On Mon, 17 Jun 2013, Alex wrote:
Hi,
On Mon, Jun 17, 2013 at 1:48 PM, John Hardin <jhar...@impsec.org> wrote:
On Mon, 17 Jun 2013, Amir 'CG' Caspi wrote:
At 7:20 PM -0700 06/15/2013, John Hardin wrote:
I took a closer look at this and it seems they're working around trivial
gibberish detection by putting a valid CSS property at the very beginning of
the style tag.
Revising the rules...
I am now seeing STYLE_GIBBERISH hitting on a lot of spam in the past day
or so, since the new rules hit the distribution. So far, all TPs, no FPs.
Yay!
I've also noticed the latest iteration hitting now quite a bit, but
also found an FP from groupon:
http://pastebin.com/qwdtSqJd
Well, that *is* gibberish in a STYLE tag. Bad coder, no biscuit.
If it persists I can add an exclusion for mail from groupon.com
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Liberals love sex ed because it teaches kids to be safe around their
sex organs. Conservatives love gun education because it teaches kids
to be safe around guns. However, both believe that the other's
education goals lead to dangers too terrible to contemplate.
-----------------------------------------------------------------------
Tomorrow: SWMBO's Birthday
