You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Robert Boyl <ro...@gmail.com> on 2016/03/15 17:07:45 UTC
Abused accounts
Hi, everyone
Please check http://pastebin.com/GUBqpyZ8
Interesting how some spams that abuse some legit account such as this one
are hard to detect, how Spamassassin scores almost nothing although there
are spammy works, etc. System caught DCC_CHECK 1.10.
Some other systems such as isnotspam.com caught some SA rule which doesnt
exist anymore in latest SA... AXB_X_FF_SEZ_S=3.10.
Any ways to report such spams to spamassassin devels so they can try to
create new rules?
Any tips how to mark such mails as spam?
Thanks!
Robert
Re: Abused accounts
Posted by RW <rw...@googlemail.com>.
On Tue, 15 Mar 2016 14:15:53 -0700
Ted Mittelstaedt wrote:
> It's foolish to throw away working rulesets and put all your eggs in
> the Bayes basket. Bayes is not a panacea. I kind of feel there is a
> NIH mentality among the spamassassin maintainers when it comes to
> rulesets - it's like "we invented Bayes so it's the best, other
> people invented rules so they aren't as good" it seems like there is
> an overemphasis on throwing out rules.
Unless you mistook Harold for a developer, that doesn't make much
sense. Most of the effort on SpamAssassin doesn't involve Bayes, it's
relatively mature. What you are suggesting would imply that SA is no
longer under active development.
I don't see what "other people invented rules" means, SA has always
been rule-based. There's no one fending-off would-be rule developers
with a stick.
Re: Abused accounts
Posted by RW <rw...@googlemail.com>.
On Tue, 15 Mar 2016 17:47:51 -0700
Ted Mittelstaedt wrote:
> On 3/15/2016 5:14 PM, Reindl Harald wrote:
> >
> >
> > a lot of nosense
> >
> > * nobody is talking about throw away *any* other rules
>
> Uh, why yes, they are:
>
> "Some other systems such as isnotspam.com caught some SA rule which
> DOESENT EXIST ANYMORE in latest SA."
>
> sure seems like SOMEONE IS talking about throwing away rules.....
The OP was mistaken, the rule does exist in SA, but not in his Barracuda
ruleset.
Re: Abused accounts
Posted by Ted Mittelstaedt <te...@ipinc.net>.
On 3/15/2016 5:14 PM, Reindl Harald wrote:
>
>
> a lot of nosense
>
> * nobody is talking about throw away *any* other rules
Uh, why yes, they are:
"Some other systems such as isnotspam.com caught some SA rule which
DOESENT EXIST ANYMORE in latest SA."
sure seems like SOMEONE IS talking about throwing away rules.....
Ted
Re: Abused accounts
Posted by Reindl Harald <h....@thelounge.net>.
Am 15.03.2016 um 22:15 schrieb Ted Mittelstaedt:
> It's foolish to throw away working rulesets and put all your eggs in the
> Bayes basket. Bayes is not a panacea. I kind of feel there is a
> NIH mentality among the spamassassin maintainers when it comes to
> rulesets
a lot of nosense
* nobody is talking about throw away *any* other rules
* a good bayes is *added* to all other rules
* guess why *we* use 50 DNSBL/DNSWL combined
* i am *not* a SA developer
Re: Abused accounts
Posted by Ted Mittelstaedt <te...@ipinc.net>.
That is a little different. Google makes it clear to colleges and
universities that their mail system is not to be used for HIPAA
stuff there is no guarantee of privacy. This is different than a
run-of-the-mill class. There are legal restrictions in place on medical
communications and in fact the university shouldn't have even emailed
you an unencrypted email in the first place.
And many colleges already understand this. For example when University
of Washington - originator of the IMAP protocol - replaced their
email system with Gmail a few years ago, they retained their mail
system for use by the medical college.
I understand where you are coming from on the business email issue but
the reality is that the millennial generation isn't listening. However,
don't blame them. The moment that the first employer looked up a
job candidate's Facebook posts, that wall between business and personal
was breached. And that was done long before the millennial generation
started intermixing the two.
