You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "David F. Skoll" <df...@roaringpenguin.com> on 2014/11/07 17:41:30 UTC
New spam / phishing rule?
Hi,
I've seen a couple of hundred phishing emails come in that all had an
attachment of type "application/html" which is (of course) bogus.
I've put in a rule to block these and will see how it goes.
I've put an example up at http://pastebin.com/M3dRp4dD
with only slight editing to hide the actual recipient's name.
Regards,
David.
Re: New spam / phishing rule?
Posted by Axb <ax...@gmail.com>.
On 11/07/2014 05:41 PM, David F. Skoll wrote:
> Hi,
>
> I've seen a couple of hundred phishing emails come in that all had an
> attachment of type "application/html" which is (of course) bogus.
>
> I've put in a rule to block these and will see how it goes.
> I've put an example up at http://pastebin.com/M3dRp4dD
> with only slight editing to hide the actual recipient's name.
commiting a mimeheader rule to my sandbox...
Re: New spam / phishing rule?
Posted by LuKreme <kr...@kreme.com>.
On Nov 8, 2014, at 5:54 PM, Reindl Harald <h....@thelounge.net> wrote:
> Am 09.11.2014 um 01:48 schrieb Dave Pooser:
>> On 11/8/14, 5:57 PM, "Reindl Harald" <h....@thelounge.net> wrote:
>>
>>> what is that garbage worth for?
>>
>> It's from a book by Terry Pratchett. Are we really so hard up for things to talk about that we're going to have a .sig flamewar now?
>
> it's not a matter of "hard"
> it's a matter of sending 1 line followed by 10 or more garbage
Feel free to bin/killfile/spam-tag my my posts. Makes less than no difference to me. That would be far more effective than complaining about it.
--
'It's a lovely morning, lads,' he said. 'I feel like a million dollars.
Don't you?' There was a murmur of reluctant agreement. 'Good,' said
Cohen. 'Let's go and get some.' --Interesting Times
Re: New spam / phishing rule?
Posted by Benny Pedersen <me...@junc.eu>.
On November 9, 2014 2:12:16 AM John Hardin <jh...@impsec.org> wrote:
> Yep. .sig flamewar. Sigh.
Thats why i use no sig at all, please dont copy me :)
Re: New spam / phishing rule?
Posted by John Hardin <jh...@impsec.org>.
On Sun, 9 Nov 2014, Reindl Harald wrote:
> Am 09.11.2014 um 01:48 schrieb Dave Pooser:
>> On 11/8/14, 5:57 PM, "Reindl Harald" <h....@thelounge.net> wrote:
>>
>> > what is that garbage worth for?
>>
>> It's from a book by Terry Pratchett. Are we really so hard up for things
>> to talk about that we're going to have a .sig flamewar now?
>
> it's not a matter of "hard"
> it's a matter of sending 1 line followed by 10 or more garbage
Yep. .sig flamewar. Sigh.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Activist: Someone who gets involved.
Unregistered Lobbyist: Someone who gets involved with something
the MSM doesn't approve of. -- WizardPC
-----------------------------------------------------------------------
3 days until Veterans Day
Re: New spam / phishing rule?
Posted by Reindl Harald <h....@thelounge.net>.
Am 09.11.2014 um 01:48 schrieb Dave Pooser:
> On 11/8/14, 5:57 PM, "Reindl Harald" <h....@thelounge.net> wrote:
>
>> what is that garbage worth for?
>
> It's from a book by Terry Pratchett. Are we really so hard up for things
> to talk about that we're going to have a .sig flamewar now?
it's not a matter of "hard"
it's a matter of sending 1 line followed by 10 or more garbage
Re: New spam / phishing rule?
Posted by Dave Pooser <da...@pooserville.com>.
On 11/8/14, 5:57 PM, "Reindl Harald" <h....@thelounge.net> wrote:
>what is that garbage worth for?
It's from a book by Terry Pratchett. Are we really so hard up for things
to talk about that we're going to have a .sig flamewar now?
--
Dave Pooser
Cat-Herder-in-Chief, Pooserville.com
Programming: The profession of progressing from "WTF?" to "Oh, duh."
