Completely wrong spam detection in SpamAssassin
Vinícius Ferrão <[email protected]> Sat, 24 Nov 2012 13:51:58 +0000
| Newsgroups | gmane.linux.gentoo.server |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_2D3DA3AF-A04F-4268-B510-FDA674F6A2E5 Content-Type: multipart/alternative; boundary="Apple-Mail=_C576F361-BF79-4A60-B4A2-E7AF352C2E5F" --Apple-Mail=_C576F361-BF79-4A60-B4A2-E7AF352C2E5F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 Hello folks, I'm having a lot of problems with Spam passing through our = Postfix+Amavisd-new solution. What happens: an phishing attack arrives, it is not detected as spam = with the bayesian filter and since it was originated from an = authenticated user (stolen password) and from a know MTA it receives an = negative score from AWL and the spam/phishing attack get in the system = and finally is relayed to our Exchange Server that uses our postfix as = an Smarthost. The question is: how can I debug this? I'm getting tired to use sa-learn = to train our bayesian filter without success. =46rom months, the same = message get passed through our system and it never get caught. This is weird since when we use spamassassin -r to report the message, = it was detected with 100% of confidence that it is spam. Here are an example: Return-Path: <[email protected]> Delivered-To: clean-quarantine X-Envelope-To: <********************************> X-Envelope-To-Blocked: X-Quarantine-ID: <vb4FI3WXpiqz> X-Spam-Flag: NO X-Spam-Score: 1.674 X-Spam-Level: * X-Spam-Status: No, score=3D1.674 tag=3D-99.9 tag2=3D6.2 kill=3D6.9 = tests=3D[AWL=3D0.000, BAYES_00=3D-1.9, FREEMAIL_FROM=3D0.001, FREEMAIL_REPLYTO=3D1, MISSING_HEADERS=3D1.021, REPLYTO_WITHOUT_TO_CC=3D1.552] = autolearn=3Dno And when I run the spamassassin -r command I got this: Received: from localhost by ironforge.if.ufrj.br with SpamAssassin (version 3.3.1); Sat, 24 Nov 2012 11:38:50 -0200 From: "Webmail Administrador" <[email protected]> Subject: Cuidado com o administrador - confirmar a = infor=3D?ISO-8859-1?Q?ma=3DE7=3DE3o_webmail_abai?=3Dxo Date: Fri, 23 Nov 2012 18:11:26 -0300 Message-Id: <[email protected]> X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on = ironforge.if.ufrj.br X-Spam-Flag: YES X-Spam-Level: ****** X-Spam-Status: Yes, score=3D6.1 required=3D5.0 = tests=3DAWL,BAYES_99,FREEMAIL_FROM, FREEMAIL_REPLYTO,MISSING_HEADERS,REPLYTO_WITHOUT_TO_CC = autolearn=3Dno version=3D3.3.1 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=3D"----------=3D_50B0CDEA.C3BB593D= " This is a multi-part message in MIME format. ------------=3D_50B0CDEA.C3BB593D Content-Type: text/plain; charset=3Diso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit Spam detection software, running on the system "ironforge.if.ufrj.br", = has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Caro usu?rio Webmail Sua cota de correio excedeu o = conjunto quota / limite e voc? est? atualmente em execu??o no GB Baixa devido = a arquivos ocultos e pastas em sua caixa postal. Voc? pode n?o ser capaz de = receber ou enviar novos e-mails at? que voc? re- validar a permitir espa?o em = suas pastas de webmail. Isso tamb?m pode ser causado por n?o validar o seu = webmail como aconselhado anteriormente. [...]