Re: [SAtalk] Re: Spam using invalid Mime headers to bypass SpamAssassin?

[Ryan Moore]

There is alot there for SA to trigger on, as noticed in the headers for 
the fixedmime.txt which yields expected results, however the original 
one only had one hit, which tells me that SA was unable to parse the 
HTML part of the message. Problem is that over the past two days, we've 
gotten half a dozen of these on one account. Guess I'll give 2.60 a try 
and see how it handles these.

Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Fuzzy Fox wrote:
Ryan Moore <[EMAIL PROTECTED]> wrote:

I got an email that made it by spamassassin with virtually no hits,
which looks like it used some wierd mime technique to get through
spamassassin.  I put the source of the email at
http://h0b0.net/brokenmime.txt.


I don't see anything broken about the MIME structure.  My mailer (Mutt)
had no trouble discerning the structure and showing me the message.  A
glance through the raw message shows that the structure is a bit more
than you'll find in a typical message, but there is nothing underhanded
about it.
I'm not sure why you thought this message should score highly, as there
is very little to trigger of SA's rules.  The text plain part simply
say:
    don't wait
    01743594368
    Jim
while the text/html part simply says:

    [IMG]
    [IMG]
    Hey Jim sounds good zdmhK
    Go FcP Wish you were here kqIPn
There is very little for any of SA's rules to trigger on, very little
for any Bayes tokenization to use.  The message is short, and I'd
consider it basically an "image-only" type of spam, which SA is not
likely to ever detect as spam, unless there is some corroborating evidence
in the headers.
--

Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net


-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk