How did this bypass a simple rule?

[Charles Gregory <cg...@hwcn.org>]

Because I don't want to trigger your SA, a V-drug rule has been replaced
with 'Pinopin' in this question:

I get a message that includes the text,

P*ino*pinPain Killers

It is not broken up by HTML code, nor is it BASE64'ed....

I have a rule that reads:
body LOC_PINOPINBO
/(?!pinopin)p[_\W]?[i1l\|][_\W]?n[_\W]?[o0\@a][_\W]?p[_\W]?[i1l\|][_\W]?n/i

Didn't match. Any suggestions????????

- Charles

Re: [spa] Re: How did this bypass a simple rule?

[Charles Gregory <cg...@hwcn.org>]

On Thu, 20 May 2004, Matt Kettler wrote:
> It is possible that the character in question was a high-bit char. You did 
> some text substitution so that could have changed things.

Yes, I wasn't expecting people to be able to 'test' what I mailed, but I
was hoping someone would recognize the description/conditions I listed.

> Any chance you can send me the exact string and exact rule that failed to 
> match? (in an off-list message if you don't want to post it to the list)

Sorry. It got munched. The 'text' is still there, but my saved copy now
passes my check. Which really makes me suspect either a high bit
character, or an embedded non-printable character that spoiled the test.
I thought I saved the original, but it was gone. Ooops.

> Well * is DEFINIETLY a part of the \W class.

Well, yeah, I thought so, but I'm grasping at straws here. :-)

> Yes, it would require mime headers. I'd made that guess since you only 
> pasted a sample string and no other information.

Sorry, I thought I'd made it plain (pun intended) that this was a very
ordinary, single-part message. No mime, no characterset specifcations.
Whatever they did was buried in there. Either that or my local.cf file
just barfed for some reason (it was linting okay, but I've updated it
today, so that might have made a difference.....).

Anyways, I will try the print body idea, or convert this puppy to hex next
time I get one..... And if it is a new spammer trick, you know I'll get
one. :-)

Thanks!

- Charles

Re: How did this bypass a simple rule?

[Matt Kettler <mk...@evi-inc.com>]

At 02:52 PM 5/20/2004, Charles Gregory wrote:
>  SA triggered fine on a URI rule in the same
>message, and there were no 'mime parts' to confuse it. My best guess is
>that one of the characters is somehow not really alphabetic, but is like a
>'high bit' version of the letter?

It is possible that the character in question was a high-bit char. You did 
some text substitution so that could have changed things.

Any chance you can send me the exact string and exact rule that failed to 
match? (in an off-list message if you don't want to post it to the list)

>Or maybe '*' is not part of the \W
>class?

Well * is DEFINIETLY a part of the \W class. I actually copy-pasted your 
rule and text into a test config and test message. The rule hit your sample 
text, complete with *'s, just fine.



> > I'd venture to guess the original message has some weird mime tricks
> > that are confusing SA's mime parser.
>
>Wouldn't that require mime headers/sections?
>Why would a URI parse fine, but the text not?

Yes, it would require mime headers. I'd made that guess since you only 
pasted a sample string and no other information.

Re: How did this bypass a simple rule?

[Kris Deugau <kd...@webhart.net>]

Charles Gregory wrote:
> Anyways, here is the original message..... as you can see it's single
> part, with no fancy charactersets.....
> 
> ---------- Forwarded message ----------

[snip]

> A guy is taking a walk and sees a frog on the side of the road. As he
> comes closer, the frog starts to talk. "Kiss me and I will turn into

[snip]

> A man and a woman walk into a very posh Rodeo Drive store. "Show the
> lady your finest mink!" the fellow exclaims. So the owner of the shop

I'm almost considering a set of rules for these jokes.  One joke per
rule, score 1.5-ish each.  That extra 3 points would push most of these
over the default 5 threshold without any further effort.  These make up
the bulk of the FNs reported by customers over the past few weeks...

-kgd
-- 
"Sendmail administration is not black magic.  There are legitimate
technical reasons why it requires the sacrificing of a live chicken."
   - Unknown

Re: How did this bypass a simple rule?

[Charles Gregory <cg...@hwcn.org>]

On Thu, 20 May 2004, Fred wrote:
> Post the message to this group or upload it and post a link.  That way, we
> can look to see if something is odd / wrong with that message.

I deleted the original, but I found a copy that I sent myself as a test.
Oddly enough, the test also failed to match the rule, but if I try to
resend the 'sent-mail' copy (this is all in Pine) of the test, NOW it
triggers the rule. (shake head)

Next time I get one of these, I will try the 'body print' idea. Thanks!

Anyways, here is the original message..... as you can see it's single
part, with no fancy charactersets.....

---------- Forwarded message ----------
Return-Path: <le...@v-sexi.com>
Delivered-To: charles@xxxxxx.net
Received: from v-sexi.com (unknown [218.72.109.85])
	by sheppard1.xxxxxx.net (Postfix) with SMTP
	id 2275F1C3A8; Thu, 20 May 2004 11:09:03 -0400 (EDT)
Message-ID: <56...@v-sexi.com>
Date: Thu, 20 May 2004 03:49:28 -1000
From: "edmund zamudio" <le...@v-sexi.com>
User-Agent: MIME-tools 5.503 (Entity 5.501)
MIME-Version: 1.0
To: "shirley depriest" <bn...@xxxxx.net>
Cc: "otha asbury" <ch...@xxxxx.net>,
	"irving notari" <cx...@xxxxx.net>,
	"troy alleman" <ab...@xxxxx.net>,
	"ignacio mashburn" <bt...@xxxxx.net>
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Virus-Status: No
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on 
	king.xxxx.org
X-Spam-Level: **
X-Spam-Status: No, hits=2.5 required=3.5 autolearn=no tests=RCVD_IN_SORBS=0.1,
	URI_OFFERS=2.373
Subject: [2.5] Swmcc Rx Center

aesculaap  doswaiteventsem  dbconvert  


Get The Most Popular Medications Now!

