What are they thinking?!?

John Rudd jrudd at UCSC.EDU
Fri Feb 20 21:08:24 GMT 2004


Craig Daters wrote:
>
> Case in point... What the hell is the message trying to scam me out of?
>

> X-WestPress-MailScanner-SpamScore: sss

> X-Spam-Status: No, hits=4.2 required=7.5

> repel alone expiration exhortation mastermind throwaway forgery
> continent attache cowman rubicund conservative incompletion
> prophylactic nouakchott cryogenic <BR>
> alundum sinusoidal agglomerate conceive freakish staircase anaheim
> billow wilkes derive marsupial conscientious chilean groin happy
> embargoes sank atlantic assyria celestial sister eyed boot within
> icicle bonnet memphis grosset associate <BR>
>


You're looking at it wrong.  It's not trying to scam YOU out of
anything.  It's trying to scam your bayesian learner (if you have one,
which you probably do since you're using a recent version spam assassin
(me too)).

See, the message is scored as non-spam, so if this message ends up being
auto-learned, it will throw off the weights of your bayes ranks for
these words ... so if they insert these words into actual spam messages,
then it will lower the score of the spam message.  That's the logic,
anyway.

It's a bayes poisoning attack, or attempt.  I don't know how well they
work ... it certainly doesn't seem to have had a negative impact on my
bayes db.



More information about the MailScanner mailing list