Unless employers are willing to take a hands-off attitude to employees
personal online activities, then their demands that employees use the
"blessed' mail system are going to continue to be ignored. They cannot
have their cake and eat it too and if they insist on it then their
employees just won't go to work for them - and in fact may setup
competing businesses and put them out of business. And so far employers
seem to be insisting that employee's personal activities outside of work
are fair game.
So, I think your fighting a losing battle - in another generation the
statement "you can't just use your own random @gmail.com account for
business purposes" will have absolutely no meaning.
Ted
On 3/16/2016 1:11 PM, Dave Warren wrote:
> On 2016-03-15 14:15, Ted Mittelstaedt wrote:
>> I agree with you on that one. There's a big push among colleges to push
>> students to use their "blessed" mailsystems. They don't want students
>> emailing instructors from the student's gmail account, they want the
>> students emailing the instructors from the college-provided gmail
>> account.
>
> I would too. If nothing else, this prepares students for the real world,
> where you can't just use your own random @gmail.com account for business
> purposes either.
>
> I've walked away from a university study after getting an email from and
> CC'd to some random @gmail.com/@hotmail.com addresses requesting further
> medical information to confirm placement in the study. I filed an
> official ethics complaint as the preliminary medical information I
> submitted was supposed to be held safely and all data is supposed to be
> protected, revealed only to me, my doctor, and otherwise anonymized
> before any dissemination, yet was CC'd to multiple providers and now is
> subject to their marketing department's whims, within the range of third
> party privacy policies in other countries.
>
> Information security is hard, mostly because of users, and it takes
> practice. Accepting and trusting inbound email from random addresses is
> what brings us to
> https://krebsonsecurity.com/2016/03/thieves-phish-moneytree-employee-tax-data/
>
>
Re: Abused accounts
Posted by Dave Warren <da...@hireahit.com>.
On 2016-03-15 14:15, Ted Mittelstaedt wrote:
> I agree with you on that one. There's a big push among colleges to push
> students to use their "blessed" mailsystems. They don't want students
> emailing instructors from the student's gmail account, they want the
> students emailing the instructors from the college-provided gmail account.
I would too. If nothing else, this prepares students for the real world,
where you can't just use your own random @gmail.com account for business
purposes either.
I've walked away from a university study after getting an email from and
CC'd to some random @gmail.com/@hotmail.com addresses requesting further
medical information to confirm placement in the study. I filed an
official ethics complaint as the preliminary medical information I
submitted was supposed to be held safely and all data is supposed to be
protected, revealed only to me, my doctor, and otherwise anonymized
before any dissemination, yet was CC'd to multiple providers and now is
subject to their marketing department's whims, within the range of third
party privacy policies in other countries.
Information security is hard, mostly because of users, and it takes
practice. Accepting and trusting inbound email from random addresses is
what brings us to
https://krebsonsecurity.com/2016/03/thieves-phish-moneytree-employee-tax-data/
--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren
Re: Abused accounts
Posted by Ted Mittelstaedt <te...@ipinc.net>.
On 3/15/2016 2:01 PM, David B Funk wrote:
> IE, out of the 130KB of that message, only a few dozen bytes is actually
> the spam 'payload' and thus Bayes wise gets swamped by the O365 noise.
>
> I'm considering tagging most of the O365 headers with bayes_ignore_header.
> Anybody else wrestling with this? Any suggestions?
>
>
I agree with you on that one. There's a big push among colleges to push
students to use their "blessed" mailsystems. They don't want students
emailing instructors from the student's gmail account, they want the
students emailing the instructors from the college-provided gmail
account. It is incredibly wasteful of space and as a result a lot of
these students have a dozen or so email accounts they regard as
"tossaways" and they don't give a tinker's damn about using secure
passwords. And colleges aren't the only orgs getting into this
nonsense, other orgs are handing these accounts out - probably to mine
marketing data no doubt.
Bayes is useless with compromised accounts on these systems and I'm sick
of the excuses that these systems self-police, they don't.
