Re: Phishing Script and Server Update & Future Plans
Bogdan Rotariu <[email protected]> Wed, 6 Nov 2024 17:04:17 +0200
| Newsgroups | gmane.mail.virus.mailscanner |
|---|---|
| Message-ID | <[email protected]> |
--===============2658111464558612135== Content-Type: multipart/alternative; boundary=Apple-Mail-C51950C2-BA24-4B97-B4D5-4844744749B7 Content-Transfer-Encoding: 7bit --Apple-Mail-C51950C2-BA24-4B97-B4D5-4844744749B7 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D= utf-8"></head><body dir=3D"auto">Yes its a broken gz with redirect info, but= as it already happen and affected all that use the older script and might n= ot follow this list, the new script should fix the problem created by the re= direct.<div><br id=3D"lineBreakAtBeginningOfSignature"><div dir=3D"ltr">Sent= from mobile</div><div dir=3D"ltr"><br><blockquote type=3D"cite">On Nov 6, 2= 024, at 16:38, Jerry Benton <jerry.benton-OT/[email protected]> wrote:<br><b= r></blockquote></div><blockquote type=3D"cite"><div dir=3D"ltr">=EF=BB=BF <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-12= 52"> <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style>@font-face { font-family: Helvetica; } @font-face { font-family: "Cambria Math"; } @font-face { font-family: Calibri; } @font-face { font-family: Aptos; } p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0in; font-size: 12pt; fon= t-family: Aptos, sans-serif; } a:link, span.MsoHyperlink { color: blue; text-decoration: underline; } span.apple-converted-space { } span.EmailStyle19 { font-family: Aptos, sans-serif; color: windowtext; } .MsoChpDefault { font-size: 10pt; } @page WordSection1 { size: 8.5in 11in; margin: 1in; } div.WordSection1 { page: WordSection1; }</style> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">It was not in gzip f= ormat because the update server was handing you a 301 that was not being han= dled correctly. This will no longer happen. <o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></s= pan></p> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">-- <o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">Jerry Benton<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"><a href=3D"http://www.mailborder.com"><span style=3D"= color:#0563C1">www.mailborder.com</span></a><o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">+1 843-800-8605<o:p></o:p></span></p> </div> </div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></s= pan></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></s= pan></p> <div id=3D"mail-editor-reference-message-container"> <div> <div> <div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0= in 0in"> <p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><b><span style=3D"colo= r:black">From: </span></b><span style=3D"color:black">MailScanner <mailscanner-bounces+j= erry.benton=3Dmailborder.com-qhrM8SXbD5JTOyd/[email protected]> on behalf of Bogdan-= Stefan Rotariu <[email protected]><br> <b>Date: </b>Wednesday, November 6, 2024 at 09:36<br> <b>To: </b>MailScanner Discussion <mailscanner-qhrM8SXbD5JTOyd/[email protected]>= <br> <b>Subject: </b>Re: Phishing Script and Server Update & Future Plans<o:p= ></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">Thank you for the recent u= pdate. I would like to suggest two changes:<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black"><br> 1. Since we have already set the PATH, we can simply use ms-peek withou= t specifying the full path (/usr/sbin/ms-peek).<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">2. Regarding the enf= orcement of HTTPS, we have encountered issues with bad .gz files. Currently,= the only fix is to remove them manually. I propose that the script either o= verwrites these .gz files or removes them before downloading new ones to prevent this issue.<o:p></o:p></span></p> </div> <p class=3D"MsoNormal"><span style=3D"color:black"><br> gzip: /usr/mailscanner/etc/phishing.safe.sites.conf.master.gz: not in gzip f= ormat</span><o:p></o:p></p> <div> <p class=3D"MsoNormal"><span style=3D"color:black"><br> I have added a workaround to our script:<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black"><o:p> </o:p></span><= /p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black">if [ -d $CONFIGDIR ]; the= n<br> cd $CONFIGDIR<br> #delete .gz old gz files if left behind<br> find "$CONFIGDIR" -name "*.gz" -type f -exec rm -f {} +<br> <br> Thanks,<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"color:black"><o:p> </o:p></span><= /p> </div> <div> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;font-family:Helvetica;= color:black">--<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;font-family:Helvetica;= color:black">Bogdan-Stefan Rotariu<o:p></o:p></span></p> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div> <p class=3D"MsoNormal"><br> <br> <o:p></o:p></p> <blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt"> <div> <p class=3D"MsoNormal">On 6 Nov 2024, at 14:20, Jerry Benton <jerry.bento= [email protected]> wrote:<o:p></o:p></p> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> <div> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">I have updated the c= ron script for phishing bad/safe sites to v0.3.1. It is available here:<a hr= ef=3D"https://phishing.mailscanner.info/"><span style=3D"color:#467886">http= s://phishing.mailscanner.info</span></a><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"> <o:p></o:p></s= pan></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">The phishing update s= erver has been updated to use https, but will not force that connection and w= ill now accept http.