Eric Wilde
BSM Development
44 Whitewood Circle
Norwood, MA 02062
Phone: 781-551-0153

Mail Filtering Software Removes Image and Concealed Spam

Norwood, MA -- February 25, 2003 -- BSM Development ( announces that the latest release of MailCorral, a mail filtration program, for use on Unix and Linux systems and available for download from the company's Web site, removes image spam and spam concealed by various tricks so as not to be detectable by content-based filters.

Many spammers are beginning to employ clever techniques to obfuscate their spam in order to circumvent content-based spam filters. These techniques include sending messages entirely as images (image spam) and inserting tags or escape sequences into the text that break up the words keyed upon by content-based identifiers (embedding) so the spam cannot be identified. A related technique provides feedback to the spammer, indicating when a recipient opens a message, by inserting coded links to Web pages that can be used to update their database with information about the recipient.

Image spam is remarkably like a certain form of virus that has been common of late. In that respect, MailCorral has always and continues to remove the image spam so that it doesn't complete its nefarious task. Now, in addition to being rendered harmless, image spam is sent to the spam corral along with all the other spam.

Embedded comments and escape sequences are efficiently detected by statistical analysis of the messages which contain them. They prove to be very effective predictors of spam because these methods are never utilized in legitimate mail. A sender would have no other reason to employ them, except to obscure the content of their message, hence, the presence of them in a message is a sure indicator of spam with a very low false-positive rate. MailCorral now applies a number of statistical checks to filtered messages to identify this kind of spam.

A further benefit of statistical identification is that the tests are fast and easy to apply so that they yield a significant performance boost to the filter. Statistical tests are applied by MailCorral, in conjunction with the existing virus scanning activity, before invoking any other spam identifier. The cost, in terms of processing time, is very low and it often eliminates the need to call the more-expensive content-based identifier altogether. This results in significant increases in throughput for the latest kinds of spam.

MailCorral filters mail delivered to Unix and Linux systems via the standard Simple Mail Transfer Protocol (SMTP) interface, through sendmail, the Mail Transfer Agent (MTA). It watches all mail traffic entering the system and inspects it for the presence of harmful viruses and annoying spam. It detects and renders harmless the viruses as well as identifying and sidelining the spam.

In addition to the built-in statistical and white-list/black-list identification of spam, employed by MailCorral, spam is identified through the use of plug-in spam identifiers which make the decision about whether a message is spam or not. The message headers and key portions of the message are passed to the identifier while large attachments that are irrelevant are not, thereby speeding up the process of spam identification. MailCorral decodes all encoded plain text and HTML MIME components to find viruses and spam hidden by encoding. It only passes decoded messages to the spam identifier so that it can concentrate on identifying spam and not have to worry about unraveling the many convolutions of MIME documents. The spam identifier can be upgraded at any time without effecting the actual processing of email, which is always done by MailCorral.

Spam can be marked as such and delivered, it can simply be discarded or it can be sidelined in the corral (the most popular choice) where it can be delivered to the recipient at a later date. The related product by BSM Development, SpamCorral, allows the recipients of sidelined spam to quickly and easily decide whether they actually wish to see the spam or otherwise allow the system to dispose of it. The requirements on the recipient's time, to deal with spam, are kept to a bare minimum, as little as a few seconds a day.

SpamCorral sends a notification to each recipient, once a day (more frequently if you choose), showing them all of the spam that they would have received and listing its details. The recipient has the option of replying to the notification, to request that specific pieces of spam be remailed to them or ignoring it altogether. The annoyance of dealing with spam is kept very short and only happens once a day.

If the recipient ignores the notification, the spam is silently deleted by SpamCorral. If the recipient replies to the notification (replies to the notification are processed automatically by a robot), they can select which pieces of spam they wish to receive. You never know. Someone might send you a valuable piece of spam one day. In this case, the recipient spends ten or fifteen seconds replying to the notification and SpamCorral sends them their request. Once again, the unrequested spam is deleted silently.

For more information about these products, see the company's products Web page,, email or phone 781-551-0153.