cbl spam block

Which is the best email spam filter software and block list? As a person who logs online more than anything else, my email account is constantly being bombarded with spam emails. I receive an average of 100 – 200 spam mails per day, not even the mighty Gmail can stop them from entering my inbox.

Based on many years of experience, I’ve discovered the best way to filter out spam on a email hosting server is CBL Spam Block, as for those using Microsoft Outlook, Spamihilator is the best, not perfect but good enough to filter out 98% of spam mails.

Labels:

greymail spam

Running the Grey Mail Gauntlet

Thursday, June 14, 2007 at 8:19am by Schalk Cronjé

A while ago over at Security Insights, McAfee CTO Chris Bolin blogged about grey spam. As far as content-based analysis goes, it is a tricky area for anti-spam vendors.

Mass email can roughly be categorised into three groups:

• Real spam: the dubious pills, the get-rich-quick scams, phishing, etc. Everyone hates that, but if you have a good anti-spam solution in place you should end up seeing a very small percentage of what was sent to you.
• Mass-marketing mail: the kind of stuff your bank sends out to each one of its customers. Some of that is useful; some of it you might not care about. Usually if you ask, your bank will stop emailing you.
• Grey-mail spam: This lies somewhere between the top two. This is the stuff that cannot really be classified as spam. They have valid email addresses and even valid telephone numbers. But it doesn’t matter to you; these emails are just irritating. You really don’t want any of them.

For vendors providing anti-spam solutions, grey mail is a difficult thing to tackle. Any attempt to add too many detection rules risks false positives for good sites like Amazon. It might even place the vendor at risk for legal action from some marketing companies. This makes this form of spam very attractive to many unscrupulous mass-mailing marketeers; they’re willing to run the grey-mail gauntlet.

Don’t get me wrong: I think email marketing has its place and that it can be a very powerful tool, but it should be done ethically. There are many mail-marketing firms that play by the rules, but they can get a bad name because of the bigger group that simply doesn’t care, as long as they can make a few bucks.

To a great extent, remediation for grey spam falls outside the scope of a content-analysis engine. Although the latter can help, it needs input from the customer. Only the cutomer can determine what is unwanted and what is allowed in this case: one person’s spam is another person’s ham. Chris has listed a number of things you can do to protect yourself, but if you are already receiving grey mail, here are two good techniques for combating this:

• Blacklists
• Bayesian

Blacklists: Because grey spam tends to have a defined structure, known sender email addresses, etc., you can use blacklists. These blacklists should be created and updated by the customer and not the vendor.

Bayesian: Spam filtering might be another solution, but the problem is that it needs to be trained correctly. The training itself might be too much work for the ordinary home user. Luckily some email clients do a good job of making it easier for a person to use.

Handling false positives: Normally content rules will receive rigorous testing to avoid false positives. When customers introduce blacklists or Bayesian techniques, they are creating custom content rules. As these rules will be ad-hoc, there is a higher chance for false positives. To help with this issue, some form of quarantine system needs to be introduced. The single person at home or in a small company with fewer than 10 employees might use the rules-and-folders functionality in a decent email client to handcraft a solution. However, for any company with a large number of employees, something more structured is required. McAfee offers the product Quarantine Manager to complement some of its other mail-product offerings.

Expect to read more postings on this topic from some of my colleagues at Avert Labs.

Labels:

system administrator spam

Spam on Mailman Lists

To reduce or eliminate spam on mailing lists when using Mailman

The following steps will do two things in mailman:

1. Discard any message from an email name that does not end in "virginia.edu". (The admin of the list can optionally get a notice of all discarded messages.
2. Hold all other messages for the administrator to approve. The burden on the administrator is that s/he must approve all messages posted to the list, including those from members. But this will keep all spam (including the ones with spoofed email IDs) from going out to all members of your list. (This solution might be good for low-traffic lists where letting any spam through causes problems, perhaps by annoying a lot of people or some important people.)