<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"> <o:p></o:p></s= pan></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">Several previous aut= omatic bad site scrubs were removed for the google domain and several subdom= ains. This means you will need to add them to the phishing safe sites custom= file to retain links to google domains.<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"> <o:p></o:p></s= pan></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">Uncompressed version= s of the bad/safe sites files are no longer available. If you have an old sc= ript trying to download those files, it will fail. You will need to use the n= ewer update script or modify any custom scripts to download the compressed versions and then extract them fo= r use.<span class=3D"apple-converted-space"> </span><o:p></o:p></span><= /p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"> <o:p></o:p></s= pan></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">The phishing bad sit= es is compiled from Phishtank data. It essentially pulls the domains from th= e phishing links and puts them into a flat file for use in MailScanner.<o:p>= </o:p></span></p> </div> <div> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">Future plan:</span><span style=3D"font-size:11.0pt"><= o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">I am looking into creating a mechanism to populate a S= QLite database with phishing links instead of just domains. I am creating th= is for use in Mailborder, but will make the database available for MailScanner. In order to be used in MailScanner some= one would have to write the code to use it. (I have enough to do.) Once I cr= eate a base structure of what the database would look like, I will send out a= n update here with a link to the SQLite database. Not sure how this would impact scanning speed at this t= ime. It would of course depend on how big that database gets.</span><span st= yle=3D"font-size:11.0pt"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">The reason why I am looking into this =E2=80=A6</span= ><span style=3D"font-size:11.0pt"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">I contacted Openphish about licensing cost to get the= ir database. They want $10k per server per year for the =E2=80=9Clight=E2=80= =9D version. That is just nuts.</span><span style=3D"font-size:11.0pt"><o:p>= </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">How you can help =E2=80=A6</span><span style=3D"font-= size:11.0pt"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">I need source data to compile this database. I can ge= t some from Phishtank and a very small amount from Openphish free sources. I= haven=E2=80=99t put a whole lot of cycles into this, but if you have any suggestions, please email me.<span class=3D"apple-conve= rted-space"> </span></span><span style=3D"font-size:11.0pt"><o:p></o:p>= </span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"> </span><span style=3D"font-size:11.0pt"><o:p></= o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">-- </span><span style=3D"font-size:11.0pt"><o:p>= </o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">Jerry Benton</span><span style=3D"font-size:11.0pt"><= o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif"><a href=3D"http://www.mailborder.com/"><span style=3D= "color:#0563C1">www.mailborder.com</span></a></span><span style=3D"font-size= :11.0pt"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Cal= ibri",sans-serif">+1 843-800-8605</span><span style=3D"font-size:11.0pt= "><o:p></o:p></span></p> </div> </div> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"> <o:p></o:p></s= pan></p> </div> </div> <p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;font-family:Helvetica"= ><br> <br> --<span class=3D"apple-converted-space"> </span><br> MailScanner mailing list<br> </span><a href=3D"mailto:mailscanner-qhrM8SXbD5JTOyd/[email protected]"><span style=3D"= font-size:9.0pt;font-family:Helvetica;color:#467886">[email protected]= canner.info</span></a><span style=3D"font-size:9.0pt;font-family:Helvetica">= <br> </span><a href=3D"http://lists.mailscanner.info/mailman/listinfo/mailscanner= "><span style=3D"font-size:9.0pt;font-family:Helvetica;color:#467886">http:/= /lists.mailscanner.info/mailman/listinfo/mailscanner</span></a><o:p></o:p></= p> </div> </blockquote> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> </div> </div> </div> <span></span><br><span></span><br><span>-- </span><br><span>MailScanner mail= ing list</span><br><span>mailscanner-qhrM8SXbD5JTOyd/[email protected]</span><br><span>= http://lists.mailscanner.info/mailman/listinfo/mailscanner</span><br><span><= /span><br></div></blockquote></div></body></html>= --Apple-Mail-C51950C2-BA24-4B97-B4D5-4844744749B7-- --===============2658111464558612135== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- MailScanner mailing list mailscanner-qhrM8SXbD5JTOyd/[email protected] http://lists.mailscanner.info/mailman/listinfo/mailscanner --===============2658111464558612135==--