You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jm...@apache.org on 2004/09/30 00:19:42 UTC
svn commit: rev 47509 - in spamassassin/site: . presentations/2004-09-Toorcon presentations/2004-09-Toorcon/html
Author: jm
Date: Wed Sep 29 15:19:41 2004
New Revision: 47509
Added:
spamassassin/site/presentations/2004-09-Toorcon/
spamassassin/site/presentations/2004-09-Toorcon/html/
spamassassin/site/presentations/2004-09-Toorcon/html/index.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.txt
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.html
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.idx.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.jpg (contents, props changed)
spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.txt
spamassassin/site/presentations/2004-09-Toorcon/src.tar.gz (contents, props changed)
Modified:
spamassassin/site/main.wmk
Log:
upload Toorcon presentation slides
Modified: spamassassin/site/main.wmk
==============================================================================
--- spamassassin/site/main.wmk (original)
+++ spamassassin/site/main.wmk Wed Sep 29 15:19:41 2004
@@ -215,6 +215,11 @@
Here's some presentations and papers regarding SpamAssassin.
+ - Justin Mason, **Spam Forensics: Reverse-Engineering Spammer Tactics**,
+ Toorcon 2004: <a href="$(TOP/)presentations/2004-09-Toorcon/html/">
+ HTML slideshow from MagicPoint</a>
+ (source <a href="$(TOP/)presentations/2004-09-Toorcon/src.tar.gz">here </a>).
+
- Matt Sergeant, **Internet-Level Spam Detection and SpamAssassin 2.50**,
Spam Conference 2003: <a href="$(TOP/)presentations/SpamConf2003.ppt">PPT
(368k)</a>, <a href="$(TOP/)presentations/SpamConf2003.pdf">PDF (4megs)</a>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/index.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/index.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,37 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="mgp00001.html"><IMG SRC="mgp00001.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 1"></A>
+<A HREF="mgp00002.html"><IMG SRC="mgp00002.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 2"></A>
+<A HREF="mgp00003.html"><IMG SRC="mgp00003.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 3"></A>
+<A HREF="mgp00004.html"><IMG SRC="mgp00004.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 4"></A>
+<A HREF="mgp00005.html"><IMG SRC="mgp00005.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 5"></A>
+<A HREF="mgp00006.html"><IMG SRC="mgp00006.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 6"></A>
+<A HREF="mgp00007.html"><IMG SRC="mgp00007.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 7"></A>
+<A HREF="mgp00008.html"><IMG SRC="mgp00008.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 8"></A>
+<A HREF="mgp00009.html"><IMG SRC="mgp00009.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 9"></A>
+<A HREF="mgp00010.html"><IMG SRC="mgp00010.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 10"></A>
+<A HREF="mgp00011.html"><IMG SRC="mgp00011.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 11"></A>
+<A HREF="mgp00012.html"><IMG SRC="mgp00012.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 12"></A>
+<A HREF="mgp00013.html"><IMG SRC="mgp00013.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 13"></A>
+<A HREF="mgp00014.html"><IMG SRC="mgp00014.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 14"></A>
+<A HREF="mgp00015.html"><IMG SRC="mgp00015.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 15"></A>
+<A HREF="mgp00016.html"><IMG SRC="mgp00016.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 16"></A>
+<A HREF="mgp00017.html"><IMG SRC="mgp00017.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 17"></A>
+<A HREF="mgp00018.html"><IMG SRC="mgp00018.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 18"></A>
+<A HREF="mgp00019.html"><IMG SRC="mgp00019.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 19"></A>
+<A HREF="mgp00020.html"><IMG SRC="mgp00020.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 20"></A>
+<A HREF="mgp00021.html"><IMG SRC="mgp00021.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 21"></A>
+<A HREF="mgp00022.html"><IMG SRC="mgp00022.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 22"></A>
+<A HREF="mgp00023.html"><IMG SRC="mgp00023.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 23"></A>
+<A HREF="mgp00024.html"><IMG SRC="mgp00024.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 24"></A>
+<A HREF="mgp00025.html"><IMG SRC="mgp00025.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 25"></A>
+<A HREF="mgp00026.html"><IMG SRC="mgp00026.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 26"></A>
+<A HREF="mgp00027.html"><IMG SRC="mgp00027.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 27"></A>
+<A HREF="mgp00028.html"><IMG SRC="mgp00028.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 28"></A>