What to do in the mailman admin interface:

1. Under "Privacy options..." choose "Sender Filters".
2. The first item (for the value default_member_moderation) should be set to "yes".
3. On the same page, find the item: List of non-member addresses whose postings will be immediately held for moderation. In the box, enter this regular expression: ^.*virginia\.edu$
4. On the same page, for the next to the last item (generic_nonmember_action), set this to "Discard".
5. On the same page, for the last item, set this to "yes" if the admin wants to get emails with each message from those that are automatically discarded because they are not from a "virginia.edu" address. (Might be a reasonable thing to do if there is a chance that a legitimate message from outside virginia.edu will come to the list.)
6. Click "Submit your Changes".
7. At the top of the page, choose "Membership Management".
8. At the bottom of the page, for the option "Set everyone's moderation bit, including those members not currently visible", click "yes" and then hit the "Set" button.

Labels:

postmaster spam

This complaint has a multitude of variations but we tend to label the problem as “postmaster spam”.

Simply put, postmaster spam is any spam email that comes from a postmaster email address, whether it is the postmaster for your own domain or for someone else’s domain.

The postmaster address performs a critical role in email communication and its presence and use is prescribed in the RFCs for the SMTP protocol.

“Any system that includes an SMTP server supporting mail relaying or delivery MUST support the reserved mailbox “postmaster” as a case-insensitive local name.”

…and…

“SMTP systems are expected to make every reasonable effort to accept mail directed to Postmaster from any other system on the Internet.”

Who is the Postmaster?

The postmaster address is usually the source (or “from”) address for system generated emails such as non-delivery reports, although some email servers allow a different address to be used.

But this common usage, combined with the RFC requirements, creates a series of problems. Spammers know that the postmaster@ email address is almost always going to be valid, and email servers often treat email from postmaster@ email addresses as more trusted.

Postmaster Forgeries

One way in which spammers try to exploit this is by forging the sender address of spam to make it appear that it is coming from a postmaster@ address for a well known domain name. This is an effective technique because most email users have received genuine NDRs in the past and have at least some idea that a postmaster@ address is valid and trustworthy.

Because the human element of this exploit is so weak the best defence against this technique is to detect and block the spam before it reaches the intended victim. Anti-spam techniques such as connection filtering, content filtering, and Bayesian filtering are effective in stopping this.

Backscatter Spam

Another way spammers create “postmaster spam” is by causing NDRs, also known as backscatter spam. With this method a spammer will send email with forged sender addresses to various email systems, and when it is sent to non-existent addresses the receiving server sends back a NDR from their postmaster@ address to the forged sender address.

The person whose email address was used as the forged email address then receives the NDR, usually along with the original spam content attached or embedded. This technique is often successful because email systems don’t want to block important non-delivery reports.

Some anti-spam products specifically include protection for this type of NDRbackscatter spam through a combination of technologies. There is also an emerging technique appearing in some products that uses a header tag for all outgoing email. When an NDR comes back from an external source it can be checked for that tag. If it exists and matches a known email that was sent, then the NDR can be trusted and allowed back in to the email system. If the header tag does not exist then it is likely that the email originated elsewhere, probably from a spammer, and can be considered less trustworthy and subject to different filtering rules.

Other Postmaster Problems

The two problems that are mentioned above mostly impact end users, those who we are trying to protect from spam threats.

But another issue also exists, and that is spam addressed to the postmaster@ address itself. Because of the importance of the postmaster as prescribed in the RFC it is common for it to be exempt from any form of filtering or protection, to ensure it receives 100% of important email addressed to it.

Fortunately although this opens the door to spammers, the postmaster@ mailbox is usually only accessed by experienced administrators who are less likely to be tricked into opening spam or clicking on a phishing link. And in extreme cases the RFC does permit blocking of particularly bad sources of spam to the postmaster@ address.

