full-disclosure - Swen Really Sucks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030924193801.GA32394@cattlegrid.net>
From: christophe at cattlegrid.net (christophe barbe)
Subject: Swen Really Sucks

On Wed, Sep 24, 2003 at 12:31:08PM -0500, Brent J. Nordquist wrote:
> On Wed, 24 Sep 2003, Peter Busser <peter@...steddebian.org> wrote:
> 
> > I use several procmail rules to filter out domains (microsoft.com,
> > msdn.com, etc.) in From: and From, To: (e.g. microsoft.com) and certain
> > words in the subject (e.g. Microsoft). Since the virus depends on
> > looking like an authentic message, it can't do too much randomisation of
> > the domains and subject lines. Of course the filtering is not perfect,
> > but it still reduces the number of virus messages hitting the inbox.
> 
> Someone pointed out yesterday that Swen has the header "SUBJECT: " in all
> upper-case, as opposed to the usual mixed-case "Subject: ".  I looked at
> all the ones I've received, and sure enough, they're all upper-case.  
> That might be another telltale you can use if you're taking the procmail
> approach.

>From the debian mailing list, the best test you can use with procmail
seems to be to look for the uuencoded counter url used by the virus.
b3IAAABBZG1pbgAAAEdFVCBodHRwOi8vd3cyLmZjZS52dXRici5jei9iaW4vY291bnRlci5naWYv

The following procmail rule has been proposed:

:0
* > 140000
* < 165000
{
:0 BD
* b3IAAABBZG1pbgAAAEdFVCBodHRwOi8vd3cyLmZjZS52dXRici5jei9iaW4vY291bnRlci5naWYv
/dev/null
}

If you want to avoid the body search (B option), you can use the
following regexp on the subject header:

^subject: (undeliverable|undelivered|returned)? ?(mail|message)(:? (returned to (mail|send)er|user unknown))?
^subject: (new(est)?|latest|last|current)? ?(net(work)?|microsoft|internet)? ?(critical|security)? ?(pack|patch|update|upgrade)
^subject: (abort|bug|error|failure)? ?(advice|announcement|letter|message|notice|report)

The only missing subject is the empty one.

Christophe

-- 
Christophe Barbé <christophe.barbe@...es.org>
GnuPG FingerPrint: E0F6 FADF 2A5C F072 6AF8  F67A 8F45 2F1E D72C B41E

An empty stomach is not a good political advisor.
-- Albert Einstein