+<A HREF="mgp00029.html"><IMG SRC="mgp00029.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 29"></A>
+<A HREF="mgp00030.html"><IMG SRC="mgp00030.idx.jpg" WIDTH=200 HEIGHT=150 ALT="Page 30"></A>
+<HR>
+Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+<BR>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00001.txt>[text page]</A> [<<start] [<prev] <A HREF=mgp00002.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 1: Spam Forensics: Reverse-Engineering Spammer Tactics<BR>
+<HR>
+<IMG SRC="mgp00001.jpg" WIDTH=800 HEIGHT=600 ALT="Page 1"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00001.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,14 @@
+
+
+
+
+Spam Forensics: Reverse-Engineering Spammer Tactics
+
+
+
+
+Justin Mason
+<to...@jmason.org>
+http://spamassassin.apache.org/
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00002.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00001.html>[<prev]</A> <A HREF=mgp00003.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 2: Rule-based Filtering<BR>
+<HR>
+<IMG SRC="mgp00002.jpg" WIDTH=800 HEIGHT=600 ALT="Page 2"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00002.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+
+Rule-based Filtering
+
+Can we use simple rules to detect spam reliably?
+
+Yes! Simple, fast rules hit about 95% of spam in our corpus
+
+Rules are at the core of SpamAssassin
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00003.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00002.html>[<prev]</A> <A HREF=mgp00004.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 3: But Why Do They Work?<BR>
+<HR>
+<IMG SRC="mgp00003.jpg" WIDTH=800 HEIGHT=600 ALT="Page 3"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00003.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,8 @@
+
+But Why Do They Work?
+
+Most spammers don't write their own code
+
+They use special-purpose, proxy-exploiting, header-hiding spamware
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00004.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00003.html>[<prev]</A> <A HREF=mgp00005.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 4: Let's Reverse the Spamware<BR>
+<HR>
+<IMG SRC="mgp00004.jpg" WIDTH=800 HEIGHT=600 ALT="Page 4"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00004.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,13 @@
+
+Let's Reverse the Spamware
+
+But spamware is not always available for download
+
+Some "top-of-the-line" spamware is kept in a very small group
+
+(Like exploits!)
+
+Even see spam relay trojans installed on rooted machines
+
+So: reverse from the end-results
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00005.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00004.html>[<prev]</A> <A HREF=mgp00006.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 5: Some Rule History<BR>
+<HR>
+<IMG SRC="mgp00005.jpg" WIDTH=800 HEIGHT=600 ALT="Page 5"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00005.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,11 @@
+
+Some Rule History
+
+In the early days, life was good
+
+Spamware announced itself:
+
+ X-Mailer: DiffondiCool V3.0 (W95/NT) Delfino Solutions (Build: Jun 14 1998)
+
+Pretty easy to catch that -- thanks, spammers!
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00006.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00005.html>[<prev]</A> <A HREF=mgp00007.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 6: Spammers Wise Up<BR>
+<HR>
+<IMG SRC="mgp00006.jpg" WIDTH=800 HEIGHT=600 ALT="Page 6"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00006.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,8 @@
+
+Spammers Wise Up
+
+If their spam looks like legit mail, it may get through
+
+So they started impersonating legit Mail User Agents
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00007.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00006.html>[<prev]</A> <A HREF=mgp00008.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 7: Spammers Wise Up (2)<BR>
+<HR>
+<IMG SRC="mgp00007.jpg" WIDTH=800 HEIGHT=600 ALT="Page 7"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00007.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,8 @@
+
+Spammers Wise Up (2)
+
+If their spam looks like legit mail, it may get through
+
+So they started impersonating legit Mail User Agents
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00008.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00007.html>[<prev]</A> <A HREF=mgp00009.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 8: Detecting X-Mailer Forgery<BR>
+<HR>
+<IMG SRC="mgp00008.jpg" WIDTH=800 HEIGHT=600 ALT="Page 8"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00008.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,13 @@
+
+Detecting X-Mailer Forgery
+
+Mass analysis of spam and nonspam headers supposedly from "Outlook Express"
+
+All the legit Message-ID headers had a common feature
+
+ Message-ID: <00e601c4926f$468d5870$....
