multiple from entries

[Michael Scheidell <mi...@secnap.com>]

Ok, I think its stupid, and don't know what the spammers are trying to 
acomplish, except to hope that one of the entries is whtelisted.

But, a from header of:

From:  user@domain,com, user2@domain.com, user3@domain.com.. (on to 20 
users) is just plain stupid.
It SHOULD be blocked at the MTA, except that the RFC's allow it.

Anyone know of any legitimate use of multiple email addresses in a from 
line?

if you want a reply to multiple people, just put them all in the reply to.

-- 
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
 >*| *SECNAP Network Security Corporation

    * Best Intrusion Prevention Product, Networks Product Guide
    * Certified SNORT Integrator
    * Hot Company Award, World Executive Alliance
    * Best in Email Security, 2010 Network Products Guide
    * King of Spam Filters, SC Magazine

______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________  

Re: multiple from entries

["David F. Skoll" <df...@roaringpenguin.com>]

On Sun, 10 Apr 2011 08:30:46 -0400
Michael Scheidell <mi...@secnap.com> wrote:

> header __MANY_SENDER sender =~ /@.*@/

Trying to match email addresses with regexes is dangerous.  The string:

       "funny@last"@roaringpenguin.com

is a valid email address.  Check the RFCs if you don't believe me.

(That being said, such an address is unlikely to be seen in the wild and
very likely to break a lot of SMTP software, so you're probably safe.)

Regards,

David.

Re: multiple from entries

[Michael Scheidell <mi...@secnap.com>]

On 4/9/11 10:51 AM, David F. Skoll wrote:
>
> So you could (I suppose) legitimately reject a message with multiple From:
> addresses that lacks a conforming Sender: header.
>
__L_HAS_SNDR looks for sender(s).  BUT we need a 'one sender' rule


so, a meta rule like:
meta __MANY_FROM && ! __ONE_SENDER

should do it.

sender can't have FULLNAME, only email, and can't have multiple emails.

header __MANY_SENDER sender =~ /@.*@/

header __ONE_SENDER __L_HAS_SNDR && ! __MANY_SENDER

header __MANY_FROM From:addr =~ /@.*@/


but, I can't get many 'from' to trigger: with that, but this does work.

header __MANY_FROM From =~/(?:\@[^@]{5,30}){3}/

that (from your MANY_RECIPS).   anyone want to pair it down do make it 
less expensive?

suggest put in sandbox for a while? but, no reason it should not trigger 
a score of 3 or more.


(pastebin available upon request, but:

From: <be...@domain.com>,
<jk...@domain.com>,
<sp...@domain.com>,
<am...@domain.com>,
<ag...@domain.com>



> Regards,
>
> David.


-- 
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
 >*| *SECNAP Network Security Corporation

    * Best Intrusion Prevention Product, Networks Product Guide
    * Certified SNORT Integrator
    * Hot Company Award, World Executive Alliance
    * Best in Email Security, 2010 Network Products Guide
    * King of Spam Filters, SC Magazine

______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________  

Re: multiple from entries

["David F. Skoll" <df...@roaringpenguin.com>]

On 9 Apr 2011 14:29:24 -0000
"John Levine" <jo...@taugh.com> wrote:

> >Anyone know of any legitimate use of multiple email addresses in a
> >from line?

> Yes. I know a few IETF people who do it.  Stuff like notes to a
> working group from both chairs.

RFC 5322 does allow multiple addresses in the From: field, but it says:

   If the from field contains more than one mailbox specification in
   the mailbox-list, then the sender field, containing the field name
   "Sender" and a single mailbox specification, MUST appear in the
   message.

So you could (I suppose) legitimately reject a message with multiple From:
addresses that lacks a conforming Sender: header.

Regards,

David.

Re: multiple from entries

[John Levine <jo...@taugh.com>]

>Anyone know of any legitimate use of multiple email addresses in a from 
>line?

Yes. I know a few IETF people who do it.  Stuff like notes to a working
group from both chairs.

I think I've seen the same multiple-from spam you have.  It appears to
confuse Mailman, but that's not postfix's problem.

R's,
John