[Mimedefang] New way of obfuscating text

Tue Feb 10 14:26:39 EST 2004

Jim McCullars wrote:
> also, but they will obfuscate a letter by doing this:
>
> 	<font style="font-size: 1;">s
>
> which makes that "s" basically invisible.  Can anyone think of a valid
> reason for setting a font size of 1?  I am thinking of a SA rule like:
>
> rawbody UAH_SMALL_FONT /<font\s+style=\"font-size:\s+1;/i

Personally I think that's a great idea.  I've seen these a lot lately too
and I think I'm going to put something like this into place as well.  But
how about making the pattern simply:

/font-size:\s*1;/i

since:

(1) The "style" attribute doesn't necessarily have to be the first one in
the "font" tag
(2) The "style" attribute could be applied to other tags as well (<td> for
example)
(3) This style could be included between <style type="text/css"></style>
tags in the <head> portion of the HTML.

I think I'll drop this rule into place with a score of 0.1 for now and see
how what it catches before I adjust the score.  My suspicion is that it'll
be at least 99.9% spam.

Thanks for sharing...

___________________________________________
Michael Sims
Project Analyst - Information Technology
Crye-Leike Realtors
Office: (901)758-5648  Pager: (901)769-3722
___________________________________________