Damn Spam.

[mbarrick]

The e-mail system at work is pretty much my baby, that means trying to block spam is part of my job. I read about this particular insidious trick the other day and just noticed my first example of it. This is a new tactic being used to bypass content filters:

<p>G<!--iup8uh1kwzve-->et Vi<!--9zdgum1zqa5-->a<!--0iifrz1kwv-->gra o<!--g1esqe2qa1dz53-->nline N<!--xdgz301z7hi-->ow <!--yun98a212g-->! <br>

The subject line was innocuous and unfilterable ("Answer my question please"). The content is in HTML. In HTML <!--comment goes here--> is a comment tag and doesn't render so the above text reads "Get Viagra online now!" The contents of the comments are completely random and randomly inserted in the text. Adding insult to injury the random comments not only subvert all but the most sophisticated (and expensive) heuristics filters, they make the message multiple times larger than it's content, chewing up considerably more bandwidth.

Comments

I built a workaround for this already.

[logik.livejournal.com]

I used libmilter, pass the body to an html stipper first, then pass the body back to my bayesian filter, and presto.

I became aware of this tactic last year about this time.

Depending on what your mail system is, you should be able to pass inbound mail through a tag stripper to analyze it without too much trouble.

Re: I built a workaround for this already.

[mbarrick.livejournal.com]

Thanks for the tip. I don't want to strip out all the HTML, but stripping the comment tags is, now that you mention it, obviously the way to go.

[sleeplessknight.livejournal.com]

That's EVIL. >_

[mbarrick.livejournal.com]

Yeah, but a big fat "d'oh" from me for not thinking of just stripping out all comment tags. I was thinking, "Gee, I can't disallow HTML mail, how can I deal with it? Lots of pages have comment tags so I can't deny anything with a comment tag..." Kim is so right, the comment tags don't render, so just strip them all out before the mail goes to the filters. D'oh. D'oh. D'oh!