Re: Was "One large image" now is "several small images"

[jdow]

From: "John D. Hardin" <[EMAIL PROTECTED]>

On Thu, 15 Jun 2006, Matt wrote:

It seems the spammers have gotten smart to the fact that we were
filtering for one large image and no text... now what I am seeing
is that the spammers are sending many small images inline with the

e-mails! But, I have yet to see a way to filter against this. Any thoughts?

This is yet another argument for match counts in SA rules. It would be
useful to score (say) .10 per image attachment after the first two or
three...

--
John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
[EMAIL PROTECTED]    FALaholic #11174    pgpk -a [EMAIL PROTECTED]
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Look at the people at the top of both efforts. Linus Torvalds is a
university graduate with a CS degree. Bill Gates is a university
dropout who bragged about dumpster-diving and using other peoples'
garbage code as the basis for his code. Maybe that has something to
do with the difference in quality/security between Linux and
Windows.                          -- anytwofiveelevenis on Y! SCOX
----------------------------------------------------------------------
3 days until SWMBO's Birthday

Actually not. My birthday's in January.

{O,o}