You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Don Newcomer <ne...@dickinson.edu> on 2004/05/10 14:24:04 UTC
Software (fwd)
This is becomeing more and more of an issue for me. I'm using MailScanner
4.30.3 and SpamAssassin 2.63. I've whitelisted anything from
"dickinson.edu" so as to prevent any campus mailings from being labeled as
spam. Now I've run into forged headers that list "xxx@dickinson.edu" as
the sender and they're being whitelisted. The attached message was
interesting in that the only place "dickinson.edu" is listed is in the
"X-MailScanner-From" line (and they chose my own address to boot). I'm
open to suggestions here. It hasn't happened too often but you know it'll
pick up as time goes on. Thanks.
Don Newcomer
Senior Manager, Systems
Infrastructure Systems Department
Library and Information Services
Dickinson College
P.O. Box 1773
Carlisle, PA 17013
717-245-1256 (Voice)
717-245-1690 (FAX)
newcomer@dickinson.edu
Re: FORGED_MUA_OUTLOOK
Posted by Ragnar Paulson <ra...@wanware.com>.
Never mind ... I just realized that this e-mail came in via a not yet upgraded SpamAssassin and this may be due to a known
bug http://bugzilla.spamassassin.org/show_bug.cgi?id=2022
I'll have 2.63 into production real soon.
Ragnar
----- Original Message -----
From: "Ragnar Paulson" <ra...@wanware.com>
To: <sp...@incubator.apache.org>
Sent: Thursday, May 13, 2004 10:24 AM
Subject: FORGED_MUA_OUTLOOK
>
> A couple of days ago I suggested ignoring the whitelist if the headers appeared forged. Now I've been bitten by doing exactly that,
> one of our suppliers sends me legitimate e-mail that always gets flagged with FORGED_MUA_OUTLOOK (2.2), the fact he sends e-mail high priority (1.9 + 0.4) and it was discussing a legitimate marketing partnership (2.1) blew it out of the water. However all
> would have been saved by the whitelist except for the fact I have a rule that undoes whitelisting due to FORGED_MUA_OUTLOOK. How does SpamAssassin determine the header is forged, and any ideas why this would happen
> on a legitimate e-mail? Perhaps because it originated in Germany? Headers follow with some e-mail addresses removed for
> privacy.
>
> Ragnar
>
> Return-Path: <xx...@xxxxxx.de>
> Received: from xxxx.xxxxx.com (xxxx.xxxxx.com [ipaddress])
> by ns2.wanware.com (8.11.6p2/8.11.6) with ESMTP id i4D8O4505876;
> Thu, 13 May 2004 04:24:05 -0400
> Received: from localhost (unknown [127.0.0.1])
> by xxxx.xxxxx.com (XXXXX Postfix) with ESMTP
> id E61108BC8D; Thu, 13 May 2004 10:23:52 +0200 (CEST)
> Received: from XXXXXXXX (xxxxxxxxxx.de [ipaddress])
> (using TLSv1 with cipher RC4-MD5 (128/128 bits))
> (No client certificate requested)
> by xxxx.xxxxx.com (XXXXX Postfix) with ESMTP
> id 1CFC48BC8D; Thu, 13 May 2004 10:23:51 +0200 (CEST)
> From: "Name" <xx...@xxxxx.de>
> To: "'Ragnar Paulson'" <ra...@wanware.com>
> Subject: FW: Distributor Contract
> Date: Thu, 13 May 2004 10:23:55 +0200
> Organization:
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="----=_NextPart_000_001E_01C438D4.65D33820"
> X-Priority: 1 (Highest)
> X-MSMail-Priority: High
> X-Mailer: Microsoft Office Outlook, Build 11.0.5510
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
> Thread-Index: AcQx9eDxPOifNvOoQ/Cd04r3rGFRcgGzOEUA
> Importance: High
> Message-Id: <20...@xxxx.xxxxx.com>
> X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.25.0.3; VDF 6.25.0.61
> X-Spam-Status: Yes, hits=5.7 required=3.0
> tests=BAYES_30,FORGED_MUA_OUTLOOK,MARKETING_PARTNERS,
> MISSING_OUTLOOK_NAME,TSG_UNWHITELIST,USER_IN_WHITELIST,
> X_MSMAIL_PRIORITY_HIGH,X_PRIORITY_HIGH
> version=2.54-sentinet
> X-Spam-Level: *****
> X-Spam-Checker-Version: SpamAssassin 2.54-sentinet (1.174.2.17-2003-05-11-exp)
> X-Spam-Report: This mail is probably spam. The original message has been attached
> along with this report, so you can recognize or block similar unwanted
> mail in future. See http://spamassassin.org/tag/ for more details.
