Re: [OT] Re: ATTACK TO MY SYSTEM

Re: [OT] Re: ATTACK TO MY SYSTEM

[John Bradford]

> > I'm running my own mailserver and it's hard not to accept it.  I have
> > basically done checks in the from and to headers.  If it appears as a virus,
> > i lockout the smtp sender.  It's not permenant.  When the virus stops, i
> > unblock every one.
>
> I've noticed that they *ALL* have their From:, To:, and Subject: written in
> uppercase. So it's really easy to filter them out depending on the tools used.
> If a mail header either matches ^FROM:, ^TO: or ^SUBJECT: then it has high
> chances to be a spam/virus. I checked all my recent mails and a few months
> back in LKML and did not found anything except spam/viruses which match this.
> At least, we should be lucky that these virus writers don't fully respect
> protocols...

What protocols are you referring to?

RFC 822, section 3.4.7, makes clear that case is _not_ significant for
these field names.  RFC 2822 doesn't change this.

Just because no commonly used E-Mail application seems to generate
uppercase field names, how do you know something like a password
auto-responder script won't?

That may not be a concern for you, but please don't spread
mis-information to others.

John.

Re: [OT] Re: ATTACK TO MY SYSTEM

[Willy Tarreau]

On Wed, Sep 24, 2003 at 08:40:35AM +0100, John Bradford wrote:
 
> RFC 822, section 3.4.7, makes clear that case is _not_ significant for
> these field names.  RFC 2822 doesn't change this.

Sorry John about the mis-information. Of course case is not significant,
otherwise we would simply not receive these mails. I should have said
"common usage" and not "protocols", since I really thought the former
eventhough I wrote the later.

> Just because no commonly used E-Mail application seems to generate
> uppercase field names, how do you know something like a password
> auto-responder script won't?

I don't know. It's only an empirical choice based on observations. Many of us
are more concerned by hundreds of mails a day than risking to get a rare
false-positive. But I agree, I should have been clearer.

I have nearly the same .procmailrc as the one Joern Engel proposed :

  :0 D
  * ^FORM:
  spam/swen

And I too agree that I have 0% false positive so far. But just like any filter,
use at your own risk...

Willy

Re: [OT] Re: ATTACK TO MY SYSTEM

[Jörn Engel]

On Wed, 24 September 2003 10:46:16 +0200, Willy Tarreau wrote:
> On Wed, Sep 24, 2003 at 08:40:35AM +0100, John Bradford wrote:
>  
> > RFC 822, section 3.4.7, makes clear that case is _not_ significant for
> > these field names.  RFC 2822 doesn't change this.
> 
> Sorry John about the mis-information. Of course case is not significant,
> otherwise we would simply not receive these mails. I should have said
> "common usage" and not "protocols", since I really thought the former
> eventhough I wrote the later.
> 
> > Just because no commonly used E-Mail application seems to generate
> > uppercase field names, how do you know something like a password
> > auto-responder script won't?
> 
> I don't know. It's only an empirical choice based on observations. Many of us
> are more concerned by hundreds of mails a day than risking to get a rare
> false-positive. But I agree, I should have been clearer.
> 
> I have nearly the same .procmailrc as the one Joern Engel proposed :
> 
>   :0 D
>   * ^FORM:
>   spam/swen
> 
> And I too agree that I have 0% false positive so far. But just like any filter,
> use at your own risk...

All right, let's do this on-list *once* before the already off-topic
thread spreads too far.

o Filtering by all-uppercase subject, etc. if effective for swen.
o This filter has produces 0% false positives *so far*.
o This filter, just like any filter, can produce false positives.
o Anyone using filters without checking for false positives it at his
  and her own mercy.  Tough luck, deal with it.

EOT.

Jörn

-- 
A defeated army first battles and then seeks victory.
-- Sun Tzu

Re: ATTACK TO MY SYSTEM

[Mike Galbraith]

At 11:12 AM 9/23/2003 +0200, german aracil boned wrote:

>Please
>
>I have an important attack in my system!
>I received many mails from many nets! with virus attachment.
>I don't have virus in my unix system. But people send mails with my mail
>address. Please see mail's header. It's not from my system ip.
>
>I close now my system to more of 700 nets!! and continuous receiving
>mails now :(:(:(

You aren't alone, I'm getting the same crap in my lkml account.  I'm using 
a pop previewer with filter to nuke it.  I don't know what else you can do 
about it other than to nuke the account, or hope that the ignorant twit 
who's doing this manages to irritate one of the network gods.

         -Mike

Re: ATTACK TO MY SYSTEM

[J.A. Magallon]

On 09.23, Mike Galbraith wrote:
> At 11:12 AM 9/23/2003 +0200, german aracil boned wrote:
> 
> >Please
> >
> >I have an important attack in my system!
> >I received many mails from many nets! with virus attachment.
> >I don't have virus in my unix system. But people send mails with my mail
> >address. Please see mail's header. It's not from my system ip.
> >
> >I close now my system to more of 700 nets!! and continuous receiving
> >mails now :(:(:(
> 
> You aren't alone, I'm getting the same crap in my lkml account.  I'm using 
> a pop previewer with filter to nuke it.  I don't know what else you can do 
> about it other than to nuke the account, or hope that the ignorant twit 
> who's doing this manages to irritate one of the network gods.
> 

Me too.
Some pointer to that pop previewer ?
Filter based on attachments ?

