Found a way to avoid spamassassin! How to fix?

[Mark London <mr...@psfc.mit.edu>]

I found a way for spam to be sent to someone, even if the spam rating is high.

If a spammer sends a message with a FROM address that contains a real local
address, like mrl@psfc.mit.edu, and then sends it TO a fake local address, like
fake@psfc.mit.edu, even though the original message is sent through
spamassassin, the BOUNCED message is not, since it's delivered locally back to
mrl@psfc.mit.edu.   The user gets the bounced message, with a warning that
fake@psfc.mit.edu doesn't exist, and the test of the original message with the
spam follows. The spamassassin X-Spam-Level header is in the header of the
original message, but not the header of the bounced message, so it gets past
the mail client's header test for X-Spam-Level

I'm using spamassassin with sendmail, mimedefang, and cyrus.

Any suggestions?  I guess what I need to do, is to configure sendmail, so
that internally created messages, like bounced messages from

MAILER-DAEMON@psfc.mit.edu, are passed through mimedefang, which would then
run spamassassin.  However, I don't know if sendmail can be configured so
thatinternal mail (not sent via SMTP) can be sent through a filter like
MAILDEFANG.    Does anyone know?

And even if it can be done, the bounced message might not have a high spam
rating, because the usual spamassassin header tests would not be useful,
since they would be applied to the bounced header, and not the original
header.  I guess what I might have to do is to create a BODY test for a
line which starts with X-Spam-Level:, and test the score level of the
line (i.e. test for ******).  Either that, or somehow have the X-Spam-Level
header from the original message, propagated to the bounced message header.

Has this issued been discussed? Thanks.

Mark

Re: Found a way to avoid spamassassin! How to fix?

[Cirelle Enterprises <gc...@cirelle.com>]

----- Original Message ----- 
From: "Mark London" <mr...@psfc.mit.edu>
To: <sp...@incubator.apache.org>
Sent: Friday, May 14, 2004 9:30 AM
Subject: Found a way to avoid spamassassin! How to fix?


| I found a way for spam to be sent to someone, even if the spam rating is high.
| 
| If a spammer sends a message with a FROM address that contains a real local
| address, like mrl@psfc.mit.edu, and then sends it TO a fake local address, like
| fake@psfc.mit.edu, even though the original message is sent through
| spamassassin, the BOUNCED message is not, since it's delivered locally back to
| mrl@psfc.mit.edu.   The user gets the bounced message, with a warning that
| fake@psfc.mit.edu doesn't exist, and the test of the original message with the
| spam follows. The spamassassin X-Spam-Level header is in the header of the
| original message, but not the header of the bounced message, so it gets past
| the mail client's header test for X-Spam-Level
 

This assumes you send bounces for bad/fake addresses.

 just accept all and dev/null the bad email and this is avoided, if I understand 
what you are trying to accomplish.

Regards
Greg

Re: Found a way to avoid spamassassin! How to fix?

[Duncan Hill <sa...@nacnud.force9.co.uk>]

On Friday 14 May 2004 14:40, Duncan Hill might have typed:
> On Friday 14 May 2004 14:30, Mark London might have typed:
> > I found a way for spam to be sent to someone, even if the spam rating is
> > high.
> >
> > If a spammer sends a message with a FROM address that contains a real
> > local address, like mrl@psfc.mit.edu, and then sends it TO a fake local
> > address, like fake@psfc.mit.edu, even though the original message is sent
> > through spamassassin, the BOUNCED message is not, since it's delivered
> > locally back to mrl@psfc.mit.edu.   The user gets the bounced message,
> > with a warning
>
> Why are you accepting mail for a non-existent user at your border gateway?
>
> Spammy connects, says HELO, says MAIL FROM your valid user, RCPT TO your
> invalid user.  You should tell spammy to go jump off a cliff at this point.

To follow this up, and make sure my brain is actually in gear:
The 5xx code is then returned to spammy's mail client.  Said clients don't 
usually try to generate a bounce notification.  If they do, they'll come back 
to your gateway as from <>, to $real_user and should pass through your spam 
filters.

Re: Found a way to avoid spamassassin! How to fix?

[Duncan Hill <sa...@nacnud.force9.co.uk>]

On Friday 14 May 2004 14:30, Mark London might have typed:
> I found a way for spam to be sent to someone, even if the spam rating is
> high.
>
> If a spammer sends a message with a FROM address that contains a real local
> address, like mrl@psfc.mit.edu, and then sends it TO a fake local address,
> like fake@psfc.mit.edu, even though the original message is sent through
> spamassassin, the BOUNCED message is not, since it's delivered locally back
> to mrl@psfc.mit.edu.   The user gets the bounced message, with a warning

Why are you accepting mail for a non-existent user at your border gateway?

Spammy connects, says HELO, says MAIL FROM your valid user, RCPT TO your 
invalid user.  You should tell spammy to go jump off a cliff at this point.