You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Scott Rothgaber <sc...@palmetto.tv> on 2004/06/04 03:41:54 UTC
Tiny Font
SA caught this one with the new Bayes poison rule but it missed the tiny
font. I took a peek at 20_html_tests.cf but I'm Perl-impaired. :( Can
anyone suggest a way to catch this:
<font style=3Dfont-size:1px>
Thanks!
Scott
Re: Tiny Font
Posted by Ryan Thompson <sp...@sasknow.com>.
Scott Rothgaber wrote to spamassassin-users@incubator.apache.org:
> SA caught this one with the new Bayes poison rule but it missed the tiny
> font. I took a peek at 20_html_tests.cf but I'm Perl-impaired. :( Can
> anyone suggest a way to catch this:
>
> <font style=3Dfont-size:1px>
Assuming you're running 2.63, I don't believe there *is* any kind of
tiny font rule, unless I'm really missing something. HTML_FONT_BIG is an
eval rule ultimately handled by HTML.pm, and it's quite simple:
--- HTML.pm Sat Jan 17 17:56:07 2004
+++ /staff/ryan/HTML.pm Thu Jun 3 21:07:29 2004
@@ -383,6 +383,10 @@
if ($tag eq "font" && exists $attr->{size}) {
$self->{html}{big_font} = 1 if (($attr->{size} =~ /^\s*(\d+)/ && $1 > 3) ||
($attr->{size} =~ /\+(\d+)/ && $1 >= 1));
+ # Absolutely untested
+ $self->{html}{tiny_font} = 1 if (($attr->{size} =~ /^\s*(\d+)/ && $1 <= 1) ||
+ ($attr->{size} =~ /\-(\d+)/ && $1 >= 1) || # -1 or less
+ ($attr->{size} =~ /^\s*(\d+)\s*px/ && $1 <= 5)); # 5px or smaller
}
if ($tag eq "font" && exists $attr->{color}) {
my $bg = $self->{bgcolor_color}[-1];
Then, you'd need to define a new rule like so:
body HTML_FONT_TINY eval:html_test('tiny_font')
# score HTML_FONT_TINY 0.001 # ...responsibly
Unfortunately, I'm taking a break from frantically packing for a
much-needed vacation, and my head is fuzzy, so the above may well start
the next world war on compilation... but it may indeed be worthy of a
little fine tuning (i.e., what you consider "tiny" enough to be a spam
indicator) and corpus testing.
Good luck,
- Ryan
--
Ryan Thompson <ry...@sasknow.com>
SaskNow Technologies - http://www.sasknow.com
901-1st Avenue North - Saskatoon, SK - S7K 1Y4
Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon
Toll-Free: 877-727-5669 (877-SASKNOW) North America
Re[2]: Tiny Font (Success)
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Matthias,
Saturday, June 5, 2004, 2:36:55 AM, you wrote:
>>Now to see if I can enhance the rule(s -- there are others also) to catch
>>these before the spammers take action on your samples. :-)
MK> I started making my own rules as I found the first spam with a 1px font
MK> that wasn't caught by the two already present rules
MK> My rule to catch those stuff bases on the idea that I dont try to catch
MK> the complete font-size but just as far as I can be sure it HAS to be a
MK> tinyfont...
Pretty much the same line of thought I had when refining the tinyfont
rules in the html rule sets last month.
MK> I'm very sorry that I didn't see up to right now that sare_coding has
MK> been moved to sare_html and I've not yet tested those so there might
MK> be a couple of double rules but I'm sure we can sort that out.....
Jesse points out that most of your examples are caught by his
contributions found in various sare_html rules, but I think you may have
a few examples his didn't cover.
MK> So Bob, I believe you have the possibility to do some masschecking over
MK> all my rules (I've got a lot of other CSS and especially HTML tag rules
MK> very often seen in spammails) as I'd like to know if they can hit some
MK> hams which most of those did not do on my system....
Yes, if you'll send me a copy of those rules in an attached file, I'll
gladly run them against my mass-check, in conjunction with the sare_html
set. I can then not only see how well yours perform, but analyze the
overlap with what we already have.
MK> Then I could send you my rules and if they prove to be successful, plese
MK> be free to include them in sare_html
That would be great. Thanks.
Bob Menschel
Re: Tiny Font (Success)
Posted by Matthias Keller <li...@matthias-keller.ch>.
Hi Bob
Robert Menschel wrote:
>Friday, June 4, 2004, 10:36:43 AM, you wrote:
>
>
>RV> that tiny font stuff is barely catchable :(
>RV> try to catch this:
>RV> <font style="font-size:0.01234567890px ...
>
>Thanks for the ideas. While I'm not sure how valid the html/css is,
>certainly some email clients will display it as the spammer wanted.
>
>Now to see if I can enhance the rule(s -- there are others also) to catch
>these before the spammers take action on your samples. :-)
>
>Bob Menschel
>
>
Well this discussion comes just right as I'm developing my own
Anti-Coding Rules for some weeks now which all proved quite effective on
my small system (with about 300 ham and 300 spam mails a day)
I started making my own rules as I found the first spam with a 1px font
that wasn't caught by the two already present rules
My rule to catch those stuff bases on the idea that I dont try to catch
the complete font-size but just as far as I can be sure it HAS to be a
tinyfont...