It's foolish to throw away working rulesets and put all your eggs in the
Bayes basket. Bayes is not a panacea. I kind of feel there is a
NIH mentality among the spamassassin maintainers when it comes to
rulesets - it's like "we invented Bayes so it's the best, other
people invented rules so they aren't as good" it seems like there is
an overemphasis on throwing out rules.
Ted
Re: Abused accounts
Posted by Reindl Harald <h....@thelounge.net>.
Am 15.03.2016 um 22:01 schrieb David B Funk:
> Actually this is one case where Bayes may not be a help. Our campus
> recently
> outsourced almost all users to O365. As a consequence our Bayes gets a
> -lot- of ham from O365 and therefore has most of its fingerprints tagged
> as ham.
> Thus it takes a very spammy message passed thu O365 to get anything but
> BAYES_00
get rid of autolearning, maintain your bayes by hand and strip most
headers from samples and all that problems are gone away
especially strip Received headers from samples and put one generic on top
Re: Abused accounts
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Tue, 15 Mar 2016, Kris Deugau wrote:
> Robert Boyl wrote:
>> Hi, everyone
>>
>> Please check http://pastebin.com/GUBqpyZ8
>>
>> Interesting how some spams that abuse some legit account such as this
>> one are hard to detect, how Spamassassin scores almost nothing although
>> there are spammy works, etc. System caught DCC_CHECK 1.10.
>>
>> Some other systems such as isnotspam.com <http://isnotspam.com> caught
>> some SA rule which doesnt exist anymore in latest SA...
>> AXB_X_FF_SEZ_S=3.10.
[snip..]
> I'm not certain, but it also looks like you might not be using Bayes.
> This is likely one of the key methods of detecting spam like this;
> since it was sent through outlook.com the message structure is perfectly
> legitimate so IP DNSBLs will have little value.
It looks like that message was sent from a compromised college account hosted in
Office-365.
Actually this is one case where Bayes may not be a help. Our campus recently
outsourced almost all users to O365. As a consequence our Bayes gets a
-lot- of ham from O365 and therefore has most of its fingerprints tagged as ham.
Thus it takes a very spammy message passed thu O365 to get anything but
BAYES_00.
IE, out of the 130KB of that message, only a few dozen bytes is actually the
spam 'payload' and thus Bayes wise gets swamped by the O365 noise.
I'm considering tagging most of the O365 headers with bayes_ignore_header.
Anybody else wrestling with this? Any suggestions?
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Abused accounts
Posted by Kris Deugau <kd...@vianet.ca>.
Robert Boyl wrote:
> Hi, everyone
>
> Please check http://pastebin.com/GUBqpyZ8
>
> Interesting how some spams that abuse some legit account such as this
> one are hard to detect, how Spamassassin scores almost nothing although
> there are spammy works, etc. System caught DCC_CHECK 1.10.
>
> Some other systems such as isnotspam.com <http://isnotspam.com> caught
> some SA rule which doesnt exist anymore in latest SA...
> AXB_X_FF_SEZ_S=3.10.
I'm assuming that's your Barracuda appliance that added those Barracuda
headers. If so, it's running a VERY out of date SA (3.2.2) when the
current release versions is 3.4.1.
IIRC the upstream SpamAssassin project is no longer publishing rule
updates for 3.2.x. That particular rule is relatively *new*, and so
would not have been published to the 3.2.x rules channel.
I'm not certain, but it also looks like you might not be using Bayes.
This is likely one of the key methods of detecting spam like this;
since it was sent through outlook.com the message structure is perfectly
legitimate so IP DNSBLs will have little value.
Since there's no link, just a (probably cracked/stolen) email address in
the body, DNSBL body rules will also have very little value on this message.
-kgd
Re: Abused accounts
Posted by Charles Sprickman <sp...@bway.net>.
