New >1MB spam run?

[Matt Kettler <mk...@evi-inc.com>]

I just recently received a run of spam which would push some system's scan-size
limit. These messages have a very short text part and consist mostly of an
attached image file. The file is a gigantic 2952 x 3937 pixel jpeg that is
774,568 bytes in binary form, making for a base-64 encoded email over 1 meg.

Some of you using spamc or other tools with size limits might want to bump up
your size limits. (the relay shows up in spamcop currently)

More amusing than the fact that the oversized image is tough to view on a PC,
the spam seems to be advertising local stores by their street addresses, and
appears to be in Guatemala. That's a long way to go to buy shoes from Maryland, USA.

For anyone interested, here's some headers and a bit of body off one:

Return-Path: <to...@itelgua.com>
Received: from gold.guate.net (gold.guate.net [200.12.63.200] (may be forged))
	by xanadu.evi-inc.com (8.12.8/8.12.8) with ESMTP id j56HW51U016177
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO)
	for <mk...@evi-inc.com>; Mon, 6 Jun 2005 13:32:07 -0400
Received: from usuario-hyhaya5 (ip-50-221.guate.net.gt [200.12.50.221] (may be
forged))
	by gold.guate.net (8.12.9/8.12.5) with ESMTP id j56I2Opg020328
	for <mk...@evi-inc.com>; Mon, 6 Jun 2005 12:02:24 -0600
Message-ID: <38...@usuario-hyhaya5>
From: "top shoes" <to...@itelgua.com>
To: mkettler@evi-inc.com
Subject: nueva linea de verano
Date: Mon, 6 Jun 2005 11:31:53 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_1796513849613620103153874"
Status:

This is a multi-part message in MIME format.

------=_NextPart_1796513849613620103153874
Content-type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

adquiere los ultimos estilos de verano

------=_NextPart_1796513849613620103153874
Content-Type: image/jpeg; name="volante 8 mujer verano.jpg"
Content-Transfer-Encoding: base64
Content-Description: volante 8 mujer verano.jpg
Content-Disposition: attachment; filename="volante 8 mujer verano.jpg"
<snip>

Re: New >1MB spam run?

[Matt Kettler <mk...@evi-inc.com>]

Theo Van Dinter wrote:
> On Mon, Jun 06, 2005 at 09:41:05PM +0200, wolfgang wrote:
> 
>>assuming the scan-size limit would be changed from default 250k to 1250k, how 
>>would that affect ressource consumption?
> 
> 
> It's highly recommended that people do *NOT* increase the max scan size past
> the default of 250k.  Do so at your own risk.
> 


It will definitely bump up resource usage. That said, if you've got plenty of
ram to spare, you should be able to raise your limit safely.

Theo, correct me if I'm wrong, but I can't imagine that SA's memory resource
usage penalty for large messages is worse than 16x message size, so make sure
you've got at least 16mb * number of spamd children of ram to spare if you're
going to add a meg.

This does point out a direction that the SA devel team needs to start
considering for future releases. Bandwidth is increasing, and SURBL is putting
more pressure on spammers to use embedded images instead of web links, so spam
message sizes are on the rise.

Admittedly this example is unusual (but I did get a run of them), and the
largest "common" spam I've seen is 80kb. However, keep in mind that 2 years ago
that kind of size was unheard of. Still it would be particularly unfortunate for
SA to get caught in a situation where a mass-outbreak of large spam hit and SA
couldn't handle scanning it.

If nothing else, it would be good to do the scan-size limits based on the
text-section message size, as opposed to the raw message size with all
attachments that most parts of SA will ignore (all except full rules). To do
that you'd need to take measures to make sure the binary sections don't wind up
using extra resources inside SA, but that shouldn't be hard and might be true
currently.

Re: New >1MB spam run?

[Theo Van Dinter <fe...@apache.org>]

On Mon, Jun 06, 2005 at 09:41:05PM +0200, wolfgang wrote:
> assuming the scan-size limit would be changed from default 250k to 1250k, how 
> would that affect ressource consumption?

It's highly recommended that people do *NOT* increase the max scan size past
the default of 250k.  Do so at your own risk.

-- 
Randomly Generated Tagline:
"I see!  So the cockpits are going to be filled with drunks with guns ...
 Co-pilot, switch seats with me!  I can't get another DUI!  and if the
 cop gets nosy, plug him!"       - Lewis Black, The Daily Show 2002.07.17

Re: New >1MB spam run?

[wolfgang <me...@gmx.net>]

In an older episode (Monday 06 June 2005 21:17), Matt Kettler wrote:
> wolfgang wrote:
> > In an older episode (Monday 06 June 2005 20:08), Matt Kettler wrote:
> > 
> >>I just recently received a run of spam which would push some system's 
> > 
> > scan-size
> > 
> >>limit.

> If you use spamc, there's a default limit of 250k. see the spamc manpage for
> command-line options to change this.

thanks for pointing that out, we are using spamc. which limit would you 
recommend to scan the mails you mentioned?

assuming the scan-size limit would be changed from default 250k to 1250k, how 
would that affect ressource consumption?

thanks,

wolfgang

Re: New >1MB spam run?

[Matt Kettler <mk...@evi-inc.com>]

wolfgang wrote:
> In an older episode (Monday 06 June 2005 20:08), Matt Kettler wrote:
> 
>>I just recently received a run of spam which would push some system's 
> 
> scan-size
> 
>>limit.
> 
> 
> AFAIK, there is no default scan-size limit in SA, correct?
> 

If you use spamc, there's a default limit of 250k. see the spamc manpage for
command-line options to change this.

If you use spamassassin, or the API, it's up to the caller to limit the size.

Most of the sample procmail rules have a size limit.

Most integration tools that use the API have size limits.

So, most people with "normal" SA setups will be affected by this.

Re: New >1MB spam run?

[wolfgang <me...@gmx.net>]

In an older episode (Monday 06 June 2005 20:08), Matt Kettler wrote:
> I just recently received a run of spam which would push some system's 
scan-size
> limit.

AFAIK, there is no default scan-size limit in SA, correct?

regards,

wolfgang