You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jefferson Davis <jd...@standard.k12.ca.us> on 2009/10/05 18:32:39 UTC
Low score? Recommendations?
Keep getting similar obvious (to me) spam - tuning recommendations? My threshold is torqued down to 3.5
X-SPAM-LEVEL: *
X-SPAM-STATUS: No, score=1.1 required=3.5 tests=BAYES_50,RAZOR2_CHECK, SPF_HELO_PASS,US_DOLLARS_3 autolearn=no version=3.2.4
Good Day
My name is Mr. Song Li. I work with the Hang Seng Bank. There is a sum of
$19,500,000.00 in my bank Hang Seng Bank", Hong Kong. There were no
beneficiaries stated concerning these funds which means no one would ever
come to claim it. That is why I ask that we work together.
I do solicit for your assistance in effecting this transaction.I intend to
give 30% of the total funds as compensation for your assistance.
I will notify you on the full transaction on receipt of your response if
interested, and I shall send you the details and necessary
procedures with which to make the transfer.
Should you be interested? Please send me your:
1. Full names
2. Private phone number
3. Current residential address
You can email me at : { songli45@gmail.com }
Kind Regard.
Mr Song li
--
Jefferson K Davis
Technology and Information Systems Manager
Standard School District
1200 North Chester Ave
Bakersfield, CA 93308
661.392.2110
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Low score? Recommendations?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2009-10-05 at 09:32 -0700, Jefferson Davis wrote:
> Keep getting similar obvious (to me) spam - tuning recommendations?
Bayes training. Sought [1] Fraud third-party rule-set.
> My threshold is torqued down to 3.5
Don't. Do expect FPs with a required_score that low.
> X-Spam-Status: No, score=1.1 required=3.5 tests=BAYES_50,RAZOR2_CHECK,
> SPF_HELO_PASS,US_DOLLARS_3 autolearn=no version=3.2.4
[pasted sample snipped]
Do NOT paste spam samples. Put 'em up your site or a pastebin instead
and provide a link. Always do provide the RAW, unaltered original mail,
rather than a copy-n-paste of the body into a munging editor.
[1] http://wiki.apache.org/spamassassin/SoughtRules
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: +++Spam+++: Low score? Recommendations?
Posted by "McDonald, Dan" <Da...@austinenergy.com>.
On Mon, 2009-10-05 at 09:32 -0700, Jefferson Davis wrote:
> Keep getting similar obvious (to me) spam - tuning recommendations?
> My threshold is torqued down to 3.5
AV:Sanesecurity.Junk.14595.UNOFFICIAL=6.1,
AE_DETAILS_WITH_EMAIL=2.5, AE_DETAILS_WITH_MONEY=2, BOTNET_SOHO=-0.1,
HTML_MESSAGE=0.001, JM_SOUGHT_FRAUD_3=3, L_P0F_UNKN=0.8,
RCVD_IN_DNSWL_HI=-8, RELAY_US=0.01, SPF_PASS=-0.001, US_DOLLARS_3=1.165
Try the SOUGHT rules or the sanesecurity unofficial signatures.
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com
Re: Low score? Recommendations?
Posted by John Hardin <jh...@impsec.org>.
On Mon, 5 Oct 2009, Jefferson Davis wrote:
> installed 20_sought
There are actually two sought rulesets, one generated from a general
spamtrap and one generated from hand-classified fraud corpora. You likely
want both.
If you set up sought in sa-update (which is what you should do as they are
regenerated often) rather than manually installing a rule file, you're
good. You also want to be running sa_update daily if you're using them.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Windows Vista: Windows ME for the XP generation.
-----------------------------------------------------------------------
Approximately 9188040 firearms legally purchased in the U.S. this year
Re: Low score? Recommendations?
Posted by Benny Pedersen <me...@junc.org>.
