You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Cathryn Mataga <ca...@junglevision.com> on 2012/10/05 05:56:08 UTC
Words with embedded symbols
I'm getting a lot of SPAM with words written like this. These are pretty
horrible, and I don't like
getting them every day.
A:N ;A %L"
P:O ~R %N ( P &lCT U #R&E /
Is there a way to make a rule for strings of characters that would
ignoring non-alpha characters embedded
in the string?
Re: Words with embedded symbols
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Fri, 5 Oct 2012, Cathryn Mataga wrote:
> Thanks for the comments. I'll see if I can cook something up here.
> Someone asked to see the
> actual messages.
>
> I collected 4 of these messages and put them at this link.
>
> http://www.mataga.net/mataga/spam.txt
Most of those spams are ab-using free webhosting services to host their
porn adds. (EG: freewebhostingarea.com ). Most of those sort of services
don't want this kind of client and have TOS that prohibits it.
Report them to the webhosting company and get the pages killed.
If that doesn't happen then blacklist that domain.
I run my own local URI-RBLDNSD server/list and happily list fly-by-nigh
sites hosting spammers. I've got a setup that lets me set individual
scores per domain name. (IE add a low score for questionable hosting
companies, add a BIG score for direct porn/pilz sites).
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Words with embedded symbols
Posted by Cathryn Mataga <ca...@junglevision.com>.
> Here's another version. This successfully recognises all four of your
> examples and doesn't fire on any of my other spam test messages:
>
> describe MG_TWOLETTER_OBFUSCATION Two letter obfuscation (X:X X :X))
> header MG_TWOLETTER_OBFUSCATION
> Subject =~ /[A-Z][:%~;^][A-Z]\s{0,1}[:%~;^][A-Z0-9]/
> score MG_TWOLETTER_OBFUSCATION 5.0
>
> This rather longer regexp was wrapping when pasted into this reply, so I
> split the line at 'Subject' for clarity.
>
>
> Martin
>
I looked over my old spam logs, and I'm finding hits from this rule.
All I did was add a few
extra characters that some spam were using. This is working good now.
Thanks.
Re: Words with embedded symbols
Posted by Martin Gregorie <ma...@gregorie.org>.
On Fri, 2012-10-05 at 10:17 -0700, Cathryn Mataga wrote:
> Thanks for the comments. I'll see if I can cook something up here.
> Someone asked to see the
> actual messages.
>
> I collected 4 of these messages and put them at this link.
>
> http://www.mataga.net/mataga/spam.txt
>
Here's another version. This successfully recognises all four of your
examples and doesn't fire on any of my other spam test messages:
describe MG_TWOLETTER_OBFUSCATION Two letter obfuscation (X:X X :X))
header MG_TWOLETTER_OBFUSCATION
Subject =~ /[A-Z][:%~;^][A-Z]\s{0,1}[:%~;^][A-Z0-9]/
score MG_TWOLETTER_OBFUSCATION 5.0
This rather longer regexp was wrapping when pasted into this reply, so I
split the line at 'Subject' for clarity.
Martin
PS: this may be a well-known trick, but I haven't seen it mentioned
here: current versions of grep will execute Perl regexes if you use the
-P option, so rather than writing writing a rule using a new /regex/ you
can rapidly debug it first using grep to execute it and command line
editing to modify it:
grep -P 'regex' corpus/testmessages*
noting that grep doesn't use Perl delimiters ('/') round the regex. Then
when the regex is more or less working you can write the rule and hammer
it some more.
Re: Words with embedded symbols
Posted by Alexandre Boyer <bi...@gmail.com>.
Try my regex ( /[:;`(){}~#&"%$_][a-z][:;`(){}_~#&"%$]/im ) in a subject
header check, and meta this with something like __HAS_ANY_URI and or
SUBJ_ALL_CAPS.
You may also want to upper your scoring for URIBL rules.
And train your bayesian filter with those spam messages. BAEYS_00 means
they are considered hammy.
