# 08/2009 image spams using specific pattern indicating tbird MUA forgery? # FP rate is _UNKNOWN_ so do NOT score this rule very high without testing! # Originally by John Hardin # with input from Alex Broens and Karsten Bräckelmann ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __JPEG_ATTACH Content-Type =~ /image\/jpeg/i endif header __MUA_TBIRD User-Agent =~ /Thunderbird/ header __MIME_BDRY_0D0D Content-Type =~ /boundary="-{12}(?:0[1-9]){12}/ meta __FORGED_TBIRD_IMG __MUA_TBIRD && __JPEG_ATTACH && __MIME_BDRY_0D0D describe __FORGED_TBIRD_IMG Possibly forged Thunderbird image spam # Additional meta spotted by Alex Broens. Still might FP on legit mail with # manually typed addresses or undisclosed recipients. header __TO_UNDISCLOSED To =~ /(?:undisclosed-recipients|destinataires inconnus):/i header __TO_NO_ARROWS_R To !~ /(?:>$|>,)/ meta FORGED_TBIRD_IMG_ARROW __FORGED_TBIRD_IMG && __TO_NO_ARROWS_R && !__TO_UNDISCLOSED describe FORGED_TBIRD_IMG_ARROW Likely forged Thunderbird image spam #score FORGED_TBIRD_IMG_ARROW 0.8 # Try it against other stuff, too, # "To without <>" might be useful outside the context of image spam meta __TO_NO_BRKTS_HTML_IMG __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && HTML_MESSAGE && __ONE_IMG meta TO_NO_BRKTS_HTML_IMG __TO_NO_BRKTS_HTML_IMG && !__FM_TO_ALL_NUMS score TO_NO_BRKTS_HTML_IMG 0.20 describe TO_NO_BRKTS_HTML_IMG To: misformatted and HTML and one image meta __TO_NO_BRKTS_HTML_ONLY __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && MIME_HTML_ONLY meta TO_NO_BRKTS_HTML_ONLY __TO_NO_BRKTS_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__CTYPE_CHARSET_QUOTED && !__SUBJECT_ENCODED_B64 && !__VIA_ML && !__MSGID_BEFORE_RECEIVED && !__MIME_BASE64 && !__RCD_RDNS_MAIL_MESSY && !__COMMENT_EXISTS && !LOTS_OF_MONEY && !__TAG_EXISTS_CENTER && !__UPPERCASE_URI && !__UNSUB_LINK && !__RCD_RDNS_MX_MESSY && !__DKIM_EXISTS && !__BUGGED_IMG && !__FM_TO_ALL_NUMS && !__URI_12LTRDOM && !__RDNS_NO_SUBDOM && !__HDRS_LCASE #score TO_NO_BRKTS_HTML_ONLY 0.20 describe TO_NO_BRKTS_HTML_ONLY To: misformatted and HTML only meta __TO_NO_BRKTS_DYNIP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_DYNAMIC meta TO_NO_BRKTS_DYNIP __TO_NO_BRKTS_DYNIP && !__NAME_IS_EMAIL && !__MSGID_OK_HEX && !__UNSUB_LINK && !__THREADED && !__RCD_RDNS_MX_MESSY && !__COMMENT_EXISTS && !__MUA_TBIRD && !__CD && !__ML1 && !__RP_MATCHES_RCVD describe TO_NO_BRKTS_DYNIP To: misformatted and dynamic rDNS #tflags TO_NO_BRKTS_DYNIP publish meta __TO_NO_BRKTS_NORDNS __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_NONE meta TO_NO_BRKTS_NORDNS __TO_NO_BRKTS_NORDNS && !__MANY_RECIPS && !__FROM_RUNON && !__VIA_ML && !__TO___LOWER && !ALL_TRUSTED && !__COMMENT_EXISTS && !__DOS_HAS_LIST_UNSUB && !__OE_MSGID_1 && !__MSGID_JAVAMAIL && !__CTYPE_MULTIPART_MIXED && !__UNSUB_LINK && !__JM_REACTOR_DATE && !__TAG_EXISTS_CENTER && !__HAS_UA && !__TO_EQ_FROM_DOM #score TO_NO_BRKTS_NORDNS 0.20 describe TO_NO_BRKTS_NORDNS To: misformatted and no rDNS meta __TO_NO_BRKTS_NORDNS_HTML __TO_NO_BRKTS_HTML_ONLY && RDNS_NONE meta TO_NO_BRKTS_NORDNS_HTML __TO_NO_BRKTS_NORDNS_HTML && !ALL_TRUSTED && !__MSGID_JAVAMAIL && !__MSGID_BEFORE_RECEIVED && !__VIA_ML && !__UA_MUTT && !__COMMENT_EXISTS && !__HTML_LENGTH_384 && !__MIME_BASE64 && !__UPPERCASE_URI && !__TO___LOWER && !__BUGGED_IMG && !__TAG_EXISTS_CENTER #score TO_NO_BRKTS_NORDNS_HTML 0.20 describe TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only meta __TO_NO_BRKTS_MSFT __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS) meta TO_NO_BRKTS_MSFT __TO_NO_BRKTS_MSFT && !__VIA_ML && !__LYRIS_EZLM_REMAILER && !__THREAD_INDEX_GOOD && !__IS_EXCH && !__UNSUB_LINK && !__NOT_SPOOFED && !__DOS_HAS_LIST_UNSUB && !__NAME_EQ_EMAIL && !__SUBJECT_ENCODED_QP && !