Mailing List Archive

Attachment policy
Hi,
I'm looking for input from people on how they handle attachments, and
people using email as a file transfer service. One of our users must have
posted to a job site recently, soliciting resumes from people
internationally. This resulted in 100+ emails from random people who had
never emailed this user before, many of which had no subject and no body,
just a PDF attachment. Some had the "Sent by my iPhone" signatures, but
that's about it. Virtually all of them were tagged as spam due to bayes.

Any recommendations? There wasn't otherwise anything wrong with the
attachments - they were all legitimate resumes from legitimate sources.
Should they be blocked? Should I retrain bayes to not consider these spam?
I'm now training bayes with them as ham, but it will take a lot to
offset these. Same with emails that only contain images. Should an email
with only an image attachment with no subject and no body but sent from a
legitimate source and otherwise not dangerous be considered spam?

Many also hit DCC, presumably because of the empty body. Is it possible to
train DCC with one of these to be ignored that would then apply to all
similar messages? I've generated a signature of an empty email before, but
unsure how much variation is allowed before it's no longer considered the
same signature.

Somewhat related, is the ExtractText plugin useful anymore? I had to
disable it altogether because of the money rules and people emailing their
credit card statements, and even though they talk about money, it's not
malicious.
Re: Attachment policy [ In reply to ]
Those sound like perfectly legitimate emails so working to classify them as
decent emails would be our goal. Was there anything malicious snuck in
there?

We are using extract text and have been making improvements to it. False
positives especially with the beneficiary and financial rules is something
to be noted and worked on as well.

HTH, KAM

On Mon, Jun 27, 2022, 16:50 Alex <mysqlstudent@gmail.com> wrote:

> Hi,
> I'm looking for input from people on how they handle attachments, and
> people using email as a file transfer service. One of our users must have
> posted to a job site recently, soliciting resumes from people
> internationally. This resulted in 100+ emails from random people who had
> never emailed this user before, many of which had no subject and no body,
> just a PDF attachment. Some had the "Sent by my iPhone" signatures, but
> that's about it. Virtually all of them were tagged as spam due to bayes.
>
> Any recommendations? There wasn't otherwise anything wrong with the
> attachments - they were all legitimate resumes from legitimate sources.
> Should they be blocked? Should I retrain bayes to not consider these spam?
> I'm now training bayes with them as ham, but it will take a lot to
> offset these. Same with emails that only contain images. Should an email
> with only an image attachment with no subject and no body but sent from a
> legitimate source and otherwise not dangerous be considered spam?
>
> Many also hit DCC, presumably because of the empty body. Is it possible to
> train DCC with one of these to be ignored that would then apply to all
> similar messages? I've generated a signature of an empty email before, but
> unsure how much variation is allowed before it's no longer considered the
> same signature.
>
> Somewhat related, is the ExtractText plugin useful anymore? I had to
> disable it altogether because of the money rules and people emailing their
> credit card statements, and even though they talk about money, it's not
> malicious.
>
>
>
Re: Attachment policy [ In reply to ]
On 6/27/22 2:50 PM, Alex wrote:
> Hi,

Hi,

> I'm looking for input from people on how they handle attachments, and
> people using email as a file transfer service.

My opinion is that you shouldn't rely on using email as a file transfer
service until /after/ you've tested that it works.

> One of our users must have posted to a job site recently, soliciting
> resumes from people internationally. This resulted in 100+ emails
> from random people who had never emailed this user before, many of
> which had no subject and no body, just a PDF attachment. Some had the
> "Sent by my iPhone" signatures, but that's about it. Virtually all
> of them were tagged as spam due to bayes.

>wince<

> Any recommendations? There wasn't otherwise anything wrong with the
> attachments - they were all legitimate resumes from legitimate sources.

*nod*

> Should they be blocked?

I don't think so.

By your own description, these seem like perfectly legitimate email.
Admittedly the content was a little questionably formatted.

> Should I retrain bayes to not consider these spam? I'm now training
> bayes with them as ham, but it will take a lot to offset these. Same
> with emails that only contain images.

I don't know what the /technical/ solution to this particular use case
is. However these messages /sound/ legitimate to me.

> Should an email with only an image attachment with no subject and no
> body but sent from a legitimate source and otherwise not dangerous
> be considered spam?

These don't sound like spam to me.



--
Grant. . . .
unix || die
Re: Attachment policy [ In reply to ]
> Those sound like perfectly legitimate emails so working to classify them
> as decent emails would be our goal. Was there anything malicious snuck in
> there?
>

No, they were all just very basic PDF documents, mostly from gmail
accounts, but also from another dozen or different providers. Some looked
to be pasted from Google Translate from their native language to English,
and a few were in languages other than English.

Some were tagged because of the DKIM/DMARC bug, lol.

Okay, I'll train them as ham and hope it can later discern these from
malicious emails with PDF attachments.

Please keep us updated on the progress of the ExtractText plugin.

Thanks,
Alex