Re: New spam / phishing rule?
Posted by Reindl Harald <h....@thelounge.net>.
Am 09.11.2014 um 00:51 schrieb LuKreme:
> On Nov 7, 2014, at 10:03 AM, Benny Pedersen <me...@junc.eu> wrote:
>>
>> What mua clients shows invalid mimetypes ?
>
> Most all of them
"thank you" for your "fortune footer" in the name of everybody trying to
train ham messages for bayes......
what is that garbage worth for?
__________________________________________________
He'd never asked for an exciting life. What he really liked, what he
sought on every occasion, was boredom. The trouble was that boredom
tended to explode in your face. Just when he thought he'd found it he'd
be suddenly involved in what he supposed other people - thoughtless,
feckless people - would call an adventure. And he'd be forced to visit
many strange lands and meet exotic and colourful people, although not
for very long because usually he'd be running. He'd seen the creation of
the universe, although not from a good seat, and had visited Hell and
the afterlife. He'd been captured, imprisoned, rescued, lost and
marooned. Sometimes it had all happened on the same day.
Re: New spam / phishing rule?
Posted by LuKreme <kr...@kreme.com>.
On Nov 7, 2014, at 10:03 AM, Benny Pedersen <me...@junc.eu> wrote:
>
> What mua clients shows invalid mimetypes ?
Most all of them.
--
He'd never asked for an exciting life. What he really liked, what he
sought on every occasion, was boredom. The trouble was that boredom
tended to explode in your face. Just when he thought he'd found it he'd
be suddenly involved in what he supposed other people - thoughtless,
feckless people - would call an adventure. And he'd be forced to visit
many strange lands and meet exotic and colourful people, although not
for very long because usually he'd be running. He'd seen the creation of
the universe, although not from a good seat, and had visited Hell and
the afterlife. He'd been captured, imprisoned, rescued, lost and
marooned. Sometimes it had all happened on the same day.
Re: MUAs and invalid MIME type handling (was Re: New spam / phishing rule?)
Posted by Benny Pedersen <me...@junc.eu>.
On November 7, 2014 6:06:40 PM "David F. Skoll" <df...@roaringpenguin.com> wrote:
> > What mua clients shows invalid mimetypes ?
> Microsoft, thank you... if the attachment name ends in ".htm" or ".html" it
> is treated as HTML regardless of MIME type.
Microsoft could fix this in a monthly bugfix update for dangerous software
fix :)
> Actually, most MUAs do this. There are an unbelievable number of MIME
> generators that attach everything (PDFs, spreadsheets, whatever) as
> application/octet-stream so MUAs are forced to guess the real MIME type
> based on the filename or based on sniffing the content. :(
I think i will submit this as my first mime signature to clamav and
hopefull get it signed with clamav team as a good signature, so clients
stop using badly writed software
> The current state of email sucks, in case nobody's noticed.
I have, currently i think there is a bug in libspf2 1.2.10, used here in
opendmarc 1.3.0, problem i see is that pypolicyd-spf does not agre with
same results as libspf2, hmm
And its weekend here :)
MUAs and invalid MIME type handling (was Re: New spam / phishing
rule?)
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Fri, 07 Nov 2014 18:03:32 +0100
Benny Pedersen <me...@junc.eu> wrote:
> What mua clients shows invalid mimetypes ?
Microsoft, thank you... if the attachment name ends in ".htm" or ".html" it
is treated as HTML regardless of MIME type.
Actually, most MUAs do this. There are an unbelievable number of MIME
generators that attach everything (PDFs, spreadsheets, whatever) as
application/octet-stream so MUAs are forced to guess the real MIME type
based on the filename or based on sniffing the content. :(
The current state of email sucks, in case nobody's noticed.
Regards,
David.
Re: New spam / phishing rule?
Posted by Benny Pedersen <me...@junc.eu>.
On November 7, 2014 5:41:30 PM "David F. Skoll" <df...@roaringpenguin.com> wrote:
> I've seen a couple of hundred phishing emails come in that all had an
> attachment of type "application/html" which is (of course) bogus.
What mua clients shows invalid mimetypes ?