> Content preview: Dear Ragnar, We thank you for your decision
> to become our official partner in Canada. It is a pleasure for us to do
> business with your company and we are sure that the future will show
> the mutual benefit resulted from our contract. [...]
> Content analysis details: (5.70 points, 3 required)
> X_MSMAIL_PRIORITY_HIGH (0.4 points) Sent with 'X-Msmail-Priority' set to high
> X_PRIORITY_HIGH (1.9 points) Sent with 'X-Priority' set to high
> MARKETING_PARTNERS (2.1 points) BODY: Claims you registered with some kind of partner
> BAYES_30 (-0.9 points) BODY: Bayesian classifier says spam probability is 30 to 40%
> [score: 0.3753]
> USER_IN_WHITELIST (-100.0 points)From: address is in the user's white-list
> FORGED_MUA_OUTLOOK (2.2 points) Forged mail pretending to be from MS Outlook
> MISSING_OUTLOOK_NAME (0.0 points) Message looks like Outlook, but isn't
> TSG_UNWHITELIST (100.0 points)Undo SpamAssassin Whitelisting
> X-Spam-Flag: YES
>
FORGED_MUA_OUTLOOK
Posted by Ragnar Paulson <ra...@wanware.com>.
A couple of days ago I suggested ignoring the whitelist if the headers appeared forged. Now I've been bitten by doing exactly that,
one of our suppliers sends me legitimate e-mail that always gets flagged with FORGED_MUA_OUTLOOK (2.2), the fact he sends e-mail high priority (1.9 + 0.4) and it was discussing a legitimate marketing partnership (2.1) blew it out of the water. However all
would have been saved by the whitelist except for the fact I have a rule that undoes whitelisting due to FORGED_MUA_OUTLOOK. How does SpamAssassin determine the header is forged, and any ideas why this would happen
on a legitimate e-mail? Perhaps because it originated in Germany? Headers follow with some e-mail addresses removed for
privacy.
Ragnar
Return-Path: <xx...@xxxxxx.de>
Received: from xxxx.xxxxx.com (xxxx.xxxxx.com [ipaddress])
by ns2.wanware.com (8.11.6p2/8.11.6) with ESMTP id i4D8O4505876;
Thu, 13 May 2004 04:24:05 -0400
Received: from localhost (unknown [127.0.0.1])
by xxxx.xxxxx.com (XXXXX Postfix) with ESMTP
id E61108BC8D; Thu, 13 May 2004 10:23:52 +0200 (CEST)
Received: from XXXXXXXX (xxxxxxxxxx.de [ipaddress])
(using TLSv1 with cipher RC4-MD5 (128/128 bits))
(No client certificate requested)
by xxxx.xxxxx.com (XXXXX Postfix) with ESMTP
id 1CFC48BC8D; Thu, 13 May 2004 10:23:51 +0200 (CEST)
From: "Name" <xx...@xxxxx.de>
To: "'Ragnar Paulson'" <ra...@wanware.com>
Subject: FW: Distributor Contract
Date: Thu, 13 May 2004 10:23:55 +0200
Organization:
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_001E_01C438D4.65D33820"
X-Priority: 1 (Highest)
X-MSMail-Priority: High
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
Thread-Index: AcQx9eDxPOifNvOoQ/Cd04r3rGFRcgGzOEUA
Importance: High
Message-Id: <20...@xxxx.xxxxx.com>
X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.25.0.3; VDF 6.25.0.61
X-Spam-Status: Yes, hits=5.7 required=3.0
tests=BAYES_30,FORGED_MUA_OUTLOOK,MARKETING_PARTNERS,
MISSING_OUTLOOK_NAME,TSG_UNWHITELIST,USER_IN_WHITELIST,
X_MSMAIL_PRIORITY_HIGH,X_PRIORITY_HIGH
version=2.54-sentinet
X-Spam-Level: *****
X-Spam-Checker-Version: SpamAssassin 2.54-sentinet (1.174.2.17-2003-05-11-exp)
X-Spam-Report: This mail is probably spam. The original message has been attached
along with this report, so you can recognize or block similar unwanted
mail in future. See http://spamassassin.org/tag/ for more details.
