Re: Tiny Font (Success)

[Scott Rothgaber <sc...@palmetto.tv>]

Robert Menschel wrote:
 >
> rawbody   SARE_HTML_FSIZE2         /font-size:\s*[0-4]p[tx]\b/i

That did it!

Thanks,
Scott

Re[2]: Tiny Font (Success)

[Robert Menschel <Ro...@Menschel.net>]

Hello Matthias,

Saturday, June 5, 2004, 2:36:55 AM, you wrote:

>>Now to see if I can enhance the rule(s -- there are others also) to catch
>>these before the spammers take action on your samples.   :-)

MK> I started making my own rules as I found the first spam with a 1px font
MK> that wasn't caught by the two already present rules

MK> My rule to catch those stuff bases on the idea that I dont try to catch
MK> the complete font-size but just as far as I can be sure it HAS to be a
MK> tinyfont...

Pretty much the same line of thought I had when refining the tinyfont
rules in the html rule sets last month.

MK> I'm very sorry that I didn't see up to right now that  sare_coding  has
MK> been moved to  sare_html  and I've not yet tested those so there might
MK> be a couple of double rules but I'm sure we can sort that out.....

Jesse points out that most of your examples are caught by his
contributions found in various sare_html rules, but I think you may have
a few examples his didn't cover.

MK> So Bob, I believe you have the possibility to do some masschecking over
MK> all my rules (I've got a lot of other CSS and especially HTML tag rules
MK> very often seen in spammails) as I'd like to know if they can hit some
MK> hams which most of those did not do on my system....

Yes, if you'll send me a copy of those rules in an attached file, I'll
gladly run them against my mass-check, in conjunction with the sare_html
set.  I can then not only see how well yours perform, but analyze the
overlap with what we already have.

MK> Then I could send you my rules and if they prove to be successful, plese
MK> be free to include them in  sare_html

That would be great. Thanks.

Bob Menschel

Re: Tiny Font (Success)

[Matthias Keller <li...@matthias-keller.ch>]

Hi Bob

Robert Menschel wrote:

>Friday, June 4, 2004, 10:36:43 AM, you wrote:
>
>
>RV> that tiny font stuff is barely catchable :(
>RV> try to catch this:
>RV> <font style="font-size:0.01234567890px ...
>
>Thanks for the ideas.  While I'm not sure how valid the html/css is,
>certainly some email clients will display it as the spammer wanted.
>
>Now to see if I can enhance the rule(s -- there are others also) to catch
>these before the spammers take action on your samples.   :-)
>
>Bob Menschel
>  
>
Well this discussion comes just right as I'm developing my own 
Anti-Coding Rules for some weeks now which all proved quite effective on 
my small system (with about 300 ham and 300 spam mails a day)

I started making my own rules as I found the first spam with a 1px font 
that wasn't caught by the two already present rules

My rule to catch those stuff bases on the idea that I dont try to catch 
the complete font-size but just as far as I can be sure it HAS to be a 
tinyfont...
All mentioned examples were caught by my rule which goes as follows:

rawbody         MKE_CSS_ZEROSIZE              
/<[^>]+(=3d|\b)font-size:[\s\"\']*[0]*[0-4][^0-9]/i
describe        MKE_CSS_ZEROSIZE                A CSS contained 
font-size:0 up to 4
score           MKE_CSS_ZEROSIZE                0.5

Other stuff that is incorporated in this rule:
Almost all others dont catch stuff like:   style="color:black; 
font-size:0px"
That's why I completely ignored any style and just make sure that this  
font-size  HAS to appear inside a tag where I dont see any other 
possibility than in a style-like block
the other thing is I dont want to use pt, px or whatever... because 
browsers also accept just a  font-size:0  without any other thing. 
additionally there's more stuff than  pt  and  px  !
So I just make sure that the number may be padded with zeros, then has a 
0, 1, 2, 3 or 4 and the NEXT char is anything but a number...
That might be a dot, a 'px' - whatever.......

So Bob, I believe you have the possibility to do some masschecking over 
all my rules (I've got a lot of other CSS and especially HTML tag rules 
very often seen in spammails) as I'd like to know if they can hit some 
hams which most of those did not do on my system....
Then I could send you my rules and if they prove to be successful, plese 
be free to include them in  sare_html

I'm very sorry that I didn't see up to right now that  sare_coding  has 
been moved to  sare_html  and I've not yet tested those so there might 
be a couple of double rules but I'm sure we can sort that out.....

Have a nice day

Matt

Re[2]: Tiny Font (Success)

[Robert Menschel <Ro...@Menschel.net>]

Hello Ralf,

Friday, June 4, 2004, 10:36:43 AM, you wrote:

RV> Scott Rothgaber wrote:
>> Robert Menschel wrote:
>>> rawbody   SARE_HTML_FSIZE2         /font-size:\s*[0-4]p[tx]\b/i
>> That did it!

RV> that tiny font stuff is barely catchable :(
RV> try to catch this:
RV> <font style="font-size:0.01234567890px ...

Thanks for the ideas.  While I'm not sure how valid the html/css is,
certainly some email clients will display it as the spammer wanted.

Now to see if I can enhance the rule(s -- there are others also) to catch
these before the spammers take action on your samples.   :-)

Bob Menschel

Re: Tiny Font (Success)

[Ralf Vitasek <vi...@tqsoft.de>]

Scott Rothgaber wrote:
> Robert Menschel wrote:
>  >
> 
>> rawbody   SARE_HTML_FSIZE2         /font-size:\s*[0-4]p[tx]\b/i
> 
> 
> That did it!
> 
> Thanks,
> Scott
> 
> 

hi!

that tiny font stuff is barely catchable :(

try to catch this:

<font style="font-size:0.01234567890px;color:rgb(255,255,255)">very tiny 
font</font>

or

<font style="font-size:000.01234567890px;color:rgb(255,254,255)">very 
tiny font</font>

or

<font style="font-size:0.050px;color:rgb(255,255,254)">very tiny font</font>

or

<font style="font-size:1.050px;color:rgb(254,255,255)">very tiny font</font>

or ... or ... or ...


regards
Ralf