You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Michael Orlitzky <mi...@orlitzky.com> on 2012/09/05 17:47:29 UTC
Sensitivity of FILL_THIS_FORM_SHORT (score: 2.556)
It looks to me like this score is much too high given how easy it is to
match. FILL_THIS_FORM_SHORT matches either __FILL_THIS_FORM_SHORT1 or
__FILL_THIS_FORM_SHORT2, and the second is more lenient:
body __FILL_THIS_FORM_SHORT2
/(?:<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){3}/i
which contains...
replace_tag FF_YOUR
(?:a?\s?copy\sof\s)?
(?:(?:your|din|seu)[\s,:]{1,5})?
(?:present\s|c[uo]rrent\s|full(?:st[\xe4]ndigt)?\s?|complete\s|direct
\s|private?\s|valid\s|personal\s|nuvarande\s|vollst[\xe4]ndige
\s|aktuelle\s){0,3}
Optional group, optional group, and a match on zero occurences. The
entire thing is optional. So FILL_THIS_FORM_SHORT can be reduced to,
/(?:<FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){3,}/i
First, let's look at FF_SUFFIX:
FF_SUFFIX
(?:\sin\s(?:full|words)|\scompleto)?:?(?:\s?[({][^)}]{1,30}[)}])?
Optional, optional. The whole thing is optional, so we can remove that,
too. All that's left is,
/(?:<FF_ALL>(?:<FF_BLANK2>|<ANDOR>)){3,}/i
So all we're really matching is 3 or more occurrences of FF_ALL, and
that matches a lot of stuff. If I'm reading everything right, any
lengthy email is likely to hit it. My recent logwatch reports show it
hitting more ham than spam, which makes sense for something like
HTML_MESSAGE but not when it's scoring >2.5 points.
Re: Sensitivity of FILL_THIS_FORM_SHORT (score: 2.556)
Posted by John Wilcock <jo...@tradoc.fr>.
Le 06/09/2012 18:34, John Hardin a écrit :
> ...yeah, the _PARTIAL versions are intended to catch a form that's
> spread out over several paragraphs or HTML sections. Unfortunately
> there's no way to tell a rule to match multiple times but not for a
> string it has already matched.
Yes, I've seen similar with "Tel:" in a signature getting repeated
multiple times due to people quoting all messages in a long exchange of
e-mail.
John.
--
-- Over 5000 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages - www.tradoc.fr
Re: Sensitivity of FILL_THIS_FORM_SHORT (score: 2.556)
Posted by John Hardin <jh...@impsec.org>.
On Thu, 6 Sep 2012, Michael Orlitzky wrote:
> On 09/05/2012 01:07 PM, John Hardin wrote:
>> On Wed, 5 Sep 2012, Michael Orlitzky wrote:
>>
>>> My recent logwatch reports show it hitting more ham than spam,
>>
>> If you could send me offline the rule hits for the hams it's hitting at
>> your site that would help. That should be an easy grep of your maillog.
>>
>> Its primary use is for metas (e.g. a short fill-in form plus mention of
>> millions of dollars _is_ reasonably suspicious); its apparent utility as a
>> standalone rule may be artificially emphasized in masschecks if the
>> masscheck corpus is deficient in ham that includes short fill-in forms.
>>
>
> I'll still send my logs,
Thanks.
> but I was wrong about which subrule was causing
> trouble. It's,
>
> meta __FILL_THIS_FORM_SHORT ...
> (__FILL_THIS_FORM_PARTIAL > 2 || __FILL_THIS_FORM_PARTIAL_RAW > 2)
>
> body __FILL_THIS_FORM_PARTIAL
> /^\s?<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>
> (?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20){1,4}$)/im
> I ran with -D on the message that brought this
> to my attention, and this is what triggered it:
>
> Sep 6 11:58:36.169 [10858] dbg: rules: ran body rule
> __FILL_THIS_FORM_PARTIAL ======> got hit: "Address:
> Sep 6 11:58:36.169 [10858] dbg: rules: [...] "
>
> Sep 6 11:58:36.170 [10858] dbg: rules: ran body rule
> __FILL_THIS_FORM_PARTIAL ======> got hit: "Address:
> Sep 6 11:58:36.170 [10858] dbg: rules: [...] "
>
> Sep 6 11:58:36.189 [10858] dbg: rules: ran body rule
> __FILL_THIS_FORM_PARTIAL ======> got hit: "Address:
> Sep 6 11:58:36.189 [10858] dbg: rules: [...] "
>
> Sep 6 11:58:36.191 [10858] dbg: rules: ran body rule
> __FILL_THIS_FORM_PARTIAL ======> got hit: "Address:
> Sep 6 11:58:36.191 [10858] dbg: rules: [...] "
>
>
> Just >2 mentions of an address, anywhere in the message.