--
Charles Sprickman
NetEng/SysAdmin
Bway.net - New York's Best Internet www.bway.net
spork@bway.net - 212.982.9800
> On Mar 15, 2016, at 12:28 PM, Reindl Harald <h....@thelounge.net> wrote:
>
>
>
> Am 15.03.2016 um 17:07 schrieb Robert Boyl:
>> Hi, everyone
>>
>> Please check http://pastebin.com/GUBqpyZ8
>>
>> Interesting how some spams that abuse some legit account such as this
>> one are hard to detect, how Spamassassin scores almost nothing although
>> there are spammy works, etc. System caught DCC_CHECK 1.10.
>>
>> Some other systems such as isnotspam.com <http://isnotspam.com> caught
>> some SA rule which doesnt exist anymore in latest SA...
>> AXB_X_FF_SEZ_S=3.10.
>>
>> Any ways to report such spams to spamassassin devels so they can try to
>> create new rules?
>>
>> Any tips how to mark such mails as spam?
>
> easy to detect and no way to slip through our filters
> Barracuda Networks *lol* we where victims of that noobs too...
>
> X-Barracuda-Envelope-From: williams.1727@osu.edu
> X-Barracuda-Apparent-Source-IP: 157.56.111.246
> X-Barracuda-Envelope-To: XXX
>
> /var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml: Sanesecurity.Spear.williams_dot_1727_at_osu_dot_edu.UNOFFICIAL FOUND
> /var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml: ScamNailer.Phish.williams.1727_AT_osu.edu.UNOFFICIAL FOUND
> /var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml: Sanesecurity.Spear.williams_dot_1727_at_osu_dot_edu.UNOFFICIAL FOUND
> /var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml: Sanesecurity.Spear.williams_dot_1727_at_osu_dot_edu.UNOFFICIAL FOUND
> /var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml: ScamNailer.Phish.williams.1727_AT_osu.edu.UNOFFICIAL FOUND
> /var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml: Sanesecurity.Spear.williams_dot_1727_at_osu_dot_edu.UNOFFICIAL FOUND
>
> ----------- VIRUS-SCAN SUMMARY -----------
> Infected files: 1
> Time: 0.024 sec (0 m 0 s)
> Content analysis details: (18.4 points, 5.5 required)
>
> pts rule name description
> ---- ---------------------- --------------------------------------------------
> -0.2 CUST_DNSWL_8 RBL: dnswl-aggregate.thelounge.net (No Trust)
> [157.56.111.246 listed in dnswl-aggregate.thelounge.net]
> 0.1 CUST_DNSBL_33 RBL: dnsbl-backscatterer.thelounge.net
> (ips.backscatterer.org)
> [157.56.111.246 listed in dnsbl-backscatterer.thelounge.net]
> 7.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
> [score: 0.9995]
> 3.1 AXB_X_FF_SEZ_S Forefront sez this is spam
> -0.1 CUST_DNSWL_5 RBL: list.dnswl.org (No Trust)
> [157.56.111.246 listed in list.dnswl.org]
> 0.5 CUST_DNSBL_31 RBL: bl.nszones.com
> [157.56.111.246 listed in bl.nszones.com]
> 1.0 CUST_DNSBL_23 RBL: bl.spamcannibal.org
> [157.56.111.246 listed in bl.spamcannibal.org]
> -0.1 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
> [157.56.111.246 listed in wl.mailspike.net]
> 1.5 CUST_DNSBL_21 RBL: score.senderscore.com (senderscore.com High)
> [157.56.111.246 listed in score.senderscore.com]
> 1.0 CUST_DNSBL_25 RBL: score.senderscore.com (senderscore.com Medium)
> 0.4 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
> [score: 0.9995]
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 0.7 LOTS_OF_MONEY Huge... sums of money
> 0.5 CUST_SUBJ_6 Begins Very Low
> 2.5 MONEY_FROM_41 Lots of money from Africa
> 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
>
I thought I was doing an OK job of training Bayes, but in my case Bayes went hammy on this one:
Content analysis details: (7.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.1 AXB_X_FF_SEZ_S Forefront sez this is spam
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[157.56.111.246 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[157.56.111.246 listed in wl.mailspike.net]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
2.8 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
0.0 LOTS_OF_MONEY Huge... sums of money
2.0 MONEY_FROM_41 Lots of money from Africa
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
1.3 TXREP TXREP: Score normalizing based on sender's reputation
Sometimes I wish there was a paid “Bayes in the Cloud” service that aggregated a bunch of well-fed bayesian dbs.
