Author Archives: Péter Karsai

About Péter Karsai

Head of product development with a special interest in IT security. Father of one two. Can ship any ORF release long after promised. Loves running even without zombies chasing him. Works with Vamsoft since 2000. Find me on LinkedIn.

PDF Spam Agent 1.0 Beta

5 Replies

We just have released the first beta of our new PDF Spam Agent, an External Agent designed specifically to stop the recent PDF spam outbreak. It is a fairly simple program that categorizes the email as PDF spam if all of the conditions below are satisfied:

The email…

  • Size must be less than 200kB
  • Must have exactly one attachment, a PDF file
  • Attachment size must be less than 100kB

The PDF…

  • Must have only one page
  • Must be version 3 (Acrobat 4.x)
  • Must not have an info block
  • Must have only one font embedded
  • Must contain exactly one image

The image…

  • Must have name /Im0 (most PDF generators define /Im1)
  • Must be GIF (kind of… must have one filter called /LZWDecode)

I realize it is far from perfect and can be tricked very easily—this time, the goal was to reliably detect the current outbreak and differentiate it from legitimate PDF attachments, however. As the PDF spam phenomenon evolves, the above rule set will get deprecated and will have to get updates. This is why we decided to release the source code of the agent this time—I know many of the readers can code in C# and your reaction time is probably faster than ours. Feel free to modify the agent and/or move the project to SourceForge.net.

Cornelius vs. Cornelia

4 Replies

I get a few of these every day to my unfiltered email account:

Hi! I am bored this evening. I am 25 y.o. girl that would like to chat with you. Email me at lnxwzi@anymailonline.info only. Hope you like my pictures.

I am not really interested in giving advise to spammers, but oh come on! Are you guys sure that the best sender names available for a message like this are “Cornelius Schneider”, “Jayson Hastings” or “Ken Glenn”?

Beta Newsletter Issue

Leave a reply

Obviously, there is a good reason why people do not send newsletters in the morning while drinking their first coffee of the day—I just did that and managed to compile a wrong recipient list, so the 4.0 Beta newsletter was sent even to those users who explicitly requested not to receive any kind of newsletters from us. Sorry, I should have been much more careful. We definitely did not intend to send unsolicited emails to you and I will make sure this will not happen again in the future.