...yeah, the _PARTIAL versions are intended to catch a form that's spread
out over several paragraphs or HTML sections. Unfortunately there's no way
to tell a rule to match multiple times but not for a string it has already
matched.
The score limit will go out with the next rule update.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Gun Control is marketed to the public using the appealing delusion
that violent criminals will obey the law.
-----------------------------------------------------------------------
11 days until the 225th anniversary of the signing of the U.S. Constitution
Re: Sensitivity of FILL_THIS_FORM_SHORT (score: 2.556)
Posted by Michael Orlitzky <mi...@orlitzky.com>.
On 09/05/2012 01:07 PM, John Hardin wrote:
> On Wed, 5 Sep 2012, Michael Orlitzky wrote:
>
>> My recent logwatch reports show it hitting more ham than spam,
>
> If you could send me offline the rule hits for the hams it's hitting at
> your site that would help. That should be an easy grep of your maillog.
>
> Its primary use is for metas (e.g. a short fill-in form plus mention of
> millions of dollars _is_ reasonably suspicious); its apparent utility as a
> standalone rule may be artificially emphasized in masschecks if the
> masscheck corpus is deficient in ham that includes short fill-in forms.
>
I'll still send my logs, but I was wrong about which subrule was causing
trouble. It's,
meta __FILL_THIS_FORM_SHORT ...
(__FILL_THIS_FORM_PARTIAL > 2 || __FILL_THIS_FORM_PARTIAL_RAW > 2)
body __FILL_THIS_FORM_PARTIAL
/^\s?<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>
(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20){1,4}$)/im
In my previous message I mentioned that FF_YOUR and FF_SUFFIX always
match, so this is just,
(?:<FF_ALL>){1,3}(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20){1,4}$)
But those matches can show up anywhere in the body, not necessarily
adjacent to one another. I ran with -D on the message that brought this
to my attention, and this is what triggered it:
Sep 6 11:58:36.169 [10858] dbg: rules: ran body rule
__FILL_THIS_FORM_PARTIAL ======> got hit: "Address:
Sep 6 11:58:36.169 [10858] dbg: rules: [...] "
Sep 6 11:58:36.170 [10858] dbg: rules: ran body rule
__FILL_THIS_FORM_PARTIAL ======> got hit: "Address:
Sep 6 11:58:36.170 [10858] dbg: rules: [...] "
Sep 6 11:58:36.189 [10858] dbg: rules: ran body rule
__FILL_THIS_FORM_PARTIAL ======> got hit: "Address:
Sep 6 11:58:36.189 [10858] dbg: rules: [...] "
Sep 6 11:58:36.191 [10858] dbg: rules: ran body rule
__FILL_THIS_FORM_PARTIAL ======> got hit: "Address:
Sep 6 11:58:36.191 [10858] dbg: rules: [...] "
Just >2 mentions of an address, anywhere in the message.
Re: Sensitivity of FILL_THIS_FORM_SHORT (score: 2.556)
Posted by John Hardin <jh...@impsec.org>.
On Wed, 5 Sep 2012, Michael Orlitzky wrote:
> So all we're really matching is 3 or more occurrences of FF_ALL, and
> that matches a lot of stuff.
...but all of that looks like name/address/other-personal-info stuff, all
adjacent.
> If I'm reading everything right, any lengthy email is likely to hit it.
I wouldn't say that; few lengthy emails will have something that looks
like a fill-in form. It is, however, unavoidably sensitive to short
sequences of stuff that looks like a fill-in form, which does have FP
potential.
> My recent logwatch reports show it hitting more ham than spam,
If you could send me offline the rule hits for the hams it's hitting at
your site that would help. That should be an easy grep of your maillog.
Its primary use is for metas (e.g. a short fill-in form plus mention of
millions of dollars _is_ reasonably suspicious); its apparent utility as a
standalone rule may be artificially emphasized in masschecks if the
masscheck corpus is deficient in ham that includes short fill-in forms.
> which makes sense for something like HTML_MESSAGE but not when it's
> scoring >2.5 points.
I will put a reasonable upper limit on those rules, and review the
overlaps for more FP reduction when the overlap reports are fixed.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Any time law enforcement becomes a revenue center, the system
becomes corrupt.
-----------------------------------------------------------------------
12 days until the 225th anniversary of the signing of the U.S. Constitution