=20 Content analysis details: (6.1 points, 5.0 required) pts rule name description ---- ---------------------- = -------------------------------------------------- 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% [score: 1.0000] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail = provider (alert_news[at]programmer.net) 1.0 MISSING_HEADERS Missing To: header 1.6 REPLYTO_WITHOUT_TO_CC REPLYTO_WITHOUT_TO_CC 1.0 FREEMAIL_REPLYTO Reply-To/=46rom or Reply-To/body contain = different freemails -1.0 AWL AWL: From: address is in the auto white-list I'm looking for any help, since the solutions don't appears to be = working as expected. Thanks in advance, Vin=EDcius Ferr=E3o: Administrador de Sistemas=20 www.ferrao.eti.br Vin=EDcius Ferr=E3o: Administrador de Sistemas=20 www.ferrao.eti.br | +55 (21) 8888-2169 --Apple-Mail=_C576F361-BF79-4A60-B4A2-E7AF352C2E5F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Diso-8859-1"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hello = folks,<div><br></div><div>I'm having a lot of problems with Spam passing = through our Postfix+Amavisd-new solution.</div><div><br></div><div>What = happens: an phishing attack arrives, it is not detected as spam with the = bayesian filter and since it was originated from an authenticated user = (stolen password) and from a know MTA it receives an negative score from = AWL and the spam/phishing attack get in the system and finally is = relayed to our Exchange Server that uses our postfix as an = Smarthost.</div><div><br></div><div>The question is: how can I debug = this? I'm getting tired to use sa-learn to train our bayesian filter = without success. =46rom months, the same message get passed through our = system and it never get caught.</div><div><br></div><div>This is weird = since when we use spamassassin -r to report the message, it was detected = with 100% of confidence that it is spam.</div><div><br></div><div>Here = are an example:</div><div><br></div><div><div><div>Return-Path: <<a = href=3D"mailto:[email protected]">[email protected]</a>>= ;</div><div>Delivered-To: clean-quarantine</div><div>X-Envelope-To: = <********************************></div><div>X-Envelope-To-Blocked:<= /div><div>X-Quarantine-ID: = <vb4FI3WXpiqz></div></div><div>X-Spam-Flag: = NO</div><div>X-Spam-Score: 1.674</div><div>X-Spam-Level: = *</div><div>X-Spam-Status: No, score=3D1.674 tag=3D-99.9 tag2=3D6.2 = kill=3D6.9 tests=3D[AWL=3D0.000,</div><div> = BAYES_00=3D-1.9, FREEMAIL_FROM=3D0.001, = FREEMAIL_REPLYTO=3D1,</div><div> = MISSING_HEADERS=3D1.021, REPLYTO_WITHOUT_TO_CC=3D1.552] = autolearn=3Dno</div></div><div><br></div><div><br></div><div><br></div><di= v><br></div><div><br></div><div><br></div><div><br></div><div>And when I = run the spamassassin -r command I got = this:</div><div><br></div><div><div>Received: from localhost by <a = href=3D"http://ironforge.if.ufrj.br">ironforge.if.ufrj.br</a></div><div><s= pan class=3D"Apple-tab-span" style=3D"white-space:pre"> </span>with = SpamAssassin (version 3.3.1);</div><div><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span>Sat, 24 Nov 2012 11:38:50 = -0200</div><div>From: "Webmail Administrador" <<a = href=3D"mailto:[email protected]">[email protected]</a>>= ;</div><div>Subject: Cuidado com o administrador - confirmar a = infor=3D?ISO-8859-1?Q?ma=3DE7=3DE3o_webmail_abai?=3Dxo</div><div>Date: = Fri, 23 Nov 2012 18:11:26 -0300</div><div>Message-Id: = <20121123210616.<a = href=3D"mailto:[email protected]">[email protected]</a>></div= ><div>X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on <a = href=3D"http://ironforge.if.ufrj.br">ironforge.if.ufrj.br</a></div><div>X-= Spam-Flag: YES</div><div>X-Spam-Level: = ******</div><div><b>X-Spam-Status: Yes, score=3D6.1 required=3D5.0 = tests=3DAWL,BAYES_99,FREEMAIL_FROM,</b></div><div><b><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> = </span>FREEMAIL_REPLYTO,MISSING_HEADERS,REPLYTO_WITHOUT_TO_CC = autolearn=3Dno</b></div><div><b><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> = </span>version=3D3.3.1</b></div><div>MIME-Version: = 1.0</div><div>Content-Type: multipart/mixed; = boundary=3D"----------=3D_50B0CDEA.C3BB593D"</div><div><br></div><div>This= is a multi-part message in MIME = format.