You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ilan Aisic <ia...@gmail.com> on 2005/09/03 19:51:34 UTC
Pharamcudical list of words in a table
I was surprised to get an email with a list of drugs that scored
relatively little on SA.
Apparently, the spammer cleverly divided all the words into pairs of
letters and placed each pair in the proper table cell just so that the it
all appear right (all the drug names next to their prices).
I also run all the network checks, but 24 hours ago when that message
arrived, the URL it referred to (inspectioflig.com) was only listed in
one place (URIBL_WS_SURBL). I checked it now and it appears in others
as well.
It also scored from Razor2 but all in all it penetrated my SA well
below my threshold.
It would be very difficult to write rules that would detect spam
disguised like this in an HTML table.
Any comment?
--
Ilan Aisic
Registered Linux User 8124 http://counter.li.org
Re: Pharamcudical list of words in a table
Posted by Loren Wilton <lw...@earthlink.net>.
> It would be very difficult to write rules that would detect spam
> disguised like this in an HTML table.
> Any comment?
Yes it would be. Is.
That said, I think we have a rule or two in the SARE stuff, probably in the
HTML files, that attempt to catch at least some of these. Don't know how
well they are still working, since they are about a month old.
Loren
Re[2]: Pharamcudical list of words in a table
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Ilan,
Tuesday, September 6, 2005, 12:07:24 AM, you wrote:
IA> I keep getting these kind of pharm. spam where a list of
IA> drugs and their prices is arranged in an html table. ...
IA> Obviously, the OBFU rule set is not that sophisticated.
Could have fooled me, since none of that spam is reaching me.
However, since it is reaching others, I'd like to look at enhancing the OBFU rule set.
But since none of that spam is reaching me, I have no samples to work by.
If you (or anyone else) can zip a dozen or so of those spam into one package and email it to me, I'll do as Loren described, and see what patterns I can find to enhance the OBFU rule set with. I'll then compare my ideas with Loren's, and between us we should come up with something useful.
Bob Menschel
Re: Pharamcudical list of words in a table
Posted by "M.Lewis" <_S...@cajuninc.com>.
Ilan, I believe this is the *exact* same dude/dudette that I was
referring to with the topic 'Rule Question'.
Mike
Ilan Aisic wrote:
> Hi again,
> I keep getting these kind of pharm. spam where a list of drugs and their
> prices is arranged in an html table.
> I'm using all the SARE rules including the OBFU (which I've added thanks
> to recommendations in this thread.
> However, only the SARE_HTML_MANY_BR05 is fired ( Tooo many <br>'s!).
> Indeed the way this is arranged is that this is in a cell on the first
> column:
> <B>Vi</B><BR>
> The matching cell of the next table column is:
> <B>ag</B><BR>
> The next is:
> <B>ra</B>
>
> And in between there are all the other pairs of letters for the other
> drugs and the HTML command: <DIV style="FLOAT: left;">
>
> Obviously, the OBFU rule set is not that sophisticated.
>
> On top of that, the spammer (someone said it's Leo Kuvayev) keeps
> changing the URL it points to. I've recieved it with
> inspectioflig(dot)com (scored 2.7) than with exclusivaven(dot)com
> (scored 6.4) , than with univnews(dot)com (scored 7.1) and the last one
> was sinceschool(dot)com (scored 7.8)
>
> So, the good news is that in spite of the spammer's effort, the score
> gets higher and higher (due to increased effecency of the network
> checks) but on my system it should reach 12 to be totally trashed.
> For scores > 5 it only marks the subject as potential spam.
>
> --
> Ilan Aisic
> Registered Linux User 8124 http://counter.li.org
Re: Pharamcudical list of words in a table
Posted by Ilan Aisic <ia...@gmail.com>.
Just a followup:
Well, in the last few messages the rule
SARE_HTML_MANY_BR05 hasn't been fired anymore.
I then got one that fired SARE_OBFU_MEDS, but the last one I got did not
fire any SARE rule or other stock rules.
However, the score keeps getting higher and higher due to all the network
checks.
I've sent few samples to Robert Meschel.
On 9/6/05, Ilan Aisic <ia...@gmail.com> wrote:
>
> Hi again,
> I keep getting these kind of pharm. spam where a list of drugs and their
> prices is arranged in an html table.
> I'm using all the SARE rules including the OBFU (which I've added thanks
> to recommendations in this thread.
