You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "McDonald, Dan" <Da...@austinenergy.com> on 2009/05/15 21:08:47 UTC
20_advance_fee.cf
I've got a couple of users getting 419 scams, and it looks like
20_advance_fee.cf has got most of the good stuff for finding these
nasties. Unfortunately, it's only matching one of the sub-tests
( __FRAUD_DBI ).
If I wanted to extend it a bit, how should I go about it? Maybe create:
meta __ADVANCE_FEE_1 (__FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB +
__FRAUD_XJR + __FRAUD_EZY + __FRAUD_ZFJ + __FRAUD_KDT + __FRAUD_BGP +
__FRAUD_FBI + __FRAUD_JBU + __FRAUD_JYG + __FRAUD_XVW + __FRAUD_SNT +
__FRAUD_LTX + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF +
__FRAUD_FCW + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_NRG +
__FRAUD_RLX + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA +
__FRAUD_YPO + __FRAUD_UOQ + __FRAUD_DBI + __FRAUD_BEP + __FRAUD_DPR +
__FRAUD_QXX + __FRAUD_QFY + __FRAUD_PTS + __FRAUD_TDP + __FRAUD_GAN +
__FRAUD_IPK + __FRAUD_AON + __FRAUD_WNY + __FRAUD_AUM + __FRAUD_WFC +
__FRAUD_YWW + __FRAUD_ULK + __FRAUD_IOU + __FRAUD_JNB + __FRAUD_IRT +
__FRAUD_ETX + __FRAUD_WDR + __FRAUD_UUY + __FRAUD_MLY > 0 )
Then, create my new subtests and:
meta AE_ADVANCE_FEE (__ADVANCE_FEE_1 + __AE_FRAUD_1 + __AE_FRAUD_2...
>1)
Or would it be better to just overwrite ADVANCE_FEE_{2,3,4} with more
subtests?
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com
Re: 20_advance_fee.cf
Posted by Adam Katz <an...@khopis.com>.
McDonald, Dan wrote:
> If I wanted to extend it a bit, how should I go about it? Maybe create:
> meta __ADVANCE_FEE_1 (__FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB +
> __FRAUD_XJR + __FRAUD_EZY + __FRAUD_ZFJ + __FRAUD_KDT + __FRAUD_BGP +
> __FRAUD_FBI + __FRAUD_JBU + __FRAUD_JYG + __FRAUD_XVW + __FRAUD_SNT +
> __FRAUD_LTX + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF +
> __FRAUD_FCW + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_NRG +
> __FRAUD_RLX + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA +
> __FRAUD_YPO + __FRAUD_UOQ + __FRAUD_DBI + __FRAUD_BEP + __FRAUD_DPR +
> __FRAUD_QXX + __FRAUD_QFY + __FRAUD_PTS + __FRAUD_TDP + __FRAUD_GAN +
> __FRAUD_IPK + __FRAUD_AON + __FRAUD_WNY + __FRAUD_AUM + __FRAUD_WFC +
> __FRAUD_YWW + __FRAUD_ULK + __FRAUD_IOU + __FRAUD_JNB + __FRAUD_IRT +
> __FRAUD_ETX + __FRAUD_WDR + __FRAUD_UUY + __FRAUD_MLY > 0 )
>
> Then, create my new subtests and:
> meta AE_ADVANCE_FEE (__ADVANCE_FEE_1 + __AE_FRAUD_1 + __AE_FRAUD_2
> ... > 1)
I may get corrected by somebody who knows the code better, but using
addition prevents short-circuiting (no, not the SA plugin with that
name); you need to calculate each of those fraud tests in order to
find that you hit one of them. If you use "||" instead of "+" (thus
eliminating the need for the parenthesis and the "> 0"), it will stop
evaluating the rest of that lengthy rule on the first hit.
Re: 20_advance_fee.cf
Posted by John Hardin <jh...@impsec.org>.
On Fri, 15 May 2009, McDonald, Dan wrote:
> But there are still 419's getting through. One lady has been inundated
> with them.
You might also consider the SARE fraud rulesets as well, they still
perform well for me.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A superior gunman is one who uses his superior judgment to keep
himself out of situations that would require the use of his
superior skills.
-----------------------------------------------------------------------
6 days until the 5th anniversary of SpaceshipOne winning the X-prize
Re: 20_advance_fee.cf
Posted by "McDonald, Dan" <Da...@austinenergy.com>.
On Fri, 2009-05-15 at 12:15 -0700, John Hardin wrote:
> On Fri, 15 May 2009, McDonald, Dan wrote:
>
> > Or would it be better to just overwrite ADVANCE_FEE_{2,3,4} with more
> > subtests?
>
> The sought_fraud rules are dynamically generated from current 419 emails.
> Were you aware of them? Granted, they are rather large...
Yes, I have them. They are in the same channel as the rest of the
sought rules.
$ grep -o -P 'JM_SOUGHT_FRAUD_\d' /var/log/mail/info | sort | uniq -c
452 JM_SOUGHT_FRAUD_1
775 JM_SOUGHT_FRAUD_2
1174 JM_SOUGHT_FRAUD_3
Reasonable overlap with the built-in ADVANCE_FEE rules:
$ grep ADVANCE_FEE /var/log/mail/info | grep -o -P 'JM_SOUGHT_FRAUD_\d'
| sort | uniq -c
338 JM_SOUGHT_FRAUD_1
555 JM_SOUGHT_FRAUD_2
731 JM_SOUGHT_FRAUD_3
$ grep ADVANCE_FEE /var/log/mail/info | grep -vc
'JM_SOUGHT_FRAUD_'
1038
But there are still 419's getting through. One lady has been inundated
with them.
Maybe just a meta with __FRAUD_DBI && __HAS_ANY_EMAIL would be enough...
>
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com
Re: 20_advance_fee.cf
Posted by John Hardin <jh...@impsec.org>.
On Fri, 15 May 2009, McDonald, Dan wrote:
> Or would it be better to just overwrite ADVANCE_FEE_{2,3,4} with more
> subtests?
The sought_fraud rules are dynamically generated from current 419 emails.
Were you aware of them? Granted, they are rather large...
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
It's easy to be noble with other people's money.
-- John McKay, _The Welfare State:
No Mercy for the Middle Class_
-----------------------------------------------------------------------
6 days until the 5th anniversary of SpaceshipOne winning the X-prize