home *** CD-ROM | disk | FTP | other *** search
/ ftp.f-secure.com / 2014.06.ftp.f-secure.com.tar / ftp.f-secure.com / support / hotfix / fsis / IS-SpamControl.fsfix / iufssc / rules / 96_fs-received.cf < prev    next >
Text File  |  2006-11-29  |  13KB  |  335 lines
  1. # 96_fs-received.cf -- era Mon May 23 13:25:03 2005
  2. # Copyright (C) 2005 F-Secure Corporation
  3. # $Id: 96_fs-received.cf 2346 2005-12-09 13:59:39Z  $
  4.  
  5.  
  6. ifplugin FS::MsgStructure
  7.  
  8. # rule: RECEIVED_DOUBLE_BY
  9. # added 2005-05-18
  10. # test: spam-2005-05-18/df-2005-05-18-008544.txt
  11. # test: spam-2005-05-18/df-2005-05-18-003952.txt
  12.  
  13. define_structure RECEIVED_DOUBLE_BY
  14. structure (?:^)
  15. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  16. structure Received: from  \(EHLO [-A-Za-z0-9_.]{0,64} ?\)(?: )\n
  17. structure  (?: ) by mta[0-9]{1,4}[-A-Za-z0-9_.]{0,60} with SMTP;.{0,200}\n
  18. structure  (?: ) by mta[0-9]{1,4}[-A-Za-z0-9_.]{0,60} with SMTP;.{0,200}\n
  19. structure  (?:[ \t].{0,1023}\n){0,50}
  20. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  21. structure    (?:[ \t].{0,1023}\n){0,50}){0,50}
  22. structure \n
  23.  
  24. describe RECEIVED_DOUBLE_BY Clumsy Received: forgery, doubled "by" fields
  25. score     RECEIVED_DOUBLE_BY 9
  26.  
  27.  
  28. # rule: RECEIVED_WOSTFIX
  29. # added 2005-05-18
  30. # edit 2005-05-20: FQDN hostname, additional comment after (Wostfix ...
  31. # test: spam-2005-05-18/df-2005-05-18-008468.txt
  32. # test: spam-2005-05-20/df-2005-05-20-008127.txt
  33.  
  34. define_structure RECEIVED_WOSTFIX
  35. structure (?:^)
  36. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  37. structure Received: by [.-A-Za-z0-9_]{0,64} \(Wostfix
  38. structure    (?:, from userid \d{3,7})?\)\n
  39. structure (?:[ \t].{0,1023}\n){0,50}
  40. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  41. structure    (?:[ \t].{0,1023}\n){0,50}){0,50}
  42. structure \n
  43.  
  44. describe RECEIVED_WOSTFIX Silly "Wostfix" Received: forgery
  45. score     RECEIVED_WOSTFIX 9
  46.  
  47.  
  48. # rule: RECEIVED_FORGED_FOR_SELF
  49. # added 2005-05-18
  50. # test: spam-2005-05-18/df-2005-05-18-000059.txt
  51. # see also: MSGSTRUCT_FORGED_FOR_SELF
  52.  
  53. define_structure RECEIVED_FORGED_FOR_SELF
  54. structure (?:^)
  55. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  56. structure Received: from [-A-Za-z0-9_.]{0,64}
  57. # telltale sign #1: HELO in parens where genuine Sendmail would have rdns
  58. structure     (?: )\((?:EH|HE)LO [-A-Za-z0-9_.]{0,64} \[[0-9.]{7,15}\]\)\n
  59. structure   \tby [-A-Za-z0-9_.]{0,64}(?: )
  60. # telltale sign #2: occasionally somewhat weird Sendmail version identifier
  61. structure    \(8\.[0-9]{1,2}\.[0-9]{1,2}(?:\.[-_A-Za-z0-9]{1,15})?
  62. structure     /8\.[0-9]{1,2}\.[0-9]{1,2}(?:\.[-_A-Za-z0-9]{1,15})?