</div><div><br></div><div>------------=3D_50B0CDEA.C3BB593D</div><d= iv>Content-Type: text/plain; = charset=3Diso-8859-1</div><div>Content-Disposition: = inline</div><div>Content-Transfer-Encoding: = 8bit</div><div><br></div><div>Spam detection software, running on the = system "<a href=3D"http://ironforge.if.ufrj.br">ironforge.if.ufrj.br</a>",= has</div><div>identified this incoming email as possible spam. = The original message</div><div>has been attached to this so you = can view it (if it isn't spam) or label</div><div>similar future email. = If you have any questions, see</div><div>the administrator of that = system for details.</div><div><br></div><div>Content preview: Caro = usu?rio Webmail Sua cota de correio excedeu o conjunto</div><div> = quota / limite e voc? est? atualmente em execu??o no GB Baixa = devido a arquivos</div><div> ocultos e pastas em sua caixa = postal. Voc? pode n?o ser capaz de receber</div><div> ou enviar = novos e-mails at? que voc? re- validar a permitir espa?o em = suas</div><div> pastas de webmail. Isso tamb?m pode ser = causado por n?o validar o seu webmail</div><div> como = aconselhado anteriormente. [...] </div><div><br></div><div>Content = analysis details: (6.1 points, 5.0 = required)</div><div><br></div><div> pts rule name = description</div><div>---- = ---------------------- = --------------------------------------------------</div><div><b> 3.5 = BAYES_99 BODY: Bayes = spam probability is 99 to 100%</b></div><div> = = [score: 1.0000]</div><div> 0.0 FREEMAIL_FROM = Sender email is commonly abused enduser mail = provider</div><div> = (alert_news[at]<a = href=3D"http://programmer.net">programmer.net</a>)</div><div> 1.0 = MISSING_HEADERS Missing To: = header</div><div> 1.6 REPLYTO_WITHOUT_TO_CC = REPLYTO_WITHOUT_TO_CC</div><div> 1.0 FREEMAIL_REPLYTO = Reply-To/=46rom or Reply-To/body contain = different</div><div> = = freemails</div><div>-1.0 AWL = AWL: From: address is in the auto = white-list</div></div><div><br></div><div><br></div><div><br></div><div>I'= m looking for any help, since the solutions don't appears to be working = as expected.</div><div><br></div><div>Thanks in = advance,</div><div><br></div><div><br></div><div><br><div = apple-content-edited=3D"true"> <div id=3D"sig" style=3D"line-height: 13px; margin: 6px 0px; padding: = 8px; border-top-width: 1px; border-top-color: rgb(153, 153, 153); = border-top-style: dotted; border-bottom-width: 1px; border-bottom-color: = rgb(153, 153, 153); border-bottom-style: dotted; font-family: 'Lucida = Grande', Verdana, Arial, sans-serif; font-size: 11px; color: rgb(51, = 102, 153); position: static; z-index: auto; "> <strong style=3D"color: #336699;">Vin=EDcius = Ferr=E3o</strong>: Administrador de Sistemas <br> <a href=3D"http://www.ferrao.eti.br" style=3D"color: = #336699; text-decoration: none; border-bottom: 1px #999999 = dotted;">www.ferrao.eti.br</a></div> </div> <br></div><br><br><div> <div id=3D"sig" style=3D"line-height: 13px; margin: 6px 0; padding: 8px; = border-top: 1px #999999 dotted; border-bottom: 1px #999999 dotted; = font-family: 'Lucida Grande', Verdana, Arial, Sans-Serif; font-size: = 11px; color: #336699;"> <strong style=3D"color: #336699;">Vin=EDcius = Ferr=E3o</strong>: Administrador de Sistemas <br> <a href=3D"http://www.ferrao.eti.br" style=3D"color: = #336699; text-decoration: