procmail
[Top] [All Lists]

Re: detecting faked "From"

2001-07-20 12:04:41
On Fri, Jul 20, 2001 at 10:45:35AM -0700, Professional Software Engineering 
wrote:
         @geol.ucsb.edu:user(_at_)someplaceelse(_dot_)com

The message would be delivered to the geol.ucsb.edu MX which (if it 
supported the syntax) would parse the address and realize that it needed to 
be passed along to another server, and would pass it along to 
someplaceelse.com.  A regexp such as:

Interesting. I stand corrected.

         ^From:(_dot_)*(_at_)geol(_dot_)ucsb(_dot_)edu

Which is a fairly common regexp form, would fail to catch this relay 
syntax, having satisfied itself that the host in question was specified.

Would "^From:(_dot_)*(_at_)geol(_dot_)ucsb(_dot_)edu$" catch this than?
Of course, this introduces problems with something like 'From:
<address(_at_)geol(_dot_)ucsb(_dot_)edu> "Real Name"', but I'm not sure putting 
a comment AFTER
the actual address is allowed (don't think I've ever seen it, but that doesn't
mean anything). Of course, piping through formail to get just the address
would fix that.

Of course, this encoding is largely unsupported these days (DNS MX records 
obliviate the need for it), but it is still supported by some MTAs here and 
there.  Perhaps the one in this case...

I just checked, and my own mail servers appear to support the syntax (in 
fact, the message was sent from another domain entirely, and arrived at my 
SMTP to be declined there).  Fortunatley (because this technique used to be 
in favour amongst spammers), my server properly declines to relay:

Yes, my server was briefly ORB'd due to this, when they scanned me for
potential open-relay issues and found it would relay that one. I fixed it
right away.

-- 
Andrew Edelstein        -       andrew(_at_)pure-chaos(_dot_)com
http://andrew.pure-chaos.com
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>