  63. structure     [-_/A_Za-z0-9]{0,15}\)(?: with E?SMTP)
  64. structure   (?: )id [A-Za-z0-9]{5,20}\n
  65. structure  \tfor <([-A-Za-z0-9._%=]{1,50}\@[-A-Za-z0-9.]{5,64})>;
  66. structure  (?: )(?:Mon|T(?:ue|hu)|Wed|Fri|S(?:at|un)), [ 0-3][0-9]
  67. structure  (?: )(?:J(?:an|u[nl])|Feb|Ma[ry]|A(?:pr|ug)|Sep|Oct|Nov|Dec)
  68. structure  (?: )[12][0-9]{3} [012][0-9](?::[0-5][0-9]){2} [+-][01][0-9][0-5]0\n
  69. # telltale sign #3: whimsical envelope-from after the real thing
  70. structure  \t\(envelope-from \1\)\n
  71. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  72. structure     (?:[ \t].{0,1023}\n){0,50}){0,50}
  73. structure \n
  74.  
  75. describe RECEIVED_FORGED_FOR_SELF Sendmail Received: forgery, "for sender"
  76. score     RECEIVED_FORGED_FOR_SELF 9
  77.  
  78.  
  79.  
  80. # rule: RECEIVED_FORGED_MAJORDOMO
  81. # added 2005-05-18
  82. # test: spam-2005-05-18/df-2005-05-18-008436.txt
  83. ######## TODO: look at genuine Majordomo handovers, look for better telltales?
  84.  
  85. define_structure RECEIVED_FORGED_MAJORDOMO
  86. structure (?:^)
  87. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  88. # telltale sign #1: claims to be (from majordomo?)
  89. structure Received: \(from majordomo?@[-A-Za-z0-9_.]{5,64}\)\n
  90. structure   \tby [-A-Za-z0-9_.]{5,64}(?: )
  91. # telltale sign #2: weirdish Sendmail version id (and no "with E?SMTP")
  92. structure    \(8\.[0-9]{1,2}\.[0-9]{1,2}(?:\.[-_A-Za-z0-9]{1,15})?
  93. structure     /8\.[0-9]{1,2}\.[0-9]{1,2}(?:\.[-_A-Za-z0-9]{1,15})?
  94. structure     /SubmitX\)
  95. structure   (?: )id [A-Za-z0-9]{5,20}\n
  96. # telltale sign #3: proper Majordomo list-dash-name
  97. structure   \tfor [A-Za-z0-9]{1,50}-[A-Za-z0-9]{1,64};
  98. structure  (?: )(?:Mon|T(?:ue|hu)|Wed|Fri|S(?:at|un)), [ 0-3][0-9]
  99. structure  (?: )(?:J(?:an|u[nl])|Feb|Ma[ry]|A(?:pr|ug)|Sep|Oct|Nov|Dec)
  100. structure  (?: )[12][0-9]{3} [012][0-9](?::[0-5][0-9]){2} [+-][01][0-9][0-5]0\n
  101. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  102. structure     (?:[ \t].{0,1023}\n){0,50}){0,50}
  103. structure \n
  104.  
  105. describe RECEIVED_FORGED_MAJORDOMO Forged Majordomo/Sendmail/SubmitX handoff
  106. score     RECEIVED_FORGED_MAJORDOMO 9
  107.  
  108.  
  109.  
  110. # rule: RECEIVED_FORGED_MINIMAL
  111. # added 2005-05-18
  112. # test: spam-2005-05-18/df-2005-05-18-000132.txt
  113.  
  114. define_structure RECEIVED_FORGED_MINIMAL
  115. structure (?:^)
  116. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  117. structure Received: from [-A-Za-z0-9_.]{0,64} \(HELO [-A-Za-z0-9_.]{0,64}\)\n
  118. structure   \tby [-A-Za-z0-9_.]{0,64} with E?SMTP;
  119. structure  (?: )(?:Mon|T(?:ue|hu)|Wed|Fri|S(?:at|un)), [ 0-3][0-9]
  120. structure  (?: )(?:J(?:an|u[nl])|Feb|Ma[ry]|A(?:pr|ug)|Sep|Oct|Nov|Dec)
  121. structure  (?: )[12][0-9]{3} [012][0-9](?::[0-5][0-9]){2} [+-][01][0-9][0-5]0\n
  122. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  123. structure     (?:[ \t].{0,1023}\n){0,50}){0,50}
  124. structure \n
  125.  
  126. describe RECEIVED_FORGED_MINIMAL Minimal forged Received: header
  127. score     RECEIVED_FORGED_MINIMAL 2
  128.  
  129.  
  130. # rule: FS_RECEIVED_FORGED_8X
  131. # added 2005-05-20
  132. # test: spam-2005-05-20/df-2005-05-20-008124.txt
  133.  
