|
Image spam is rather difficult to deal with. FuzzyOcr has helped me do so.
Of course, running an OCR scanner on images contained in messages will slow
down the spam scanning process (considerably in some cases), but for me this is not a problem, just
be aware of it. I document my installation of FuzzyOcr here.
I will assume you have at least testing and stable sources listed
in /etc/apt/sources.list, and 'stable' has top priority in
/etc/apt/preferences
and you are able to compile programs from source (but of course there is
no reason you could not install this stuff on an Etch or Sid system).
You need to be at SpamAssassin version 3.1.1 or greater to use these plugins.
Consider installing SpamAssassin from
sarge-backports
if you are trying to keep your system 'stable'. You can possibly install
SpamAssassin from 'testing' without upgrading to the testing versions
of libc6 or Perl or the Kernel by
using the form 'apt-get install spamassassin/testing'. Using this form should
install dependencies from 'stable'. Simulate it first with 'apt-get -s install [...]'.
In order to prevent accidental upgrades when running 'apt-get upgrade'
you might also consider putting the package on hold if you use this method: echo "spamassassin hold" | dpkg --set-selections One of the programs we need is not available in the stable release, so we will install from testing. First test that installing libimage-exiftool-perl will not install libc6 or related programs:
apt-get update
If libimage-exiftool-perl is the only thing that will be installed, then install it. If it is not, and you are trying to keep your system stable, then contact me before you continue:
apt-get install libimage-exiftool-perl/testing
See what version you have:dpkg -l libimage-exiftool-perl
If your version is less than 6.36-1, patch ExifTool:
cd /usr/share/perl5/Image/ExifTool/
To prevent future accidental upgrades during 'apt-get upgrade', place
the libimage-exiftool-perl package on hold:
echo "libimage-exiftool-perl hold" | dpkg --set-selections
You should not have both giflib-bin and libungif installed. Simulate removing giflib-bin: apt-get -s remove giflib-bin
If it's not installed, then you can move on. If it's the only thing that will be removed, then remove it: apt-get remove giflib-bin
Download, extract, patch, compile and install libungif:
cd /usr/local/src
Continue to install other required programs:
apt-get install libnetpbm10-dev netpbm giflib3g-dev libimage-exif-perl libstring-approx-perl
The beginning of the output should look something like this:' AnENTlON ALL DAY TRADERS AND INVESTORS 'Run another test. The result should be roughly the same, but this time you should not get error messages from giftopnm:
giffix image001.gif > image001.fixed
Visit
http://users.own-hero.net/~decoder/fuzzyocr/ and see what the latest version
of FuzzyOcr is (this document is based on 2.3b dated 29-Aug-2006), then modify the lines below if needed. If you install a different version
than what I have listed below, then the instructions could differ considerably.
Begin by locating the /Plugin/ directory used by SpamAssassin:
updatedb
If you installed SpamAssassin using apt-get, the /Plugin directory should be /usr/share/perl5/Mail/SpamAssassin/Plugin. If yours is different, you will need to modify the commands below.
cd /usr/local/src/
We will use a new patch Robert LeBlanc created for this particular version of FuzzyOcr.