-- 
J.A. Magallon <jamagallon()able!es>     \                 Software is like sex:
werewolf!able!es                         \           It's better when it's free
Mandrake Linux release 9.2 (Cooker) for i586
Linux 2.4.23-pre5-jam1 (gcc 3.3.1 (Mandrake Linux 9.2 3.3.1-2mdk))

[OT] Re: ATTACK TO MY SYSTEM

[Steven Cole]

First, apologies to all since this is technically offtopic, but there
does seem to be enough interest in this subject that I'll provide a
short answer here.

On Tue, 2003-09-23 at 07:40, J.A. Magallon wrote:
> On 09.23, Mike Galbraith wrote:
> > At 11:12 AM 9/23/2003 +0200, german aracil boned wrote:
> > 
> > >Please
> > >
> > >I have an important attack in my system!
> > >I received many mails from many nets! with virus attachment.
> > >I don't have virus in my unix system. But people send mails with my mail
> > >address. Please see mail's header. It's not from my system ip.
> > >
> > >I close now my system to more of 700 nets!! and continuous receiving
> > >mails now :(:(:(
> > 
> > You aren't alone, I'm getting the same crap in my lkml account.  I'm using 
> > a pop previewer with filter to nuke it.  I don't know what else you can do 
> > about it other than to nuke the account, or hope that the ignorant twit 
> > who's doing this manages to irritate one of the network gods.
> > 
> 
> Me too.
> Some pointer to that pop previewer ?
> Filter based on attachments ?

The problem with the W32.Swen.A@mm worm/virus  became severe enough that
my home account on 56k dialup was almost unusable.  I've been getting
hundreds of these large emails per day for the past several days, and
the problem seems to be getting worse, not better.

At my home account, I've switched from Evolution to Kmail for my MUA. 
Under receiving options, you can select 'Filter messages if they are
greater than' some value you put in.  I've selected 40K, and this
results in a few false positives, but Kmail allows you to then select
each message individually to be received, stay on the pop server, or get
trashed. This is clearly suboptimal, but better than getting all that
junk.  It would be nice if 'getting trashed' was selectable as the
default, but that's a Kmail development issue.

Others have posted more elegant solutions using procmail.  Perhaps some
email gurus can put together a FAQ and post its URL. Thanks in advance
if you do.

Steven

Re: [OT] Re: ATTACK TO MY SYSTEM

[Wakko Warner]

> First, apologies to all since this is technically offtopic, but there
> does seem to be enough interest in this subject that I'll provide a
> short answer here.

Hate to keep it going, but...

> The problem with the W32.Swen.A@mm worm/virus  became severe enough that
> my home account on 56k dialup was almost unusable.  I've been getting
> hundreds of these large emails per day for the past several days, and
> the problem seems to be getting worse, not better.

I'm running my own mailserver and it's hard not to accept it.  I have
basically done checks in the from and to headers.  If it appears as a virus,
i lockout the smtp sender.  It's not permenant.  When the virus stops, i
unblock every one.

-- 
 Lab tests show that use of micro$oft causes cancer in lab animals

Re: [OT] Re: ATTACK TO MY SYSTEM

[Wade]

Wakko Warner wrote:
>>First, apologies to all since this is technically offtopic, but there
>>does seem to be enough interest in this subject that I'll provide a
>>short answer here.
> 
> 
> Hate to keep it going, but...
> 
> 
>>The problem with the W32.Swen.A@mm worm/virus  became severe enough that
>>my home account on 56k dialup was almost unusable.  I've been getting
>>hundreds of these large emails per day for the past several days, and
>>the problem seems to be getting worse, not better.
> 
> 
> I'm running my own mailserver and it's hard not to accept it.  I have
> basically done checks in the from and to headers.  If it appears as a virus,
> i lockout the smtp sender.  It's not permenant.  When the virus stops, i
> unblock every one.
> 

Why not block mail with attachments which end in .pif or .exe? Who needs 
that?

Re: [OT] Re: ATTACK TO MY SYSTEM

[Willy Tarreau]

On Tue, Sep 23, 2003 at 11:50:39AM -0400, Wakko Warner wrote:
 
> I'm running my own mailserver and it's hard not to accept it.  I have
> basically done checks in the from and to headers.  If it appears as a virus,
> i lockout the smtp sender.  It's not permenant.  When the virus stops, i
> unblock every one.

I've noticed that they *ALL* have their From:, To:, and Subject: written in
uppercase. So it's really easy to filter them out depending on the tools used.
If a mail header either matches ^FROM:, ^TO: or ^SUBJECT: then it has high
chances to be a spam/virus. I checked all my recent mails and a few months
back in LKML and did not found anything except spam/viruses which match this.
At least, we should be lucky that these virus writers don't fully respect
protocols...

HTH,
Willy