Charles
Re: Abused accounts
Posted by Reindl Harald <h....@thelounge.net>.
Am 15.03.2016 um 17:07 schrieb Robert Boyl:
> Hi, everyone
>
> Please check http://pastebin.com/GUBqpyZ8
>
> Interesting how some spams that abuse some legit account such as this
> one are hard to detect, how Spamassassin scores almost nothing although
> there are spammy works, etc. System caught DCC_CHECK 1.10.
>
> Some other systems such as isnotspam.com <http://isnotspam.com> caught
> some SA rule which doesnt exist anymore in latest SA...
> AXB_X_FF_SEZ_S=3.10.
>
> Any ways to report such spams to spamassassin devels so they can try to
> create new rules?
>
> Any tips how to mark such mails as spam?
easy to detect and no way to slip through our filters
Barracuda Networks *lol* we where victims of that noobs too...
X-Barracuda-Envelope-From: williams.1727@osu.edu
X-Barracuda-Apparent-Source-IP: 157.56.111.246
X-Barracuda-Envelope-To: XXX
/var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml:
Sanesecurity.Spear.williams_dot_1727_at_osu_dot_edu.UNOFFICIAL FOUND
/var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml:
ScamNailer.Phish.williams.1727_AT_osu.edu.UNOFFICIAL FOUND
/var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml:
Sanesecurity.Spear.williams_dot_1727_at_osu_dot_edu.UNOFFICIAL FOUND
/var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml:
Sanesecurity.Spear.williams_dot_1727_at_osu_dot_edu.UNOFFICIAL FOUND
/var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml:
ScamNailer.Phish.williams.1727_AT_osu.edu.UNOFFICIAL FOUND
/var/www/uploadtemp/7f4da2b4dac87498e3828802c5b22fc098e963be.eml:
Sanesecurity.Spear.williams_dot_1727_at_osu_dot_edu.UNOFFICIAL FOUND
----------- VIRUS-SCAN SUMMARY -----------
Infected files: 1
Time: 0.024 sec (0 m 0 s)
Content analysis details: (18.4 points, 5.5 required)
pts rule name description
---- ----------------------
--------------------------------------------------
-0.2 CUST_DNSWL_8 RBL: dnswl-aggregate.thelounge.net (No Trust)
[157.56.111.246 listed in
dnswl-aggregate.thelounge.net]
0.1 CUST_DNSBL_33 RBL: dnsbl-backscatterer.thelounge.net
(ips.backscatterer.org)
[157.56.111.246 listed in
dnsbl-backscatterer.thelounge.net]
7.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 0.9995]
3.1 AXB_X_FF_SEZ_S Forefront sez this is spam
-0.1 CUST_DNSWL_5 RBL: list.dnswl.org (No Trust)
[157.56.111.246 listed in list.dnswl.org]
0.5 CUST_DNSBL_31 RBL: bl.nszones.com
[157.56.111.246 listed in bl.nszones.com]
1.0 CUST_DNSBL_23 RBL: bl.spamcannibal.org
[157.56.111.246 listed in bl.spamcannibal.org]
-0.1 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[157.56.111.246 listed in wl.mailspike.net]
1.5 CUST_DNSBL_21 RBL: score.senderscore.com (senderscore.com
High)
[157.56.111.246 listed in
score.senderscore.com]
1.0 CUST_DNSBL_25 RBL: score.senderscore.com (senderscore.com
Medium)
0.4 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 0.9995]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 LOTS_OF_MONEY Huge... sums of money
0.5 CUST_SUBJ_6 Begins Very Low
2.5 MONEY_FROM_41 Lots of money from Africa
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information