If you do not train your baeysian filter, disable it at once (add
"use_bayes 0" and "bayes_auto_learn 0" in your local.cf)
These are only my opinions, I apologize for not being able to provide
more support (busy day at work).
Alex, from prypiat.
Yes, I recycle.
On 12-10-05 01:17 PM, Cathryn Mataga wrote:
> Thanks for the comments. I'll see if I can cook something up here.
> Someone asked to see the
> actual messages.
>
> I collected 4 of these messages and put them at this link.
>
> http://www.mataga.net/mataga/spam.txt
>
Re: Words with embedded symbols
Posted by Cathryn Mataga <ca...@junglevision.com>.
Thanks for the comments. I'll see if I can cook something up here.
Someone asked to see the
actual messages.
I collected 4 of these messages and put them at this link.
http://www.mataga.net/mataga/spam.txt
Re: Words with embedded symbols
Posted by Alexandre Boyer <bi...@gmail.com>.
Hello,
On 12-10-05 08:43 AM, Martin Gregorie wrote:
> On Thu, 2012-10-04 at 20:56 -0700, Cathryn Mataga wrote:
>> I'm getting a lot of SPAM with words written like this. These are pretty
>> horrible, and I don't like
>> getting them every day.
>>
>> A:N ;A %L"
>> P:O ~R %N ( P &lCT U #R&E /
>>
>> Is there a way to make a rule for strings of characters that would
>> ignoring non-alpha characters embedded
>> in the string?
Not in a rule, but you may want to code a plugin that would first get
rid of all non words characters, then guess if some parts of the
resulting (possibly very long) string matches SEX words, then guess if
the mail is a sexy joke or a pure annoyance.
Let's say that it would be difficult and painfull for a non obvious result.
> Try this:
>
> describe MG_TWOLETTER_OBFUSCATION Two letter obfuscation (X:X X :X))
> body MG_TWOLETTER_OBFUSCATION /[A-Z]\W[A-Z] \W[A-Z]\W[A-Z]/
> score MG_TWOLETTER_OBFUSCATION 5.0
It works, but matches only the second line ("T U #R&E "). If the spams
Cathryn receives is composed with those two lines, this rule is
effective enough.
But if you see some varations (different words and obfu, case
sensitivity etc.), you may want to work the regex a little more.
Based on Martin's work, here is an example:
body ME_SPAM /[:;`(){}~#&"%$][a-z][:;`(){}~#&"%$]/im
Use a tflag multiple and if you count, say, 2 to 4 of them, flag the
mail as a spam.
You also may want to meta this with some header checks to avoid false
positives (is it HTML_ONLY, FREEMAIL_FROM, !SPF_PASS etc. ?).
Bayesian learning should also be pretty helpfull if you use it.
> It matches the data you posted and does not match anything else in my
> spam corpus, so its quite specific the that type of spam, on the
> contents of my mail stream anyway, but of course ymmv.
>
>
> Martin
>
>
Alex, from prypiat.
Yes, I recycle.
Re: Words with embedded symbols
Posted by Martin Gregorie <ma...@gregorie.org>.
On Thu, 2012-10-04 at 20:56 -0700, Cathryn Mataga wrote:
> I'm getting a lot of SPAM with words written like this. These are pretty
> horrible, and I don't like
> getting them every day.
>
> A:N ;A %L"
> P:O ~R %N ( P &lCT U #R&E /
>
> Is there a way to make a rule for strings of characters that would
> ignoring non-alpha characters embedded
> in the string?
>
Try this:
describe MG_TWOLETTER_OBFUSCATION Two letter obfuscation (X:X X :X))
body MG_TWOLETTER_OBFUSCATION /[A-Z]\W[A-Z] \W[A-Z]\W[A-Z]/
score MG_TWOLETTER_OBFUSCATION 5.0
It matches the data you posted and does not match anything else in my
spam corpus, so its quite specific the that type of spam, on the
contents of my mail stream anyway, but of course ymmv.
Martin