procmail
[Top] [All Lists]

Re: Filtering [base64] encoded spam

2002-10-10 20:50:48
 You will give me a swelled head asking this of me.
 
As if I could add anything to your program. The fact 
of the matter is that I did it on a few words tried 
it found it worked but also found that I wasnt 
getting too many base64 emails. As time goes I 
may make a list but have not seen in the emails 
I get any great warrent for it. ( although it seems 
to get worse and worse) I may go back to it if it
 increases and if I learn some more about it.

I have seen many many emails here and elseware on this problem of converting 
base64 code. I started thinking to myself gee I think base 64 aught to be the 
easiest thing in the world to find since its just letters in the alphebet. Its 
just another language. Rather than 
struggling with this eternal question of decoding then
encoding in procmail or use a perl script or other
complex thing why not do it in base 64 its a language
(unintelegible as it is.)
If someone wanted to make up a list they could do it I think easily enough. 
There are many programs out there that encode, decode to/from base64. There are 
probably about 20 or 30 basic words that are troublesome. 
Put one word in each file encode the file and your done. Open the file and see 
the word. 

HOWEVER and I know that there are people who actually 
know something about base64, I think that the base64 
string, contains a few chaacters at the end that have data in it that is not 
the word. It could be the number of characters the string is or something. So it
 would be good to know what they are and cut them off. 
I discovered that I could encode the word lets say 
Mortgage and then search a base64 email for a string 
that started with the base64 word and it would be
 exact accept for a few letters at the end. In doing some experimenting which I 
wount bore you with, I deduced that a few of the ending letters where "headers" 
containing information about the encode. (accept I suppose they would be 
Tailers since they looked like they were at the end.) 

I'm not speaking as a knowlegeble person on any of this so I hope no one chews 
my head off if I have miss 
spoken. The other thing is that I asume that you will  
have to convert each normal occurence of the word eg.
MORTGAGE, mortage, Mortgage, since I asume that when
it is encoded it copies the exact word as is. Of 
course procmail does not search for case which means if you had the word 
AAAbbbCCC it would also catch aaaBBBccc or any combo there of. BUT if you used 
grep as I do with a list of backlisted addresses I suppose it could search for 
case. 

If I have moved this base64 convert dont convert thing
along so we can now reasonably search and delete more
spam I'm proud of my idea.

I hope you understand all that I have writen. I'm a verbose sorta guy.

Feedback?



____________________________________________________________
Watch a championship game with Elway or McGwire.
Enter Now at http://champions.lycos.com 
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>