+ Message-ID: <008901c48e89$3efc91a0$....
+ Message-ID: <0b5301c49704$2741bee0$....
+ Message-ID: <006d01c493f3$c570da60$....
+ Message-ID: <002801c32fd1$5f6598f0$....
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00009.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00008.html>[<prev]</A> <A HREF=mgp00010.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 9: Detecting X-Mailer Forgery, 2<BR>
+<HR>
+<IMG SRC="mgp00009.jpg" WIDTH=800 HEIGHT=600 ALT="Page 9"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00009.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,13 @@
+
+Detecting X-Mailer Forgery, 2
+
+Outlook Express includes the current DATETIME when generating Message-IDs
+
+ Message-ID: <0b5301c49704$2741bee0$....
+
+generate correct timestamp from Received header data, and compare
+
+Spam often used random values, or values that didn't match the Received headers
+
+Result: the MSGID_OUTLOOK_INVALID rule, hit 25% of spam
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00010.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00009.html>[<prev]</A> <A HREF=mgp00011.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 10: Hashing Systems<BR>
+<HR>
+<IMG SRC="mgp00010.jpg" WIDTH=800 HEIGHT=600 ALT="Page 10"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00010.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,11 @@
+
+Hashing Systems
+
+Detecting "bulk mail"; if the same message body is sent to loads of people, it's bulk
+
+You can then apply other techniques to whitelist the "good stuff"
+
+legit bulk mail, mailing lists etc
+
+Hashing system examples: Razor, Pyzor, DCC, AOL's internal filters
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00011.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00010.html>[<prev]</A> <A HREF=mgp00012.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 11: Hashbusters<BR>
+<HR>
+<IMG SRC="mgp00011.jpg" WIDTH=800 HEIGHT=600 ALT="Page 11"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00011.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,14 @@
+
+Hashbusters
+
+Add random gibberish to the body
+
+ rtezkaehjx twyi
+ OUR US DOCTORS WILL WRITE YOU A PRESCR1PTION FOR FREE!
+ ddvtab eztua
+ http://www.jtgxsezyk.com@www.oiadjdjist.biz/cf634/
+
+Hash signatures no longer match
+
+If used at start of base64-encoded mail, patterns that occur later in the base64'd data will no longer match
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00012.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00011.html>[<prev]</A> <A HREF=mgp00013.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 12: Detecting Hashbusters<BR>
+<HR>
+<IMG SRC="mgp00012.jpg" WIDTH=800 HEIGHT=600 ALT="Page 12"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00012.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,14 @@
+
+Detecting Hashbusters
+
+However: "random" gibberish sometimes not so random
+
+Here's a good example. Across a selection of spams:
+
+ From: 246309@hotmail.com
+ From: 246307@excite.com
+ From: 246369@msn.com
+ From: 246372@email.com
+
+Obviously a pattern there!