wget http://www200.pair.com/mecham/spam/fuzzyocr-23b-hashdb-poison.patch
Then place the files:
cp FuzzyOcr.pm /usr/share/perl5/Mail/SpamAssassin/Plugin/
Edit v310.pre and add the plugin:
vi /etc/spamassassin/v310.pre
and insert (at the bottom):
loadplugin FuzzyOcr /usr/share/perl5/Mail/SpamAssassin/Plugin/FuzzyOcr.pm
Configure FuzzyOcr.cf:
vi /etc/spamassassin/FuzzyOcr.cf
comment out the first line (the one that loads the plugin):#loadplugin FuzzyOcr FuzzyOcr.pm If (and only if) you are using a version of SpamAssassin less than 3.1.4, uncomment this line and set the value to 1.0: focr_pre314 1.0 Set focr_base_score to 2 (this is my personal choice): focr_base_score 2 Only while we test, set focr_autodisable_score to 50: focr_autodisable_score 50 Save and exit the file, then we test. Start by linting spamassassin:
spamassassin --lint
Once you have resolved any (serious) lint errors, we do some more testing. This assumes you are still in the /usr/local/src/fuzzyocr-2.3b directory:
cd samples
I got:
19 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"alert" in 4 lines
"charts" in 1 lines
"symbol" in 1 lines
"alert" in 4 lines
"stock" in 2 lines
"company" in 3 lines
"trade" in 1 lines
"xanax" in 1 lines
"meridia" in 1 lines
"growth" in 1 lines
(19 word occurrences found)
If you did not get something similar, check the log
for the last error message (if any).For example, on a low powered machine you may have to increase focr_timeout in /etc/spamassassin/FuzzyOcr.cf:
cat /etc/spamassassin/FuzzyOcr.log
Ideally, FuzzyOcr.log will not exist. Continue on to the next test:
spamassassin -t < corrupted-gif.eml
I got:
1.5 FUZZY_OCR_WRONG_CTYPE BODY: Mail contains an image with wrong
content-type set
Image has format "GIF" but content-type is
"image/jpeg"
2.5 FUZZY_OCR_CORRUPT_IMG BODY: Mail contains a corrupted image
Corrupt image: GIF-LIB error: Image is
defective, decoding aborted.
10 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"alert" in 1 lines
"alert" in 1 lines
"stock" in 2 lines
"investor" in 1 lines
"company" in 1 lines
"trade" in 1 lines
"target" in 1 lines
"service" in 1 lines
"recommendation" in 1 lines
(10 word occurrences found)
Continue on to the next test (make sure your focr_autodisable_score is 50):
spamassassin -t < jpeg.eml
I got:
4.0 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"viagra" in 2 lines
"cialis" in 1 lines
"levitra" in 1 lines
(4 word occurrences found)
Continue on to the next test(if this one fails, read http://marc.theaimsgroup.com/?l=spamassassin-users&m=115664281009909):
spamassassin -t < png.eml
I got:
28 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"alert" in 2 lines
"news" in 2 lines
"symbol" in 1 lines
"alert" in 2 lines
"stock" in 1 lines
"investor" in 3 lines
"company" in 2 lines
"buy" in 1 lines
"price" in 2 lines
"trade" in 2 lines
"target" in 2 lines
"service" in 2 lines
"recommendation" in 1 lines
"levitra" in 1 lines
"software" in 2 lines
(26 word occurrences found)
Edit FuzzyOcr.cf and set focr_autodisable_score score back to a more reasonable level:
vi /etc/spamassassin/FuzzyOcr.cf
I set the focr_autodisable_score to the same value as my $sa_kill_level_deflt in amavisd.conf: focr_autodisable_score 8 Reload amavisd-new (or spamd if you are using that):
amavisd-new reload
And keep an eye on the mail.log for a while:
tail -f /var/log/mail.log
If you upgrade to SpamAssassin 3.1.4 or newer from an older 3.1.x version, remember to set focr_pre314 to 0.0 |
Now we will install another plugin. This one is from SARE
http://www.rulesemporium.com/plugins.htm.
Once again, navigate to your Plugin directory and grab the plugin:
cd /usr/share/perl5/Mail/SpamAssassin/Plugin
Also get the configuration file:
cd /etc/spamassassin/
Edit v310.pre:
vi v310.pre
and insert (at the bottom): loadplugin Mail::SpamAssassin::Plugin::ImageInfo Edit imageinfo.cf and lower any scores that are 3.0 or more to half their value. This is to help prevent false positives:
vi imageinfo.cf
Save and exit the file, and of course, lint spamassassin:
spamassassin --lint
and reload amavisd-new (or spamd if you are using that):
amavisd-new reload
|