__THREADED && !__HAS_THREAD_INDEX && !__HAS_X_REF && !__HAS_IN_REPLY_TO && !__FROM_ENCODED_QP && !__RP_MATCHES_RCVD describe TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool score TO_NO_BRKTS_MSFT 3.50 # limit meta __TO_NO_BRKTS_PCNT __TO_NO_ARROWS_R && __FB_NUM_PERCNT meta TO_NO_BRKTS_PCNT __TO_NO_BRKTS_PCNT && !__SUBJECT_ENCODED_B64 && !__DOS_HAS_LIST_UNSUB && !__VIA_ML && !__ISO_2022_JP_DELIM && !__IMS_MSGID && !__THREAD_INDEX_GOOD && !__RCD_RDNS_MX_MESSY && !__UNSUB_LINK && !__LONGLINE && !URI_HEX && !__RP_MATCHES_RCVD && !__MAIL_LINK && !__BUGGED_IMG describe TO_NO_BRKTS_PCNT To: misformatted + percentage #score TO_NO_BRKTS_PCNT 0.20 meta __TO_NO_BRKTS_DIRECT __TO_NO_ARROWS_R && __DOS_DIRECT_TO_MX meta TO_NO_BRKTS_DIRECT __TO_NO_BRKTS_DIRECT && !__IS_EXCH && !__THREAD_INDEX_GOOD && !__COMMENT_EXISTS && !__RCD_RDNS_MTA_MESSY && !__TVD_SPACE_RATIO && !__THREADED && !__FB_DO_NOT_REPLY && !__VBOUNCE_MAILSWEEP3 && !__DEAL && !__RCD_RDNS_MAIL_MESSY && !__UNSUB_LINK && !__RP_MATCHES_RCVD && !__DKIM_EXISTS && !__TAG_EXISTS_CENTER describe TO_NO_BRKTS_DIRECT To: misformatted and direct-to-MX #tflags TO_NO_BRKTS_DIRECT publish meta __TO_NO_BRKTS_NOTLIST __TO_NO_ARROWS_R && !__VIA_ML meta TO_NO_BRKTS_NOTLIST __TO_NO_BRKTS_NOTLIST && !__UNUSABLE_MSGID && !__THREADED && !__SUBJ_RE && !__RCD_RDNS_MAIL_MESSY && !__MANY_RECIPS && !__HAS_MIMEOLE && !__THREAD_INDEX_GOOD && !__IMS_MSGID && !__RCD_RDNS_MTA_MESSY && !__BOUNCE_RPATH_NULL && !__BOUNCE_STAT_FAIL && !__BOUNCE_CTYPE && !ALL_TRUSTED && !__FB_DO_NOT_REPLY && !__RPATH_12LTRDOM && !__MIME_BASE64 && !__UPPERCASE_URI && !__TO___LOWER && !__BUGGED_IMG && !__JM_REACTOR_DATE && !__RP_MATCHES_RCVD && !__X_CRON_ENV && !NO_RELAYS describe TO_NO_BRKTS_NOTLIST To: misformatted and not a mailing list ifplugin Mail::SpamAssassin::Plugin::FreeMail # meta TO_NO_BRKTS_FREEMAIL __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && (FREEMAIL_FROM || FREEMAIL_REPLYTO) meta __TO_NO_BRKTS_FREEMAIL __TO_NO_ARROWS_R && (FREEMAIL_FROM || FREEMAIL_REPLYTO) meta TO_NO_BRKTS_FREEMAIL __TO_NO_BRKTS_FREEMAIL && !__TO_EQ_FROM_DOM describe TO_NO_BRKTS_FREEMAIL To: misformatted and free email service #score TO_NO_BRKTS_FREEMAIL 0.20 tflags TO_NO_BRKTS_FREEMAIL nopublish endif meta __TO_NO_BRKTS_FROM_RUNON __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && __FROM_RUNON meta __TO_NO_BRKTS_FROM_MSSP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && __FROM_MISSPACED meta TO_NO_BRKTS_FROM_MSSP __TO_NO_BRKTS_FROM_RUNON && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__TO___LOWER && !__BUGGED_IMG && !__SUBJECT_ENCODED_QP && !__VIA_ML && !__FR_SPACING_8 && !__TAG_EXISTS_CENTER && !__RCVD_ZIXMAIL && !__RP_MATCHES_RCVD && !__HAS_SENDER score TO_NO_BRKTS_FROM_MSSP 2.50 # max describe TO_NO_BRKTS_FROM_MSSP Multiple formatting errors # The boundary *does* FP on legit mail. However, all of KB's recent samples # have another thing in common -- direct MUA to MX spam! Most unlikely with # an MUA like Thunderbird. meta FORGED_TBIRD_IMG_TO_MX __FORGED_TBIRD_IMG && __DOS_DIRECT_TO_MX describe FORGED_TBIRD_IMG_TO_MX Likely forged Thunderbird image spam #score FORGED_TBIRD_IMG_TO_MX 2.5 # Another constraint. No tiny images, and larger ones up to "less than # 640x480", as observed in the wild. ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __ONE_IMG eval:image_count('all',1,1) body __IMG_LE_300K eval:pixel_coverage('all',62500,300000) meta FORGED_TBIRD_IMG_SIZE __FORGED_TBIRD_IMG && __ONE_IMG && __IMG_LE_300K describe FORGED_TBIRD_IMG_SIZE Likely forged Thunderbird image spam #score FORGED_TBIRD_IMG_SIZE 0.8 endif # Try some combinations not related to tbird forgery meta IMG_DIRECT_TO_MX __DOS_DIRECT_TO_MX && __JPEG_ATTACH && __ONE_IMG && __IMG_LE_300K #score IMG_DIRECT_TO_MX 0.20