Re: QR code phish?
On Thu, Feb 1, 2024 at 5:01 PM Kevin A. McGrail mailto:kmcgr...@apache.org>> wrote: Hi Alex, we are definitely seeing them. There is code in trunk for this with one of the plugins and rules in the KAM ruleset using the new code. LMK if you need more info. On 2/4/24 18:56, Alex wrote: It looks like it's tied to the Raptor service and the ExtractText plugin. Do you have more details on doing that? On 05.02.24 08:31, giova...@paclan.it wrote: If you do not use any other ExtractText config line for image file types, zbarimg(1) can be configured on SpamAssassin 4.0 as well. On 2/5/24 09:49, Matus UHLAR - fantomas wrote: what if you do? does ExtractText only run one of configured programs for the same type of file? On 05.02.24 12:14, giova...@paclan.it wrote: Exactly, ExtractText only run the first configured program for the same type of file. That's unfortunate, I already use it for OCR. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. "The box said 'Requires Windows 95 or better', so I bought a Macintosh".
Re: QR code phish?
On 2/5/24 09:49, Matus UHLAR - fantomas wrote: On Thu, Feb 1, 2024 at 5:01 PM Kevin A. McGrail mailto:kmcgr...@apache.org>> wrote: Hi Alex, we are definitely seeing them. There is code in trunk for this with one of the plugins and rules in the KAM ruleset using the new code. LMK if you need more info. On 2/4/24 18:56, Alex wrote: It looks like it's tied to the Raptor service and the ExtractText plugin. Do you have more details on doing that? On 05.02.24 08:31, giova...@paclan.it wrote: you can configure ExtractText to run zbarimg(1) to extract uris from QR codes. zbarimg(1) is available at https://zbar.sf.net or packaged on many OS. in Debian (I assume Ubuntu as well) it's in the zbar-tools package If you do not use any other ExtractText config line for image file types, zbarimg(1) can be configured on SpamAssassin 4.0 as well. what if you do? does ExtractText only run one of configured programs for the same type of file? Exactly, ExtractText only run the first configured program for the same type of file. Giovanni OpenPGP_signature.asc Description: OpenPGP digital signature
Re: QR code phish?
On Thu, Feb 1, 2024 at 5:01 PM Kevin A. McGrail mailto:kmcgr...@apache.org>> wrote: Hi Alex, we are definitely seeing them. There is code in trunk for this with one of the plugins and rules in the KAM ruleset using the new code. LMK if you need more info. On 2/4/24 18:56, Alex wrote: It looks like it's tied to the Raptor service and the ExtractText plugin. Do you have more details on doing that? On 05.02.24 08:31, giova...@paclan.it wrote: you can configure ExtractText to run zbarimg(1) to extract uris from QR codes. zbarimg(1) is available at https://zbar.sf.net or packaged on many OS. in Debian (I assume Ubuntu as well) it's in the zbar-tools package If you do not use any other ExtractText config line for image file types, zbarimg(1) can be configured on SpamAssassin 4.0 as well. what if you do? does ExtractText only run one of configured programs for the same type of file? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. A day without sunshine is like, night.
Re: QR code phish?
On 2/4/24 18:56, Alex wrote: Hi, On Thu, Feb 1, 2024 at 5:01 PM Kevin A. McGrail mailto:kmcgr...@apache.org>> wrote: Hi Alex, we are definitely seeing them. There is code in trunk for this with one of the plugins and rules in the KAM ruleset using the new code. LMK if you need more info. It looks like it's tied to the Raptor service and the ExtractText plugin. Do you have more details on doing that? you can configure ExtractText to run zbarimg(1) to extract uris from QR codes. zbarimg(1) is available at https://zbar.sf.net or packaged on many OS. If you do not use any other ExtractText config line for image file types, zbarimg(1) can be configured on SpamAssassin 4.0 as well. Regards Giovanni OpenPGP_signature.asc Description: OpenPGP digital signature
Re: QR code phish?
Hi, On Thu, Feb 1, 2024 at 5:01 PM Kevin A. McGrail wrote: > Hi Alex, we are definitely seeing them. There is code in trunk for this > with one of the plugins and rules in the KAM ruleset using the new > code. LMK if you need more info. > It looks like it's tied to the Raptor service and the ExtractText plugin. Do you have more details on doing that? Thanks, Alex
Re: QR code phish?
Hi Alex, we are definitely seeing them. There is code in trunk for this with one of the plugins and rules in the KAM ruleset using the new code. LMK if you need more info. On 2/1/2024 4:06 PM, Alex wrote: Hi, I'm just wondering if there is any mechanism for detecting and blocking QR code emails? Would that require using image detection? Perhaps instead it's a database of known malicious QR codes? Has anyone even really seen any? -- Kevin A. McGrail kmcgr...@apache.org Member, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project https://www.linkedin.com/in/kmcgrail - 703.798.0171
QR code phish?
Hi, I'm just wondering if there is any mechanism for detecting and blocking QR code emails? Would that require using image detection? Perhaps instead it's a database of known malicious QR codes? Has anyone even really seen any?