  134. define_structure FS_RECEIVED_FORGED_8X
  135. structure (?:^)
  136. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  137. structure Received: from .{1,999}\n
  138. structure    (?: )by (?:[-0-9A-Za-z_]{1,64}\.){1,7}[A-Za-z]{2,4}
  139. structure    (?: )with ESMTP \(8(?:\.[0-9]{1,2}){2}/8(?:\.[0-9]{1,2}){2}[/)]
  140.  
  141. describe FS_RECEIVED_FORGED_8X Misplaced Sendmail 8.x.x identification
  142. score     FS_RECEIVED_FORGED_8X 7
  143.  
  144.  
  145. # rule: FS_RECEIVED_FORGED_8XX
  146. # added 2005-05-20
  147. # test: spam-2005-05-20/df-2005-05-20-008121.txt
  148.  
  149. define_structure FS_RECEIVED_FORGED_8XX
  150. structure (?:^)
  151. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  152. # telltale sign #1: X-Apparently-To:
  153. structure X-Apparently-To: .{1,999}\n
  154. # telltale sign #2: like above, but even without "with E?SMTP"
  155. structure Received: from .{1,999}\n
  156. structure    (?: )by (?:[-0-9A-Za-z_]{1,64}\.){1,7}[A-Za-z]{2,4}
  157. structure    (?: )\(8(?:\.[0-9]{1,2}){2}/8(?:\.[0-9]{1,2}){2}
  158. structure    (?:/[-A-Za-z0-9./_]{2,15})?\)\n
  159. structure    (?: )ID <[0-9A-Za-z]{5,20}@
  160. structure    (?:[-0-9A-Za-z_]{1,64}\.){1,7}[A-Za-z]{2,4}>;
  161. structure  (?: )(?:Mon|T(?:ue|hu)|Wed|Fri|S(?:at|un)), [ 0-3][0-9]
  162. structure  (?: )(?:J(?:an|u[nl])|Feb|Ma[ry]|A(?:pr|ug)|Sep|Oct|Nov|Dec)
  163. structure  (?: )[12][0-9]{3} [012][0-9](?::[0-5][0-9]){2} [+-][01][0-9][0-5]0\n
  164. # and we require it to be the final Received: line
  165. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  166. structure     (?:[ \t].{0,1023}\n){0,50}){0,50}
  167. structure \n
  168.  
  169. describe FS_RECEIVED_FORGED_8XX Misplaced Sendmail 8.x.x identification, mk II
  170. score     FS_RECEIVED_FORGED_8XX 9
  171.  
  172.  
  173. # rule: MSGSTRUCT_RECEIVED_STUB
  174. # added 2005-05-13
  175. # test: spam-2005-05-13/df-2005-05-13-006279.txt
  176.  
  177. define_structure MSGSTRUCT_RECEIVED_STUB
  178. structure (?:^)
  179. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  180. # telltale sign #1: Received by IP
  181. structure Received: by (?:[1-9][0-9]?|1[0-9][0-9]|2[0-4][0-9]|25[0-4])
  182. structure    \.(?:0|[1-9][0-9]?|1[0-9][0-9]|2[0-4][0-9]|25[0-5])
  183. structure    \.(?:0|[1-9][0-9]?|1[0-9][0-9]|2[0-4][0-9]|25[0-5])
  184. structure    \.(?:[1-9][0-9]?|1[0-9][0-9]|2[0-4][0-9]|25[0-4])
  185. # telltale sign #2: with SMTP, smack dab; longish queue id
  186. structure   (?: )with SMTP id [A-Za-z0-9]{8,20};
  187. structure  (?: )(?:Mon|T(?:ue|hu)|Wed|Fri|S(?:at|un)), [ 0-3][0-9]
  188. structure  (?: )(?:J(?:an|u[nl])|Feb|Ma[ry]|A(?:pr|ug)|Sep|Oct|Nov|Dec)
  189. structure  (?: )[12][0-9]{3} [012][0-9](?::[0-5][0-9]){2} [+-][01][0-9][0-5]0\n
  190. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  191. structure    (?:[ \t].{0,1023}\n){0,50}){0,50}
  192. structure \n
  193.  
  194. describe MSGSTRUCT_RECEIVED_STUB Forged very minimal final Received: header
  195. score     MSGSTRUCT_RECEIVED_STUB 4
  196.  
