You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Arvid Ephraim Picciani <ae...@ibcsolutions.de> on 2008/03/22 19:10:03 UTC
uri obfuscation
Hi,
seems that spammers are leaving encoding characters in the urls to make SA
unable to parse it. my mailprogram (kmail currently) displays those urls
_without_ the leftovers.
http://rafb.net/p/S95P6c12.html
i suggest taking this kind of obfuscation as a sign for spam (ie it should be
in the default ruleset)
--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani
Re: uri obfuscation
Posted by Arvid Ephraim Picciani <ae...@ibcsolutions.de>.
On Sunday 23 March 2008 14:10:18 The Doctor wrote:
> Where should this be added?
to your custom rules.
i suggest editing local.cf and adding the following line:
include /etc/spamassassin/myrules
then make that directory and put your custom rules in it (one file is one
rule)
you can also put all rules at the end of local.cf.
whatever you prefer.
--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani
Re: uri obfuscation
Posted by The Doctor <do...@doctor.nl2k.ab.ca>.
On Sat, Mar 22, 2008 at 09:26:39PM -0400, Joseph Brennan wrote:
>
>> thats a dynamic ip from telecomitalia. i'm getting lots of spam from
>> there but the ips are in no dynamic list. is there a more complete list
>> of dynamic hosts?
>
> We are currently doing this:
>
>
> # Telecomitalia. ISP with a big spam problem
> # A rare exception found had a .it tld sender, so let's try that exception
> header __CU_TELECOMITALIA Received =~ /telecomitalia\.it.*\bby\b/
> header __CU_TLD_IT From =~ /\.it\>/
> meta CU_TELECOMITALIA __CU_TELECOMITALIA && !__CU_TLD_IT
> describe CU_TELECOMITALIA Mail came from telecomitalia.it
> score CU_TELECOMITALIA 6.0
>
>
> We reject at 8.0. No fp's from this in a month. I know 6.0 is a very
> high score for one test.
>
Where should this be added?
--
Member - Liberal International
This is doctor@nl2k.ab.ca Ici doctor@nl2k.ab.ca
God, Queen and country! Beware Anti-Christ rising!
Remember Christ is the reason for the season.
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
Re: uri obfuscation
Posted by Arvid Ephraim Picciani <ae...@ibcsolutions.de>.
On Sunday 23 March 2008 02:26:39 Joseph Brennan wrote:
> > thats a dynamic ip from telecomitalia. i'm getting lots of spam from
> > there but the ips are in no dynamic list. is there a more complete list
> > of dynamic hosts?
>
> We are currently doing this:
http://sarah.ibcsolutions.de/~aep/sa/70_telecomitalia.cf
thank you!
--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani
Re: uri obfuscation
Posted by Joseph Brennan <br...@columbia.edu>.
> thats a dynamic ip from telecomitalia. i'm getting lots of spam from
> there but the ips are in no dynamic list. is there a more complete list
> of dynamic hosts?
We are currently doing this:
# Telecomitalia. ISP with a big spam problem
# A rare exception found had a .it tld sender, so let's try that exception
header __CU_TELECOMITALIA Received =~ /telecomitalia\.it.*\bby\b/
header __CU_TLD_IT From =~ /\.it\>/
meta CU_TELECOMITALIA __CU_TELECOMITALIA && !__CU_TLD_IT
describe CU_TELECOMITALIA Mail came from telecomitalia.it
score CU_TELECOMITALIA 6.0
We reject at 8.0. No fp's from this in a month. I know 6.0 is a very
high score for one test.
Joseph Brennan
Lead Email Systems Engineer
Columbia University Information Technology
Re: Forged Received headers and Message-Ids (was: Re: uri obfuscation)
Posted by Arvid Ephraim Picciani <ae...@ibcsolutions.de>.
On Saturday 22 March 2008 21:31:13 Karsten Bräckelmann wrote:
> On Sat, 2008-03-22 at 19:31 +0100, Arvid Ephraim Picciani wrote:
> > > http://rafb.net/p/S95P6c12.html
>
> Yes, this is a spam alright. The Message-Id alone tells so. See my rule
> KB_RATWARE_MSGID in bug 5830 [1].
> [1] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5830
> [2] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5817
nice, thanks a lot.
--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani
Forged Received headers and Message-Ids (was: Re: uri obfuscation)
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sat, 2008-03-22 at 19:31 +0100, Arvid Ephraim Picciani wrote:
> > http://rafb.net/p/S95P6c12.html
Yes, this is a spam alright. The Message-Id alone tells so. See my rule
KB_RATWARE_MSGID in bug 5830 [1].
