Scanning images

[Glenn Steen]

On 9 February 2010 09:26, Monis Monther <mmmm82 at gmail.com> wrote:
>
> Hi:
>
> Today I got some emails that had attached images containing unwanted material
>
>
> My MailScanner tagged it as clean
>
> RBL did not find tag the domain or IP as black list ( I use spamhaus-zen and CBL)
I might be having a senior moment, but.... Isn't CBL part of zen?

> SA scores were as follows
> 0.10RDNS_NONE
> 2.90TVD_SPACE_RATIO
> The body was empty only an attachment of a jpg image containing the unwanted material
>
> I use RBL test and SA no bayes or MCP
>
> 1- How can detect such messages?

Since many years I use ImageInfo in SA, to great effect. Since it
mostly is a bunch of rules, it'll cost little. Else you might explore
FuzzyOCR, but this comes with a rather hefty performance impact... I'd
only use it on low-volume systems;).
Else... you'll have to look at the actual message (and the whole
message, body and headers) to try determine if there is anything you
can try score it with (Things like Bayes and CRM114 will likely not
help here). I'm sure others have other ideas:-)

>
> 2- Can anyone explain a little bit what MCP does and when or why do I need it. All I read is what was written in the MailScanner.conf documentation and that it uses another copy of SA to rescan the body (attachments are part of the body, correct me if I misunderstand attachments), doesn't SA already scan the body?? why scan again the same thing with different rules? why not have all these rules under SA in the first place and do one full scan? please shed some light so I can understand the mechanism
>
Message Content Protection is actually a second SpamAssassin, with a
completely separate configuration. It's main goals are to have
separate actions on specific words/rules. It is deprecated since a
while back... It's functionality has been "replaced" by use of
SpamAssassin Rule Hit configuration... which has none of the
performance-related impact that MCP carries.
So... Don't use MCP;-)

> Thanks
>
> Best Regards
>
> Monis
>
>

Cheers
--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se