Re: [SmartList] Re: faked from addresses getting through to my lists - problem and poss solution?
I've been dealing with this for a few months on a number of lists I manage, as the Bagle virus picks up from lines from received emails on infected computers. From the pattern, it doesn't seem to be an intentional attack against listserves, it's just another #*!&^ virus. My lists are newsletter-type (with a few approved posters on each). Outlook and Outlook Express, in use by most folks, can't add custom headers. The "Organization" field is now rarely used by folks. Therefore, if I can get smartlist to look at this header field AND have the approved posters use, e.g. the organization "1234", I can have only approved posts get thru my lists. But I'm not a programmer. I simply bludgeon smartlist into submission, which is preety easy due to the many easy-to-change parameters. Here's what I came up with: Filename: rc.local.20 -------- cut here --------- HEAD=`formail -zx Organization:` # extract the header information :0fw * ^Organization:.*\[1234]\ -------- cut here --------- Alas... it doesn't work. All posts go thru regardless of the contents of the Organization field. Any ideas? -- Phil
On Tue, Jun 15, 2004 at 02:42:32PM -0500, rgball wrote:
1) go through all the list's archives and match information in the bottom-most Received: line to the subscriber's address. Keep all of this in a database (not the dist file).
Can't rely on that. Received: lines can be faked, as long as they're below the point of injection into the system.
If there's spoofing going on, the spoofers are presumably motivated to keep it happening.
You could just rely on a valid PGP signature before passing on the message. But there are very few lists that do this, in large part because most people find PGP too hard to use.
It's still not going to be proof against a determined spoofer but should eliminate the casual spammers.
I first saw spam with fake Received: header lines some time around 1997.
Roger
On Thu, 09 Sep 2004 08:34:07 -0400, Phillip Sego wrote
I've been dealing with this for a few months on a number of lists I manage, as the Bagle virus picks up from lines from received emails on infected computers. From the pattern, it doesn't seem to be an intentional attack against listserves, it's just another #*!&^ virus.
My lists are newsletter-type (with a few approved posters on each). Outlook and Outlook Express, in use by most folks, can't add custom headers. The "Organization" field is now rarely used by folks. Therefore, if I can get smartlist to look at this header field AND have the approved posters use, e.g. the organization "1234", I can have only approved posts get thru my lists.
But I'm not a programmer. I simply bludgeon smartlist into submission, which is preety easy due to the many easy-to-change parameters.
Here's what I came up with:
Filename: rc.local.20
-------- cut here --------- HEAD=`formail -zx Organization:` # extract the header information :0fw * ^Organization:.*\[1234]\
-------- cut here ---------
Alas... it doesn't work. All posts go thru regardless of the contents of the Organization field.
True, the above won't work for what you are trying to do and rc.local.s20 wouldn't be the file to use either. You can use either rc.local.s00 or rc.local.s10. Let's say .s10 is the choice: 1) make sure the line RC_LOCAL_SUBMIT_10 = rc.local.s10 is uncommented in rc.custom 2) if you just want to bail out of the submission process if the specified Organization header isn't present then, in rc.local.s10 put :0 * !^Organization:.*1234 HOST=continue_with_rc.request Rich (the above isn't tested with respect to exactly what happens since I don't protect my lists this way)
participants (2)
-
Phillip Sego -
rgball