bugtraq - Re: Is predictable spam filtering a vulnerability?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 19 Jun 2004 22:41:59 -0400
From: Phil Barnett <philb@...lb.us>
To: bugtraq@...urityfocus.com
Subject: Re: Is predictable spam filtering a vulnerability?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Friday 18 June 2004 6:05 pm, Andrew Hunter wrote:

> Filtering certain works is also bad aswell eg "penis", "viagra".
> It can easyly be evoided:
> Email "Free penis enlargement pills" - Would be filterd
> Email "Free pen is enlargement pills" - Wouldn't be filtered
>
> So in order to be effective it has to look for variations on the works
> For example "penis" it could look for "P E N I S", "peni$" etc...

It's not all that hard to make a better filter with regex. The following would 
catch everything you suggested.

'p.?[eé].?n.?[|ííiil1].?[s$]'

It would also catch p.e.n.i.s and p e-ni-s, etc.

Yes, it's possible that it would stop "Your pen is in your top drawer". I 
whitelist the people I know. They never see the filter.

After administering a bunch of Mailman lists, I had to automate or spend hours 
thumbing through the reject list. Now, I can automatically kill 95+% of the 
messages on hold that are spam and look through what's left. List members 
never see the filter as long as they post in plain text. (I hold for mime 
headers, too)

- -- 

"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFA1Pl3WMqSOYd58pwRAgdeAJ49xwYqnqE3gxEklgrqWS9BujvTNgCfYL/4
omWs39lqrDefqfCrvQ9Ykyk=
=geC0
-----END PGP SIGNATURE-----