You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Nick Edwards <ni...@gmail.com> on 2015/08/24 05:14:41 UTC
phishing rules
Hey,
Kind of had enough of regular URIBL's not getting this stuff, so
wondering has anyone wrote any rules they want to share on/off list to
match on mismatched URI links,
example
the displayed version in mail might be www.example.com, but the actual
URI when you highlight or click on it, is foobar.example.net
I want to score all mismatches rather high (i'm not interested in "oh
you shouldnt do that .. reason" type replies, sorry :) but have given
this long though and the pros do outweigh the cons.
SA usually catches the phishing stuff, there is often many get through
of late, so the collateral damage is acceptable by our risk
assessments.
ciao
Re: phishing rules
Posted by Benny Pedersen <me...@junc.eu>.
On August 24, 2015 5:14:53 AM Nick Edwards <ni...@gmail.com> wrote:
> ciao
Agere, create share deploy, thank you
Re: phishing rules
Posted by RW <rw...@googlemail.com>.
On Mon, 24 Aug 2015 13:14:41 +1000
Nick Edwards wrote:
> Hey,
>
> Kind of had enough of regular URIBL's not getting this stuff, so
> wondering has anyone wrote any rules they want to share on/off list to
> match on mismatched URI links,
Are you getting a lot of phishes that still do this?
It used to be really common, but I haven't seen it much recently.
Re: phishing rules
Posted by RW <rw...@googlemail.com>.
On Tue, 25 Aug 2015 08:25:30 -0400
Joe Quinn wrote:
> On 8/25/2015 7:51 AM, RW wrote:
> > On Tue, 25 Aug 2015 09:55:57 +0200
> > Tom Hendrikx wrote:
> >
> >
> >> Basically every MUA I know will label the message as a possible
> >> scam when you use the BAD version, which why you actually never
> >> see it in non-spam mail, unless the editor was a real noob.
> > That applies to spam too.
> >
> > Would this really have a significant effect on modern phishes?
> It still works against a lot of people, even those who know what to
> look for. It's easy to get complacent and click a link without
> checking it first when you go through a hundred emails a day.
It's not really about whether it might work, but whether it's
actually being used.
The original post was about the current wave of phishes that are
getting though SA. What I'm seeing is phishes that are convincing
without using the domain miss-match which triggers a malicious link
warming.
I just wondered whether it had been established that domain mismatches
are a common feature of the phishes that are getting through.
Re: phishing rules
Posted by Joe Quinn <jq...@pccc.com>.
On 8/25/2015 7:51 AM, RW wrote:
> On Tue, 25 Aug 2015 09:55:57 +0200
> Tom Hendrikx wrote:
>
>
>> Basically every MUA I know will label the message as a possible scam
>> when you use the BAD version, which why you actually never see it in
>> non-spam mail, unless the editor was a real noob.
> That applies to spam too.
>
> Would this really have a significant effect on modern phishes?
It still works against a lot of people, even those who know what to look
for. It's easy to get complacent and click a link without checking it
first when you go through a hundred emails a day.
That said, it also works because it's common in ham to the point that
you just sometimes have to ignore it. Lots of questionable but
consented-to mass marketing emails will use a tracker domain for
embedded URLs, so when someone links to <a
href=http://apache.org>apache.org</a>, it gets rewritten and now it hits
this new rule. Or perhaps if you ever are told to go to <a
href=http://*www*.google.com>google.com</a> and log into <a
href=http://*accounts.google.com*>gmail.com</a> you'll hit the rule too...
There's a lot of reasons to have such a rule and lots of reasons to not
have it. Without any data, I would lean towards not having it, because
there's usually a better pattern to match on.
But we can have data! Put the rule in a sandbox and see what RuleQA
thinks of its stats.
Re: phishing rules
Posted by RW <rw...@googlemail.com>.
On Tue, 25 Aug 2015 09:55:57 +0200
Tom Hendrikx wrote:
> Basically every MUA I know will label the message as a possible scam
> when you use the BAD version, which why you actually never see it in
> non-spam mail, unless the editor was a real noob.
That applies to spam too.
Would this really have a significant effect on modern phishes?
Re: phishing rules
Posted by Tom Hendrikx <to...@whyscream.net>.
On 24-08-15 18:34, Joseph Brennan wrote:
>
> Nick Edwards <ni...@gmail.com> wrote:
>
>> example
>> the displayed version in mail might be www.example.com, but the actual
>> URI when you highlight or click on it, is foobar.example.net
>
>
> The most common case is that the text shows the real web page, but the
> link goes to a click counter page that redirects to the real web page.
> This is usually not spam but wanted list mail from Mail Chimp, Constant
> Contact, and friends.
That is why all those messages actually don't use a URL in the text, but
a regular textual description:
BAD: <a href="http://redirector.tld?go=acme.com">acme.com</a>
GOOD: <a href="http://redirector.tld?go=acme.com">Visit ACME website</a>
Basically every MUA I know will label the message as a possible scam
when you use the BAD version, which why you actually never see it in
non-spam mail, unless the editor was a real noob. I have no recent
experience with MailChimp and friends, but I hope they're educating
users to use the GOOD version.
So a clear spam indicator for me.
Regards,
Tom
Re: phishing rules
Posted by Joseph Brennan <br...@columbia.edu>.
Nick Edwards <ni...@gmail.com> wrote:
> example
> the displayed version in mail might be www.example.com, but the actual
> URI when you highlight or click on it, is foobar.example.net
The most common case is that the text shows the real web page, but the link
goes to a click counter page that redirects to the real web page. This is
usually not spam but wanted list mail from Mail Chimp, Constant Contact,
and friends.
A recent variation is a link going to urldefense.proofpoint.com which
redirects to the real web page-- or not, if Proofpoint has found the web
page to be malicious by the time the user clicks. Even if you don't use
Proofpoint to do this rewriting, you're going to see the result sometimes
in replies that include the original, and forwards. Ironically this is an
ANTI phishing technique.
I realize you're not interested but other people read this list :-)
Joseph Brennan
Columbia University