On man 05 okt 2009 20:30:09 CEST, "McDonald, Dan" wrote
> How often should I be running sa-update to pick up SOUGHT. I currently
> run it automatically once a day, and ad-hoc whenever I tweak any other
> rules. Should I run 4 times/day? 6? Inquiring minds want to know.
first one would need to know how sa-update works, 2nd then you know
how many times each day you would like to try updateing :)
sa-update check dns, not http to find if there is updates, if dns says
new version exists, it will download it with http, and if it --lint it
will be used, if it does not lint the update is holded back until
remote have fixed the problem
answers is more in how many times each day you want to sa-compile
--
xpoint
Re: Sought Fraud Rule-Set
Posted by John Hardin <jh...@impsec.org>.
On Mon, 5 Oct 2009, Warren Togami wrote:
> On 10/05/2009 03:52 PM, Karsten Bräckelmann wrote:
>> On Mon, 2009-10-05 at 15:44 -0400, Warren Togami wrote:
>> > On 10/05/2009 02:53 PM, Karsten Bräckelmann wrote:
>>
>> > > Well, the Sought rule-set (and thus Fraud sub-set) is being
>> > > re-generated every 4 hours -- with an exception of night-time,
>> > > UTC.
>>
>> > They are really being generated every 4 hours when new patterns can be
>> > tested for safety only during the nightly masscheck?
>>
>> Yes, that's the very nature of the Sought process. Automatic pattern
>> extraction. These are not hand-written rules, and they are neither
>> candidates for inclusion in stock.
>>
>> Also, the nightly masschecks are bound to a specific SVN revision, so
>> automatic or hand-written changes shortly after the deadline don't
>> affect the results.
>
> What is the difference between JM_SOUGHT_FRAUD_[123] and JM_SOUGHT_[123]
> in the nightly masschecks?
As I said earlier, one is based on a full spamtrap feed (thus will include
fraud spams but also a lot of other stuff) and the other is based on
hand-filtered fraud-only spams.
> How can rules be automatically generated and pushed to the channel every 4
> hours and be manually vetted as described here?
They are both automatically generated from corpora. One (SOUGHT) is
generated from unvetted spamtrap corpora, the other (SOUGHT_FRAUD) from
manually-selected corpora from live email feeds.
> Are the nightly masscheck results used at all to determine the safety of
> SOUGHT sub-rules?
I don't know that that is necessary if the spamtrap feeding SOUGHT is
constructed such that it will never receive ham. And the SOUGHT_FRAUD
submitters are trusted to vet and submit responsibly.
They appear to be performing well:
http://ruleqa.spamassassin.org/?rule=%2FSOUGHT
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The question of whether people should be allowed to harm themselves
is simple. They *must*. -- Charles Murray
-----------------------------------------------------------------------
Approximately 9194940 firearms legally purchased in the U.S. this year
Re: Sought Fraud Rule-Set
Posted by Warren Togami <wt...@redhat.com>.
On 10/05/2009 03:52 PM, Karsten Bräckelmann wrote:
> On Mon, 2009-10-05 at 15:44 -0400, Warren Togami wrote:
>> On 10/05/2009 02:53 PM, Karsten Bräckelmann wrote:
>
>>> Well, the Sought rule-set (and thus Fraud sub-set) is being re-generated
>>> every 4 hours -- with an exception of night-time, UTC.
>
>> They are really being generated every 4 hours when new patterns can be
>> tested for safety only during the nightly masscheck?
>
> Yes, that's the very nature of the Sought process. Automatic pattern
> extraction. These are not hand-written rules, and they are neither
> candidates for inclusion in stock.
>
> Also, the nightly masschecks are bound to a specific SVN revision, so
> automatic or hand-written changes shortly after the deadline don't
> affect the results.
>
>
What is the difference between JM_SOUGHT_FRAUD_[123] and JM_SOUGHT_[123]
in the nightly masschecks?
Perhaps I'm not understanding fully understanding how SOUGHT works.
http://taint.org/2007/03/05/134447a.html
http://taint.org/2007/08/04/200125a.html
How can rules be automatically generated and pushed to the channel every
4 hours and be manually vetted as described here?