> second, i'd love to go and slap some ISPs a round a little for not even having
> an abuse@ adress. my complaint at telecomitalia just bounced. It's like
> saing "yeah our customers do spam, so what?". So how do we punish them a
This is an unrelated, different topic -- see your Subject. Please start
a new thread in such a case.
> little? block them from the internet? impossible. DDOS? too childish.
And illegal in most parts of this world, one might add...
> i guess the most effective way would be to find some email adresses of chiefs
> and relay all the spam from their network directly to their mailbox. until
This *IS* a (D)Dos. Do not do that.
> oh. another thing. there is a forged received header in the mail i think
> (knowledge of email rfcs ends here) why didnt sa see it?
No violation of RFCs, but you are right -- the first Received header is
forged.
My rule FORGED_RELAY_MUA_TO_MX is designed to catch this kind of forged
Received headers with direct delivery to MX. See bug 5817 [2].
As to why SA doesn't see it (out of the box) currently is easy. Because
no one spotted a pattern and wrote the code before. Well, until early
Feb. ;)
guenther
[1] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5830
[2] https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5817
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: uri obfuscation
Posted by Arvid Ephraim Picciani <ae...@ibcsolutions.de>.
On Saturday 22 March 2008 19:10:03 Arvid Ephraim Picciani wrote:
> http://rafb.net/p/S95P6c12.html
i forgot two things:
thats a dynamic ip from telecomitalia. i'm getting lots of spam from there but
the ips are in no dynamic list. is there a more complete list of dynamic
hosts? i've seen sorbs doesn't allow submissions at all unless you own the
pool.
second, i'd love to go and slap some ISPs a round a little for not even having
an abuse@ adress. my complaint at telecomitalia just bounced. It's like
saing "yeah our customers do spam, so what?". So how do we punish them a
little? block them from the internet? impossible. DDOS? too childish.
i guess the most effective way would be to find some email adresses of chiefs
and relay all the spam from their network directly to their mailbox. until
the admin of their mailsystem has to block their own customers.
oh. another thing. there is a forged received header in the mail i think
(knowledge of email rfcs ends here) why didnt sa see it?
--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani
Re: uri obfuscation
Posted by mouss <mo...@netoyen.net>.
mouss wrote:
> Arvid Ephraim Picciani wrote:
>> On Saturday 22 March 2008 19:52:46 SM wrote:
>>
>>> He was referring to the URL that is wrapped into two lines with the
>>> quoted-printable encoding. It is parsed correctly.
>>>
>> so thats no error or invalid markup? ok well in this case... sorry
>> for the false alert.
>>
>>
>>
>
> you need to show the raw body. http://ec=xz... is invalid and results
> in an error when I click on. even with quoted printable, it is still
> invalid because '=' must be followed by hex characters (0-9a-fA-F).
oops. forget about it. I've just realized the url you posted contained
the message!
note that the message came from a "generic rdns" host and helo'ed with a
non fqdn hostname.
Re: uri obfuscation
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
> you need to show the raw body. http://ec=xz... is invalid and results
> in an error when I click on. even with quoted printable, it is still
> invalid because '=' must be followed by hex characters (0-9a-fA-F).
Dude, see the OP. :) He did provide the full, raw message.
This very snippet is just a bad (later) paste, and perfectly explains
the wrong assumption about this being an invalid char inside the URL.
guenther
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: uri obfuscation
Posted by mouss <mo...@netoyen.net>.
Arvid Ephraim Picciani wrote:
> On Saturday 22 March 2008 19:52:46 SM wrote:
>
>> He was referring to the URL that is wrapped into two lines with the
>> quoted-printable encoding. It is parsed correctly.
>>
> so thats no error or invalid markup? ok well in this case... sorry for the
> false alert.
>
>
>
you need to show the raw body. http://ec=xz... is invalid and results
in an error when I click on. even with quoted printable, it is still
invalid because '=' must be followed by hex characters (0-9a-fA-F).
Re: uri obfuscation
Posted by Arvid Ephraim Picciani <ae...@ibcsolutions.de>.
On Saturday 22 March 2008 19:52:46 SM wrote:
> He was referring to the URL that is wrapped into two lines with the
> quoted-printable encoding. It is parsed correctly.
so thats no error or invalid markup? ok well in this case... sorry for the
false alert.
--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani
Re: uri obfuscation
Posted by SM <sm...@resistor.net>.
At 11:27 22-03-2008, Justin Mason wrote:
>what is the URL you think it's missing?
He was referring to the URL that is wrapped into two lines with the
quoted-printable encoding. It is parsed correctly.
Regards,
-sm