You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Marc <Ma...@f1-outsourcing.eu> on 2025/01/24 13:03:42 UTC
base64 html page in headers
I just received this crap from ceneo.pl. Interesting is that in the header (or just below it?) there is a large (2154 lines) base64 encoded block which if you decoded it, is a full html 1261 line html page starting with <!doctype html> and ending with </html>
Boldly enough they even include a google tracking link within this html
<img src='https://ssl.google-analytics.com/collect?v=1&tid=UA-51159636-11&cid=039927d7-b027-40f0-b1e9-xxxxxx&t=event&ec=TrustedReview&ea=Shop%20ID:%2024715&el=open' style="display: none"/>
I can't view the raw source of this message (using crappy outlook) But I have the impression this base64 html is not exactly the same as the message I am seeing in outlook using converted to plain text viewing.
Afaik you use mime mime headers to separate txt and html version of the email. I was wondering if this is a new trick to bypass spam detection, and if spamassassin decodes these blocks.
Reply-To: opinie@ceneo.pl
Date: 24 Jan 2025 08:09:01 +0100
Subject: =?utf-8?B?8J+SqiBNYXN6IGplc3pjemUgc3phbnPEmSAtIHBhbGVjemth?=
=?utf-8?B?bWkucGwgY3pla2Eg8J+VkCBuYSBUd29qxIUgb3BpbmnEmSE=?=
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: base64
Received-SPF: pass (193.203.222.34 is listed to deliver ceneo.pl)
X-Verification-Result: dkim=pass; ip-@ceneo.pl paleczkami-pl@ceneo.pl
X-Spam-Status: No, score=0.3 required=3.0 tests=HTML_FONT_LOW_CONTRAST,
HTML_IMAGE_RATIO_06,HTML_MESSAGE,MIME_HTML_ONLY,MISSING_MID,
T_DATE_IN_FUTURE_96_Q,T_REMOTE_IMAGE,T_SCC_BODY_TEXT_LINE
autolearn=disabled version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
89d96068-ddf8-47bc-a33a-3ad5b65bfb7d
DQo8IWRvY3R5cGUgaHRtbD4NCjxodG1sIGxhbmc9InBsIiB4bWw6bGFuZz0icGwiIHht
bG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIiB4bWxuczp2PSJ1cm46c2No
ZW1hcy1taWNyb3NvZnQtY29tOnZtbCIgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9z
b2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIj4NCg0KPGhlYWQ+DQogICAgPHRpdGxlPg0KICAg
IDwvdGl0bGU+DQogICAgPCEtLVtpZiAhbXNvXT48IS0tIC0tPg0KICAgIDxtZXRhIGh0
dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIgY29udGVudD0iSUU9ZWRnZSI+DQogICAg
PCEtLTwhW2VuZGlmXS0tPg0KICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlw
ZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04Ij4NCiAgICA8bWV0YSBu
YW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFs
LXNjYWxlPTEiPg0KICAgIDxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+DQogICAgICAgICNv
.
.
.
Re: base64 html page in headers
Posted by Vincent Lefevre <vi...@vinc17.net>.
On 2025-01-24 13:03:42 +0000, Marc wrote:
> Afaik you use mime mime headers to separate txt and html version of
> the email. I was wondering if this is a new trick to bypass spam
> detection, and if spamassassin decodes these blocks.
There are more and more legitimate messages encoded in base64
(including for text/plain). :( For instance, the messages in the
tinycc-devel mailing-list are converted to base64. Some software
that adds a "DKIM-Signature:" header seems do to that too. Gnus
may generate base64 text/plain.
--
Vincent Lefèvre <vi...@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
RE: base64 html page in headers
Posted by Marc <Ma...@f1-outsourcing.eu>.
> I just received this crap from ceneo.pl. Interesting is
> that in the
> header (or just below it?)
>
>
> Just below it. The blank line delimits headers from body.
>
>
>
>
> Thanks. If they knew this at microsoft/outlook, I would not be
> wasting anyones time with this
>
> THEY know - YOU pretended "Interesting is that in the header (or just
> below it?) there is a large (2154 lines) base64 encoded block which if
> you decoded it" while posting a mail with a base64 body as anyone can
> see
>
They do not know. They show this bulk in the section when I view the INTERNET HEADERS. It should not be shown there, if it is not an internet header.