V*ico*dinPain Killers

Make it easy for you to order meds. 

D W http://ml.info.peakoffer.com/abc/luck/


To exclude yourself from future 0ffers, please go visit our we,bpage

A guy is taking a walk and sees a frog on the side of the road. As he comes
closer, the frog starts to talk. "Kiss me and I will turn into a princess."
The guy picks the frog up and puts it in his pocket. The frog starts
shouting, "Hey! Didn't you hear me? I'm a Princess. Just kiss me and I will
be yours." The guy takes the frog out of his pocket and smiles at it and
puts it back. The frog is really frustrated. "I don't get it. Why won't you
kiss me? I will turn into a beautiful princess and do anything you ask." The
guy says, "Look, I'm a computer geek. I don't have time for girls. But a
talking frog is cool.!"
A man and a woman walk into a very posh Rodeo Drive store. "Show the lady
your finest mink!" the fellow exclaims. So the owner of the shop goes in
back and comes out with an absolutely gorgeous full-length coat. As the lady
tries it on, the owner discreetly whispers to the man, "Ah, sir, that
particular fur goes for $65,000." "No problem! I'll write you a check!"
"Very good, sir." says the shop owner. "Today is Saturday. You may come by
on Monday to pick it up, after the check has cleared." So the man and the
woman leave. On Monday, the fellow returns. The store owner is outraged,
"How dare you show your face in here?! There wasn't a single penny in your
checking account!!""I just had to come by," grinned the guy, "to thank you
for the most wonderful weekend of my life!"
hyotto9jumokuno05kyotai,koigatak konzyaku. 

--------------- fin ----------------

- Charles

Re: How did this bypass a simple rule?

[Fred <sp...@freddyt.com>]

Charles Gregory wrote:
> Well, yes, that's the whole point. The message *looked* like 'ordinary
> text', but failed to match. SA triggered fine on a URI rule in the
> same message, and there were no 'mime parts' to confuse it. My best
> guess is that one of the characters is somehow not really alphabetic,
> but is like a 'high bit' version of the letter? Or maybe '*' is not
> part of the \W class?


Post the message to this group or upload it and post a link.  That way, we
can look to see if something is odd / wrong with that message.

If you would rather figure this out yourself, add this rule to your local.cf
file:
body    PRINTBODY /(^.*$)(?{ print "Body:\n$^N\nEnd Body\n" })/i

Then run the same message through SpamAssassin using -D for debug and watch
the output, it'll show you what SA sees as the body text and output exactly
what the rules would see when they run.  Remember to always remove this rule
when done with it, it'll always score 1 point if not!

This has saved me troubles many times, for example, I was writing a rule to
catch multiple spaces between specific words and I found that "body" tests
was removing all unnessary spaces and causing my tests to break.  For the
life of me, it was a simple regex looking for 3 or more spaces and I
couldn't get it to work.   After using this test rule, it showed me how the
extra spaces were removed before the rule ran, and that's why my rules
weren't firing.

HTH


Frederic Tarasevicius
Internet Information Services, Inc.
http://www.i-is.com/
810-794-4400
mailto:info@i-is.com

Re: How did this bypass a simple rule?

[Charles Gregory <cg...@hwcn.org>]

On Thu, 20 May 2004, Matt Kettler wrote:
> >P*ino*pinPain Killers
> >body LOC_PINOPINBO
> >/(?!pinopin)p[_\W]?[i1l\|][_\W]?n[_\W]?[o0\@a][_\W]?p[_\W]?[i1l\|][_\W]?n/i
> >Didn't match. Any suggestions????????
> It matches just fine on my system when I insert it into an ordinary 
> text/plain message.

Well, yes, that's the whole point. The message *looked* like 'ordinary
text', but failed to match. SA triggered fine on a URI rule in the same
message, and there were no 'mime parts' to confuse it. My best guess is
that one of the characters is somehow not really alphabetic, but is like a
'high bit' version of the letter? Or maybe '*' is not part of the \W
class?

> I'd venture to guess the original message has some weird mime tricks
> that are confusing SA's mime parser.

Wouldn't that require mime headers/sections? 
Why would a URI parse fine, but the text not?

- Charles

Re: How did this bypass a simple rule?

[Matt Kettler <mk...@evi-inc.com>]

At 12:36 PM 5/20/2004, Charles Gregory wrote:
>Because I don't want to trigger your SA, a V-drug rule has been replaced
>with 'Pinopin' in this question:
>
>I get a message that includes the text,
>
>P*ino*pinPain Killers
>
>It is not broken up by HTML code, nor is it BASE64'ed....
>
>I have a rule that reads:
>body LOC_PINOPINBO
>/(?!pinopin)p[_\W]?[i1l\|][_\W]?n[_\W]?[o0\@a][_\W]?p[_\W]?[i1l\|][_\W]?n/i
>
>Didn't match. Any suggestions????????

It matches just fine on my system when I insert it into an ordinary 
text/plain message.



I'd venture to guess the original message has some weird mime tricks that 
are confusing SA's mime parser.