Content preview: Dear Ragnar, We thank you for your decision
to become our official partner in Canada. It is a pleasure for us to do
business with your company and we are sure that the future will show
the mutual benefit resulted from our contract. [...]
Content analysis details: (5.70 points, 3 required)
X_MSMAIL_PRIORITY_HIGH (0.4 points) Sent with 'X-Msmail-Priority' set to high
X_PRIORITY_HIGH (1.9 points) Sent with 'X-Priority' set to high
MARKETING_PARTNERS (2.1 points) BODY: Claims you registered with some kind of partner
BAYES_30 (-0.9 points) BODY: Bayesian classifier says spam probability is 30 to 40%
[score: 0.3753]
USER_IN_WHITELIST (-100.0 points)From: address is in the user's white-list
FORGED_MUA_OUTLOOK (2.2 points) Forged mail pretending to be from MS Outlook
MISSING_OUTLOOK_NAME (0.0 points) Message looks like Outlook, but isn't
TSG_UNWHITELIST (100.0 points)Undo SpamAssassin Whitelisting
X-Spam-Flag: YES
Re: Software (fwd)
Posted by Ragnar Paulson <ra...@wanware.com>.
I don't believe that SpamAssassin looks at X-MailScanner-From ... but it does look at "Return-Path:" which is also forged.
MailScanner probably gets it's header from "Return-Path:".
Also when I use the SpamAssassin whitelist, it adds a score of -100 for USER_IN_WHITELIST. I don't see this in your e-mail
headers, instead it appears you have a large SPAM score (SpamAssassin (score=23.919, required 3))
but it ignored by SpamCheck (X-Dickinson-MailScanner-SpamCheck: not spam (whitelisted)).
So you may have to take this up with SpamCheck. Meanwhile for what its worth, I have created a local rules:
meta __TSG_UNTRUSTED (FORGED_AOL_RCVD || FORGED_HOTMAIL_RCVD || FORGED_EUDORAMAIL_RCVD || FORGED_YAHOO_RCVD || FORGED_JUNO_RCVD || FORGED_GW05_RCVD || FORGED_MUA_OUTLOOK)
describe __TSG_UNTRUSTED Received headers indicate a forgery of some type
score __TSG_UNTRUSTED 1.00
meta TSG_WHITELIST (USER_IN_WHITELIST && !(__TSG_UNTRUSTED))
describe TSG_WHITELIST Received headers do not indicate forgery, and USER_IN_WH
ITELIST
score TSG_WHITELIST -1.000
meta TSG_UNWHITELIST (USER_IN_WHITELIST && __TSG_UNTRUSTED)
describe TSG_UNWHITELIST Undo SpamAssassin Whitelisting
score TSG_UNWHITELIST 100.0
This has the effect of undoing the whitelist score of -100 when there is something suspicious about the headers. I use procmail for
filtering, so the rule "TSG_WHITELIST" is just there to give me something to filter on instead of "USER_IN_WHITELIST". Also this is still not perfect, Spammers just have to get better at the headers to fool this one too (it has happenned).