And for our customers we are able to prescribe quality solutions to the problem of postmaster spam by implementing effective anti-spam systems on their networks.

Labels:

spam analysis

Spam Analyse your newsletter

Welcome to Spam Analyse. Email-marketing can be an excellent practice for both large and small organisations to market themselves in a fast and affordable manner. Newsletters are particularly powerful ways that can complement your marketing strategy and help meet your organisation's objectives.

Many email newsletters however are now ending up in spam and junk folders of popular domains such hotmail, yahoo, gmail and many more. The growth of spam email has resulted in increasingly sophisticated spam filters. Over 30% of your mailings could possibly be classed as spam and be unread by your customer. Attention must be paid to the coding, content and the structure of your newsletter to ensure it does not end up as spam.

Spam analyse is a application built to check if your email newsletter is spam filter friendly. Also check out ourarticles on the latest spam findings.

Simply take the coding from your html or text based newsletter and paste it in the box below for an instant spam analysis report of your newsletter..

Labels:

maia spam

Content Overview Integrating Amavisd-New with Postfix Installing Amavisd-New Configuring Amavisd-New Quarantine Handling Globally Sender whitelists and blacklists Per-Recipient Sender Whitelists and Blacklists (Maia Mailguard) Maia Installing and Configuration Configure Postfix for Amavisd-New ClamAV Virus Scanning Sender Policy Framework SPF Overview Postfix is a mail transport agent written by security researcher Wietse Venema. Not surprisingly, Postfix is designed from the ground up to be a highly secure system. It consists of several components, each of which runs with least privilege and none of which trust data from the other without validating it themselves. Despite the extensive security emphasis in the system's architecture, Postfix is capable of very good performance in normal conditions; because of architectural decisions, it is also fault tolerant and capable of good performance under adverse conditions such as resource starvation. Postfix supports three content inspection methods, ranging from light-weight one-line-at-a-time scanning before mail is queued, to heavy duty machinery that does sophisticated content analysis after mail is queued. Each approach serves a different purpose. The method shown in this article inspects mail AFTER it is stored in the queue, and uses standard protocols such as SMTP. After-queue inspection allows you to use content filters of arbitrary complexity without causing timeouts while receiving mail, and without running out of memory resources under a peak load. The SpamAssassin system is software for analyzing email messages, determining how likely they are to be spam, and reporting its conclusions. It is a rule-based system that compares different parts of email messages with a large set of rules. Each rule adds or removes points from a message's spam score. A message with a high enough score is reported to be spam. Amavisd-New is a high-performance and reliable interface between mailer (MTA) and one or more content checkers: virus scanners, and SpamAssassin. It is written in Perl, assuring high reliability, portability and maintainability. It talks to MTA via (E)SMTP or LMTP, or by using helper programs. No timing gaps exist in the design, which could cause a mail loss. It is normally positioned at or near a central mailer, not necessarily where user's mailboxes and final delivery takes place. When calling of Mail::SpamAssassin (SA) is enabled, it calls SA only once per message (regardless of the number of recipients), and tries very hard to correctly honour per-recipient preferences, such as pass/reject, and inserting spam-related mail header fields.

Integrating Amavisd-New with Postfix This article does not explain how to install and setup Postfix / SpamAssassin, this is explained here: Postfix -- the Sendmail Replacement Fighting Spam with SpamAssassin and Postfix If you want to set up a spam-checking gateway for all recipients, local or not, you need a way to perform spam-checking as mail is received, before final delivery. Postfix provides a general-purpose filtering directive called content_filter. The content_filter directive specifies a mail transport that Postfix will invoke after receiving a message. The mail transport hands the message to a filtering program. The filter checks the message and then either refuses it (which will cause Postfix to generate a bounce message), discards it, or reinjects the modified message into Postfix for further delivery. Messages that pass the filter are reinjected so that Postfix can operate on them almost as if they were new messages; this allows Postfix to behave properly if the content filter rewrites message headers.

Labels: