New image method ... anyone found a reliable way to block??

[Scott Underwood <sc...@firelan.net>]

Hello all.  I've recently begun seeing a lot of messages that are being
passed through the spam scanners.  The messages include a GIF image that
is included in the HTML as a inline attachment, since the attachment is
included with the message there are no RBL blocks that can catch it.
Has anyone found a reliable way to block these messages without severely
disrupting valid messages that use this same technique?  
 
I'm using Spamassassin 3.0.4 with the spamd daemon answering for several
virus scanners running spamc.  The tag generally includes something
similar to:
 
<IMG=20 alt=3D"" src=3D"ATT-0-8306DE01FBBDB440832F9EE2A8C5E10C-Wptc.GIF"
border=3D0>
 
I've considered adding a rule to block the src=3D"ATT-" but it turns out
that Microsoft Office uses the same method for embedding it's HTML
messages so a very large percentage of the users would be affected.  Any
suggestions would be much appreciated.
 
Thanks
Scott

Re: New image method ... anyone found a reliable way to block??

[Matt Kettler <mk...@comcast.net>]

At 09:44 AM 8/18/2005, Scott Underwood wrote:
>Hello all.  I've recently begun seeing a lot of messages that are being 
>passed through the spam scanners.  The messages include a GIF image that 
>is included in the HTML as a inline attachment, since the attachment is 
>included with the message there are no RBL blocks that can catch it.  Has 
>anyone found a reliable way to block these messages without severely 
>disrupting valid messages that use this same technique?


Razor and DCC both do well against these. I know razor does e4 hashes on a 
per-mime-segment basis, so once the image is reported to razor it can hit it.

Rulesemporium has a few rules that detect some specific patterns for these, 
but I've not tested them.

Other than that, conventional RBLs to try to catch the message based on 
source IP, and bayes training are about all I can recommend.