stupid spammers

stupid spammers

[Christopher Faylor]

I'd been perplexed as to how some html email had gotten through the
filters recently.  Neither ezmlm nor mlcheck recognized some idiot
spammer email as containing html content.  Worse, the body of the
message was not even subjected to any checking, allowing the mail to
sail through even when it contained spammy keywords.

Whenever I got one of these in my inbox, I would dutifully run it
through my standard checks and see that it was properly caught.  Yep.
mlcheck always complained when I ran the check by hand.

Yesterday, after seeing six or seven messages in my personal spam traps,
I had the bright idea of running mlcheck on the contents from the
archive rather than saved contents from my email client.  Bingo.  My
email client was reformatting things nicely so that mlcheck recognized
the attachmens.  The archived messages were in a format that confused
the perl MIME::Parser functions.

As far as MIME::Parser is concerned, these were multipart/alternative
messages which had no body but just had a preamble.  Since I wasn't
checking the preamble for naughty content, the messages seemed to be
empty and empty messages are only subject to, er, subject checks and
from/to address checks.  Some of these messages used from addresses of
local subscribers so they got through with no problem.

Anyway, I am now checking the preamble and the problem should be solved.
The increase in spam to the mailing lists should be squashed.  There is
a minor possibility that I am doing something stupid (hmm, maybe not
so minor) and that mail could be blocked, so please be alert to any
mailing list problems.

FYI,
cgf