Re: More sorbs blacklisting

[Craig Sanders <cas@taz.net.au>]

On Fri, Aug 18, 2006 at 10:56:53AM -0400, Micah Anderson wrote:
> Michelle Konzack wrote:
> > Am 2006-06-29 12:49:43, schrieb John Kelly:
> >> Spammers turn to images to fool filters
> >>
> >> http://news.yahoo.com/s/ap/20060628/ap_on_hi_te/spam_images;_ylt=An8NruBEo7Speg9bvdRayHsRSLMF;_ylu=X3oDMTA4ZnRnZjhkBHNlYwMxNjk1
> > 
> > 
> >     :0
> >     * B ?? ^Content-Type:.*image/(gif|jpeg|pjpeg)
> >     .SPAM.FLT_gif_jpeg/
> > 
> > 
> > in ~/.procmailrc works wonder...
> 
> I've been trying to find a way to block this at the postfix level
> without blocking legitimate image attachments. Has anyone been able to
> do this?

i block all embedded (not just attached) images in html mail, like so
(in pcre body_checks):

/\bsrc\s*=(?:3D)?\s*"?cid:/ REJECT


WARNING: in theory, images can be embedded like this in legitimate mail.
i haven't seen one yet, in several years of using this rule, every
single one that i've seen has been spam (usually pill spam for the few
i've bothered to actually look at)....but that may be because of the
kind of mail i receive.

craig

-- 
craig sanders <cas@taz.net.au>           (part time cyborg)