| View previous topic :: View next topic |
| Author |
Message |
Bob
Guest IP: 205.184.*.*
|
Posted: Sat Aug 02, 2003 4:05 am Post subject: Defeating the ............... |
|
|
I have filter rules set to:
"The Body" "contains" "Viagra" and have "any rule below is satisfied" checked but still get messages in my box that are not removed as they should be.
Now I was confused at first, but when I took a look at the whole header, the bastards are encoding the file in html and inserting comment fields randomly interspersed throughtout the message, obviously to defeat spam blockers.
Does the iinsanity ever end!?!? Any way to defear this?[/quote]
|
|
| Back to top |
|
 |
Sam
Guest IP: 24.92.*.*
|
Posted: Sat Aug 02, 2003 5:28 am Post subject: |
|
|
Yes , we need to find them and line them up and break there hands and fingers with a nice Louieville Slugger. 
|
|
| Back to top |
|
 |
dav4is
Guest IP: 129.44.*.*
|
Posted: Sat Aug 02, 2003 8:54 am Post subject: |
|
|
Yes, I've been seeing more of this lately.
This tactic would be easily defeated if WW had an option in the filter to apply the BODY check to the HTML rendered text -- i.e. with all the markup removed.
-R.
|
|
| Back to top |
|
 |
rusticdog
Site Moderator Premium Member
 Joined: Aug 12, 2002 Posts: 5850 Location: New_Zealand
|
Posted: Mon Aug 04, 2003 8:29 am Post subject: |
|
|
Filtering for these tags is easiest.
Following is a filter another user has written to detect these, which with Mailwaher closed you can just copy/paste into your filters.txt file
[enabled],"[2] HTML Spam Tricks (B)","[2] HTML Spam Tricks (B)",16711680,OR,Blacklist,Delete,Body,containsRE,"font size=""?0""?",Body,containsRE,"((<![\w\s,\.\-]+>)+([\w\s,\.\-]){1,20}){3}",Body,containsRE,"(</\w>)[\w\s,\.\-]{1,20}(\1([\w\s,\.\-]){1,20}){2}"
For the full filter list this user has published, check out http://www.w5hq.com/MailWasher/MailWasherFilters.txt
|
|
| Back to top |
|
 |
TimeGhost
Major

 Joined: Apr 11, 2003 Posts: 750 Location: USA
|
Posted: Mon Aug 04, 2003 3:28 pm Post subject: |
|
|
Another exploit is one in which invalid html tags are inserted into spam keywords. For example, via<duh>gra would appear as viagra, but not get caught by Gary's filter.
Please read this thread for more information. HTH
|
|
| Back to top |
|
 |
jjmarsi
Guest IP: 68.186.*.*
|
Posted: Mon Aug 04, 2003 7:34 pm Post subject: Gary's filters are a godsend! |
|
|
I just wanted to give Gary some props here for his awesome filter list. I was getting bombarded with spam and was not really up to the task of building them myself. I copied them in, and the next time I ran MW, it caught a bunch of stuff it wouldn't have caught before!
Thanks again!
John

|
|
| Back to top |
|
 |
IP: 80.62.*.*
Guest
|
|
| Back to top |
|
 |
directory
Guest IP: 68.38.*.*
|
Posted: Tue Sep 02, 2003 11:46 am Post subject: |
|
|
The file filters.txt is found, in, my gosh:
C:\Documents and Settings\sandy.USER-ZBYWXSO0KS\Application Data\MailWasher
I don't want the file in this crazy directory!
I want it in the same directory as MailWasher.exe.
How do I fix this?
|
|
| Back to top |
|
 |
TimeGhost
Major

 Joined: Apr 11, 2003 Posts: 750 Location: USA
|
Posted: Tue Sep 02, 2003 1:54 pm Post subject: |
|
|
You could use a shared list and put it in the MWP directory. But the automated features such as GUI edits and additions won't take effect on that shared file.
The current location makes sense in a multi-user environment. That way, each user can have his/her own lists of goodies and baddies.
|
|
| Back to top |
|
 |
!Wilbur
Cadet

 Joined: Aug 31, 2003 Posts: 7
|
Posted: Tue Sep 02, 2003 10:53 pm Post subject: Re: Gary's filters are a godsend! |
|
|
| jjmarsi wrote: | I just wanted to give Gary some props here for his awesome filter list. I was getting bombarded with spam and was not really up to the task of building them myself. I copied them in, and the next time I ran MW, it caught a bunch of stuff it wouldn't have caught before!
Thanks again!
John
 |
Where can I get this list?
|
|
| Back to top |
|
 |
rusticdog
Site Moderator Premium Member
 Joined: Aug 12, 2002 Posts: 5850 Location: New_Zealand
|
|
| Back to top |
|
 |
|
|