You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Yves Goergen <no...@unclassified.de> on 2015/02/24 18:35:25 UTC
Lots of Polish spam
Hello,
for a few months I'm getting lots of Polish spam to one of my e-mail
addresses, sometimes a dozen per day. I have no idea what it's telling
me, I don't understand a single word. I just recognise characteristic
characters to know the language. Some messages have a .pl domain as
sender address, others not. The sending hosts have all kinds of TLDs.
Most messages have only a very short or empty body (a few words at
maximum). Almost all messages contain a .zip attachment, often named
like *_JPG.zip or *.pdf.zip. It doesn't seem to contain malware caught
by clamav, but I haven't looked into any of these archives yet.
SpamAssassin doesn't seem to be too successful in filtering them out. I
set up that mailbox to reject anything beyond 10 points. Almost all
messages stay under that limit. Only occasionally, a few messages are
rejected with scores up to around 15. (Other regular spam can easily
reach scores in the 50s.)
Does anybody have an idea how to stop that? Are there special rule sets
for that?
I could provide samples of those messages if somebody is interested in
it. These messages include my SpamAssassin headers so the matching rules
can be seen. Unfortunately I'm not an SA wizard so I can't make new
rules for such things.
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 24.02.2015 um 23:18 schrieb John Hardin:
> On Tue, 24 Feb 2015, Alex Regan wrote:
>
>> Does anyone know/think it would be a good idea to add ".pdf.zip" to
>> the mime types reject list? Has anyone seen a real example that wasn't
>> a virus?
>
> Pretty much *any* double-extension filename is suspect
on Windows systems....
.tar.gz
.tar.bz2
.tar.xz
Re: Lots of Polish spam
Posted by Benny Pedersen <me...@junc.eu>.
On February 24, 2015 11:57:23 PM Axb <ax...@gmail.com> wrote:
> I can imagine other Linux Desktops doing the same. Dunno about Windows
> or Apple
users is not asked for a filename, since the default seems fine :)
Re: Lots of Polish spam
Posted by "@lbutlr" <kr...@kreme.com>.
On Feb 24, 2015, at 3:49 PM, Axb <ax...@gmail.com> wrote:
> On 02/24/2015 11:39 PM, LuKreme wrote:
>> On Feb 24, 2015, at 15:24, Axb <ax...@gmail.com> wrote:
>>> *.pdf.zip is a dangerous one to block on sight - FP risk is huge
>>
>> Really? I've never seen a .pdf.zip that was legitimate.
>>
>
> KDE: right click on a blah.pdf "compress as Zip Archive" and bang: blah.pdf.zip
>
> I can imagine other Linux Desktops doing the same. Dunno about Windows or Apple
That would deb blah.zip on Windows and OS X, at least y default.
I am not saying it is not possible to have a pdf.zip valid file, i am simply saying I have never seen one.
I saw a virus load:
name="Secure E-mail Quick Reference Guide - External Users-pdf.zip”
But that only matched because I searched for .pdf.zip instead of \.pdf\.zip
YMMV.
--
Why can't you be in a good mood? How hard is it to decide to be in a
good mood and be in a good mood once in a while?"
Re: Lots of Polish spam
Posted by Axb <ax...@gmail.com>.
On 02/24/2015 11:39 PM, LuKreme wrote:
> On Feb 24, 2015, at 15:24, Axb <ax...@gmail.com> wrote:
>> *.pdf.zip is a dangerous one to block on sight - FP risk is huge
>
> Really? I've never seen a .pdf.zip that was legitimate.
>
KDE: right click on a blah.pdf "compress as Zip Archive" and bang:
blah.pdf.zip
I can imagine other Linux Desktops doing the same. Dunno about Windows
or Apple
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 24.02.2015 um 23:39 schrieb LuKreme:
> On Feb 24, 2015, at 15:24, Axb <ax...@gmail.com> wrote:
>> *.pdf.zip is a dangerous one to block on sight - FP risk is huge
>
> Really? I've never seen a .pdf.zip that was legitimate
and i sent hundrets which where by just right click on the pdf and chose
"add to zip archive origin.pdf.zip" - and now?
Re: Lots of Polish spam
Posted by LuKreme <kr...@kreme.com>.
On Feb 24, 2015, at 15:24, Axb <ax...@gmail.com> wrote:
> *.pdf.zip is a dangerous one to block on sight - FP risk is huge
Really? I've never seen a .pdf.zip that was legitimate.
Re: Lots of Polish spam
Posted by Axb <ax...@gmail.com>.
On 02/24/2015 11:18 PM, John Hardin wrote:
> On Tue, 24 Feb 2015, Alex Regan wrote:
>
>> Does anyone know/think it would be a good idea to add ".pdf.zip" to
>> the mime types reject list? Has anyone seen a real example that wasn't
>> a virus?
>
> Pretty much *any* double-extension filename is suspect.
*.pdf.zip is a dangerous one to block on sight - FP risk is huge
(got the t-shirt .-)
Re: Lots of Polish spam
Posted by John Hardin <jh...@impsec.org>.
On Tue, 24 Feb 2015, Alex Regan wrote:
> Does anyone know/think it would be a good idea to add ".pdf.zip" to the mime
> types reject list? Has anyone seen a real example that wasn't a virus?
Pretty much *any* double-extension filename is suspect.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Markley's Law (variant of Godwin's Law): As an online discussion
of gun owners' rights grows longer, the probability of an ad hominem
attack involving penis size approaches 1.
-----------------------------------------------------------------------
10 days until Dawn reaches Ceres
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 24.02.2015 um 22:49 schrieb Alex Regan:
>> for a few months I'm getting lots of Polish spam to one of my e-mail
>> addresses, sometimes a dozen per day. I have no idea what it's telling
>> me, I don't understand a single word. I just recognise characteristic
>> characters to know the language. Some messages have a .pl domain as
>> sender address, others not. The sending hosts have all kinds of TLDs.
>> Most messages have only a very short or empty body (a few words at
>> maximum). Almost all messages contain a .zip attachment, often named
>> like *_JPG.zip or *.pdf.zip. It doesn't seem to contain malware caught
>> by clamav, but I haven't looked into any of these archives yet.
>
> I have a number of mime_header_checks rules that reject unwanted file
> types. This can also be done with amavisd.
>
> Does anyone know/think it would be a good idea to add ".pdf.zip" to the
> mime types reject list? Has anyone seen a real example that wasn't a virus?
well, if i right click ona PDF file at my KDE desktop the context menu
offers a simple option to compress it as zip archive resulting in
origin-name.pdf.zip
here you go: http://sanesecurity.com/usage/signatures/
the zip is not the problem, the content is interesting
as already mentioned: http://sanesecurity.com/foxhole-databases/
Re: Lots of Polish spam
Posted by Alex Regan <my...@gmail.com>.
Hi,
> for a few months I'm getting lots of Polish spam to one of my e-mail
> addresses, sometimes a dozen per day. I have no idea what it's telling
> me, I don't understand a single word. I just recognise characteristic
> characters to know the language. Some messages have a .pl domain as
> sender address, others not. The sending hosts have all kinds of TLDs.
> Most messages have only a very short or empty body (a few words at
> maximum). Almost all messages contain a .zip attachment, often named
> like *_JPG.zip or *.pdf.zip. It doesn't seem to contain malware caught
> by clamav, but I haven't looked into any of these archives yet.
I have a number of mime_header_checks rules that reject unwanted file
types. This can also be done with amavisd.
Does anyone know/think it would be a good idea to add ".pdf.zip" to the
mime types reject list? Has anyone seen a real example that wasn't a virus?
> SpamAssassin doesn't seem to be too successful in filtering them out. I
> set up that mailbox to reject anything beyond 10 points. Almost all
> messages stay under that limit. Only occasionally, a few messages are
> rejected with scores up to around 15. (Other regular spam can easily
> reach scores in the 50s.)
What about "ok_locales" or "ok_languages" ? Is that reliable?
Thanks,
Alex
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 24.02.2015 um 19:15 schrieb Yves Goergen:
> Am 24.02.2015 um 19:02 schrieb Reindl Harald:
>> RBL's long before the contentfilter!