Are the nightly masscheck results used at all to determine the safety of
SOUGHT sub-rules?
Warren Togami
wtogami@redhat.com
Re: Sought Fraud Rule-Set
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2009-10-05 at 15:44 -0400, Warren Togami wrote:
> On 10/05/2009 02:53 PM, Karsten Bräckelmann wrote:
> > Well, the Sought rule-set (and thus Fraud sub-set) is being re-generated
> > every 4 hours -- with an exception of night-time, UTC.
> They are really being generated every 4 hours when new patterns can be
> tested for safety only during the nightly masscheck?
Yes, that's the very nature of the Sought process. Automatic pattern
extraction. These are not hand-written rules, and they are neither
candidates for inclusion in stock.
Also, the nightly masschecks are bound to a specific SVN revision, so
automatic or hand-written changes shortly after the deadline don't
affect the results.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Sought Fraud Rule-Set
Posted by Warren Togami <wt...@redhat.com>.
On 10/05/2009 02:53 PM, Karsten Bräckelmann wrote:
> On Mon, 2009-10-05 at 13:30 -0500, McDonald, Dan wrote:
>> On Mon, 2009-10-05 at 20:17 +0200, Karsten Bräckelmann wrote:
>
>>> Just a minor nit, in case it isn't just different terminology. Installed
>>> sounds like a one-time operation -- the Sought rule-set needs to be
>>> updated using sa-update frequently, preferably more than once a day.
>>
>> How often should I be running sa-update to pick up SOUGHT. I currently
>> run it automatically once a day, and ad-hoc whenever I tweak any other
>> rules. Should I run 4 times/day? 6? Inquiring minds want to know.
>
> Well, the Sought rule-set (and thus Fraud sub-set) is being re-generated
> every 4 hours -- with an exception of night-time, UTC.
>
> You pretty much can run it as often as you want, but I'd recommend 4+
> times a day. Just please be careful to spread the load, and don't run
> your cron jobs at a full hour. (I know you do, Dan, this goes out to
> everyone reading this post.)
>
> guenther
>
>
They are really being generated every 4 hours when new patterns can be
tested for safety only during the nightly masscheck?
Warren Togami
wtogami@redhat.com
Sought Fraud Rule-Set (was: Low score? Recommendations?)
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2009-10-05 at 13:30 -0500, McDonald, Dan wrote:
> On Mon, 2009-10-05 at 20:17 +0200, Karsten Bräckelmann wrote:
> > Just a minor nit, in case it isn't just different terminology. Installed
> > sounds like a one-time operation -- the Sought rule-set needs to be
> > updated using sa-update frequently, preferably more than once a day.
>
> How often should I be running sa-update to pick up SOUGHT. I currently
> run it automatically once a day, and ad-hoc whenever I tweak any other
> rules. Should I run 4 times/day? 6? Inquiring minds want to know.
Well, the Sought rule-set (and thus Fraud sub-set) is being re-generated
every 4 hours -- with an exception of night-time, UTC.
You pretty much can run it as often as you want, but I'd recommend 4+
times a day. Just please be careful to spread the load, and don't run
your cron jobs at a full hour. (I know you do, Dan, this goes out to
everyone reading this post.)
guenther
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Low score? Recommendations?
Posted by "McDonald, Dan" <Da...@austinenergy.com>.
On Mon, 2009-10-05 at 20:17 +0200, Karsten Bräckelmann wrote:
> On Mon, 2009-10-05 at 11:01 -0700, Jefferson Davis wrote:
> > Thanks for the tips and low-grade knuck-wrap. Investigating -
> > installed 20_sought, tweaked local.cf back to 5.0 per list
> > recommendation.
> Just a minor nit, in case it isn't just different terminology. Installed
> sounds like a one-time operation -- the Sought rule-set needs to be
> updated using sa-update frequently, preferably more than once a day.
How often should I be running sa-update to pick up SOUGHT. I currently
run it automatically once a day, and ad-hoc whenever I tweak any other
rules. Should I run 4 times/day? 6? Inquiring minds want to know.
