[Bug 4875] New: obfuscated drugs

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4875

           Summary: obfuscated drugs
           Product: Spamassassin
           Version: 3.1.0
          Platform: All
        OS/Version: other
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Libraries
        AssignedTo: dev@spamassassin.apache.org
        ReportedBy: bas@debian.org


Today, I got a few viagra/cialis spams that didn't get caught by spamassassin. 
It's using HTML obfuscating where the letters of the names of the drugs (VIAGRA,
etc) are interspersed with random letters inside a <FONT size=2 color=#F3F027>
tag.  

I guess this could be matched quite easily by first removing font tags with
small sized, and then matching the resulting string against the drug names. 
Something like (untested)

s{<font[^>]+size=['"]?(?:0*[1-4](?!\d)|0*[0-3]?\d\%).*?>.*?</font.*?>}{}gi;

would remove <font> tags with sizes of 4pt and smaller or percentages of less
than 40%.  The result should be matched against the existing drug name tests.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 4875] obfuscated drugs

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4875





------- Additional Comments From bas@debian.org  2006-04-23 12:44 -------
Created an attachment (id=3483)
 --> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3483&action=view)
example spam

example drug spam that was not detected by spamassassin



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 4875] obfuscated drugs

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4875





------- Additional Comments From saj_sabz@thecommune.net  2006-04-24 15:06 -------
I catch these by ignoring the html part and looking at the text part which is
much simpler.  The ReplaceTags plugin was very useful.  I created a replace_tag
that looks for a lower-case letter surrounded by spaces.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 4875] obfuscated drugs

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4875





------- Additional Comments From saj_sabz@thecommune.net  2006-04-24 15:07 -------
Created an attachment (id=3488)
 --> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3488&action=view)
Rules File for Obfuscated Drug Names




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 4875] obfuscated drugs

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4875


saj_sabz@thecommune.net changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3488|application/octet-stream    |text/plain
          mime type|                            |






------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.