>
> Do you mean to reject messages as soon as a single RBL triggers it?
> That's definitely not what I want to do! I've had way too much trouble
> with others doing that. RBLs get points and the score decides. Never let
> any single check decide alone.
re-read my message again and try to understand it
this is *not* a single check
this is *scoring*
>> postscreen_dnsbl_ttl = 5m
>> postscreen_dnsbl_threshold = 8
>> postscreen_dnsbl_action = enforce
>> (...)
>
> What is that?
Google would have leaded to
http://www.postfix.org/POSTSCREEN_README.html
>> b.barracudacentral.org=127.0.0.2*7
>> zen.spamhaus.org=127.0.0.[10;11]*8
>> zen.spamhaus.org=127.0.0.[4..7]*6
>> zen.spamhaus.org=127.0.0.3*4
>> zen.spamhaus.org=127.0.0.2*3
>
> These are evil...
really?
maybe you should qualify tips *after* you understood "What is that?"
* the reject score is 8
* "b.barracudacentral.org=127.0.0.2*7" has 7 points
* zen.spamhaus.org with response 127.0.0.10 or 127.0.0.11 is PBL
* zen.spamhaus.org with repsonse 127.0.0.4-127.0.0.7 is XBL
* zen.spamhaus.org with response 127.0.0.3 is CSS and only 4 points
* zen.spamhaus.org with repsonse 127.0.0.2 is SBL and only 3 points
* you missed the DNSWL's with negative scores completly
___________________________________________________
AGAIN: that is a score-based reject including a ton of whitelists
postscreen_dnsbl_ttl = 5m
postscreen_dnsbl_threshold = 8
postscreen_dnsbl_action = enforce
postscreen_greet_action = enforce
postscreen_dnsbl_sites =
b.barracudacentral.org=127.0.0.2*7
dnsbl.inps.de=127.0.0.2*7
bl.mailspike.net=127.0.0.2*5
bl.mailspike.net=127.0.0.[10;11;12]*4
dnsbl.sorbs.net=127.0.0.10*8
dnsbl.sorbs.net=127.0.0.5*6
dnsbl.sorbs.net=127.0.0.7*3
dnsbl.sorbs.net=127.0.0.8*2
dnsbl.sorbs.net=127.0.0.6*2
dnsbl.sorbs.net=127.0.0.9*2
zen.spamhaus.org=127.0.0.[10;11]*8
zen.spamhaus.org=127.0.0.[4..7]*6
zen.spamhaus.org=127.0.0.3*4
zen.spamhaus.org=127.0.0.2*3
hostkarma.junkemailfilter.com=127.0.0.2*3
hostkarma.junkemailfilter.com=127.0.0.4*1
hostkarma.junkemailfilter.com=127.0.1.2*1
wl.mailspike.net=127.0.0.[18;19;20]*-2
list.dnswl.org=127.0.[0..255].0*-2
list.dnswl.org=127.0.[0..255].1*-3
list.dnswl.org=127.0.[0..255].2*-4
list.dnswl.org=127.0.[0..255].3*-5
hostkarma.junkemailfilter.com=127.0.0.1*-2
Re: Lots of Polish spam
Posted by Yves Goergen <no...@unclassified.de>.
Am 24.02.2015 um 19:02 schrieb Reindl Harald:
> RBL's long before the contentfilter!
Do you mean to reject messages as soon as a single RBL triggers it?
That's definitely not what I want to do! I've had way too much trouble
with others doing that. RBLs get points and the score decides. Never let
any single check decide alone.
> postscreen_dnsbl_ttl = 5m
> postscreen_dnsbl_threshold = 8
> postscreen_dnsbl_action = enforce
> (...)
What is that?
> b.barracudacentral.org=127.0.0.2*7
> zen.spamhaus.org=127.0.0.[10;11]*8
> zen.spamhaus.org=127.0.0.[4..7]*6
> zen.spamhaus.org=127.0.0.3*4
> zen.spamhaus.org=127.0.0.2*3
These are evil...
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 24.02.2015 um 18:58 schrieb Yves Goergen:
> Am 24.02.2015 um 18:39 schrieb Jeremy McSpadden:
>> Usually scores are 6 low 10 high. Are you running any RBLs ?
>
> I have the default settings plus the attached custom configuration.
> There are several RBLs among them
RBL's long before the contentfilter! doing that properly and "lot's of
spam" won't happen independent of the content and language
postscreen_dnsbl_ttl = 5m
postscreen_dnsbl_threshold = 8
postscreen_dnsbl_action = enforce
postscreen_greet_action = enforce
postscreen_dnsbl_sites =
b.barracudacentral.org=127.0.0.2*7
dnsbl.inps.de=127.0.0.2*7
bl.mailspike.net=127.0.0.2*5
bl.mailspike.net=127.0.0.[10;11;12]*4
dnsbl.sorbs.net=127.0.0.10*8
dnsbl.sorbs.net=127.0.0.5*6
dnsbl.sorbs.net=127.0.0.7*3
dnsbl.sorbs.net=127.0.0.8*2
dnsbl.sorbs.net=127.0.0.6*2
dnsbl.sorbs.net=127.0.0.9*2
zen.spamhaus.org=127.0.0.[10;11]*8
zen.spamhaus.org=127.0.0.[4..7]*6
zen.spamhaus.org=127.0.0.3*4
zen.spamhaus.org=127.0.0.2*3
hostkarma.junkemailfilter.com=127.0.0.2*3
hostkarma.junkemailfilter.com=127.0.0.4*1
hostkarma.junkemailfilter.com=127.0.1.2*1
wl.mailspike.net=127.0.0.[18;19;20]*-2
list.dnswl.org=127.0.[0..255].0*-2
list.dnswl.org=127.0.[0..255].1*-3
list.dnswl.org=127.0.[0..255].2*-4
list.dnswl.org=127.0.[0..255].3*-5
hostkarma.junkemailfilter.com=127.0.0.1*-2
Re: Lots of Polish spam
Posted by Marcin Mirosław <ma...@mejor.pl>.
W dniu 2015-02-24 o 19:22, Yves Goergen pisze:
> Am 24.02.2015 um 19:00 schrieb Jeremy McSpadden:
>> Your better off to implement RBL at SMTP time, not SA. IMO
>> Which MTA are you using ?
>
> Exim. But why should I do that? See my other message in this thread.
> RBLs make mistakes. But then, only one of them makes the mistake, not all.
>
> Are RBLs the only measure to fight spam today? How do these lists learn
> spam quickly if there is no other way to detect it?
>
> I'm not sure whether RBLs help here. These are some of the reports of
> recent messages:
I'm guessing that you are getting botnet spam. I'm getting thousands of
it per day since a couple weeks.
http://pastebin.com/6zLjMtM8
Re: Lots of Polish spam
Posted by Yves Goergen <no...@unclassified.de>.
Am 24.02.2015 um 19:00 schrieb Jeremy McSpadden:
> Your better off to implement RBL at SMTP time, not SA. IMO
> Which MTA are you using ?
Exim. But why should I do that? See my other message in this thread.
RBLs make mistakes. But then, only one of them makes the mistake, not all.
Are RBLs the only measure to fight spam today? How do these lists learn
spam quickly if there is no other way to detect it?
I'm not sure whether RBLs help here. These are some of the reports of
recent messages:
> 0.0 FSL_HELO_NON_FQDN_1 No description available.
> 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
> (disportsk33[at]gmx.pl)
> 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
> digit (disportsk33[at]gmx.pl)
> 0.9 SPF_FAIL SPF: Senderechner entspricht nicht SPF-Datensatz (fail)
> [SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=disportsk33%40gmx.pl;ip=188.10.118.145;r=mond2]
> 0.0 HTML_MESSAGE BODY: Nachricht enthält HTML
> 0.0 TVD_SPACE_RATIO No description available.
> 1.0 XPRIO Has X-Priority header
> 2.8 TVD_SPACE_RATIO_MINFP No description available.
