IMF Tune v3.0 Update to counter the PDF spam wave

July 26, 2007

The recent PDF spam wave has been bugging many of you. It is clear that IMF was caught on the wrong foot, and is classifying these with low SCL ratings. Thus we had to add some new filtering functionality to counter this problem.

One of the key characteristics of these emails is their empty body. Up till now IMF Tune was unable to filter emails based on this fact. However this is not the case any longer. The latest IMF Tune v3.0 build, includes a new type of condition under Advanced SCL Rules. The new condition type is shown below:

'Email has NO body text' will match all emails that either have an empty body or the body is entirely composed of non-textual elements. Thus this will also match emails that only contain images within the body (another typical spam trick).

Getting the Update

We are making the update available both as a patch and as part of the latest build number 3.0.107.24.

Follow this link to download the latest build.

Follow this link to download the patch.

Note that the patch can be applied only to IMF Tune build 3.0.107.02 and brings IMF Tune to build level 3.0.107.24.

The patch comes as a zip file and must be installed manually. The necessary installation steps are listed in the Readme.txt file included within the zip file.

Configuring a rule to block PDF spam

The following is the recommended configuration in order to counter the current PDF SPAM wave. Please verify that these settings are applicable to your organization requirements before saving changes.

1. Open the IMF Tune configuration.

2. Select SCL Rules | Advanced.

3. Enable the rules by selecting 'Apply advanced SCL Rules'.

4. Click on Add to create a new rule.

5. Give a name to the rule such as 'PDF Spam' and click Next.

6. In the condition list select the following condition in order to block emails with empty bodies:
   'Email has NO body text'

7. If you want to target more specifically the PDF spam also select the following condition:
   'Attachment name contains words'

   Click on the words link for this condition and enter the following phrase:
   ".pdf"

   Note that you should also enter the double-quotes.

   Click Add and OK to save the keyword

8. Click Next to move to the Action selection.

9. Select the Blacklist action or the action you feel most appropriate.

10. Click Next and Finish to close the Rules Wizard.

11. Click OK to apply the rule and close the configuration.