> However, only the SARE_HTML_MANY_BR05 is fired ( Tooo many <br>'s!).
> Indeed the way this is arranged is that this is in a cell on the first
> column:
> <B>Vi</B><BR>
> The matching cell of the next table column is:
> <B>ag</B><BR>
> The next is:
> <B>ra</B>
>
> And in between there are all the other pairs of letters for the other
> drugs and the HTML command: <DIV style="FLOAT: left;">
>
> Obviously, the OBFU rule set is not that sophisticated.
>
> On top of that, the spammer (someone said it's Leo Kuvayev) keeps changing
> the URL it points to. I've recieved it with inspectioflig(dot)com (scored
> 2.7) than with exclusivaven(dot)com (scored 6.4) , than with
> univnews(dot)com (scored 7.1) and the last one was sinceschool(dot)com
> (scored 7.8)
>
> So, the good news is that in spite of the spammer's effort, the score gets
> higher and higher (due to increased effecency of the network checks) but on
> my system it should reach 12 to be totally trashed. For scores > 5 it only
> marks the subject as potential spam.
>
> --
> Ilan Aisic
> Registered Linux User 8124 http://counter.li.org
>
--
Ilan Aisic
Registered Linux User 8124 http://counter.li.org
Re: Pharamcudical list of words in a table
Posted by "M.Lewis" <_S...@cajuninc.com>.
Very interesting Loren. I think a good assesment of whoever is sending
the spam.
I spend a fair portion of my day trying to catch up (filter) these dudes
out of my Inbox.
Thanks for the insights!
Mike
Loren Wilton wrote:
>>Obviously, the OBFU rule set is not that sophisticated.
>
>
> On the contrary, they are quite sophisticated in many cases.
>
>
>>On top of that, the spammer (someone said it's Leo Kuvayev)
>
>
> However, Leo is also quite sophisticated. And he has changed his spam
> generators in the last week to make things that SA can't curreently detect.
> The SARE obfu rules were last updated a couple of weeks ago. That gives Leo
> currently a 14 day or so headstart on the current SARE rulebase, and about 6
> months headstart on the standard SA rulebase.
>
>
>>keeps changing the URL it points to. I've recieved it with
>
> inspectioflig(dot)com (scored 2.7) than with exclusivaven(dot)com (scored
> 6.4) , than with univnews(dot)com (scored 7.1) and the last one was
> sinceschool(dot)com (scored 7.8)
>
> *ALL* spammers buy multiple domain names in batches. Leo buys them by the
> hundreds at a time. Just as he isn't stupid enough to send all spam from
> the same machine since it would be very quickly cut off, he isn't stupid
> enough to target all of a given spam to the same domain, because it will
> quite quickly be blocked.
>
> As near as I can tell, a run of spam from a given zombie typically is
> targeted at a single domian. However, Leo runs thousands or maybe hundreds
> of thousands of zombies in any given spam run, and he changes the spam
> slightly every few days, as best I can tell.
>
> This means you have to step back, spend a few moments thinking like Leo,
> look for what is common and what is uncommon in a spam run, and then target
> specific rules to catch the stuff that is common. It ain't that hard to do,
> but it tales time to do it, and those of us that do that sort of thing often
> only do it when we get annoyed about spam leaking into the inbox. The rest
> of the time we do our normal day jobs. Leo also does his normal day job
> most of the time. But that happens to be making spam, so he spends more
> time at it than the rest of us do.
>
> I can see about ten ways to catch Leo's current batch. However, they
> weren't particularly interesting to me, since most of them are scoring about
> 40-70 here from net rules mostly. If I get some time in the next day or two
> I'll cut a set of rules for them.
>
> Loren
>
>
>
Re: Pharamcudical list of words in a table
Posted by Ilan Aisic <ia...@gmail.com>.
Loren,
Just wanted to thank you for the eloquent resonse and for your significant
contributions to SARE and this list.
On 9/6/05, Loren Wilton <lw...@earthlink.net> wrote:
>
> ...
> I'll cut a set of rules for them.
>
> Loren
>
>
--
Ilan Aisic
Registered Linux User 8124 http://counter.li.org
Re: Pharamcudical list of words in a table
Posted by Loren Wilton <lw...@earthlink.net>.
> Obviously, the OBFU rule set is not that sophisticated.
On the contrary, they are quite sophisticated in many cases.
> On top of that, the spammer (someone said it's Leo Kuvayev)
However, Leo is also quite sophisticated. And he has changed his spam
generators in the last week to make things that SA can't curreently detect.