-----
> 0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
> 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
> (ravennvgszluotpaa[at]wp.pl)
> 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
> digit (teaspoonsfulut2[at]wp.pl)
> 0.9 SPF_FAIL SPF: Senderechner entspricht nicht SPF-Datensatz (fail)
> [SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=teaspoonsfulut2%40wp.pl;ip=115.246.74.136;r=mond2]
> 0.0 HTML_MESSAGE BODY: Nachricht enthält HTML
> 1.0 XPRIO Has X-Priority header
-----
> 0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or
> Generic rPTR
> 0.9 SPF_FAIL SPF: Senderechner entspricht nicht SPF-Datensatz (fail)
> [SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=operan37%40wp.pl;ip=95.233.166.252;r=mond2]
> 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
> digit (operan37[at]wp.pl)
> 2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
> [95.233.166.252 listed in psbl.surriel.com]
> 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
> (bartekmamut[at]wp.pl)
> 0.0 HTML_MESSAGE BODY: Nachricht enthält HTML
> 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
> https://senderscore.org/blacklistlookup/
> [95.233.166.252 listed in bl.score.senderscore.com]
> 0.0 TVD_SPACE_RATIO No description available.
> 1.0 XPRIO Has X-Priority header
> 2.7 TVD_SPACE_RATIO_MINFP No description available.
-----
> 0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or
> Generic rPTR
> 2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
> [195.223.116.82 listed in psbl.surriel.com]
> 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
> digit (panellingset52[at]gmail.com)
> 1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
> [195.223.116.82 listed in bb.barracudacentral.org]
> 1.0 SPF_SOFTFAIL Senderechner entspricht nicht SPF-Datensatz (softfail)
> 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
> (panellingset52[at]gmail.com)
> 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
> domains are different
> 0.7 MPART_ALT_DIFF BODY: Nachrichtentext im Text- und HTML-Format
> unterscheiden sich
> 0.0 HTML_MESSAGE BODY: Nachricht enthält HTML
> 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: Senderechner ist ein ungesicherter
> WWW-Server
> [195.223.116.82 listed in dnsbl.sorbs.net]
> 0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
> freemail headers are different
> 1.0 XPRIO Has X-Priority header
-----
> 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
> (beelines89[at]wp.pl)
> 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
> digit (beelines89[at]wp.pl)
> 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
> domains are different
> 0.9 SPF_FAIL SPF: Senderechner entspricht nicht SPF-Datensatz (fail)
> [SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=beelines89%40wp.pl;ip=37.152.18.1;r=mond2]
> 0.0 HTML_MESSAGE BODY: Nachricht enthält HTML
> 1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
> [37.152.18.1 listed in bb.barracudacentral.org]
> 0.4 RDNS_DYNAMIC Delivered to internal network by host with
> dynamic-looking rDNS
> 0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
> freemail headers are different
> 3.2 HELO_DYNAMIC_IPADDR HELO-Rechnername verdächtig (IP-Adresse 1)
> 1.0 XPRIO Has X-Priority header
-----
> 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
> domains are different
> 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
> (undersignedbj0[at]gmx.ch)
> 0.9 SPF_FAIL SPF: Senderechner entspricht nicht SPF-Datensatz (fail)
> [SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=undersignedbj0%40gmx.ch;ip=2.50.6.22;r=mond2]
> 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
> digit (undersignedbj0[at]gmx.ch)
> 0.7 MPART_ALT_DIFF BODY: Nachrichtentext im Text- und HTML-Format
> unterscheiden sich
> 0.0 HTML_MESSAGE BODY: Nachricht enthält HTML
> 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
> https://senderscore.org/blacklistlookup/
> [2.50.6.22 listed in bl.score.senderscore.com]
> 1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
> [2.50.6.22 listed in bb.barracudacentral.org]
> 0.6 RCVD_IN_SORBS_WEB RBL: SORBS: Senderechner ist ein ungesicherter
> WWW-Server
> [2.50.6.22 listed in dnsbl.sorbs.net]
> 0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
> freemail headers are different
> 1.0 XPRIO Has X-Priority header
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Yves Goergen <no...@unclassified.de>.
Am 24.02.2015 um 18:39 schrieb Jeremy McSpadden:
> Usually scores are 6 low 10 high. Are you running any RBLs ?
I have the default settings plus the attached custom configuration.
There are several RBLs among them.
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Jeremy McSpadden <je...@fluxlabs.net>.
Usually scores are 6 low 10 high. Are you running any RBLs ?
--
Jeremy McSpadden
Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions
Office : 850-250-5590x501<tel:850-250-5590;501> | Cell : 850-890-2543<tel:850-890-2543> | Fax : 850-254-2955<tel:850-254-2955>
On Feb 24, 2015, at 11:35 AM, Yves Goergen <no...@unclassified.de>> wrote:
Hello,
for a few months I'm getting lots of Polish spam to one of my e-mail addresses, sometimes a dozen per day. I have no idea what it's telling me, I don't understand a single word. I just recognise characteristic characters to know the language. Some messages have a .pl domain as sender address, others not. The sending hosts have all kinds of TLDs. Most messages have only a very short or empty body (a few words at maximum). Almost all messages contain a .zip attachment, often named like *_JPG.zip or *.pdf.zip. It doesn't seem to contain malware caught by clamav, but I haven't looked into any of these archives yet.
SpamAssassin doesn't seem to be too successful in filtering them out. I set up that mailbox to reject anything beyond 10 points. Almost all messages stay under that limit. Only occasionally, a few messages are rejected with scores up to around 15. (Other regular spam can easily reach scores in the 50s.)
Does anybody have an idea how to stop that? Are there special rule sets for that?
I could provide samples of those messages if somebody is interested in it. These messages include my SpamAssassin headers so the matching rules can be seen. Unfortunately I'm not an SA wizard so I can't make new rules for such things.
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Marcin Mirosław <ma...@mejor.pl>.
W dniu 2015-02-24 o 19:56, Axb pisze:
[...]
> - Please post missed spam samples in pastebin.com - do not post samples
> to mailing lists
Yes, please share it, I'll take a look what kind of spamt it is.
Re: Lots of Polish spam
Posted by Marcin Mirosław <ma...@mejor.pl>.
W dniu 2015-02-24 o 21:28, Yves Goergen pisze:
> Am 24.02.2015 um 19:56 schrieb Axb:
>> - Please post missed spam samples in pastebin.com - do not post samples
>> to mailing lists
>
> It's too many to process them individually in pastebin. Here's an
> archive with ~60 messages in files:
>
> https://drive.google.com/file/d/0B8CN0ghdY1SdSzBqdkswRUdOb0U/view
>
> ZIP password: spam
> (Google thinks there's a virus in it so I needed to encrypt it.)
----------- SCAN SUMMARY -----------
Known viruses: 4360435
Engine version: 0.98.5
Scanned directories: 0
Scanned files: 58
Infected files: 30
This is with a bunch of unofficial databases for clamav, without foxhole
mentioned by Axb.
With foxhole rules:
----------- SCAN SUMMARY -----------
Known viruses: 4360690
Engine version: 0.98.5
Scanned directories: 0
Scanned files: 58
Infected files: 50
Imho you should take a look at clamav configuration to reject such emails.
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 24.02.2015 um 22:56 schrieb Yves Goergen:
>> Last but not least, get your Bayes setup running and it will give you
>> the extra edge.
>
> I once had Bayes enabled, but since it's an unattended server system, it
> can only learn from itself. And that had worked really bad in the past.
> So I disabled it completely last time I set it up. How should Bayes work
> if nobody gives feedback about the messages from their Thunderbird
> clients? And I've tried creating rules for those Polish words, but it's
> different words all the time. I wonder whether they actually mean
> something. And it's only very few words per messages, many even with
> corrupt encoding including HTML entities. Again, how could Bayes help here?
starting with 200 spam and 200 ham samples bayes helps *a lot* and
running any contentfilter without bayes is pure nonsense
a spamfilter si not about "that is spam because this" - it#s about
scoring and bayes is a important part of the scoring
just set it up with a central bayes-db and feed it only with the samples
*you* got and anybody would benefit
with sensible RBL scoring, SpamAssassin including bayes and unofficial
ClamAV signatures you block around 95% of all junk without invest any
second of work after setup and combined with remote-hashing services
into the score mix you get up to 98% with nearly zero false positives
what you have is a dumb contentfilter without bayes and useable clamav
signatures with no RBL scroing before the contentfilter - that can't
work at all
Re: Lots of Polish spam
Posted by RW <rw...@googlemail.com>.