You can also work with "whitelist_from_rcvd", particularly for local addresses like dickinson.edu but I haven't found a good way to manage large whitelists for a large user community this way.
Regards,
Ragnar
----- Original Message -----
From: "Don Newcomer" <ne...@dickinson.edu>
To: "SpamAssassin Users List" <sp...@incubator.apache.org>
Sent: Monday, May 10, 2004 8:24 AM
Subject: Software (fwd)
> This is becomeing more and more of an issue for me. I'm using MailScanner
> 4.30.3 and SpamAssassin 2.63. I've whitelisted anything from
> "dickinson.edu" so as to prevent any campus mailings from being labeled as
> spam. Now I've run into forged headers that list "xxx@dickinson.edu" as
> the sender and they're being whitelisted. The attached message was
> interesting in that the only place "dickinson.edu" is listed is in the
> "X-MailScanner-From" line (and they chose my own address to boot). I'm
> open to suggestions here. It hasn't happened too often but you know it'll
> pick up as time goes on. Thanks.
>
> Don Newcomer
> Senior Manager, Systems
> Infrastructure Systems Department
> Library and Information Services
> Dickinson College
> P.O. Box 1773
> Carlisle, PA 17013
> 717-245-1256 (Voice)
> 717-245-1690 (FAX)
> newcomer@dickinson.edu
Re: Software (fwd)
Posted by Matt Kettler <mk...@comcast.net>.
At 08:24 AM 5/10/04 -0400, Don Newcomer wrote:
>This is becomeing more and more of an issue for me. I'm using MailScanner
>4.30.3 and SpamAssassin 2.63. I've whitelisted anything from
>"dickinson.edu" so as to prevent any campus mailings from being labeled as
>spam. Now I've run into forged headers that list "xxx@dickinson.edu" as
>the sender and they're being whitelisted.
How did you whitelist? merely a whitelist_from??? That's pretty much a
known-bad-idea. At least use whitelist_from_rcvd for such things.
whitelist_from is pretty much a tool of last-resort. You're always
vulnerable to forgery with it, which is why whitelist_from_rcvd was
created. Spammers have been abusing people foolish enough to whitelist_from
*@mydomain.com for at least 2 years now, and probably much longer.
I'd also suggest a read of the wiki:
http://wiki.apache.org/spamassassin/WhitelistingEverybody
RE: Software (fwd)
Posted by "Michele Neylon :: Blacknight Solutions" <mi...@blacknightsolutions.com>.
Don
You may want to look at using some custom MailScanner rules for this kind of
thing. If you knew the IP range for dickinson.edu you could whitelist that
instead of the domain.
In either case I would recommend posting to the MS list
Michele
Mr Michele Neylon
Blacknight Internet Solutions Ltd
http://www.blacknight.ie/
Tel. +353 59 9137101
-----Original Message-----
From: Don Newcomer [mailto:newcomer@dickinson.edu]
Sent: 10 May 2004 13:24
To: SpamAssassin Users List
Subject: Software (fwd)
This is becomeing more and more of an issue for me. I'm using MailScanner
4.30.3 and SpamAssassin 2.63. I've whitelisted anything from
"dickinson.edu" so as to prevent any campus mailings from being labeled as
spam. Now I've run into forged headers that list "xxx@dickinson.edu" as the
sender and they're being whitelisted. The attached message was interesting
in that the only place "dickinson.edu" is listed is in the
"X-MailScanner-From" line (and they chose my own address to boot). I'm open
to suggestions here. It hasn't happened too often but you know it'll pick
up as time goes on. Thanks.
Don Newcomer
Senior Manager, Systems
Infrastructure Systems Department
Library and Information Services
Dickinson College
P.O. Box 1773
Carlisle, PA 17013
717-245-1256 (Voice)
717-245-1690 (FAX)
newcomer@dickinson.edu