The SARE obfu rules were last updated a couple of weeks ago. That gives Leo
currently a 14 day or so headstart on the current SARE rulebase, and about 6
months headstart on the standard SA rulebase.
> keeps changing the URL it points to. I've recieved it with
inspectioflig(dot)com (scored 2.7) than with exclusivaven(dot)com (scored
6.4) , than with univnews(dot)com (scored 7.1) and the last one was
sinceschool(dot)com (scored 7.8)
*ALL* spammers buy multiple domain names in batches. Leo buys them by the
hundreds at a time. Just as he isn't stupid enough to send all spam from
the same machine since it would be very quickly cut off, he isn't stupid
enough to target all of a given spam to the same domain, because it will
quite quickly be blocked.
As near as I can tell, a run of spam from a given zombie typically is
targeted at a single domian. However, Leo runs thousands or maybe hundreds
of thousands of zombies in any given spam run, and he changes the spam
slightly every few days, as best I can tell.
This means you have to step back, spend a few moments thinking like Leo,
look for what is common and what is uncommon in a spam run, and then target
specific rules to catch the stuff that is common. It ain't that hard to do,
but it tales time to do it, and those of us that do that sort of thing often
only do it when we get annoyed about spam leaking into the inbox. The rest
of the time we do our normal day jobs. Leo also does his normal day job
most of the time. But that happens to be making spam, so he spends more
time at it than the rest of us do.
I can see about ten ways to catch Leo's current batch. However, they
weren't particularly interesting to me, since most of them are scoring about
40-70 here from net rules mostly. If I get some time in the next day or two
I'll cut a set of rules for them.
Loren
Re: Pharamcudical list of words in a table
Posted by Ilan Aisic <ia...@gmail.com>.
Hi again,
I keep getting these kind of pharm. spam where a list of drugs and their
prices is arranged in an html table.
I'm using all the SARE rules including the OBFU (which I've added thanks to
recommendations in this thread.
However, only the SARE_HTML_MANY_BR05 is fired ( Tooo many <br>'s!).
Indeed the way this is arranged is that this is in a cell on the first
column:
<B>Vi</B><BR>
The matching cell of the next table column is:
<B>ag</B><BR>
The next is:
<B>ra</B>
And in between there are all the other pairs of letters for the other drugs
and the HTML command: <DIV style="FLOAT: left;">
Obviously, the OBFU rule set is not that sophisticated.
On top of that, the spammer (someone said it's Leo Kuvayev) keeps changing
the URL it points to. I've recieved it with inspectioflig(dot)com (scored
2.7) than with exclusivaven(dot)com (scored 6.4) , than with
univnews(dot)com (scored 7.1) and the last one was sinceschool(dot)com
(scored 7.8)
So, the good news is that in spite of the spammer's effort, the score gets
higher and higher (due to increased effecency of the network checks) but on
my system it should reach 12 to be totally trashed. For scores > 5 it only
marks the subject as potential spam.
--
Ilan Aisic
Registered Linux User 8124 http://counter.li.org
Re: Pharamcudical list of words in a table
Posted by Loren Wilton <lw...@earthlink.net>.
> Does this cf 70_sare_obfu.cf file work with SA 2.64 as well
Most SARE rules work with 2.6x through current, unless they specifically say
they are only for a certain release or range of releases.
Loren
Re: Pharamcudical list of words in a table
Posted by Ramprasad A Padmanabhan <ra...@netcore.co.in>.
On Sun, 2005-09-04 at 03:20, wolfgang wrote:
> In an older episode (Saturday, 3. September 2005 19:51), Ilan Aisic wrote:
>
> > It would be very difficult to write rules that would detect spam
> > disguised like this in an HTML table.
>
> I think the SARE obfu rules catch quite a few of those, see
> http://www.rulesemporium.com/rules.htm#obfu
>
Does this cf 70_sare_obfu.cf file work with SA 2.64 as well
Thanks
Ram
Re: Pharamcudical list of words in a table
Posted by wolfgang <me...@gmx.net>.
In an older episode (Saturday, 3. September 2005 19:51), Ilan Aisic wrote:
> It would be very difficult to write rules that would detect spam
> disguised like this in an HTML table.
I think the SARE obfu rules catch quite a few of those, see
http://www.rulesemporium.com/rules.htm#obfu
cheers,
wolfgang