On Tue, 24 Feb 2015 22:56:08 +0100
Yves Goergen wrote:
> Am 24.02.2015 um 22:00 schrieb Axb:
> > I'd definitely suggest you enable the Spamhaus & SURBL rules.
>
> They have strange TOS that actually forbid using them for more than a
> single mailbox. Otherwise you need to pay for it.
That's not what it says on their websites, SURBL has a 1000 user limit,
and spamhaus has limits on lookups.
> My data centre
> provider wrote an interesting posting about the current situation in
> their closed customer forums. They're in a bad position as long as
> customers still access Spamhaus services from their network.
They have to pay because they're a business that sells email.
If you have your own mail server with a dedicated IP address, and do
your own DNS lookups, I don't you'd have to pay unless you're selling a
commercial email service. The problem some people run into is sending
their dns queries through a shared dns cache which aggregates look-ups
on a single IP address.
Re: Lots of Polish spam
Posted by Tom Hendrikx <to...@whyscream.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 24-02-15 22:56, Yves Goergen wrote:
> Am 24.02.2015 um 22:00 schrieb Axb:
>> On 02/24/2015 09:28 PM, Yves Goergen wrote:
>>> https://drive.google.com/file/d/0B8CN0ghdY1SdSzBqdkswRUdOb0U/view
>>>
>>>
>>>
ZIP password: spam
>>> (Google thinks there's a virus in it so I needed to encrypt
>>> it.)
>>
>> didn't need a password to extract but... whatever format those
>> .eml are in, none of text editors was able to handle them so that
>> didn't help.
>
> If you weren't asked for a password, then the files were not
> decrypted. If you can decrypt them (I used 7-Zip to create the
> archive, but ZIP encryption seems incompatible between programs,
> could create a .7z archive as well, but these seem to be
> unsupported and unwanted by most, despite their highly superiour
> performance), then you'll have plain text files as Thunderbird
> received and exported them. Nothing unusual.
>
>>>> - What plugins are you using? (pls specify: Razor, Pyzor,
>>>> DCC, etc)
>>
>> neither of thsoe are installed by default so you ma want to look
>> into them.
>>
>> RAZR/PYZOR DCCC will make a huge difference.
>
> Okay, so I'll take a look into what they are and how to install
> and configure them.
>
>> I'd definitely suggest you enable the Spamhaus & SURBL rules.
>
> They have strange TOS that actually forbid using them for more than
> a single mailbox. Otherwise you need to pay for it. My data centre
> provider wrote an interesting posting about the current situation
> in their closed customer forums. They're in a bad position as long
> as customers still access Spamhaus services from their network.
> Nobody should support them anymore, really. They're evil.
>
>> Last but not least, get your Bayes setup running and it will give
>> you the extra edge.
>
> I once had Bayes enabled, but since it's an unattended server
> system, it can only learn from itself. And that had worked really
> bad in the past. So I disabled it completely last time I set it up.
> How should Bayes work if nobody gives feedback about the messages
> from their Thunderbird clients? And I've tried creating rules for
> those Polish words, but it's different words all the time. I wonder
> whether they actually mean something. And it's only very few words
> per messages, many even with corrupt encoding including HTML
> entities. Again, how could Bayes help here?
>
The problem here that you're stating "it's an unattended server
system". E-mail and spam change all the time, you cannot have great
filtering without adjusting to new trends and threats. Using bayesian
filtering is an easy way to improve detection, because you only need
to decide whether mail is ham or spam, and the bayes engine does most
of the other hard work for you.
If you're not going to put in some effort to either train a bayesian
filter for your users, of enable them to train it themselves (this has
some risks you should be aware of), your filtering won't improve. But
on the other hand: trying to write your own SA rules in order to block
mails in a language you don't even understand is a lot harder.
Tom
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJU7PebAAoJEJPfMZ19VO/14HAP/A57vNLDgHjmt0JvBi98RAnY
Jez138atfRynhLIFxy2w8MDwWy2HWSi6v/NpnXMVjZ2DYmyMBrJNC1Tn2aYrM3Mu
uxPxfOTVNlyG2FjY3iw8XwvlSJ28shcuU8WrbTrvvD81Mv2UyBVhsaNcFNNss5Gg
PATgOtU8IIn/sqb85uLu0DkyWR7LbM3SMfmNLQ1O5uRV+9212vFfHSS6Bi8/XdJ0
KCwxBlQrI8wb1hMPzPUGFa39ke307V6HugOZtSX/JkM4Ub8vSpscvvi14Up3Cde3
WlCod8SPf7cox1jwt5aahLNhESFp9fAeXHA+QCpfBAq2wiGTVFnOhm3EqE93JMw8
Btt51cTzeaIW58ho6mTAU56IBEb6phPI7mCXtcIDbtJ6WtHNWv9ozYdyp/3aQB6Z
gfe2DxzuF9Nx9g3jimyCHSeh7/ZOHw5i3U5sp77lvQ1a+B0UEf5cW6DkG/flXnRg
o6j2yWfId0elYU+h5K8EMeWzOCK8fv02W5PIsBzVRMv9VR15/22IdOdger1gAYWZ
uyttaqOVJkN8FREO4jo1JO4Si6BJFTu3c4bWLeFbYcx2s/7RY0jQeE59B8RWBa+l
CHYLOU8IhXSBKlMyvn2A6cnDPr/lyk1aeZzL0eSVGHXXyU7b0VdEYAH7K9LzEpXK
EHRkis0DOJAomQrjNuvj
=TuOX
-----END PGP SIGNATURE-----
Re: Lots of Polish spam
Posted by Yves Goergen <no...@unclassified.de>.
Am 24.02.2015 um 22:00 schrieb Axb:
> On 02/24/2015 09:28 PM, Yves Goergen wrote:
>> https://drive.google.com/file/d/0B8CN0ghdY1SdSzBqdkswRUdOb0U/view
>>
>> ZIP password: spam
>> (Google thinks there's a virus in it so I needed to encrypt it.)
>
> didn't need a password to extract but... whatever format those .eml are
> in, none of text editors was able to handle them so that didn't help.
If you weren't asked for a password, then the files were not decrypted.
If you can decrypt them (I used 7-Zip to create the archive, but ZIP
encryption seems incompatible between programs, could create a .7z
archive as well, but these seem to be unsupported and unwanted by most,
despite their highly superiour performance), then you'll have plain text
files as Thunderbird received and exported them. Nothing unusual.
>>> - What plugins are you using?
>>> (pls specify: Razor, Pyzor, DCC, etc)
>
> neither of thsoe are installed by default so you ma want to look into them.
>
> RAZR/PYZOR DCCC will make a huge difference.
Okay, so I'll take a look into what they are and how to install and
configure them.
> I'd definitely suggest you enable the Spamhaus & SURBL rules.
They have strange TOS that actually forbid using them for more than a
single mailbox. Otherwise you need to pay for it. My data centre
provider wrote an interesting posting about the current situation in
their closed customer forums. They're in a bad position as long as
customers still access Spamhaus services from their network. Nobody
should support them anymore, really. They're evil.
> Last but not least, get your Bayes setup running and it will give you
> the extra edge.
I once had Bayes enabled, but since it's an unattended server system, it
can only learn from itself. And that had worked really bad in the past.
So I disabled it completely last time I set it up. How should Bayes work
if nobody gives feedback about the messages from their Thunderbird
clients? And I've tried creating rules for those Polish words, but it's
different words all the time. I wonder whether they actually mean
something. And it's only very few words per messages, many even with
corrupt encoding including HTML entities. Again, how could Bayes help here?
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by David Jones <dj...@ena.com>.
>________________________________________
>From: Axb <ax...@gmail.com>
>Sent: Wednesday, February 25, 2015 4:32 AM
>To: users@spamassassin.apache.org
>Subject: Re: Lots of Polish spam
>On 02/25/2015 01:42 AM, Alex Regan wrote:
>> Hi,
>>
>>
>> On 02/24/2015 07:06 PM, Reindl Harald wrote:
>>>
>>> Am 25.02.2015 um 00:56 schrieb Alex Regan:
>>>>> Sophos reports it as Troj/Tinba-O, like most others on virustotal.com
>>>>> ClamAV does not detect anything suspicious.
