                1.0
Note: this will double-match with HTML_IMAGE_ONLY_04 if the message is 0 
bytes of text.

I'd suggest adding the rule to it's own .cf file in /etc/mail/spamassassin. 
This way if a future upgrade changes the eval we're using here, you can 
quickly remove the rule until it can be revised.