none; border-bottom: 1px #999999 = dotted;">www.ferrao.eti.br</a> | +55 (21) 8888-2169 </div> </div> <br></body></html>= --Apple-Mail=_C576F361-BF79-4A60-B4A2-E7AF352C2E5F-- --Apple-Mail=_2D3DA3AF-A04F-4268-B510-FDA674F6A2E5 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIF8zCCBe8w ggTXoAMCAQICAgVJMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNVBAYTAkJSMQ8wDQYDVQQKDAZJQ1BF RFUxFjAUBgNVBAoMDVVGRiBCckdyaWQgQ0ExMzAxBgNVBAMMKlVGRiBCcmF6aWxpYW4gR3JpZCBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjA4MTUyMDI3MDlaFw0xMzA4MTUyMDI3MDlaMGwx CzAJBgNVBAYTAkJSMQ8wDQYDVQQKEwZJQ1BFRFUxFjAUBgNVBAoTDVVGRiBCckdyaWQgQ0ExDTAL BgNVBAoTBFVGUkoxCzAJBgNVBAsTAklGMRgwFgYDVQQDEw9WaW5pY2l1cyBGZXJyYW8wggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPD8dzb7uhAfuzY8R4gF3d6KSUoO2c6+lYT5sdn/Ty btXhD5T2AsT8pfp7yBTN4Q1UMndFP6KisyrnDh/cNBkyIYL22QS9GXZO2B+lVuPwvTb39TCofykm Sphz2yaC1bftNJ8wMReeZwqFtGyVompF/9qtIflVfFL4XOz7YP7ahAJoq8HTeDUx+JS3BB7Y2IgN ls/V8WSRZNJ7WGaZzKhv9QcxrqM/mxUMeL5IyrRAazb50+i54DaJ1e8pfNW/igoiOjP2xcJx2458 k2NGJAwiCuKkZERgMtvVovHj2HXNBg5aFIzpDsigEhQvf00/zk9Jbtn4HccOxZTgo5avnNIVAgMB AAGjggKaMIICljAMBgNVHRMBAf8EAjAAMBEGCWCGSAGG+EIBAQQEAwIEsDAOBgNVHQ8BAf8EBAMC BPAwMQYDVR0lBCowKAYIKwYBBQUHAwIGCCsGAQUFBwMEBggrBgEFBQcDAwYIKwYBBQUHAwgwTgYJ YIZIAYb4QgENBEEWP0NQL0NQUyBWZXJzaW9uIDEuMCAtIFVGRiBCcmF6aWxpYW4gR3JpZCBDZXJ0 aWZpY2F0aW9uIEF1dGhvcml0eTAdBgNVHQ4EFgQUxsZklJkimdBzrCpVn4fevATbDDEwgZUGA1Ud IwSBjTCBioAUSnKLs/yMeVlnj18gJDjTj8p/ddahb6RtMGsxCzAJBgNVBAYTAkJSMQ8wDQYDVQQK DAZJQ1BFRFUxFjAUBgNVBAoMDVVGRiBCckdyaWQgQ0ExMzAxBgNVBAMMKlVGRiBCcmF6aWxpYW4g R3JpZCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eYIBADBCBgNVHREEOzA5gRl2aW5pY2l1c2ZlcnJh b0BpZi51ZnJqLmJygRx2aW5pY2l1c2ZlcnJhb0BjYy5pZi51ZnJqLmJyMB0GA1UdEgQWMBSBEmJy Z3JpZGNhQGljLnVmZi5icjA2BglghkgBhvhCAQQEKRYnaHR0cDovL2JyZ3JpZGNhLmljLnVmZi5i ci9jcmwvY2FjcmwuY3JsMDYGCWCGSAGG+EIBAwQpFidodHRwOi8vYnJncmlkY2EuaWMudWZmLmJy L2NybC9jYWNybC5jcmwwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2JyZ3JpZGNhLmljLnVmZi5i ci9jcmwvY2FjcmwuY3JsMBwGA1UdIAQVMBMwEQYPKwYBBAGBwgcCAQoBAQEAMA0GCSqGSIb3DQEB BQUAA4IBAQCbGoeHW4odk1T/ym09fsm3/9wTv4rQfurVCNaOIgdQ19BV08sk+LRu9tZ5PFOVuGAQ tPvg41WUy128vPkLAbwJyN99fG2iQXulYutuc3XVw/XkRTmQas4YxGd0xKwqjhmoR4zrvH3LD6vR ewqzFIQLghPVyo1tuFLalhRGfK3hwkme6ZAmjiCmj9nm3f8guuw/st97rBx4PRT7doIG5dkgVsOa eMKevKcStaiYF72lHNQQavKk24wrKBuruLA/NiNDGrIRUvDB5S+97il8aNd+8bW96Gp/26Yw7vds bJcnHJoDiLKIZ+mZn/X460Yg0IQ0DQPA5AiRi5TampU51LzFMYIDATCCAv0CAQEwcTBrMQswCQYD VQQGEwJCUjEPMA0GA1UECgwGSUNQRURVMRYwFAYDVQQKDA1VRkYgQnJHcmlkIENBMTMwMQYDVQQD DCpVRkYgQnJhemlsaWFuIEdyaWQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkCAgVJMAkGBSsOAwIa BQCgggFlMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEyMTEyNDEz NTE1N1owIwYJKoZIhvcNAQkEMRYEFBzO/GB/ORcgPbLZ+bsQepupV+I6MIGABgkrBgEEAYI3EAQx czBxMGsxCzAJBgNVBAYTAkJSMQ8wDQYDVQQKDAZJQ1BFRFUxFjAUBgNVBAoMDVVGRiBCckdyaWQg Q0ExMzAxBgNVBAMMKlVGRiBCcmF6aWxpYW4gR3JpZCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQIC BUkwgYIGCyqGSIb3DQEJEAILMXOgcTBrMQswCQYDVQQGEwJCUjEPMA0GA1UECgwGSUNQRURVMRYw FAYDVQQKDA1VRkYgQnJHcmlkIENBMTMwMQYDVQQDDCpVRkYgQnJhemlsaWFuIEdyaWQgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkCAgVJMA0GCSqGSIb3DQEBAQUABIIBAMQLeXRbqplTLooVgS1RlFj8 yOBcj7bdPmDeYCb2m0SacCKnJvr7/4jEIgRjECd+yMXle5w9I/3lJsv3Jo3PDpaNWmnoAV0SLb30 lf1wNvpz7vWQfQRmCVciAUpMIeMPQ6dR/0YqWw7rfZHGuStTs95DEEBO8kysKa0YruAv2s9SUgvV oAmbG8G/3C1vLlCb+PTrHb4V6nCi10APEsPxFX6QVJWohnkB4a4Rm9rTuXBrL83YBkvwmUo/AkNT vXZTadsYCsQIBC5XvZK7XTZKoI3JF5ofRo1ab0Vqk3ZNJhc9tjjY8Ty7O+xeF0snzA2WrxXVx0i/ Fn+4s6VYh1UX8MMAAAAAAAA= --Apple-Mail=_2D3DA3AF-A04F-4268-B510-FDA674F6A2E5--