>>>>
>>>> I really thought clamav was much better. Can you recommend a antivirus
>>>> other than Sophos that works well with Linux/Fedora?
>>>>
>>>> Sophos is a no-go with Fedora, apparently
>>>
>>> as explained repeatly in this thread: ClamAV is a *fraemwork* and works
>>> well if you load the right signatures
>>>
>>> even SpamAssassin *is just a framework* without Bayes, URIBL, DNSBL and
>>> shared hash deployments far away from useable as a "ready solution"
>>>
>>> if you build up a spamfilter you can't just use anything out of the box
>>> and think you are done without invest in configuration and additional
>>> signatures as well as *learining* from real mail flow
>>
>> Yes, I *am* already using the additional signatures from sanesecurity
>> and others. I've started to notice the efficacy suffering over the past
>> months as users have been complaining and comments on this list (I
>> assumed those that were commenting were also using the third-party
>> signatures).
>>
>> I'm also just looking for a secondary scanner in addition to clamav to
>> run in parallel to see how it compares...
>You may want to look into Cyren (was Commtouch) though it's NOT cheap.
>http://www.cyren.com/tl_files/downloads/CYREN-AntiVirus-for-Email.pdf
>also Dr. Web is suprisingly good for the price
>https://www.drweb.com/?lng=en
>I've also been using F-Prot for years and it catches quite a few corner
>cases and for the price it's well worth it.
>If anybody expects to get *cheap* multi-layer AV, forget it.
E-set Nod32 is working very well for us. We licensed 8 mail filter boxes for
not a lot of money. It's very fast too so we dropped our processing time
in half from our McAfee AV down to 4-5 seconds per MailScanner batch.
They quoted us pricing as a 5 user license per box:
http://www.eset.co.uk/Business/Mail-Security/Linux-BSD-Solaris
Re: Lots of Polish spam
Posted by Axb <ax...@gmail.com>.
On 02/25/2015 01:42 AM, Alex Regan wrote:
> Hi,
>
>
> On 02/24/2015 07:06 PM, Reindl Harald wrote:
>>
>> Am 25.02.2015 um 00:56 schrieb Alex Regan:
>>>> Sophos reports it as Troj/Tinba-O, like most others on virustotal.com
>>>> ClamAV does not detect anything suspicious.
>>>
>>> I really thought clamav was much better. Can you recommend a antivirus
>>> other than Sophos that works well with Linux/Fedora?
>>>
>>> Sophos is a no-go with Fedora, apparently
>>
>> as explained repeatly in this thread: ClamAV is a *fraemwork* and works
>> well if you load the right signatures
>>
>> even SpamAssassin *is just a framework* without Bayes, URIBL, DNSBL and
>> shared hash deployments far away from useable as a "ready solution"
>>
>> if you build up a spamfilter you can't just use anything out of the box
>> and think you are done without invest in configuration and additional
>> signatures as well as *learining* from real mail flow
>
> Yes, I *am* already using the additional signatures from sanesecurity
> and others. I've started to notice the efficacy suffering over the past
> months as users have been complaining and comments on this list (I
> assumed those that were commenting were also using the third-party
> signatures).
>
> I'm also just looking for a secondary scanner in addition to clamav to
> run in parallel to see how it compares...
You may want to look into Cyren (was Commtouch) though it's NOT cheap.
http://www.cyren.com/tl_files/downloads/CYREN-AntiVirus-for-Email.pdf
also Dr. Web is suprisingly good for the price
https://www.drweb.com/?lng=en
I've also been using F-Prot for years and it catches quite a few corner
cases and for the price it's well worth it.
If anybody expects to get *cheap* multi-layer AV, forget it.
Re: Lots of Polish spam
Posted by Alex Regan <my...@gmail.com>.
Hi,
On 02/24/2015 07:06 PM, Reindl Harald wrote:
>
> Am 25.02.2015 um 00:56 schrieb Alex Regan:
>>> Sophos reports it as Troj/Tinba-O, like most others on virustotal.com
>>> ClamAV does not detect anything suspicious.
>>
>> I really thought clamav was much better. Can you recommend a antivirus
>> other than Sophos that works well with Linux/Fedora?
>>
>> Sophos is a no-go with Fedora, apparently
>
> as explained repeatly in this thread: ClamAV is a *fraemwork* and works
> well if you load the right signatures
>
> even SpamAssassin *is just a framework* without Bayes, URIBL, DNSBL and
> shared hash deployments far away from useable as a "ready solution"
>
> if you build up a spamfilter you can't just use anything out of the box
> and think you are done without invest in configuration and additional
> signatures as well as *learining* from real mail flow
Yes, I *am* already using the additional signatures from sanesecurity
and others. I've started to notice the efficacy suffering over the past
months as users have been complaining and comments on this list (I
assumed those that were commenting were also using the third-party
signatures).
I'm also just looking for a secondary scanner in addition to clamav to
run in parallel to see how it compares...
Thanks,
Alex
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 25.02.2015 um 00:56 schrieb Alex Regan:
>> Sophos reports it as Troj/Tinba-O, like most others on virustotal.com
>> ClamAV does not detect anything suspicious.
>
> I really thought clamav was much better. Can you recommend a antivirus
> other than Sophos that works well with Linux/Fedora?
>
> Sophos is a no-go with Fedora, apparently
as explained repeatly in this thread: ClamAV is a *fraemwork* and works
well if you load the right signatures
even SpamAssassin *is just a framework* without Bayes, URIBL, DNSBL and
shared hash deployments far away from useable as a "ready solution"
if you build up a spamfilter you can't just use anything out of the box
and think you are done without invest in configuration and additional
signatures as well as *learining* from real mail flow
Re: Lots of Polish spam
Posted by Alex Regan <my...@gmail.com>.
Hi,
> Sophos reports it as Troj/Tinba-O, like most others on virustotal.com
> ClamAV does not detect anything suspicious.
I really thought clamav was much better. Can you recommend a antivirus
other than Sophos that works well with Linux/Fedora?
Sophos is a no-go with Fedora, apparently.
Thanks,
Alex
Re: Lots of Polish spam
Posted by Mark Martinec <Ma...@ijs.si>.
Axb wrote:
> didn't need a password to extract but... whatever format those .eml
> are in, none of text editors was able to handle them so that didn't
> help.
$ mkdir Spam; cd Spam
$ 7z e -pspam ../Spam.zip
Sophos reports it as Troj/Tinba-O, like most others on virustotal.com
ClamAV does not detect anything suspicious.
Mark
Re: Lots of Polish spam
Posted by Axb <ax...@gmail.com>.
On 02/24/2015 09:28 PM, Yves Goergen wrote:
> Am 24.02.2015 um 19:56 schrieb Axb:
>> - Please post missed spam samples in pastebin.com - do not post samples
>> to mailing lists
>
> It's too many to process them individually in pastebin. Here's an
> archive with ~60 messages in files:
>
> https://drive.google.com/file/d/0B8CN0ghdY1SdSzBqdkswRUdOb0U/view
>
> ZIP password: spam
> (Google thinks there's a virus in it so I needed to encrypt it.)
didn't need a password to extract but... whatever format those .eml are
in, none of text editors was able to handle them so that didn't help.
>> - What plugins are you using?
>> (pls specify: Razor, Pyzor, DCC, etc)
neither of thsoe are installed by default so you ma want to look into them.
RAZR/PYZOR DCCC will make a huge difference.
>
> Didn't change whatever comes as a standard.
>
>> - Are you handling mail for a company, personal email, ISP, one domain,
>> many domains, etc?
>
> It's the mail server for a small web hosting service with multiple
> domains and users. I don't know whether any of them wishes to receive
> Polish messages.
I'd definitely suggest you enable the Spamhaus & SURBL rules.
I know german/austrian/swiss mail admins seems to have a problem with
Spamhaus and prefer to trust the manitu RBL, yet, for my traffic, would
be riddled with FPs while Spamhaus has been superb for the last 14 years.
