[Top] [All Lists]

Re: [ietf-smtp] [Shutup] Compressing SMTP streams

2016-02-09 10:07:58
Someone pointed out this could be bad news for spam filtering.  At
this point, it's typical to partly or completely skip the filtering on
very large messages, partly for efficiency, partly because it's not
cost effective for spammers to send lots of giant messages.

When you have 10s of thousands of infected machines at your disposal, 
cost effectiveness isn't terribly important.

Eg: the high volume spams I saw that contain 1Mb of obfuscatory gunk 
just to push a single line of payload.

It's an order of magnitude issue.  A megabyte isn't large these days,
but that 1Mb of gunk could now turn into 1Gb of gunk, or whatever size
the bad guys think is enough to get less stringent filtering.


ietf-smtp mailing list