(Unknown)

[Peter Smith <pe...@linuxbox.co.uk>]

Hi,

Over the last week, my machine (Fedora, SA 3.1.3, qmail, qmail-scanner-queue.pl) has
been recieving a fair amount of junk mail which is not being tagged as spam; in fact the
total scores are negative.

The messages are simply a random stream of words, with punctuation scattered in them. No
HTML, no URLs being advertised, no excessive capitalisation, just meaningless text. The
message headers are pretty clean too, apart from the From field being false.

As such, SA is finding very little to complain about, and is even lowering the scoring
because the bayes filtering deems it to be good.

Any thoughts on what I can do about these messages? Even with bayes turned off, they
would still fail to score more than say 2 or 3. Each message contains a different
paragraph of random text, so it's not possible to pick out keywords; and the messages
are coming from dialup machines, so blocking IP isn't going to be very effective.

Many thanks,
Peter Smith

Bayes poisoning (was Re:)

[Peter Smith <pe...@linuxbox.co.uk>]

> Are you runing net tests?  It sounds like someone has a broken zombie net
> that is supposed to be sending out gif spams, but they forgot the images.
> Net tests would probably catch these easily.

Well I'm using the following:

score DCC_CHECK 1.0
score PYZOR_CHECK 1.0
score RAZOR_CHECK 1.0
score RCVD_IN_BL_SPAMCOP_NET 3.0
score X_CHINESE_RELAY 1.5
score X_KOREAN_RELAY 1.5
score X_SPAMHAUS 1.5

But none of these are being triggered by the offending messages. Are there other net
checks I should be using?

Thanks,
Peter Smith

Re:

[Loren Wilton <lw...@earthlink.net>]

Start by training bayes that these are bad things, it will eventually get 
the idea and start helping rather than hurting.

Are you runing net tests?  It sounds like someone has a broken zombie net 
that is supposed to be sending out gif spams, but they forgot the images. 
Net tests would probably catch these easily.

        Loren

Bayes poisoning (was Re: your mail)

[Peter Smith <pe...@linuxbox.co.uk>]

>> The messages are simply a random stream of words, with punctuation
>> scattered in them. No HTML, no URLs being advertised, no excessive
>> capitalisation, just meaningless text.
>
> Technically, then, it's not spam. Spam requires a commercial message
> of some sort. :)

Yeah, I think I said 'junk' rather than spam. I wonder if such mail has a name?

> I would agree that it's an attempt to poison your bayes database,
> assuming that you have autolearn turned on, either by skewing the
> scores towards ham or by bloating the database.

Do you think the perpetrators are poisoning the bayes db with a view to sending spam at
a later date? We aren't a big organisation - few hundred mail boxes - so it seems rather
long lengths for a spammer to go to. Another suggestion was that the spammer had
intended to attach an image, which hadn't got through. Given the technical competence of
many spammers, it seems more likely they screwed up and forgot to attach the image. But
I'm just guessing here.

>> Any thoughts on what I can do about these messages? Even with
>> bayes turned off, they would still fail to score more than say 2
>> or 3. Each message contains a different paragraph of random text,
>> so it's not possible to pick out keywords; and the messages are
>> coming from dialup machines, so blocking IP isn't going to be very
>> effective.
>
> Look for punctuation? A good deal of the random bayes poison at one
> time was totally without punctuation.

I'm cautious about feeding these messages to sa-learn as spam, in case it has a negative
impact on genuine messages. The punctuation is pretty good - full stops every dozen
words or so, the odd comma. In fact, it's probably better punctuation than most of my
users use:) At the moment I'm just black-listing host or netblocks which this junk is
coming from.

Apologies for not setting a subject in my original mail by the way

Peter Smith

Re: your mail

["John D. Hardin" <jh...@impsec.org>]

On Wed, 27 Sep 2006, Peter Smith wrote:

> The messages are simply a random stream of words, with punctuation
> scattered in them. No HTML, no URLs being advertised, no excessive
> capitalisation, just meaningless text.

Technically, then, it's not spam. Spam requires a commercial message
of some sort. :)

> As such, SA is finding very little to complain about, and is even
> lowering the scoring because the bayes filtering deems it to be
> good.

I'm torn about whether or not to train on such messages. I do hand
training so I keep pretty tight control over what gets trained.

I would agree that it's an attempt to poison your bayes database,
assuming that you have autolearn turned on, either by skewing the
scores towards ham or by bloating the database.

> Any thoughts on what I can do about these messages? Even with
> bayes turned off, they would still fail to score more than say 2
> or 3. Each message contains a different paragraph of random text,
> so it's not possible to pick out keywords; and the messages are
> coming from dialup machines, so blocking IP isn't going to be very
> effective.

Look for punctuation? A good deal of the random bayes poison at one
time was totally without punctuation.

--
 John Hardin KA7OHZ    ICQ#15735746    http://www.impsec.org/~jhardin/
 jhardin@impsec.org    FALaholic #11174    pgpk -a jhardin@impsec.org
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  ...every time I sit down in front of a Windows machine I feel as
  if the computer is just a place for the manufacturers to put their
  advertising.                                -- fwadling on Y! SCOX
----------------------------------------------------------------------