Potential FPs have always been fixed VERY fast and the hit rate can't be
beat... but then.... whatever works...
Last but not least, get your Bayes setup running and it will give you
the extra edge.
h2h
Axb
Re: Lots of Polish spam
Posted by Yves Goergen <no...@unclassified.de>.
Am 24.02.2015 um 19:56 schrieb Axb:
> - Please post missed spam samples in pastebin.com - do not post samples
> to mailing lists
It's too many to process them individually in pastebin. Here's an
archive with ~60 messages in files:
https://drive.google.com/file/d/0B8CN0ghdY1SdSzBqdkswRUdOb0U/view
ZIP password: spam
(Google thinks there's a virus in it so I needed to encrypt it.)
> - What SA version are you using? and on what operating system?
3.4.0 on Ubuntu 14.04
> - How are you using SA?
> (pls specify: amavis, MIMEDefang, a milter, Mailscanner, procmail,
> Fuglu, etc, etc)
Configured as scanner from Exim 4.82
> - Are you using SA in a PC/notebook? or on a server?
On a public web/mail server
> - What plugins are you using?
> (pls specify: Razor, Pyzor, DCC, etc)
Didn't change whatever comes as a standard.
> - Are you handling mail for a company, personal email, ISP, one domain,
> many domains, etc?
It's the mail server for a small web hosting service with multiple
domains and users. I don't know whether any of them wishes to receive
Polish messages.
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Axb <ax...@gmail.com>.
On 02/24/2015 06:35 PM, Yves Goergen wrote:
> Hello,
>
> for a few months I'm getting lots of Polish spam to one of my e-mail
> addresses, sometimes a dozen per day. I have no idea what it's telling
> me, I don't understand a single word. I just recognise characteristic
> characters to know the language. Some messages have a .pl domain as
> sender address, others not. The sending hosts have all kinds of TLDs.
> Most messages have only a very short or empty body (a few words at
> maximum). Almost all messages contain a .zip attachment, often named
> like *_JPG.zip or *.pdf.zip. It doesn't seem to contain malware caught
> by clamav, but I haven't looked into any of these archives yet.
>
> SpamAssassin doesn't seem to be too successful in filtering them out. I
> set up that mailbox to reject anything beyond 10 points. Almost all
> messages stay under that limit. Only occasionally, a few messages are
> rejected with scores up to around 15. (Other regular spam can easily
> reach scores in the 50s.)
>
> Does anybody have an idea how to stop that? Are there special rule sets
> for that?
>
> I could provide samples of those messages if somebody is interested in
> it. These messages include my SpamAssassin headers so the matching rules
> can be seen. Unfortunately I'm not an SA wizard so I can't make new
> rules for such things.
>
Could you please tell us more about your setup so we get a better picture...
- Please post missed spam samples in pastebin.com - do not post samples
to mailing lists
- What SA version are you using? and on what operating system?
- How are you using SA?
(pls specify: amavis, MIMEDefang, a milter, Mailscanner, procmail,
Fuglu, etc, etc)
- Are you using SA in a PC/notebook? or on a server?
- What plugins are you using?
(pls specify: Razor, Pyzor, DCC, etc)
- Are you handling mail for a company, personal email, ISP, one domain,
many domains, etc?
thx
PS: Template extracted from:
http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/emailed/sa-list-template.txt?view=co
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 25.02.2015 um 23:23 schrieb Yves Goergen:
> Am 25.02.2015 um 23:04 schrieb Dave Warren:
>> I second this. Either go all the way, or don't do it, it's worse to
>> leave users with a false sense of security. A mentality of "The virus
>> scanner says it's safe, so it won't do any harm" is exceedingly
>> dangerous.
>
> The virus scanner doesn't say anything at all
that's not the point
if you tell a user "we san for malware" he feels more secure compared to
saying "it's your own risk what you open or not" and since anybody with
technical understanding knows that *no virus scanner at all* will have
fast enough signatures to block recent malware and so just don't allow
attachments wich can be executed by click in the mail-client
Re: Lots of Polish spam
Posted by Dave Warren <da...@hireahit.com>.
On 2015-02-25 14:23, Yves Goergen wrote:
> Am 25.02.2015 um 23:04 schrieb Dave Warren:
>> I second this. Either go all the way, or don't do it, it's worse to
>> leave users with a false sense of security. A mentality of "The virus
>> scanner says it's safe, so it won't do any harm" is exceedingly
>> dangerous.
>
> The virus scanner doesn't say anything at all. It is just an
> additional effort to keep unwanted e-mails away, just like the spam
> filter. Nobody claimed that there is any guarantee associated with it,
> not even for false rejects. Considering what still passes the filters
> this should quickly become obvious.
>
You're thinking like a techie. Don't do that. When an end user becomes
aware that there is a malware filter or antivirus, they will assume it
works, and since malware and viruses are filtered, that which is not
filtered must be safe.
Users are stupid; this is why we're employed. Understand them, and build
systems that set appropriate expectations and encourage the correct
behaviour. If you're handing people a dangerous weapon, don't tell them
all the reasons it's safe, tell them all the reasons it's dangerous even
if there are a few safeguards.
--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren
Re: Lots of Polish spam
Posted by Yves Goergen <no...@unclassified.de>.
Am 25.02.2015 um 23:04 schrieb Dave Warren:
> I second this. Either go all the way, or don't do it, it's worse to
> leave users with a false sense of security. A mentality of "The virus
> scanner says it's safe, so it won't do any harm" is exceedingly dangerous.
The virus scanner doesn't say anything at all. It is just an additional
effort to keep unwanted e-mails away, just like the spam filter. Nobody
claimed that there is any guarantee associated with it, not even for
false rejects. Considering what still passes the filters this should
quickly become obvious.
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Dave Warren <da...@hireahit.com>.
On 2015-02-25 11:42, Bill Cole wrote:
> On 24 Feb 2015, at 17:06, Yves Goergen wrote:
>
>> I can't block all archives with executable files in them.
>
> Then in all seriousness: why bother filtering email specifically for
> malware?
I second this. Either go all the way, or don't do it, it's worse to
leave users with a false sense of security. A mentality of "The virus
scanner says it's safe, so it won't do any harm" is exceedingly dangerous.
--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren
Re: Lots of Polish spam
Posted by David Jones <dj...@ena.com>.
>________________________________________
>From: Yves Goergen <no...@unclassified.de>
>Sent: Wednesday, February 25, 2015 4:15 PM
>To: users@spamassassin.apache.org
>Subject: Re: Lots of Polish spam
>Am 25.02.2015 um 20:42 schrieb Bill Cole:
>> On 24 Feb 2015, at 17:06, Yves Goergen wrote:
>>> I can't block all archives with executable files in them.
>>
>> Then in all seriousness: why bother filtering email specifically for
>> malware?
>>
>> Email is an inherently untrustworthy transport medium. Any sort of
>> executable received via email that is not cryptographically signed by a
>> trusted sender should be considered unsafe to run. If an executable is
>> signed by a trusted sender, it can just as easily be encrypted to
>> protect it from detection as an executable. If your users believe that
>> you are providing them a valuableservice by allowing transport of
>> executables via email, they are mistaken. You are putting them at
>> unnecessary risk.
>I fully understand you, but tell that end users. They're already happy
>if they manage to get an e-mail with an attached file sent out. I've
>more than once thought about shutting down the FTP service due to
>repeated issues with it, requiring that users manage their files through
>SFTP. But FTP is still the most-used access protocol and the average
>webmaster(!) doesn't care or know about it all.
>Your objection also applies to unencrypted HTTP downloads, BTW.
Check out http://zendto.com
Setup a bounce message that points your internal users to use Zendto
when it blocks a file by type or size.
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 25.02.2015 um 23:15 schrieb Yves Goergen:
> Am 25.02.2015 um 20:42 schrieb Bill Cole:
>> On 24 Feb 2015, at 17:06, Yves Goergen wrote:
>>> I can't block all archives with executable files in them.
>>
>> Then in all seriousness: why bother filtering email specifically for
>> malware?
