[Mimedefang] Random Word Spam

[David F. Skoll]

On Wed, 14 Jan 2004, Fox, Randy wrote:

> We've been seeing a lot of messages with what appears to be random words
> at the end.  This is probably an issue more for SpamAssassin but after
> doing a Google search, I'm not sure it can help.  They refer to this
> spam technique as Bayes Poison.  It sounds like over time, what happens
> is the spamassassin database(s) will grow, and the spam vs. non-spam
> will neutralize themselves out.

I don't see this happening in practice.  A well-designed Bayes database
will prune out infrequently-seen words every so often, and that prevents
the bloat.  In fact, the poison words are so oddball that when they
do recur, my Bayes engine latches on to them as spam indicators. :-)

I'm testing a SpamAssassin rule that looks like this:

body GIBBERISH_WORDS        /([a-z]{4,12} ){15}/
describe GIBBERISH_WORDS    A whole bunch of space-separated lowercase words
score GIBBERISH_WORDS       2

It looks for 15 or more all-lower case words between 4 to 12 letters
each separated by single spaces.  I don't think that occurs often in
real e-mail -- most people do use upper-case letters and punctuation
ocasionally!  But use at your own risk, especially if you correspond
with an e. e. cummings fan.

Regards,

David.