New email spam.
February 8th, 2006
A new technique in foiling content-based spam filters: using CSS rendering to construct text that the filter can’t see.
V<span style="float: right"> b </span>I<span style="float: right"> d </span>A<span=20 style="float: right"> z ...
The “chaff” characters (b, d, z, …) float to the right, while the letters “VIA” in the above example (followed by “GRA” in the source material) settle to the left, lining up in order. Your spam filter’s tokenizer sees nothing.
(Previous version of this hack relying on HTML rendering to construct text that the filter can’t see. Example: V<!--foo-->I<!--foo-->A<!--foo-->G<!--foo-->R<!--foo-->A.)