RE: base64 html page in headers
Posted by Marc <Ma...@f1-outsourcing.eu>.
>
> > I just received this crap from ceneo.pl. Interesting is that in the
> > header (or just below it?)
>
> Just below it. The blank line delimits headers from body.
>
>
Thanks. If they knew this at microsoft/outlook, I would not be wasting anyones time with this.
Re: base64 html page in headers
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2025-01-24 at 08:03:42 UTC-0500 (Fri, 24 Jan 2025 13:03:42 +0000)
Marc <Ma...@f1-outsourcing.eu>
is rumored to have said:
> I just received this crap from ceneo.pl. Interesting is that in the
> header (or just below it?)
Just below it. The blank line delimits headers from body.
> there is a large (2154 lines) base64 encoded block which if you
> decoded it, is a full html 1261 line html page starting with <!doctype
> html> and ending with </html>
Which is precisely what one would expect from a message like this
labeled as being text/html at the top level.
> Boldly enough they even include a google tracking link within this
> html
>
> <img
> src='https://ssl.google-analytics.com/collect?v=1&tid=UA-51159636-11&cid=039927d7-b027-40f0-b1e9-xxxxxx&t=event&ec=TrustedReview&ea=Shop%20ID:%2024715&el=open'
> style="display: none"/>
Also, far too common.
> I can't view the raw source of this message (using crappy outlook) But
> I have the impression this base64 html is not exactly the same as the
> message I am seeing in outlook using converted to plain text viewing.
I'm not sure what you're seeing in Outlook, but I don't see any reason
it would just make up message content...
> Afaik you use mime mime headers to separate txt and html version of
> the email.
That's only for multipart messages. This is not a multipart message.
> I was wondering if this is a new trick to bypass spam detection, and
> if spamassassin decodes these blocks.
As documented, SpamAssassin decodes all text/* parts for analysis, no
matter the encoding. This message is not in any sense unusual and
sending just text/html is not a "trick" at all.
> Reply-To: opinie@ceneo.pl
> Date: 24 Jan 2025 08:09:01 +0100
> Subject: =?utf-8?B?8J+SqiBNYXN6IGplc3pjemUgc3phbnPEmSAtIHBhbGVjemth?=
> =?utf-8?B?bWkucGwgY3pla2Eg8J+VkCBuYSBUd29qxIUgb3BpbmnEmSE=?=
> Content-Type: text/html; charset=utf-8
> Content-Transfer-Encoding: base64
> Received-SPF: pass (193.203.222.34 is listed to deliver ceneo.pl)
> X-Verification-Result: dkim=pass; ip-@ceneo.pl paleczkami-pl@ceneo.pl
> X-Spam-Status: No, score=0.3 required=3.0
> tests=HTML_FONT_LOW_CONTRAST,
> HTML_IMAGE_RATIO_06,HTML_MESSAGE,MIME_HTML_ONLY,MISSING_MID,
> T_DATE_IN_FUTURE_96_Q,T_REMOTE_IMAGE,T_SCC_BODY_TEXT_LINE
> autolearn=disabled version=3.4.6
> X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
> 89d96068-ddf8-47bc-a33a-3ad5b65bfb7d
>
> DQo8IWRvY3R5cGUgaHRtbD4NCjxodG1sIGxhbmc9InBsIiB4bWw6bGFuZz0icGwiIHht
> bG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIiB4bWxuczp2PSJ1cm46c2No
> ZW1hcy1taWNyb3NvZnQtY29tOnZtbCIgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9z
> b2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIj4NCg0KPGhlYWQ+DQogICAgPHRpdGxlPg0KICAg
> IDwvdGl0bGU+DQogICAgPCEtLVtpZiAhbXNvXT48IS0tIC0tPg0KICAgIDxtZXRhIGh0
> dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIgY29udGVudD0iSUU9ZWRnZSI+DQogICAg
> PCEtLTwhW2VuZGlmXS0tPg0KICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlw
> ZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04Ij4NCiAgICA8bWV0YSBu
> YW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFs
> LXNjYWxlPTEiPg0KICAgIDxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+DQogICAgICAgICNv
> .
> .
> .
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire