You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by fe...@apache.org on 2006/08/01 19:22:32 UTC
svn commit: r427653 - /spamassassin/rules/trunk/sandbox/felicity/70_other.cf
Author: felicity
Date: Tue Aug 1 10:22:31 2006
New Revision: 427653
URL: http://svn.apache.org/viewvc?rev=427653&view=rev
Log:
more test rule work, try to address FP issues with TVD_FW_GRAPHIC_ID3
Modified:
spamassassin/rules/trunk/sandbox/felicity/70_other.cf
Modified: spamassassin/rules/trunk/sandbox/felicity/70_other.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/felicity/70_other.cf?rev=427653&r1=427652&r2=427653&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/felicity/70_other.cf (original)
+++ spamassassin/rules/trunk/sandbox/felicity/70_other.cf Tue Aug 1 10:22:31 2006
@@ -139,16 +139,23 @@
# 5.679 6.6610 0.0203 0.997 0.92 1.00 TVD_FW_GRAPHIC_ID1
# 0.339 0.3980 0.0000 1.000 0.50 1.00 TVD_FW_GRAPHIC_ID2
-# 0.908 1.0658 0.0000 1.000 1.00 0.01 TVD_FW_GRAPHIC_ID3
mimeheader TVD_FW_GRAPHIC_ID1 Content-Id =~ /<[0-9a-f]{12}(?:\$[0-9a-f]{8}){2}\@/
mimeheader TVD_FW_GRAPHIC_ID2 Content-Id =~ /<(?:[0-9A-F]{8}\.){3}[0-9A-F]{8}/
-mimeheader TVD_FW_GRAPHIC_ID3 Content-Id =~ /<image\d+\.gif\@/
+
+# 0.908 1.0658 0.0000 1.000 1.00 0.01 TVD_FW_GRAPHIC_ID3
+# this appears to be a standard CID for Outlook so it FPs
+# the spams appear to let the MTA create the Message-ID, so I think that's
+# what we need to key off for this...
+mimeheader __TVD_OUTLOOK_IMG Content-Id =~ /<image\d+\.(?:gif|jpe?g|png)\@/
mimeheader TVD_FW_GRAPHIC_NAME_LONG Content-Type =~ /\bname="[a-z]{8,}\.gif/
mimeheader TVD_FW_GRAPHIC_NAME_MID Content-Type =~ /\bname="[a-z]{6,7}\.gif/
endif
+uri __TVD_INT_CID /^cid:/i
+meta TVD_FW_GRAPHIC_ID3 __TVD_OUTLOOK_IMG && __TVD_INT_CID && !__UNUSABLE_MSGID && ! (__OE_MSGID_2 || __IMS_MSGID )
+meta TVD_FW_GRAPHIC_ID3_2 __TVD_OUTLOOK_IMG && !__UNUSABLE_MSGID && ! (__OE_MSGID_2 || __IMS_MSGID )
# 0.353 0.4186 0.0000 1.000 1.00 0.01 TVD_GOT_UR
# 0.319 0.3774 0.0000 1.000 0.80 0.01 TVD_HAPPY_WITH
@@ -239,6 +246,14 @@
loadplugin Mail::SpamAssassin::Plugin::Sandbox::felicity sandbox-felicity.pm
ifplugin Mail::SpamAssassin::Plugin::Sandbox::felicity
+# It came up on the users@ list that some spammers generate base64 encoded
+# parts with a single or a handful of long lines over the standard length,
+# which hovers around 77 chars on average.
+# 1.632 1.9658 0.0000 1.000 0.90 0.01 T_BASE64_LENGTH_78
+# 1.628 1.9611 0.0000 1.000 0.90 0.01 T_BASE64_LENGTH_79
+# 1.627 1.9593 0.0000 1.000 0.90 0.01 T_BASE64_LENGTH_80
+# 1.100 1.3246 0.0000 1.000 0.87 0.01 T_BASE64_LENGTH_90
+
body BASE64_LENGTH_78 eval:check_base64_length('78')
body BASE64_LENGTH_79 eval:check_base64_length('79')
body BASE64_LENGTH_80 eval:check_base64_length('80')
@@ -246,6 +261,17 @@
endif
########################################################################
+# these don't have a large enough hitrate to be real rules, but it may be
+# useful to track over time since they are 100% definite obfuscation
+# techniques -- and both HEX and OCT may be used at the same time...
+#
+# 0.029 0.0344 0.0025 0.933 0.50 0.01 T_TVD_IP_HEX
+# 0.014 0.0168 0.0000 1.000 0.48 0.01 T_TVD_IP_SING_HEX
+# 0.007 0.0079 0.0012 0.864 0.46 0.01 T_TVD_IP_OCT
+#
+# http://0x7f000001/
uri T_TVD_IP_SING_HEX m@^https?://0x[0-9a-f]+(?:[:/]|$)@i
+# http://0x7f.0.0.1/
uri T_TVD_IP_HEX m@^https?://(?:\d+\.){0,3}0x[0-9a-f]{2}@i
+# http://0177.0.0.1/
uri T_TVD_IP_OCT m@^https?://(?:(?:0x[0-9a-f]+|\d+)\.){0,3}0+(?:[1-3][0-7]{0,2}|[4-7][0-7]?)(?:\.(?:0x[0-9a-f]+|\d+)){0,3}(?:[:/]|$)@i