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00013.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00012.html>[<prev]</A> <A HREF=mgp00014.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 13: Detecting Hashbusters, 2<BR>
+<HR>
+<IMG SRC="mgp00013.jpg" WIDTH=800 HEIGHT=600 ALT="Page 13"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00013.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,12 @@
+
+Detecting Hashbusters, 2
+
+It's a time-based value again; the spamware uses (time(NULL) / 4444) as a "random" value
+
+ Received: from 141.157.102.28 ... for <jm...@jmason.org>; Wed, 8 Sep 2004 00:48:18 +0100 (IST)
+ From: 246309@hotmail.com
+
+ 246309*4444 = 1094597196 = Tue Sep 7 15:46:36 2004
+
+Always has this kind of offset, less a day or two; it's when the spam run started
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00014.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00013.html>[<prev]</A> <A HREF=mgp00015.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 14: Another Use For Hashbusters<BR>
+<HR>
+<IMG SRC="mgp00014.jpg" WIDTH=800 HEIGHT=600 ALT="Page 14"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00014.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,17 @@
+
+Another Use For Hashbusters
+
+Another not-so-random block:
+
+ <p><font face="Verdana" size="1">wz^wznfba(bet</font></p>
+
+Target's email address hidden in a hashbuster
+
+ "wz^wznfba(bet" = rot13("jm@jmason.org")
+
+Result: SpamAssassin rule EMAIL_ROT13
+
+ [a-z(\]-]+\^[a-z-]+\([a-z]{2,3}
+
+Other substitution and rotation ciphers being used, but rot-13 is still by far the most common
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00015.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00014.html>[<prev]</A> <A HREF=mgp00016.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 15: Digression: List-Washing<BR>
+<HR>
+<IMG SRC="mgp00015.jpg" WIDTH=800 HEIGHT=600 ALT="Page 15"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00015.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,17 @@
+
+Digression: List-Washing
+
+Why bother inserting the target's email address?
+
+Some people report spam
+
+Complaints get spammers kicked off their ISPs
+
+Spammers want to:
+
+Detect spamtraps that auto-report
+
+Get rid of people who complain about spam
+
+Avoiding reports is a top priority
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00016.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00015.html>[<prev]</A> <A HREF=mgp00017.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 16: Avoiding Reports<BR>
+<HR>
+<IMG SRC="mgp00016.jpg" WIDTH=800 HEIGHT=600 ALT="Page 16"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00016.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,10 @@
+
+Avoiding Reports
+
+All reporting tools have to follow the Received header trail; by adding fake Received headers, they can be fooled
+
+ Received: from 24.160.77.125 (cs2416077-125.houston.rr.com [24.160.77.125]) by amgod.boxhost.net (Postfix) with SMTP id 3FC0E310412; Thu, 16 Sep 2004 18:23:55 +0100 (IST)
+ Received: from 230.236.26.15 (port=4936 helo=WJTUB) by 24.160.77.125 (8.12.10/8.12.8) with SMTP; Thu, 16 Sep 2004 13:23:00 -0500
+ Received: from [230.236.26.15] by 24.160.77.125 (Postfix) with esmtp (Exim 3.33 #1) id 4920847; Thu, 16 Sep 2004 13:23:00 -0500
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00017.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00016.html>[<prev]</A> <A HREF=mgp00018.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 17: Detecting Fake Relay Lines<BR>
+<HR>
+<IMG SRC="mgp00017.jpg" WIDTH=800 HEIGHT=600 ALT="Page 17"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00017.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,13 @@
+
+Detecting Fake Relay Lines
+
+Bad news: many spam reporting tools now ignored by ISPs due to this
+
+Good news: Legit mail never fakes Received headers, so this is a spam signature
+
+ Received: from [230.236.26.15] by 24.160.77.125 (Postfix) with esmtp (Exim 3.33 #1) id 4920847; Thu, 16 Sep 2004 13:23:00 -0500
+
+No mailserver calls itself by an IP address!
+
+SpamAssassin 3.0.0: RCVD_DOUBLE_IP_SPAM
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00018.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00017.html>[<prev]</A> <A HREF=mgp00019.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 18: Back to Hashbusters<BR>
+<HR>
+<IMG SRC="mgp00018.jpg" WIDTH=800 HEIGHT=600 ALT="Page 18"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00018.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,16 @@
+
+Back to Hashbusters
+
+Early hashbusters were static in some ways:
+
+String length
+
+Range of characters
+
+Location in message
+
+One even included an ID code describing its format!
+
+We could easily write rules to detect those
+
+Spammers needed to be more random with their randomness
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00019.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00018.html>[<prev]</A> <A HREF=mgp00020.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 19: Templating<BR>
+<HR>
+<IMG SRC="mgp00019.jpg" WIDTH=800 HEIGHT=600 ALT="Page 19"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00019.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,8 @@
+
+Templating
+
+Spammers need to reduce detectable patterns
+
+So: let the user control placement, type of hashbuster etc.
