You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kb...@apache.org on 2008/07/21 20:40:35 UTC
svn commit: r678525 - /spamassassin/rules/trunk/sandbox/kb/70_misc.cf
Author: kb
Date: Mon Jul 21 11:40:35 2008
New Revision: 678525
URL: http://svn.apache.org/viewvc?rev=678525&view=rev
Log:
Second round of RATWARE_OUTLOOK candidates for mass-check evaluation. See you
tomorrow.
Modified:
spamassassin/rules/trunk/sandbox/kb/70_misc.cf
Modified: spamassassin/rules/trunk/sandbox/kb/70_misc.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/kb/70_misc.cf?rev=678525&r1=678524&r2=678525&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/kb/70_misc.cf (original)
+++ spamassassin/rules/trunk/sandbox/kb/70_misc.cf Mon Jul 21 11:40:35 2008
@@ -43,13 +43,6 @@
uri LIVEFILESTORE_HTML m~livefilestore.com/[^/]{0,100}/[^/]{0,20}\.html?$~
-# FIXME "It is suggested that [...] names have a length of no more than 22
-# characters, as an informal convention." -- from M::SA:Conf
-
-# Evaluate full results first. mc-fast results are really weird, with
-# no hits for the full BOT variant.
-
-
# Pretty decent Outlook forgery. At the very least, they finally start to get
# the Message-Id correct. And indeed, the MIME multipart boundary and the
# Message-Id do share the same format. However, the timestamps are created
@@ -62,26 +55,36 @@
# for more forgery. I don't need your bloody payload, the headers are
# sufficient to block you.
-header KB_RATWARE_OUTLOOK_BOT ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}^Content-Type: multipart.[^;]{10,20}; boundary="----=_NextPart_000_...._\1\.\2/msi
-# " # emacs
+# FIXME "It is suggested that [...] names have a length of no more than 22
+# characters, as an informal convention." -- from M::SA:Conf
+
+# Evaluate full results first. mc-fast results are really weird, with
+# no hits for the full BOT variant.
+
+
+# This variant works just fine locally, but doesn't hit in mass-checks. Most
+# likely an issue with the multi-line Content-Type: header.
+
+# header KB_RATWARE_OUTLOOK_BOT ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}^Content-Type: multipart.[^;]{10,20}; boundary="----=_NextPart_000_...._\1\.\2/msi # "
+
+
+# Some variants with varying fuzzyness, to investigate accuracy.
+
+header KB_RATWARE_OUTLOOK_16 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # "
-# This less strict variant seems to hit ratware spreading phishes, too.
-# Usually cought by ClamAV / SaneSecurity sigs here, not passed to SA. (The
-# difference actually is the missing \2 only. The other differences in the RE
-# are irrelevant.)
+header KB_RATWARE_OUTLOOK_12 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # "
-header KB_RATWARE_OUTLOOK_SINGLE ALL =~ /Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi
+header KB_RATWARE_OUTLOOK_08 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi # "
-# " # emacs
-# header __IS_MIME_MSG exists:MIME-Version
-# header __KB_OUTLOOK_MUA X-Mailer =~ /^Microsoft (?:Office )?Outlook\b/
+# Slightly stricter Message-Id variant. Testing.
+header KB_RATWARE_OUTLOOK_MID ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$[0-9a-f]{8}\@.{100,400}boundary="----=_NextPart_000_...._\1\.\2"/msi
-header KB_DEBUG_A ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi # "
-header KB_DEBUG_B ALL =~ /\nMessage-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./si # "
+# header __IS_MIME_MSG exists:MIME-Version
+# header __IS_MICROSOFT_MUA X-Mailer =~ /^Microsoft /
-header KB_DEBUG_C ALL =~ /\nMessage-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}\nContent-Type: multipart.[^;]{10,20};\s+boundary="----=_NextPart_000_...._\1\./si # "
+# header __KB_OUTLOOK_MUA X-Mailer =~ /^Microsoft (?:Office )?Outlook\b/