Noah L. Meyerhans wrote:
This method is especially effective in the case where the bayesian
classifier only looks at the first MIME attachment, because the second
is then free to contain whatever spam tokens they want to put in it.
IIRC, this is how most bayesian filters behave.
noah
I got such an email today. The first MIME attachment contained nothing
but nonsense (random characters that looked like words, like: jkjkjasd
hjhewwoah asfjhw shwl asjdkfjo, ajjdfkjdf owerkjadf.)
In the second MIME attachment, there was the spam message. Interestingly
the mail was marked by spamassassin as no spam. Another trick they do
could be to make mails larger than 64 kByte, as the standard setup of sa
does not look at mails bigger than this (well, no, it's the standard
setup of amavisd-new for SA...).
Altough the mail did not look correct in Mozilla, I guess it would have
looked fine in OE. I fear that spammers are going a step further and try
to trick systems like spamassassin. If they do this in a clever way,
they whole spam thing will become even more cumbersome...
Marcel