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00020.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00019.html>[<prev]</A> <A HREF=mgp00021.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 20: Templating (2)<BR>
+<HR>
+<IMG SRC="mgp00020.jpg" WIDTH=800 HEIGHT=600 ALT="Page 20"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00020.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,6 @@
+
+Templating (2)
+
+Templates! Best current practice in many fields, and spam is no exception
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00021.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00020.html>[<prev]</A> <A HREF=mgp00022.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 21: Template Pitfalls<BR>
+<HR>
+<IMG SRC="mgp00021.jpg" WIDTH=800 HEIGHT=600 ALT="Page 21"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00021.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,13 @@
+
+Template Pitfalls
+
+However, added complexity for spammer users
+
+They now forget what spamware they're using
+
+ <font style=font-size:1px color=#eeeeef>sorrowuninominal %RND_A_GRAYWORD chicanounimodaldauphin %RND_A_GRAYWORD </font><br>
+
+Which is pretty handy for us
+
+SpamAssassin 3.0.0 rule: PERCENT_RANDOM
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00022.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00021.html>[<prev]</A> <A HREF=mgp00023.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 22: Bayes-Busters<BR>
+<HR>
+<IMG SRC="mgp00022.jpg" WIDTH=800 HEIGHT=600 ALT="Page 22"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00022.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,15 @@
+
+Bayes-Busters
+
+Bayesian filtering: recent hot topic
+
+Touted as immune to traditional filter evasion
+
+Sadly, nope
+
+"A text classifier is only as good as its preprocessor"
+
+So attack the preprocessing steps
+
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00023.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00022.html>[<prev]</A> <A HREF=mgp00024.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 23: Bayes Evasion<BR>
+<HR>
+<IMG SRC="mgp00023.jpg" WIDTH=800 HEIGHT=600 ALT="Page 23"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00023.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,15 @@
+
+Bayes Evasion
+
+Random non-word gibberish:
+
+ yjcya wxapxbep mjeunhvmw, zmrnidh fdopye umpvxwpoa- dpwagfdhe<BR>
+
+random-HTML-tag 'chaff':
+
+ li<modem>ke recei<benzedrine>ved th<false>is ema<downey>il
+
+Random snippets of real text in near-invisible fonts:
+
+ hence there was no calumny too idle for the Caucasians to repeat, and even to believe.
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00024.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00023.html>[<prev]</A> <A HREF=mgp00025.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 24: Bayes Evasion Results<BR>
+<HR>
+<IMG SRC="mgp00024.jpg" WIDTH=800 HEIGHT=600 ALT="Page 24"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00024.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,16 @@
+
+Bayes Evasion Results
+
+Gibberish and chaff easy to pick up with rules: LONGWORDS, HTML_BADTAG, HTML_NONELEMENT
+
+Surprisingly, the real text attack generally doesn't work at present
+
+Removing "invisible text" actually lowers Bayes accuracy
+
+Reason: bad choice of "real text"
+
+ hence there was no calumny too idle ...
+
+(How many people use the word "calumny" in nonspam mail?)
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00025.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00024.html>[<prev]</A> <A HREF=mgp00026.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 25: Bayes Evasion Theory<BR>
+<HR>
+<IMG SRC="mgp00025.jpg" WIDTH=800 HEIGHT=600 ALT="Page 25"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00025.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,17 @@
+
+Bayes Evasion Theory
+
+However, there is an attack that does work
+
+Choose words that more closely match conversational English
+
+Ensure probabilities of a given word appearing are close to those in "nonspam" text
+
+Force users to learn from those spams
+
+Biases nonspam results towards spam
+
+Tech Report at http://snipurl.com/97qb
+
+(if that snipurl expires, Google for: "A Linguistics-Based Attack on Personalised Statistical E-mail Classifiers", Henry Stern, Justin Mason, and Michael Shepherd, Technical Report CS-2004-06, Dalhousie University, March 25, 2004)
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00026.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00025.html>[<prev]</A> <A HREF=mgp00027.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 26: X-Message-Info<BR>
+<HR>
+<IMG SRC="mgp00026.jpg" WIDTH=800 HEIGHT=600 ALT="Page 26"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00026.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,14 @@
+
+X-Message-Info
+
+Mysterious headers appearing in spam recently:
+
+ X-Message-Info: 0oROdu983rDK/jdJaczEMfHXwmauX6Wf
+
+Turns out spammers think that this gets them past Hotmail's filters
+
+because a Hotmail message saved to disk contains this header?
