svn commit: r678293 - /spamassassin/rules/trunk/sandbox/kb/70_misc.cf

[kb...@apache.org]

Author: kb
Date: Sun Jul 20 11:10:50 2008
New Revision: 678293

URL: http://svn.apache.org/viewvc?rev=678293&view=rev
Log:
Outlook forgeries are evolving.  They still are forgeries, though.


Modified:
    spamassassin/rules/trunk/sandbox/kb/70_misc.cf

Modified: spamassassin/rules/trunk/sandbox/kb/70_misc.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/kb/70_misc.cf?rev=678293&r1=678292&r2=678293&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/kb/70_misc.cf (original)
+++ spamassassin/rules/trunk/sandbox/kb/70_misc.cf Sun Jul 20 11:10:50 2008
@@ -42,3 +42,38 @@
 uri  LIVEFILESTORE       m~livefilestore.com/~
 uri  LIVEFILESTORE_HTML  m~livefilestore.com/[^/]{0,100}/[^/]{0,20}\.html?$~
 
+
+# Pretty decent Outlook forgery.  At the very least, they finally start to get
+# the Message-Id correct.  And indeed, the MIME multipart boundary and the
+# Message-Id do share the same format.  However, the timestamps are created
+# *individually*, and there pretty much is no way for a human that these could
+# be identical.  Only a bot can do that.
+
+# A bunch of spam, in particular a couple variants of some rather static
+# German spam recently started avoiding the gross forgery KB_RATWARE_MSGID and
+# FORGED_RELAY_MUA_TO_MX, as well as some blacklists.  An opportunity to look
+# for more forgery.  I don't need your bloody payload, the headers are
+# sufficient to block you.
+
+header  KB_RATWARE_OUTLOOK_BOT  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}^Content-Type: multipart.[^;]{10,20}; boundary="----=_NextPart_000_...._\1\.\2/msi
+
+# "  # emacs
+
+# This less strict variant seems to hit ratware spreading phishes, too.
+# Usually cought by ClamAV / SaneSecurity sigs here, not passed to SA. (The
+# difference actually is the missing \2 only.  The other differences in the RE
+# are irrelevant.)
+
+header  KB_RATWARE_OUTLOOK_SINGLE  ALL =~ /Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi
+
+# "  # emacs
+
+# Would a meta with additional tests speed it up?  Would a failing test in the
+# meta prevent the more costly rule from being evaluated?  I guess not, but
+# wouldn't that be cool? ;)
+
+# header  __IS_MIME_MSG     exists:MIME-Version
+# header  __KB_OUTLOOK_MUA  X-Mailer =~ /^Microsoft (?:Office )?Outlook\b/
+
+# meta  FASTER_?  __IS_MIME_MSG && __RATWARE_OUTLOOK_BOT
+