CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 952
Comments: 28
block bottom
spacer spacer

Filter for 'white' fonts in msg
Goto page Previous  1, 2, 3
 
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Ghol

Trooper
Trooper


Joined: Dec 14, 2003
Posts: 14
Location: Germany

PostPosted: Tue Dec 16, 2003 1:40 pm    Post subject:
Reply with quote

@Ikeb, I don't disagree agree at all about all the surely's... I was floating an idea. You are right, the possibilities are so endless. Talking of which, I just digested the thread ( CastleCops Link/postx8096-0-0.html) about recognising the fake HTML code splitting up a word, and how endless that could become.
By the way, the link to Andrey's site mentioned in that thread has been removed at least temporarily because of the GAIN/gator problem, and they are contacting Andrey about it.

I've been getting light font hits, so thanks @all for this useful discussion.

Back to top
View users profile Send private message
denn988

Guest
IP: 66.44.*.*






PostPosted: Tue Dec 16, 2003 2:17 pm    Post subject:
Reply with quote

Ghol,

Concerning your thoughts about matching background colors to font colors.

While you more than likely could not write a RegExp that would find closely matching colors used for the background and the actual font, there is a good possibility that a filter could be written that would find those cases where the body color of the message was set at one certain color.....and a subsequent font color was set to exactly that color.

Body color=#CECECE
Font color=#CECECE

The problem woth doing that is that the Spammer could easily offset the font color by one increment from the body color:

Body color=#CECECE
Font color=#CFCECE

That would be very difficult to trap using RegExp.

Back to top
denn988

Guest
IP: 66.44.*.*






PostPosted: Tue Dec 16, 2003 6:04 pm    Post subject:
Reply with quote

Here is the basis for a RegExp that will trigger when the body color has been set to a specific color....and a font color found later in the message is made to match exactly that body color.

Code:
<body[^>]*? bgcolor=(3D)?"?#([0-9a-f][0-9a-f])([0-9a-f][0-9a-f])([0-9a-f][0-9a-f])
Code:
.*?<[^>]*?font[^>]*? color=(3D)?"?#\2\3\4[^>]*?>

NOTE:
I have broken the expression up into two parts so that it will not cause scrolling in the post. Paste the second part of the code immediately after the first part...with no interveneing charactors.



I have done limited testing on it....and I will not bother to explain how it works. Those of you out there that have been learning RegExps will be able to study the code...and the HELP files for TRegExpr to figure out how it works.

You will need a full understanding of 'backreferences' (/1 - /9) in order to see what this filter is doing. In TRegExpr there is a dropdown just below the 'Regular Expression input box' that you can see the 'subexpressions' contain in the RegExp. That will give you the numbers to be used in the 'backreferences'.

There are possibilities for a bit more flexibility in the expression, to even have the filter match font colors that are slighty different from the body color...but I would suggest that if you do create a more capable RegExp...please do NOT post it.

Posting the basics will go a long way to help others....but specifics that will increase the flexibility of a particular filter strategy (such as this one) are best kept away from 'dumb' Spammer eyes.

I hope that everyone will understand this.....and respect my wishes on this.

Otherwise I will quit posting these little gems.

Back to top
Ghol

Trooper
Trooper


Joined: Dec 14, 2003
Posts: 14
Location: Germany

PostPosted: Tue Dec 16, 2003 6:09 pm    Post subject:
Reply with quote

@Denn998: and have you been knighted yet? Wink

Thanks: I find expert's examples extremely valuable in learning myself.

Don't quit!

Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16515

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Wed Dec 17, 2003 12:37 am    Post subject:
Reply with quote

denn988 wrote:
There are possibilities for a bit more flexibility in the expression, to even have the filter match font colors that are slighty different from the body color...but I would suggest that if you do create a more capable RegExp...please do NOT post it.

I hope that everyone will understand this.....and respect my wishes on this.

Otherwise I will quit posting these little gems.

Oh alright.... Cool Bribery will get you some things. Wink

....but I can play this game too! This means you have to keep posting your nuggets or I'll spill the beans. Shocked Razz

Back to top
View users profile Send private message
denn988

Guest
IP: 66.44.*.*






PostPosted: Wed Dec 17, 2003 1:47 am    Post subject:
Reply with quote

Ikeb wrote:
denn988 wrote:
There are possibilities for a bit more flexibility in the expression, to even have the filter match font colors that are slighty different from the body color...but I would suggest that if you do create a more capable RegExp...please do NOT post it.

I hope that everyone will understand this.....and respect my wishes on this.

Otherwise I will quit posting these little gems.

Oh alright.... Cool Bribery will get you some things. Wink

....but I can play this game too! This means you have to keep posting your nuggets or I'll spill the beans. Shocked Razz



Ikeb,

Of all the people who post to this forum, I think that you may be one that would immediately understand how the code could be modified to fire on limited variations of the color. You are a fast learner and I admire that in you.

I also hope that you will soon understand that if you post the methods that could be used for that, it would give the 'dumb' spammers an indication of the limitations of RegExps as they are now implemented...and with those limits, a way to defeat such a filter. Keep them guessing....it makes it harder for them.

I try not to post too much...enough to get people thinking, but not enough to give away the farm...or the 54th Parallel for that matter Wink Razz

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16515

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Wed Dec 17, 2003 4:18 am    Post subject:
Reply with quote

denn988 wrote:
Ikeb,

Of all the people who post to this forum, I think that you may be one that would immediately understand how the code could be modified to fire on limited variations of the color. You are a fast learner and I admire that in you.

Actually I was already working on it. I'm getting too many false positives with the simple one you posted earlier.

denn988 wrote:
I also hope that you will soon understand that if you post the methods that could be used for that, it would give the 'dumb' spammers an indication of the limitations of RegExps as they are now implemented...and with those limits, a way to defeat such a filter. Keep them guessing....it makes it harder for them.

I doubt that SPAMers are actually listening to this. Yes it might help them to avoid a few filters used by a few people but they would be better off sending out yet another SPAM to 100,000 folks who don't have such filters.

That said, I'll respect your concern. After all, the best security measures require paranoid thinking.....

denn988 wrote:
I try not to post too much...enough to get people thinking, but not enough to give away the farm...or the 54th Parallel for that matter Wink Razz

I look forward to snippets of your top 10 filters. Mr. Green

Back to top
View users profile Send private message
IP: 68.51.*.*

Guest






PostPosted: Wed Dec 17, 2003 6:14 am    Post subject:
Reply with quote

denn988 wrote:

My choice would be the sound of a toilet flushing each time my filter fires. Cool


Rolling on the floor laughing...

Back to top
Keithmj

Sergeant
Sergeant
Premium Member

Joined: Oct 25, 2004
Posts: 92
Location: USA
Premium

PostPosted: Wed Jun 21, 2006 4:21 pm    Post subject:
Reply with quote

Hi..Would the filter read?... The Body Contains RegExpr <font [^>]*? color=(3D)?["]?(white|#(F[6-9A-F]){3})["]?(?# very light colored fonts )

As that is how I have it...I put in the name of ColorKiller to help me see what filter is used..

[enabled],ColorKiller,ColorKiller,33023,AND,Delete,Body,containsRE,"<font [^>]*? color=(3D)?[""]?(white|#(F[6-9A-F]){3})[""]?(?# very light colored fonts )"


_________________
Juggle-On..Cheers, Keithmj

ClipMate
Snag-it
NoteTabPro
Back to top
View users profile Send private message Visit posters website Yahoo Messenger MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions All times are GMT
Goto page Previous  1, 2, 3
Page 3 of 3

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer