StarBlog » spam

Untrained Spamfilter Blues

Stargazer — Tue, 06 Apr 2010 10:37:07 +0000

I migrated my mailserver a few hours ago to a complete new system to have a better groupware solution and less noise. But honestly, I am already missing the old patchwork system as its spamfilter was working very very very… efficient. As the new anti spam system didn’t have that much training, the detection rate is simply crap.

Spam is different. Your spam differs from mine. So the filter needs some time to get used to the messages and learn. The result should improve over time quite well.

Copyright © 2010
Please note that this feed is for private use only. All other usage, including the distribution or reproduction of multiple copies, performance or otherwise use in a public way of the images or text require the authorization of the author.
(digitalfingerprint: 0f46ca51d0fa4e6588e24f0bf2b80fed)

Is WP-Blackcheck effective?

Stargazer — Wed, 27 Jan 2010 22:54:51 +0000

That was the basic question of the research I did during the last days, greping through the logs to find some info to get an impression of the blacklists effect. Now I know, it isn’t in vain. If we’d say we have 10000 requests we would get about:

9000 Spam Comments

1000 Ham Comments

100 Reports

Spam or Virus?

Stargazer — Thu, 15 Oct 2009 10:48:57 +0000

Today I had one of those typical spam malware in my mailbox, showing that Microsoft Outlook is one of the most widely used mail programs, being attacked all the time:

Microsoft Outlook Notification for the xxxx@xxxx.xx

Support [xxxx@xxxx.xx]

Sent :Thu 15/10/2009 06:38

To xxxx@xxxx.xx

Attachment install.zip (12kb)

You have (6) New Message from Outlook Microsoft

- Please re-configure your Microsoft Outlook Again.

- Download attached setup file and install.

True, this mail usually is a bad one, but nevertheless it made me grin due to the fact that I was using Thunderbird and KMail for managing my personal mail flood. So I checked the mail headers and found out that it came from a spamhost somewhere in the net.

Just as I decided to ignore that message and train my spamfilter, I noticed the ZIP file attached. Sadly it came without a brief description of what it really does – so that part of work is left to me. But I am sure it is definitively not the new software for photo books by CeWe. Unpacking the ZIP File was an easy thing:

Listing archive: install.zip
   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2009-10-15 11:38:42 ....A        28672        21167  install.exe
------------------- ----- ------------ ------------  ------------------------
                                 28672        21167  1 files, 0 folders

The contents is just a plain EXE file, which is getting a little more interesting as you can scan it for malware, but for now, ClamAV doesn’t report a positive match. So I have to take a closer look if I want to know.

Digging in that binary, I noticed, that it is just another container that does SFX – and as I got my Swiss Army Archive tool 7-Zip with me, it is an easy thing to unpack it:

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2006-01-21 22:17:57               2606         3072  .text
2006-01-21 22:17:57               5293         5632  .rdata
2006-01-21 22:17:57              53248            0  .data
2006-01-21 22:17:57                592          512  .tls
2006-01-21 22:17:57              18138        18432  .edata
------------------- ----- ------------ ------------  ------------------------
                                 79877        27648  5 files, 0 folders

And here we go – but who is who? I am using the magic numbers of the files to get an idea of what’s their purpose.

data: empty
edata: data
rdata: data
text: VISX image file
tls: data

Skimming through the files with a HEX Editor, the string “FuC1.FuC1.FuC1″ showed up quite often, which clearly indicates that the file is made from a script kiddie and won’t do anything good on our system…

So the best thing is just ignoring those messages and deleting them immediately.

The blacklist again…

Stargazer — Wed, 12 Aug 2009 21:46:55 +0000

It is wonderful if you know that a plan is working – especially if it’s your own one. Regarding the WP-Blackcheck plugin, it might even fot more here as I was observing less and less spam comments into the moderation queues of the sites I manage. To get some numbers I tried to deactivate a number of other anti spam plug ins and compared the numbers.

It really is just a small number of god dammed hosts hammering our blogsphere. So it is just the blacklisting that keeps off most of the buggers making the other checks quite obsolete saving ressources.

At the moment of this writing the blacklist lists 215 IP Addresses which are hitting me and the other users regularly – But how many blogs do use the plugin? I cannot tell an exact number but it can’t be more than 25 sites by now…

Is it me John Wayne, is it you?

Stargazer — Thu, 06 Aug 2009 11:20:36 +0000

Some spammers can really drive you mad – especially if they are doing things like that. Looking at my mailserver logs I have found some strange IP addresses like 123.27.3.81, 222.252.80.188 or 123.16.13.188 which are resolving to ‘localhost’ regarding to their reverse DNS. In other words, a bad configured mailserver thinks that the mail comes from itself and offers special treatment to that messages – which usually means they bypass the spamfilter. The problem can be solved quite simple by using ’127.0.0.1′ instead of ‘localhost’ in your configuration files and you got green conditions again.

WP-Blackcheck – Statusreport

Stargazer — Thu, 25 Jun 2009 21:07:30 +0000

My Blacklist service is running for quite a while now and it it’s time to look at the result. Sure, it isn’t much as not many people provided feedback by reporting the IPs, but for now we have collected about 60 IP Addresses and the blogs hosted on my server haven’t had any spam in their queue except for mine, which gets tortured by the spam kids – but they don’t know that they’re doing me a favor doing so as they’re exposing their spam hosts…

WP-BlackCheck goes WP.org

Stargazer — Mon, 08 Jun 2009 08:29:30 +0000

During the last days I have sent out some preview versions of my plugin and got some feedback about the plugin which helped me getting things done. Due to the positive echo of various people, I am now posting it on wordpress.org. But I think it’s time now to tell you some of my ideas about the plugin and why I wrote it.

Usually you’d use the htaccess file to get rid of various IPs on your site, but to be honest, there is no foolproof way of doing so regarding collateral damage. What if you have blocked innocent people? Using a blacklist you can easily offer a removal request form.

Regarding IP address lists, it is hard to maintain them. True, there are always some in your spam queue, but it’s not only you being hit by them. Spambots usually hit a ton of blogs – using a centralized blacklist cutting one’s losses got easier as more and more people report.

Together we’re stronger

Stargazer — Thu, 04 Jun 2009 14:09:13 +0000

I was fed up with the comment spam again as it’s me who has to check the akismet queue for false positives. So I have started preventing spam by doing various checks before handing the comment over to akismet – but it’s always a couple of them slipping through. The good thing was, that it’s always the same hosts doing so, regarding the IP addresses.

As those IPs are rather static, I have decided to set up a blacklist service for banning those IPs all over the server using a central service. The website for this blacklist service can be found on http://www.stargazer.at/blacklist including the possibility to file a removal request.

I have already activated the plugin on every blog run at this server. If you are interested in contributing or using the plugin yourself, feel free to leave a message and I will offer the plugin for download.

Spam Attack

Stargazer — Fri, 02 Jan 2009 07:58:43 +0000

The start of the new year was quite a bad one: 931 comments are waiting for moderation. Quite much if you’d ask me. Having a closer look it wasn’t the bikers gang fighting a flamewar on one of Grazer’s postings – that would be too nice to be true. Instead of a biker clan it was a bunch of spambots trying their dirty tricks on my page again. It’s quite awful if those damn spambots are learning too many new tricks.

But however, I have to say that I’m quite satisfied with my little defense tricks I did back in June 2007 that kept my moderation queue clean until now. New year, new luck and the next round against those dirtbags. But there’s one thing for sure: I won’t run out of ideas that soon!

JSSpamBlock 2.1?

Stargazer — Wed, 03 Dec 2008 06:26:39 +0000

You might remember my ranting about the JSSpamBlock plugin of Paul Butler, thinking of porting it to the actual WP release. I have decided to keep an eye on it fixing various bugs for keeping it compatible.

JSSpamBlock extends the comment form with a simple input field for checking if you’re human or not. As this function uses a hook which is also used by the dashboard reply-to-comment function, the latter one throws an error. Assuming that spambots are not authenticated users, I did a workaround on that.

Download here