>>
>> Email is an inherently untrustworthy transport medium. Any sort of
>> executable received via email that is not cryptographically signed by a
>> trusted sender should be considered unsafe to run. If an executable is
>> signed by a trusted sender, it can just as easily be encrypted to
>> protect it from detection as an executable. If your users believe that
>> you are providing them a valuableservice by allowing transport of
>> executables via email, they are mistaken. You are putting them at
>> unnecessary risk.
>
> I fully understand you, but tell that end users
do it
> They're already happy
> if they manage to get an e-mail with an attached file sent out.
we disallow any executeable for many years now
no problem, the ordinary enduser don't come to the idea send .exe files
> I've
> more than once thought about shutting down the FTP service due to
> repeated issues with it, requiring that users manage their files through
> SFTP. But FTP is still the most-used access protocol and the average
> webmaster(!) doesn't care or know about it all.
completly different topic
> Your objection also applies to unencrypted HTTP downloads, BTW
completly different topic
your webserver don't push random binaries unasked to you
your mailserver does controlled by foreigners if you allow it
Re: Lots of Polish spam
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 25 Feb 2015, at 17:15, Yves Goergen wrote:
> Am 25.02.2015 um 20:42 schrieb Bill Cole:
>> On 24 Feb 2015, at 17:06, Yves Goergen wrote:
>>> I can't block all archives with executable files in them.
>>
>> Then in all seriousness: why bother filtering email specifically for
>> malware?
>>
>> Email is an inherently untrustworthy transport medium. Any sort of
>> executable received via email that is not cryptographically signed by
>> a
>> trusted sender should be considered unsafe to run. If an executable
>> is
>> signed by a trusted sender, it can just as easily be encrypted to
>> protect it from detection as an executable. If your users believe
>> that
>> you are providing them a valuableservice by allowing transport of
>> executables via email, they are mistaken. You are putting them at
>> unnecessary risk.
>
> I fully understand you, but tell that end users.
I do.
Based on my employer's logs and support requests, the frequency of
actual user problems with an absolute omnidirectional ban on readily
identified executables attached to email is at least 3 orders of
magnitude smaller than the frequency of that ban excluding malware in
the past 14 months. It is quite likely that some of our users have
adopted mechanisms of evading the blockage and informed their
correspondents of those mechanisms, which is a relatively low-risk issue
-- a problem not worth trying to solve.
> They're already happy if they manage to get an e-mail with an attached
> file sent out. I've more than once thought about shutting down the FTP
> service due to repeated issues with it, requiring that users manage
> their files through SFTP. But FTP is still the most-used access
> protocol and the average webmaster(!) doesn't care or know about it
> all.
Yes, I understand that a solid 50% of the human race consists of people
with below-median intelligence. That's always been necessary to take
into account and it is a persuasive reason to avoid targeting a "mass"
market of users. Put another way: a customer who demands FTP instead of
SFTP for anything other than anonymous downloading is too dumb to be
worth serving.
> Your objection also applies to unencrypted HTTP downloads, BTW.
Yes and no. No one is sent dozens of unsolicited malicious executables
daily via unencrypted HTTP, mixed in with a handful of legitimate and
possibly important messages that they are expected to see and respond
to. A user seeking out a piece of software and transporting it in an
insecure fashion is potentially problematic, but it is ultimately a
consensual problem that is mitigated by things like file encryption
and/or simple hash "fingerprints" to assure that receivers get the files
senders believe they are sending. Whether receivers are good judges of
sender integrity is a tougher problem, not readily solved by technical
measures.
Re: Lots of Polish spam
Posted by Yves Goergen <no...@unclassified.de>.
Am 25.02.2015 um 20:42 schrieb Bill Cole:
> On 24 Feb 2015, at 17:06, Yves Goergen wrote:
>> I can't block all archives with executable files in them.
>
> Then in all seriousness: why bother filtering email specifically for
> malware?
>
> Email is an inherently untrustworthy transport medium. Any sort of
> executable received via email that is not cryptographically signed by a
> trusted sender should be considered unsafe to run. If an executable is
> signed by a trusted sender, it can just as easily be encrypted to
> protect it from detection as an executable. If your users believe that
> you are providing them a valuableservice by allowing transport of
> executables via email, they are mistaken. You are putting them at
> unnecessary risk.
I fully understand you, but tell that end users. They're already happy
if they manage to get an e-mail with an attached file sent out. I've
more than once thought about shutting down the FTP service due to
repeated issues with it, requiring that users manage their files through
SFTP. But FTP is still the most-used access protocol and the average
webmaster(!) doesn't care or know about it all.
Your objection also applies to unencrypted HTTP downloads, BTW.
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 24 Feb 2015, at 17:06, Yves Goergen wrote:
> I can't block all archives with executable files in them.
Then in all seriousness: why bother filtering email specifically for
malware?
Email is an inherently untrustworthy transport medium. Any sort of
executable received via email that is not cryptographically signed by a
trusted sender should be considered unsafe to run. If an executable is
signed by a trusted sender, it can just as easily be encrypted to
protect it from detection as an executable. If your users believe that
you are providing them a valuableservice by allowing transport of
executables via email, they are mistaken. You are putting them at
unnecessary risk.
RE: Blocking .exe in zips (was Re: Lots of Polish spam)
Posted by Kevin Miller <ke...@juneau.org>.
That's what I did. I went with Zendto also as David Jones recommended. It works great, and solves both the restricted file issue as well as an email size problem. It's not unusual for users to attach half a dozen photos to a message these days and never realize they're 8-10 MB each...
...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4500
Registered Linux User No: 307357
> -----Original Message-----
> From: Yves Goergen [mailto:nospam.list@unclassified.de]
> Sent: Wednesday, February 25, 2015 1:28 PM
> To: Dave Warren; users@spamassassin.apache.org
> Subject: Re: Blocking .exe in zips (was Re: Lots of Polish spam)
>
> Am 25.02.2015 um 23:04 schrieb Dave Warren:
> > On 2015-02-25 12:18, David F. Skoll wrote:
> >> So far, no major complaints. The few who really need to send such
> >> files rename them to .ex_ before zipping them up. We have a fairly
> >> large userbase (more than 140,000) so I think we would have heard
> >> lots of complaints by now if people really couldn't live with the
> policy.
> >
> > Seconded. I run a small hosting company with email for hundreds of
> > clients, I've had a grand total of 0 complaints about blocking EXE,
> > SCR, COM and similar types. We maybe get one inquiry per year about
> > it, but no one has ever had a problem with .ex_ solutions, and they
> > generally understand and appreciate the approach.
> >
> > It scales up to large installations as well, Google blocks executable
> > files (even if zipped) too, and they seem to be doing alright in the
> > email world: https://support.google.com/mail/answer/6590?hl=en
>
> That's an interesting point, I wouldn't have thought it could work. I
> was thinking about installing a "private" file sharing website for our
> users already (ad-free and with authentication only), so that could go
> together well with an announcement that executable files would no longer
> be allowed in e-mails.
>
> --
> Yves Goergen
> http://unclassified.software
Re: Blocking .exe in zips (was Re: Lots of Polish spam)
Posted by Yves Goergen <no...@unclassified.de>.
Am 25.02.2015 um 23:04 schrieb Dave Warren:
> On 2015-02-25 12:18, David F. Skoll wrote:
>> So far, no major complaints. The few who really need to send such files
>> rename them to .ex_ before zipping them up. We have a fairly large
>> userbase (more than 140,000) so I think we would have heard lots of
>> complaints by now if people really couldn't live with the policy.
>
> Seconded. I run a small hosting company with email for hundreds of
> clients, I've had a grand total of 0 complaints about blocking EXE, SCR,
> COM and similar types. We maybe get one inquiry per year about it, but
> no one has ever had a problem with .ex_ solutions, and they generally
> understand and appreciate the approach.
>
> It scales up to large installations as well, Google blocks executable
> files (even if zipped) too, and they seem to be doing alright in the
> email world: https://support.google.com/mail/answer/6590?hl=en
That's an interesting point, I wouldn't have thought it could work. I
was thinking about installing a "private" file sharing website for our
users already (ad-free and with authentication only), so that could go
together well with an announcement that executable files would no longer
be allowed in e-mails.
--
Yves Goergen
http://unclassified.software
Re: Blocking .exe in zips (was Re: Lots of Polish spam)
Posted by Dave Warren <da...@hireahit.com>.