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com
Re: Low score? Recommendations?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Mon, 2009-10-05 at 11:01 -0700, Jefferson Davis wrote:
> Thanks for the tips and low-grade knuck-wrap. Investigating -
> installed 20_sought, tweaked local.cf back to 5.0 per list
> recommendation.
>
> Appears that perhaps bayes_db is jacked up. re-training.
All good. :)
Just a minor nit, in case it isn't just different terminology. Installed
sounds like a one-time operation -- the Sought rule-set needs to be
updated using sa-update frequently, preferably more than once a day.
Also note that when using sa-update, you need to run it for the stock
rules, too. At the very least, once. A plain 'sa-update' will populate
the stock channel.
After training Bayes, it might be worth to keep an eye on it. In
particular, that your users are not just deleting low-scoring spam, but
instead move it somewhere after human review for training.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Low score? Recommendations?
Posted by Jefferson Davis <jd...@standard.k12.ca.us>.
----- Message from jdavis@standard.k12.ca.us ---------
Date: Mon, 05 Oct 2009 09:32:39 -0700
From: Jefferson Davis <jd...@standard.k12.ca.us>
Subject: Low score? Recommendations?
To: users <us...@spamassassin.apache.org>
> Keep getting similar obvious (to me) spam - tuning recommendations? My threshold is torqued down to 3.5
*** inappropriate content removed ***
----- End message from jdavis@standard.k12.ca.us -----
Thanks for the tips and low-grade knuck-wrap. Investigating - installed 20_sought, tweaked local.cf back to 5.0 per list recommendation.
Appears that perhaps bayes_db is jacked up. re-training.
--
Jefferson K Davis
Technology and Information Systems Manager
Standard School District
1200 North Chester Ave
Bakersfield, CA 93308
661.392.2110
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Low score? Recommendations?
Posted by John Hardin <jh...@impsec.org>.
On Mon, 5 Oct 2009, Jefferson Davis wrote:
>
>
> Keep getting similar obvious (to me) spam - tuning recommendations? My
> threshold is torqued down to 3.5
>
> X-SPAM-LEVEL: *
> X-SPAM-STATUS: No, score=1.1 required=3.5 tests=BAYES_50,RAZOR2_CHECK, SPF_HELO_PASS,US_DOLLARS_3 autolearn=no version=3.2.4
>
> Good Day
>
> My name is Mr. Song Li. I work with the Hang Seng Bank. There is a sum of
> $19,500,000.00 in my bank Hang Seng Bank", Hong Kong. There were no
> beneficiaries stated concerning these funds which means no one would ever
> come to claim it. That is why I ask that we work together.
(1) put your threshold back to 5.0, all of the scores are generated based
on that threshold and it should not be changed lightly.
(2) BAYES_50 for that? You should be training your BAYES, it should have
caught that.
(3) That's the sort of spam the SOUGHT_FRAUD rules are designed to catc;
you might want to install the SOUGHT ruleset.
http://wiki.apache.org/spamassassin/SoughtRules
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Vista is at best mildly annoying and at worst makes you want to
rush to Redmond, Wash. and rip somebody's liver out. -- Forbes
-----------------------------------------------------------------------
Approximately 9185280 firearms legally purchased in the U.S. this year
Re: Low score? Recommendations?
Posted by Jari Fredriksson <ja...@iki.fi>.
> Keep getting similar obvious (to me) spam - tuning
> recommendations? My threshold is torqued down to 3.5
>
> X-Spam-Level: *
> X-Spam-Status: No, score=1.1 required=3.5
> tests=BAYES_50,RAZOR2_CHECK, SPF_HELO_PASS,US_DOLLARS_3
> autolearn=no version=3.2.4
>
Please don't send spam to the list. Post the original email with full headers to www.pastebin.org, and let us examine it.
Setting the spam threshold to 3.5 is dangerous and may lead to false positives, when you get your SpamAssassin configured correctly.
It is not possible to test your sample now, it lacks the headers and everything to make it an email message.