3 pointer for the Spammers

PbG

Well-Known Member
Mar 11, 2003
247
0
166
Spammers have a new weapon against our SPAM controls. A script embedded in the header outputs an undesireable/filterable string eg: 1/2 price Viagr*a.

I discovered this when I tested the message against the filter expecting it to fail on "Viag" in the subject. When it did not I doublechecked the subject in the header and realized they differ and/or produce different results depending on how it is being viewed.

In the inbox it shows up as:

1/2 price Viagr*a

Viewing the header (see below) returns:

Subject: =?ISO-8859-1?b?MS8yIHByaWNlIFZpYWdyKmE=?=

Gotta admire the tenacity of the bastards . . .

========== Begin Forwarded Message ========
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Thu, 15 Apr 2004 12:24:17 -0700
Received: from gus by studiog39mw.uncensored-hosting.com with local-bsmtp (Exim 4.24)
id 1BECT9-0000Fl-Uk
for [email protected]; Thu, 15 Apr 2004 12:24:17 -0700
Received: from [217.88.218.169] (helo=tenbit.pl)
by studiog39mw.uncensored-hosting.com with smtp (Exim 4.24)
id 1BECT9-0000Ff-61
for [email protected]; Thu, 15 Apr 2004 12:24:15 -0700
Subject: =?ISO-8859-1?b?MS8yIHByaWNlIFZpYWdyKmE=?=
To: [email protected]
From: "Florine A. Hathaway" <[email protected]>
Message-ID: <[email protected]>
Date: Thu, 15 Apr 2004 19:22:56 +0000
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
studiog39mw.uncensored-hosting.com
X-Spam-Level: ******
X-Spam-Status: No, hits=6.4 required=7.0 tests=HTML_60_70,HTML_IMAGE_ONLY_02,
HTML_MESSAGE,MIME_HTML_NO_CHARSET,MIME_HTML_ONLY,RCVD_IN_DYNABLOCK,
RCVD_IN_NJABL,RCVD_IN_NJABL_DIALUP,RCVD_IN_SORBS autolearn=no
version=2.63


======== End Forwarded Message =========
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,453
31
473
Go on, have a guess
Well, it's nothing really new.

If you are using spamassassin with MailScanner with bayes learning enabled, they rarely get through. Especially if you "learn" them manually.