On 2015-02-25 12:18, David F. Skoll wrote:
> On Tue, 24 Feb 2015 23:06:02 +0100
> Yves Goergen <no...@unclassified.de> wrote:
>
>> If the mail server now blocks all .exe in .zip without
>> actually scanning the contents, they're going to complain.
> <...>
>
> So far, no major complaints. The few who really need to send such files
> rename them to .ex_ before zipping them up. We have a fairly large
> userbase (more than 140,000) so I think we would have heard lots of
> complaints by now if people really couldn't live with the policy.
Seconded. I run a small hosting company with email for hundreds of
clients, I've had a grand total of 0 complaints about blocking EXE, SCR,
COM and similar types. We maybe get one inquiry per year about it, but
no one has ever had a problem with .ex_ solutions, and they generally
understand and appreciate the approach.
It scales up to large installations as well, Google blocks executable
files (even if zipped) too, and they seem to be doing alright in the
email world: https://support.google.com/mail/answer/6590?hl=en
--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren
Blocking .exe in zips (was Re: Lots of Polish spam)
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Tue, 24 Feb 2015 23:06:02 +0100
Yves Goergen <no...@unclassified.de> wrote:
> If the mail server now blocks all .exe in .zip without
> actually scanning the contents, they're going to complain.
At some point, you need to be firm and take care of your users'
security. We run a commercial filtering service and we
unconditionally block exe (and scr, etc.) files whether directly
attached or in an archive. We don't give our customers any say in
the matter, though we do of course inform them of the policy up front.
So far, no major complaints. The few who really need to send such files
rename them to .ex_ before zipping them up. We have a fairly large
userbase (more than 140,000) so I think we would have heard lots of
complaints by now if people really couldn't live with the policy.
Regards,
David.
Re: Lots of Polish spam
Posted by Benny Pedersen <me...@junc.eu>.
On February 24, 2015 11:06:31 PM Yves Goergen <no...@unclassified.de>
wrote:
> From the description, they only block by file name pattern. I can't
> block all archives with executable files in them. People need to send
> those files from time to time. And they know that a plain attached .exe
> won't get through filters, so they put it in a .zip archive. If the mail
> server now blocks all .exe in .zip without actually scanning the
> contents, they're going to complain.
pay attention to clamav max unpack 16 levels of recursive zip, that means
if a exe file is recursive zip packed 17 times it will not be a virus ? :)
more serious, if a exe file is just attached to email and its clean, no
blocking in clamav, does users not pay attention ?
we are ofttopic, atleast i am
Re: Lots of Polish spam
Posted by Reindl Harald <h....@thelounge.net>.
Am 24.02.2015 um 23:06 schrieb Yves Goergen:
> Am 24.02.2015 um 22:42 schrieb Axb:
>> ClamAV has become a framework... and atm, you can open a a bottle of
>> bubbly if the official sigs actually detect anything.
>
> Oh great. Now that I've finally set up ClamAV on the server, it's
> useless? At least it can detect the EICAR test signature, and
> occasionally I've seen it detecting other things, but I rarely get in
> touch with real malware so I didn't test that
again: do you your homework and visit
http://sanesecurity.com/usage/signatures/ - it#s all available - you
just to need it our pay someone setup the filter proper - a spamfilter
is built up with a *lot* of pieces on different stages
Re: Lots of Polish spam
Posted by Yves Goergen <no...@unclassified.de>.
Am 24.02.2015 um 22:42 schrieb Axb:
> On 02/24/2015 10:32 PM, Kris Deugau wrote:
>> These are almost certainly viruses. Upload one or two of the .zip files
>> to virustotal.com to check against a long list of AV scanners.
Didn't check it. Avira AntiVir (my desktop scanner) didn't notice any of
these files while I created the archive. When scanning the files on
demand, the scanner ends up in a life lock, not finishing. But it has
found at least one malware until then.
> ClamAV has become a framework... and atm, you can open a a bottle of
> bubbly if the official sigs actually detect anything.
Oh great. Now that I've finally set up ClamAV on the server, it's
useless? At least it can detect the EICAR test signature, and
occasionally I've seen it detecting other things, but I rarely get in
touch with real malware so I didn't test that.
> Take a look at the Sanesecurity's FoxHole sigs
From the description, they only block by file name pattern. I can't
block all archives with executable files in them. People need to send
those files from time to time. And they know that a plain attached .exe
won't get through filters, so they put it in a .zip archive. If the mail
server now blocks all .exe in .zip without actually scanning the
contents, they're going to complain.
--
Yves Goergen
http://unclassified.software
Re: Lots of Polish spam
Posted by Axb <ax...@gmail.com>.
On 02/24/2015 10:32 PM, Kris Deugau wrote:
> Yves Goergen wrote:
>> Hello,
>>
>> for a few months I'm getting lots of Polish spam to one of my e-mail
>> addresses, sometimes a dozen per day. I have no idea what it's telling
>> me, I don't understand a single word. I just recognise characteristic
>> characters to know the language. Some messages have a .pl domain as
>> sender address, others not. The sending hosts have all kinds of TLDs.
>> Most messages have only a very short or empty body (a few words at
>> maximum). Almost all messages contain a .zip attachment, often named
>> like *_JPG.zip or *.pdf.zip. It doesn't seem to contain malware caught
>> by clamav, but I haven't looked into any of these archives yet.
>
> These are almost certainly viruses. Upload one or two of the .zip files
> to virustotal.com to check against a long list of AV scanners.
>
> Any Windows executable that I find in a .zip file attached to a random
> message I automatically consider very suspect at best. I don't waste
> time trying to find out what the executable actually does, I just add a
> basic hash signature to ClamAV and move on. I've nearly given up on
> reporting these upstream to the ClamAV maintainers as well; I've got
> samples closing on two years old that still aren't flagged by stock
> signatures. :/
>
ClamAV has become a framework... and atm, you can open a a bottle of
bubbly if the official sigs actually detect anything.
Take a look at the Sanesecurity's FoxHole sigs
http://sanesecurity.com/foxhole-databases/
foxhole_generic.cdb
foxhole_filename.cdb
have been very reliable, in all ways.
Axb
Re: Lots of Polish spam
Posted by Kris Deugau <kd...@vianet.ca>.
Yves Goergen wrote:
> Hello,
>
> for a few months I'm getting lots of Polish spam to one of my e-mail
> addresses, sometimes a dozen per day. I have no idea what it's telling
> me, I don't understand a single word. I just recognise characteristic
> characters to know the language. Some messages have a .pl domain as
> sender address, others not. The sending hosts have all kinds of TLDs.
> Most messages have only a very short or empty body (a few words at
> maximum). Almost all messages contain a .zip attachment, often named
> like *_JPG.zip or *.pdf.zip. It doesn't seem to contain malware caught
> by clamav, but I haven't looked into any of these archives yet.
These are almost certainly viruses. Upload one or two of the .zip files
to virustotal.com to check against a long list of AV scanners.
Any Windows executable that I find in a .zip file attached to a random
message I automatically consider very suspect at best. I don't waste
time trying to find out what the executable actually does, I just add a
basic hash signature to ClamAV and move on. I've nearly given up on
reporting these upstream to the ClamAV maintainers as well; I've got
samples closing on two years old that still aren't flagged by stock
signatures. :/
-kgd
Re: Lots of Polish spam
Posted by John Hardin <jh...@impsec.org>.
On Tue, 24 Feb 2015, Yves Goergen wrote:
> for a few months I'm getting lots of Polish spam to one of my e-mail
> addresses, sometimes a dozen per day. I have no idea what it's telling me, I
> don't understand a single word.
>
> SpamAssassin doesn't seem to be too successful in filtering them out.
>
> Does anybody have an idea how to stop that? Are there special rule sets for
> that?
If you don't have any users who speak Polish, then Bayes would do a good
job catching them.
I get a lot of spam in Chinese, Portuguese and Spanish and it all scores
BAYES_999.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
An operating system design that requires a system reboot in order to
install a document viewing utility does not earn my respect.
-----------------------------------------------------------------------
10 days until Dawn reaches Ceres