  197.  
  198. # rule: MSGSTRUCT_FORGED_FOR_SENDER
  199. # added 2005-05-13
  200. # edit 2005-05-18: relax IP number on first line
  201. # test: spam-2005-05-13/df-2005-05-13-003032.txt
  202. # test: spam-2005-05-18/df-2005-05-18-003339.txt
  203.  
  204. define_structure MSGSTRUCT_FORGED_FOR_SENDER
  205. structure (?:^)
  206. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  207. # telltale sign #1: Received from [square brackets] (sheesh)
  208. structure Received: from \[[-.0-9A-Za-z]{5,64}\] \(\[[.0-9]{7,15}\]\)\n
  209. structure  \tby [-.0-9A-Za-z]{5,64}
  210. # telltale sign #2: somewhat weird Sendmail identification (e.g. 8.12.0.Beta5)
  211. structure   (?: )\(8\.[A-Za-z0-9.]{1,12}/8\.[A-Za-z0-9.]{1,12}\)
  212. structure   (?: )with E?SMTP id [A-Za-z0-9]{9,20}\n
  213. # telltale sign #3: for <sender>
  214. structure  \tfor (<[-A-Za-z0-9_.]{1,20}\@[-.0-9A-Za-z]{5,64}>);
  215. structure  (?: )(?:Mon|T(?:ue|hu)|Wed|Fri|S(?:at|un)), [ 0-3][0-9]
  216. structure  (?: )(?:J(?:an|u[nl])|Feb|Ma[ry]|A(?:pr|ug)|Sep|Oct|Nov|Dec)
  217. structure  (?: )[12][0-9]{3} [012][0-9](?::[0-5][0-9]){2} [+-][01][0-9][0-5]0\n
  218. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  219. structure    (?:[ \t].{0,1023}\n){0,50}){0,50}
  220. # telltale sign #3 part 2: From: terminus identical to Received: for
  221. structure From: "[^\"]{0,50}" \1\n
  222. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  223. structure    (?:[ \t].{0,1023}\n){0,50}){0,50}
  224. structure \n
  225.  
  226. describe MSGSTRUCT_FORGED_FOR_SENDER Forged Sendmail Received: for <sender>
  227. score     MSGSTRUCT_FORGED_FOR_SENDER 9
  228.  
  229.  
  230.  
  231. # rule: MSGSTRUCT_FORGED_FOR_SELF
  232. # added 2005-05-13
  233. # edit 2005-05-18: relax hostname regex in Received: from
  234. # test: spam-2005-05-13/df-2005-05-13-003031.txt
  235. # test: spam-2005-05-18/df-2005-05-18-000182.txt
  236.  
  237. define_structure MSGSTRUCT_FORGED_FOR_SELF
  238. structure (?:^)
  239. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  240. # telltale sign #1: X-Sender
  241. structure X-Sender: ([-A-Za-z0-9._]{1,64}\@[-.0-9A-Za-z]{5,64})\n
  242. # telltale sign #2: X-Apparently-To: same address
  243. structure X-Apparently-To: \1\n
  244. # telltale sign #3: really weird final Received: lines
  245. structure Received: from [-.0-9A-Za-z]{0,64} \(\1\) by [-.0-9A-Za-z]{5,64}\n
  246. structure Received: \(.{1,200}\);
  247. structure  (?: )(?:Mon|T(?:ue|hu)|Wed|Fri|S(?:at|un)), [ 0-3][0-9]
  248. structure  (?: )(?:J(?:an|u[nl])|Feb|Ma[ry]|A(?:pr|ug)|Sep|Oct|Nov|Dec)
  249. structure  (?: )[12][0-9]{3} [012][0-9](?::[0-5][0-9]){2} [+-][01][0-9][0-5]0\n
  250. structure (?:(?!Received:)[A-Za-z0-9].{0,1023}\n
  251. structure    (?:[ \t].{0,1023}\n){0,50}){0,50}
  252. structure \n
  253.  
  254. describe MSGSTRUCT_FORGED_FOR_SELF Clumsy forged X-Sender = X-Apparently-To
  255. score     MSGSTRUCT_FORGED_FOR_SELF 7
  256.  
  257.  
  258. # rule: FS_REFERENCES_RECEIVED
  259. # added 2005-05-20
  260. # test: spam-2005-05-20/df-2005-05-20-004613.txt
  261.  
