Forged X-TMDA-Confirmed headers?

"Bryan Ischo" <[email protected]> Fri, 30 May 2008 16:49:42 -0400 (EDT)

Newsgroups	gmane.mail.spam.tmda.user
Message-ID	<[email protected]>

Hi all.  Is it possible for a spammer to forge the X-TMDA-Confirmed header
and slip a message through TMDA's defenses?  I occasionally receive a spam
that I have idea how it got through TMDA.  One thing I have noticed is
that such mails will have a header like this:

X-TMDA-Confirmed: Fri, 30 May 2008 16:01:49 -0400

But if I look in my 'confirmed' list, I don't see the email address of the
sender of this email at all.  So they obviously did not actually confirm
the challenge email, otherwise their email address would have ended up in
my confirmed list.

Are they getting through because they just added an X-TMDA-Confirmed
header to their mail?  I wouldn't expect TMDA to be defeated so easily but
I don't know how else to explain these spam emails (I have received two in
the past couple of days) that are getting into my inbox despite TMDA.

I am attaching the two emails to this message just in case they are of
interest.  Note that one of them was delivered via my secondary MX server
which is a friend's server, and he runs spamassassin on everything and so
emails delivered via his server (and they are very rare) have spamassassin
decorations.

Thank you!
Bryan

------------------------------------------------------------------------
Bryan Ischo                [email protected]            2001 Mazda 626 GLX
Hamilton, New Zealand      http://www.ischo.com     RedHat Fedora Core 5
------------------------------------------------------------------------

spam1.txt (text/plain, 4.4 KB)

Old-Delivered-To: [email protected]
Message-ID: <000501c8c02f$02c68f31$097ca4b4@ljmuidf>
From: "linc lori" <[email protected]>
To: <[email protected]>
Subject: *SPAM* [10.456] Re: Free porn
Date: Tue, 27 May 2008 17:40:03 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_1211920208-4072-0"
Content-Transfer-Encoding: binary

This is a multi-part message in MIME format...

------------=_1211920208-4072-0
Message-ID: <000501c8c02f$02c68f31$097ca4b4@ljmuidf>
From: "linc lori" <[email protected]>
To: <[email protected]>
Subject: Re: Free porn
Date: Tue, 27 May 2008 17:40:03 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0002_01C8C02F.02C546B2"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198

This is a multi-part message in MIME format.

------=_NextPart_000_0002_01C8C02F.02C546B2
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

.MJsxixz
ESMTP [Secure Mail System #334]:  Secure message is attached.=09=

------=_NextPart_000_0002_01C8C02F.02C546B2
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.3199" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<style>
.MJsxixz
</style>
<DIV style=3D"width:100%; padding-top:10px; padding-bottom:10px; font-size:=
11px; padding:10px;" class=3D"GQhKeYq">
<H3 id=3D"XKOmTRu"><A href=3D"http://www.google.com/pagead/iclk?sa=3Dl&ai=
=3DIsOXYNB&num=3D38569&adurl=3Dhttp://ffthelastland.altervista.org/main.php=
">ESMTP [Secure Mail System #334]:  Secure message is attached.</A></H3>=09
</DIV></BODY></HTML>=

------=_NextPart_000_0002_01C8C02F.02C546B2--



------------=_1211920208-4072-0
Content-Type: text/plain; name="SpamAssassinReport.txt"
Content-Disposition: inline; filename="SpamAssassinReport.txt"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-Mailer: MIME-tools 5.415 (Entity 5.415)

Spam detection software, running on the system "kulick.com", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  .MJsxixz ESMTP [Secure Mail System #334]: Secure message is
   attached. ESMTP [Secure Mail System #334]: Secure message is attached. [...]
   

Content analysis details:   (10.5 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 1.5 RCVD_NUMERIC_HELO      Received: contains an IP address used for HELO
 0.0 HTML_MESSAGE           BODY: HTML included in message
 3.5 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
              [Blocked - see <http://www.spamcop.net/bl.shtml?216.215.77.114>]
 3.9 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
                            [216.215.77.114 listed in sbl-xbl.spamhaus.org]



------------=_1211920208-4072-0--

spam2.txt (text/plain, 2.7 KB)

Old-Delivered-To: [email protected]
Date: Fri, 30 May 2008 23:47:55 +0100
From: "Eddy Blankenship" <[email protected]>
Reply-To: [email protected]
Message-ID: <[email protected]>
To: [email protected]
Subject: A Rolex watch# 
MIME-Version: 1.0
Content-Type: multipart/alternative;
  boundary="----------C25D35D3C014DA1"

------------C25D35D3C014DA1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

R rqt ep vzm li is ca W uy at zw ch Why spend thousands of dollars on the real deal when a r yl ep haw lic has a w yn at ljs ch looks so much alike that only an expert could tell the difference...And you only pay a fraction of the price.CLICK HERE NOW FOR DETAILS!
------------C25D35D3C014DA1
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
</HEAD>
<BODY>

<html><body bgcolor="#FFFFFF"><font size="+2"><b>R<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> rqt </span>ep<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> vzm </span>li<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> is </span>ca W<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> uy </span>at<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> zw </span>ch</b></font> <p><font size="+2">Why spend thousands of dollars on the real deal when a r<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> yl </span>ep<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> haw </span>lic<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> has </span>a w<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> yn </span>at<span style="FONT-SIZE: 2px; FLOAT: right; COLOR: white"> ljs </span>ch looks so much alike that only an expert could tell the difference...<br>And you only pay a fraction of the price.</font><br><br></p><p></p><p><
 /p><p><font color="#FF0000"><a href="http://mwyyl.samiubeny.com/?ucwmpo"><b><font size="+2">CLICK HERE NOW FOR DETAILS!</font></b></a></font></p></body></html>

</BODY></HTML>
------------C25D35D3C014DA1--