new google trick: "docs"

["Chip M." <sa...@IowaHoneypot.com>]

They look like this:
	http://docs.google.com/doc?id=MUNGED_MUNGED

I'm not sure if the id is personally identifiable, so MUNGED both halves of
it.

I've only seen two so far, and haven't visited either (again, due to the
potential PII - both samples were from other people).

Very little else stands out about them (other than very low default SA
ruleset scores - both were caught by supplementary nation-of-origin tests).

Of potential interest is that the From and To followed this pattern:
	"account" <ac...@random.example.com>
	"account" <ac...@victim.example.com>
Which should rarely occur in Ham, and should be easily rule-writeable.

I've added "doc" to my list of tokens that are word matched in my own
battery of anti Google Tricks tests.

Hmmm... I wonder if it would be more productive to come up with a rule that
triggers on _ANY_ "unusual" params in a Google url?  In other words,
enumerate the legit ones, and score all others.

The only legit form of pre-emptive strike is the kind against spammers
(IMO). :)
	- "Chip"

Re: new google trick: "docs"

[Theo Van Dinter <fe...@apache.org>]

On Wed, Feb 27, 2008 at 02:38:50PM -0600, Chip M. wrote:
> They look like this:
> 	http://docs.google.com/doc?id=MUNGED_MUNGED
> 
> I've added "doc" to my list of tokens that are word matched in my own
> battery of anti Google Tricks tests.

What's the trick here?  Looks like a normal docs URL to me.

> Hmmm... I wonder if it would be more productive to come up with a rule that
> triggers on _ANY_ "unusual" params in a Google url?  In other words,
> enumerate the legit ones, and score all others.

There's nothing unusual in the URL quoted.


YMMV, of course, but I use Google Docs *all the time*, so see a lot of
docs.google.com and spreadsheets.google.com URLs.  If someone is abusing the
docs system and spamming people that way, report them to Google.

-- 
Randomly Selected Tagline:
"A leader leads from in front, by the power of example. A ruler pushes
 from behind, by means of the club, the whip, the power of fear."
         - Edward Abbey