  262. define_structure FS_REFERENCES_RECEIVED
  263. structure (?:^)
  264. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  265. # last Received: header with a full domain name -- grab domain name into \1
  266. structure Received: from (?:[-0-9A-Za-z]{1,64}\.)?
  267. structure     ([-0-9A-Za-z]{1,64}\.[A-Za-z]{2,4}) .{1,600}\n
  268. structure    [ \t]{1,1000}by .{1,1000}\n
  269. structure    (?:[ \t].{0,1023}\n){0,50}
  270. # anything goes, as long as it's not a Received: from something.dot
  271. structure (?:(?!Received: from [-A-Za-z0-9_]{1,64}\.[-A-Za-z0-9_])
  272. structure    [A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  273. # telltale sign: references and in-reply-to a message-id in domain \1
  274. structure References: (<[-0-9A-Za-z._+=]{1,64}@\1>)\n
  275. structure In-Reply-To: \2\n
  276.  
  277. describe FS_REFERENCES_RECEIVED In-Reply-To+References point to Received domain
  278. score     FS_REFERENCES_RECEIVED 1
  279.  
  280.  
  281.  
  282. # rule: FS_RANDOM_MID_DOMAIN
  283. # added 2005-05-20
  284. # edit 2005-05-24: add case __FS_MID_DOMAIN_FROM_AFTER
  285. # test: spam-2005-05-20/df-2005-05-20-007176.txt
  286. # fail: reference/yahoo-sample-0001.eml
  287. # fail: reference/thunderbird-sample-0001.eml
  288.  
  289. # Prerequisite: There is a Message-ID in exactly this format
  290. define_structure __FS_MID_EXISTS
  291. structure (?:^)
  292. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  293. structure Message-ID: <[-0-9A-Za-z._=+%]{1,64}@
  294. structure    (?:[-_0-9A-Za-z]{1,64}\.){0,8}[A-Za-z]{2,4}>\n
  295.  
  296. define_structure __FS_MID_DOMAIN_RECEIVED
  297. structure (?:^)
  298. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  299. structure Received: from (?:[-0-9A-Za-z]{1,64}\.){0,7}
  300. structure    ([-0-9A-Za-z]{1,64}\.[A-Za-z]{2,4}) .{1,600}\n
  301. structure    (?:[ \t].{0,1023}\n){0,50}
  302. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  303. structure Message-ID: <[-0-9A-Za-z._=+%]{1,64}@
  304. structure    (?:[-_0-9A-Za-z]{1,64}\.){0,7}\1>\n
  305.  
  306. ######## TODO: __FS_MID_DOMAIN_RECEIVED_AFTER?
  307.  
  308. define_structure __FS_MID_DOMAIN_FROM
  309. structure (?:^)
  310. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  311. structure From: .{1,100}@(?:[-_0-9A-Za-z]\.){0,7}
  312. structure    ([-0-9A-Za-z]{1,64}\.[A-Za-z]{2,4})>?
  313. structure    (?: \(.{1,500})?\n
  314. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  315. structure Message-ID: <[-0-9A-Za-z._=+%]{1,64}@
  316. structure    (?:[-_0-9A-Za-z]{1,64}\.){0,7}\1>\n
  317.  
  318. define_structure __FS_MID_DOMAIN_FROM_AFTER
  319. structure (?:^)
  320. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  321. structure Message-ID: <[-0-9A-Za-z._=+%]{1,64}@
  322. structure    (?:[-_0-9A-Za-z]{1,64}\.){0,7}
  323. structure    ([-0-9A-Za-z]{1,64}\.[A-Za-z]{2,4})>\n
  324. structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
  325. structure From: .{1,100}@(?:[-_0-9A-Za-z]\.){0,7}\1>?
  326. structure    (?: \(.{1,500})?\n
  327.  
  328. # ... but it matches none of the other rules:
  329. meta FS_RANDOM_MID_DOMAIN (__FS_MID_EXISTS && !__FS_MID_DOMAIN_RECEIVED && !__FS_MID_DOMAIN_FROM && !__FS_MID_DOMAIN_FROM_AFTER)
  330. describe FS_RANDOM_MID_DOMAIN Message-Id's domain neither Received: nor From:
  331. score     FS_RANDOM_MID_DOMAIN 1.8
  332.  
  333.  
  334. endif
  335.