All mentioned examples were caught by my rule which goes as follows:
rawbody MKE_CSS_ZEROSIZE
/<[^>]+(=3d|\b)font-size:[\s\"\']*[0]*[0-4][^0-9]/i
describe MKE_CSS_ZEROSIZE A CSS contained
font-size:0 up to 4
score MKE_CSS_ZEROSIZE 0.5
Other stuff that is incorporated in this rule:
Almost all others dont catch stuff like: style="color:black;
font-size:0px"
That's why I completely ignored any style and just make sure that this
font-size HAS to appear inside a tag where I dont see any other
possibility than in a style-like block
the other thing is I dont want to use pt, px or whatever... because
browsers also accept just a font-size:0 without any other thing.
additionally there's more stuff than pt and px !
So I just make sure that the number may be padded with zeros, then has a
0, 1, 2, 3 or 4 and the NEXT char is anything but a number...
That might be a dot, a 'px' - whatever.......
So Bob, I believe you have the possibility to do some masschecking over
all my rules (I've got a lot of other CSS and especially HTML tag rules
very often seen in spammails) as I'd like to know if they can hit some
hams which most of those did not do on my system....
Then I could send you my rules and if they prove to be successful, plese
be free to include them in sare_html
I'm very sorry that I didn't see up to right now that sare_coding has
been moved to sare_html and I've not yet tested those so there might
be a couple of double rules but I'm sure we can sort that out.....
Have a nice day
Matt
Re[2]: Tiny Font (Success)
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Ralf,
Friday, June 4, 2004, 10:36:43 AM, you wrote:
RV> Scott Rothgaber wrote:
>> Robert Menschel wrote:
>>> rawbody SARE_HTML_FSIZE2 /font-size:\s*[0-4]p[tx]\b/i
>> That did it!
RV> that tiny font stuff is barely catchable :(
RV> try to catch this:
RV> <font style="font-size:0.01234567890px ...
Thanks for the ideas. While I'm not sure how valid the html/css is,
certainly some email clients will display it as the spammer wanted.
Now to see if I can enhance the rule(s -- there are others also) to catch
these before the spammers take action on your samples. :-)
Bob Menschel
Re: Tiny Font (Success)
Posted by Ralf Vitasek <vi...@tqsoft.de>.
Scott Rothgaber wrote:
> Robert Menschel wrote:
> >
>
>> rawbody SARE_HTML_FSIZE2 /font-size:\s*[0-4]p[tx]\b/i
>
>
> That did it!
>
> Thanks,
> Scott
>
>
hi!
that tiny font stuff is barely catchable :(
try to catch this:
<font style="font-size:0.01234567890px;color:rgb(255,255,255)">very tiny
font</font>
or
<font style="font-size:000.01234567890px;color:rgb(255,254,255)">very
tiny font</font>
or
<font style="font-size:0.050px;color:rgb(255,255,254)">very tiny font</font>
or
<font style="font-size:1.050px;color:rgb(254,255,255)">very tiny font</font>
or ... or ... or ...
regards
Ralf
Re: Tiny Font (Success)
Posted by Scott Rothgaber <sc...@palmetto.tv>.
Robert Menschel wrote:
>
> rawbody SARE_HTML_FSIZE2 /font-size:\s*[0-4]p[tx]\b/i
That did it!
Thanks,
Scott
Re[2]: Tiny Font
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello David,
Thursday, June 3, 2004, 8:49:33 PM, you wrote:
DBF> On Thu, 3 Jun 2004, Scott Rothgaber wrote:
>> SA caught this one with the new Bayes poison rule but it missed the tiny
>> font. I took a peek at 20_html_tests.cf but I'm Perl-impaired. :( Can
>> anyone suggest a way to catch this:
>> <font style=3Dfont-size:1px>
DBF> Got this from a posting by Bob Menschel some time back:
DBF> rawbody RM_rbh_0ptFont
DBF> /\bfont-size:[\s"]?[01]p[tx]\b|\bstyle="font-size: ?1;"/i
DBF> describe RM_rbh_0ptFont HTML includes zero-point font size; invisible text
DBF> score RM_rbh_0ptFont 1.865
Rule is now SARE_HTML_FSIZE2 in 70_sare_html1.cf at
http://www.rulesemporium.com/rules.htm#html
rawbody SARE_HTML_FSIZE2 /font-size:\s*[0-4]p[tx]\b/i
Results against my corpus:
OVERALL SPAM HAM S/O SCORE NAME
85861 63662 22199 0.741 0.00 0.00 (all messages)
5666 5658 8 0.996 0.98 1.67 SARE_HTML_FSIZE2
Bob Menschel
Re: Tiny Font
Posted by John Hardin <jo...@aproposretail.com>.
On Thu, 2004-06-03 at 20:49, David B Funk wrote:
> On Thu, 3 Jun 2004, Scott Rothgaber wrote:
> > <font style=3Dfont-size:1px>
>
> rawbody RM_rbh_0ptFont /\bfont-size:[\s"]?[01]p[tx]\b|\bstyle="font-size: ?1;"/i
That doesn't allow for QP encoding. change the "=" to "=(3d)?"
--
John Hardin KA7OHZ <jo...@aproposretail.com>
Internal Systems Administrator voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
40 days until Apropos Forum 2004
Re: Tiny Font
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Thu, 3 Jun 2004, Scott Rothgaber wrote:
> SA caught this one with the new Bayes poison rule but it missed the tiny
> font. I took a peek at 20_html_tests.cf but I'm Perl-impaired. :( Can
> anyone suggest a way to catch this:
>
> <font style=3Dfont-size:1px>
Got this from a posting by Bob Menschel some time back:
rawbody RM_rbh_0ptFont /\bfont-size:[\s"]?[01]p[tx]\b|\bstyle="font-size: ?1;"/i
describe RM_rbh_0ptFont HTML includes zero-point font size; invisible text
score RM_rbh_0ptFont 1.865
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{