|
Image spam is rather difficult to deal with. FuzzyOcr has helped me do so.
Of course, running an OCR scanner on images contained in messages will slow
down the spam scanning process (considerably in some cases), but for me this is not
a problem, just be aware of it. I document my installation of FuzzyOcr 2.3b here.
I will assume you are able to compile programs from source.
You need to be at SpamAssassin version 3.1.1 or greater to use these plugins.
Consider installing SpamAssassin from
sarge-backports
if you are trying to keep your system 'stable'. You can possibly install SpamAssassin
from 'testing' without upgrading to the testing versions of libc6 or Perl or the Kernel
by using the form 'apt-get install spamassassin/testing'. Using this form should
install dependencies from 'stable'. Simulate it first with 'apt-get -s install [...]'.
In order to prevent accidental upgrades when running 'apt-get upgrade'
you might also consider putting the package on hold if you use this method: echo "spamassassin hold" | dpkg --set-selections You should not have both giflib-bin and libungif installed. Simulate removing giflib-bin: apt-get -s remove giflib-bin
If it's not installed, then you can move on. If it's the only thing that will be removed, then remove it: apt-get remove giflib-bin
Download, extract, patch, compile and install libungif:
cd /usr/local/src
Continue to install other required programs:
apt-get update
The beginning of the output should look something like this:' AnENTlON ALL DAY TRADERS AND INVESTORS 'Run another test. The result should be roughly the same, but this time you should not get error messages from giftopnm:
giffix image001.gif > image001.fixed
Visit
http://fuzzyocr.own-hero.net/wiki/Install FuzzyOcr 2.3b - this document is based on that version. If another version is used much of this document will no longer apply:
cd /usr/local/src/
We will use a new patch Robert LeBlanc created for this particular version of FuzzyOcr.
wget http://www200.pair.com/mecham/spam/fuzzyocr-23b-hashdb-poison.patch
Then place the files:
cp FuzzyOcr.pm /etc/spamassassin/
Edit v310.pre and add the plugin:
vi /etc/spamassassin/v310.pre
and insert (at the bottom):
loadplugin FuzzyOcr /etc/spamassassin/FuzzyOcr.pm
Configure FuzzyOcr.cf:
vi /etc/spamassassin/FuzzyOcr.cf
comment out the first line (the one that loads the plugin):#loadplugin FuzzyOcr FuzzyOcr.pm If (and only if) you are using a version of SpamAssassin less than 3.1.4, uncomment this line and set the value to 1.0: focr_pre314 1.0 Set focr_base_score to 2 (this is my personal choice): focr_base_score 2 Only while we test, set focr_autodisable_score to 50: focr_autodisable_score 50 Save and exit the file, then we test. Start by linting spamassassin:
spamassassin --lint
Once you have resolved any (serious) lint errors, we do some more testing. This assumes you are still in the /usr/local/src/fuzzyocr-2.3b directory:
cd samples
I got:
19 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"alert" in 4 lines
"charts" in 1 lines
"symbol" in 1 lines
"alert" in 4 lines
"stock" in 2 lines
"company" in 3 lines
"trade" in 1 lines
"xanax" in 1 lines
"meridia" in 1 lines
"growth" in 1 lines
(19 word occurrences found)
If you did not get something similar, check the log
for the last error message (if any).For example, on a low powered machine you may have to increase focr_timeout in /etc/spamassassin/FuzzyOcr.cf:
cat /etc/spamassassin/FuzzyOcr.log
Ideally, FuzzyOcr.log will not exist. Continue on to the next test:
spamassassin -t < corrupted-gif.eml
I got:
1.5 FUZZY_OCR_WRONG_CTYPE BODY: Mail contains an image with wrong
content-type set
Image has format "GIF" but content-type is
"image/jpeg"
2.5 FUZZY_OCR_CORRUPT_IMG BODY: Mail contains a corrupted image
Corrupt image: GIF-LIB error: Image is
defective, decoding aborted.
10 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"alert" in 1 lines
"alert" in 1 lines
"stock" in 2 lines
"investor" in 1 lines
"company" in 1 lines
"trade" in 1 lines
"target" in 1 lines
"service" in 1 lines
"recommendation" in 1 lines
(10 word occurrences found)
Continue on to the next test (make sure your focr_autodisable_score is 50):
spamassassin -t < jpeg.eml
I got:
4.0 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"viagra" in 2 lines
"cialis" in 1 lines
"levitra" in 1 lines
(4 word occurrences found)
Continue on to the next test:
spamassassin -t < png.eml
I got:
28 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"alert" in 2 lines
"news" in 2 lines
"symbol" in 1 lines
"alert" in 2 lines
"stock" in 1 lines
"investor" in 3 lines
"company" in 2 lines
"buy" in 1 lines
"price" in 2 lines
"trade" in 2 lines
"target" in 2 lines
"service" in 2 lines
"recommendation" in 1 lines
"levitra" in 1 lines
"software" in 2 lines
(26 word occurrences found)
Edit FuzzyOcr.cf and set focr_autodisable_score score back to a more reasonable level:
vi /etc/spamassassin/FuzzyOcr.cf
I set the focr_autodisable_score to the same value as my $sa_kill_level_deflt in amavisd.conf: focr_autodisable_score 8 Reload amavisd-new (or spamd if you are using that):
amavisd-new reload
And keep an eye on the mail.log for a while:
tail -f /var/log/mail.log
If you upgrade to SpamAssassin 3.1.4 or newer from an older 3.1.x version, remember to set focr_pre314 to 0.0 |
Now we will install another plugin. This one is from SARE
http://www.rulesemporium.com/plugins.htm.
Once again, navigate to your Plugin directory and grab the plugin:
cd /usr/share/perl5/Mail/SpamAssassin/Plugin
Also get the configuration file:
cd /etc/spamassassin/
Edit v310.pre:
vi v310.pre
and insert (at the bottom): loadplugin Mail::SpamAssassin::Plugin::ImageInfo Edit imageinfo.cf and lower any scores that are 3.0 or more to half their value. This is to help prevent false positives:
vi imageinfo.cf
Save and exit the file, and of course, lint spamassassin:
spamassassin --lint
and reload amavisd-new (or spamd if you are using that):
amavisd-new reload
|