+
+Result: X_MESSAGE_INFO SpamAssassin rule hits 37% of spam, 0.0004% ham
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00027.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00026.html>[<prev]</A> <A HREF=mgp00028.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 27: Other Techniques<BR>
+<HR>
+<IMG SRC="mgp00027.jpg" WIDTH=800 HEIGHT=600 ALT="Page 27"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00027.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,15 @@
+
+Other Techniques
+
+MIME structure
+
+MIME_HTML_ONLY_MULTI: hits 45% spam, 0.016% ham
+
+MIME boundary patterns
+
+MIME_BOUND_DD_DIGITS: hits 33% spam, 0% ham
+
+Hosts using their RDNS in HELO
+
+HELO_DYNAMIC_*: hits 51% spam, 0.02% ham
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00028.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00027.html>[<prev]</A> <A HREF=mgp00029.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 28: End Results<BR>
+<HR>
+<IMG SRC="mgp00028.jpg" WIDTH=800 HEIGHT=600 ALT="Page 28"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00028.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,10 @@
+
+End Results
+
+How does this arms race affect spammers?
+
+the standard HELO function with the standard headers that comes with [spamware X] scores very high on SpamAssassin etc and therefore the mailings are subsequently blocked and filtered... people using [X] need to use unique custom headers
+
+Finally, those "special" ways of masking the emails ... If anything, SpamAssassin will give you MORE points for such things, rather than let your message get through.
+
+Key is to randomize EVERYTHING, this is not simple like it used to be it is more of an art now
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00029.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00028.html>[<prev]</A> <A HREF=mgp00030.html>[next>]</A> <A HREF=mgp00030.html>[last>>]</A>
+<BR>Page 29: Next Steps<BR>
+<HR>
+<IMG SRC="mgp00029.jpg" WIDTH=800 HEIGHT=600 ALT="Page 29"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00029.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,11 @@
+
+Next Steps
+
+Download and reverse-engineer the popular spamware apps themselves?
+
+DMCA an issue
+
+Can learn a surprising amount from their documentation alone
+
+Easy to tell spamware from legit bulk mail apps; they're the ones that hide behind proxies
+
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.html
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.html Wed Sep 29 15:19:41 2004
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD><TITLE>MagicPoint presentation foils</TITLE></HEAD>
+<BODY>
+<A HREF="index.html">[index]</A> <A HREF=mgp00030.txt>[text page]</A> <A HREF=mgp00001.html>[<<start]</A> <A HREF=mgp00029.html>[<prev]</A> [next>] [last>>]
+<BR>Page 30: Thanks!<BR>
+<HR>
+<IMG SRC="mgp00030.jpg" WIDTH=800 HEIGHT=600 ALT="Page 30"><BR>
+<HR>Generated by <A HREF="http://www.mew.org/mgp/">MagicPoint</A>
+</BODY></HTML>
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.idx.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.jpg
==============================================================================
Binary file. No diff available.
Added: spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.txt
==============================================================================
--- (empty file)
+++ spamassassin/site/presentations/2004-09-Toorcon/html/mgp00030.txt Wed Sep 29 15:19:41 2004
@@ -0,0 +1,6 @@
+
+Thanks!
+
+Questions?
+
+
Added: spamassassin/site/presentations/2004-09-Toorcon/src.tar.gz
==============================================================================
Binary file. No diff available.