You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Hardin <jo...@aproposretail.com> on 2004/03/17 17:23:35 UTC
New (?) obfuscation trick
All:
A couple of spams just dropped into my inbox at home (where I'm not
fortunate enough to be running SA) and I noticed what appears to be a
new obfuscation trick.
Almost every letter in the message was surrounded by boldface or
underline tags. The message was quite readable when rendered (none of
those misspellings that make it look like the spammer is an illiterate
idiot) yet there were zero complete words in the message body...
So: a couple of questions:
1) is this obfuscation recognized yet? I haven't seen any of these get
trapped at work. If not, here's a heads-up.
2) do the bayes token scanning and sa-learn utility strip HTML tags from
the message body before processing the message? (this is probably a RTFM
- if so, sorry.)
--
John Hardin KA7OHZ
Internal Systems Administrator/Guru voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
If you smash a computer to bits with a mallet, that appears to count
as encryption in the state of Nevada.
- CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------
Re: New (?) obfuscation trick
Posted by John Hardin <jo...@aproposretail.com>.
On Wed, 2004-03-17 at 08:34, Matt Kettler wrote:
> At 11:23 AM 3/17/2004, John Hardin wrote:
> >1) is this obfuscation recognized yet? I haven't seen any of these get
> >trapped at work. If not, here's a heads-up.
>
> Yes, html-tag insertion is nothing new.
In general, yes. Are there any rules that catch tagging every single
letter?
> >2) do the bayes token scanning and sa-learn utility strip HTML tags from
> >the message body before processing the message? (this is probably a RTFM
> >- if so, sorry.)
>
> Yes, SA in general strips HTML tags, removes line-wraps, strips some binary
> attachments and decodes most encodings (QP, base64, etc) for most
> processing. AFAIK Bayes is tokenized based on the "fully cooked" version of
> the message body.
Great! Thanks. This shouldn't sneak by Bayes, then...
--
John Hardin KA7OHZ
Internal Systems Administrator/Guru voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
If you smash a computer to bits with a mallet, that appears to count
as encryption in the state of Nevada.
- CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------
Re: New (?) obfuscation trick
Posted by Matt Kettler <mk...@evi-inc.com>.
At 11:23 AM 3/17/2004, John Hardin wrote:
>1) is this obfuscation recognized yet? I haven't seen any of these get
>trapped at work. If not, here's a heads-up.
Yes, html-tag insertion is nothing new.
>2) do the bayes token scanning and sa-learn utility strip HTML tags from
>the message body before processing the message? (this is probably a RTFM
>- if so, sorry.)
Yes, SA in general strips HTML tags, removes line-wraps, strips some binary
attachments and decodes most encodings (QP, base64, etc) for most
processing. AFAIK Bayes is tokenized based on the "fully cooked" version of
the message body.