[EMAIL PROTECTED] Re: [SAtalk] Spammers using SpamAssassin to tailor their emails?
David B Funk <[EMAIL PROTECTED]> wrote:
I'm positive that spammers are tuning spam to get past SpamAssassin....
I've seen several spam crafted to trip the "nice" scores for good MUAs (USER_AGENT_*).
This was a big part of the reason SpamAssassin 2.54 was released: spammers were deliberately targeting multiple "nice" rules and ending up with scores like -30 because a message claimed to have been sent by Mozilla, Pine *and* Outlook Express using Microsoft Exchange with a reply to a known mailing list.
From what I hear, SA 2.60 has cut out all the "nice" rules except for a few that are difficult to forge (like Bonded Sender, which is a reverse DNSBL, and Habeas, which has legal teeth behind it).
I've been adjusting down many of the "nice" scores as they're starting to just reward clever spammers.
It's an arms race, pure and simple. Well, maybe not simple.
Step 1: spam blocking tools improve. Step 2: spammers find new ways to work around filters. Step 3: repeat.
In the world of spam filtering, you really need to stay on the bleeding edge. "Upgrade early, upgrade often." And it helps to try multiple attacks, something for which SA, with its support for DNS blacklists, Bayesian classification, Razor, Pyzor, and DCC, is well-suited.
Kelson Vibber
SpeedGate Communications <www.speed.net>
------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
