Re: trusted mailing list subscriber spam

2008-05-10 Thread Benny Pedersen
On Sun, May 11, 2008 03:07, [EMAIL PROTECTED] wrote: > All I know is that I don't use SPF anymore for my domain as there are > just too many problems... e.g., forwarded messages. and you usely dont know where you forwards going from, :/( come on, please :-) Benny Pedersen Need more webspace ?

Re: trusted mailing list subscriber spam

2008-05-10 Thread jidanni
>> All a spam program would have to do is say "[EMAIL PROTECTED] posts lots >> to that list. His address must be a trusted subscriber. Well, here's >> one more post from him, muhahaha." SB> If "Bob" posts a lot to a list(s) and is respected within said SB> list(s), then the other subs of that list

Re: FW: Exploiting Google MX servers as Open SMTP Relays

2008-05-10 Thread Matus UHLAR - fantomas
> On Sat, May 10, 2008 19:48, Joseph Brennan wrote: > > --On Saturday, May 10, 2008 9:57 AM -0400 Michael Scheidell > > <[EMAIL PROTECTED]> wrote: > >> fyi: post in bugtraq. You may wish to look for and remove any whitelists > >> based on google, googlegroups, or gmail accounts until google fixes

Re: FW: Exploiting Google MX servers as Open SMTP Relays

2008-05-10 Thread Benny Pedersen
On Sat, May 10, 2008 19:48, Joseph Brennan wrote: > --On Saturday, May 10, 2008 9:57 AM -0400 Michael Scheidell > <[EMAIL PROTECTED]> wrote: >> fyi: post in bugtraq. You may wish to look for and remove any whitelists >> based on google, googlegroups, or gmail accounts until google fixes this. > I

Re: Problems with sa-update

2008-05-10 Thread Geoff Soper
On 10/05/2008 18:40, Benny Pedersen wrote: On Sat, May 10, 2008 18:47, [EMAIL PROTECTED] wrote: [21292] dbg: diag: module installed: IO::Zlib, version 1.01 find where this is installed: rpm -qa | grep IO-Zlib rpm -e IO-Zlib-1.01 (only if its there) i do not know if its really called

Re: FW: Exploiting Google MX servers as Open SMTP Relays

2008-05-10 Thread Joseph Brennan
--On Saturday, May 10, 2008 9:57 AM -0400 Michael Scheidell <[EMAIL PROTECTED]> wrote: fyi: post in bugtraq. You may wish to look for and remove any whitelists based on google, googlegroups, or gmail accounts until google fixes this. I was surprised to hear that anyone gave whitelist sta

Re: Problems with sa-update

2008-05-10 Thread Benny Pedersen
On Sat, May 10, 2008 18:47, [EMAIL PROTECTED] wrote: > [21292] dbg: diag: module installed: IO::Zlib, version 1.01 find where this is installed: rpm -qa | grep IO-Zlib rpm -e IO-Zlib-1.01 (only if its there) i do not know if its really called that as rpm if its there upgrade it in rpm, if you

Re: Multiple X-Envelope-From and SPF

2008-05-10 Thread Matus UHLAR - fantomas
> On Fri, May 9, 2008 08:55, ram wrote: > > > Precisely what I am afraid of. But the issue is whatever header I use > > for envelope-from all of them can be trivially forged > > I am trying replacing all the X-Envelope headers before sending them to > > scan servers On 09.05.08 23:39, Benny Pede

Re: Problems with sa-update

2008-05-10 Thread Benny Pedersen
On Sat, May 10, 2008 16:42, Geoff Soper wrote: > Can anyone suggest what I should do next? post output of spamassassin 2>&1 -D --lint i belive you have older versions from rpm installed, dont use rpm and cpan at the same time ! Benny Pedersen Need more webspace ? http://www.servage.net/?cou

Problems with sa-update

2008-05-10 Thread Geoff Soper
I've previously used RDJ to keep my SA rules up-to-date but have got the impression I should be using sa-update instead. My first step was to run "sa-update && service spamassassin restart" but this gave the following error: IO::Zlib version 1.04 required--this is only version 1.01 at /

Re: False positive on forged_mua_outlook

2008-05-10 Thread mouss
Jeff Koch wrote: If you guys are going to keep looking at the wrong part of the header information that I sent in nothing will get done. What makes you believe we are looking at the wrong part? see below. Please look at the section below the spam scoring. Here's the header from the user's

Re: False positive on forged_mua_outlook

2008-05-10 Thread mouss
Jeff Koch wrote: That part (i.e. the top part of the header) was generated by qmail. Please look at the bottom part of the header after the spam scoring which shows the header from the user's email which was mistakenly scored as a forged_mua_outlook. The message-id is the same, but anyway,

Re: False positive on forged_mua_outlook

2008-05-10 Thread Jeff Koch
If you guys are going to keep looking at the wrong part of the header information that I sent in nothing will get done. Please look at the section below the spam scoring. Here's the header from the user's email and it was sent from Outlook Express: Received: from unknown (HELO jade.xx.co

Re: False positive on forged_mua_outlook

2008-05-10 Thread Jeff Koch
That part (i.e. the top part of the header) was generated by qmail. Please look at the bottom part of the header after the spam scoring which shows the header from the user's email which was mistakenly scored as a forged_mua_outlook. At 04:13 AM 5/10/2008, mouss wrote: Randy Ramsdell wrote

FW: Exploiting Google MX servers as Open SMTP Relays

2008-05-10 Thread Michael Scheidell
fyi: post in bugtraq. You may wish to look for and remove any whitelists based on google, googlegroups, or gmail accounts until google fixes this. -- Michael Scheidell, CTO >|SECNAP Network Security Winner 2008 Network Products Guide Hot Companies FreeBSD SpamAssassin Ports maintainer -- Fo

Re: False positive on forged_mua_outlook

2008-05-10 Thread Benny Pedersen
On Sat, May 10, 2008 15:09, D Hill wrote: > On a side note, Outlook and Outlook Express also HELO with the computer's > name when sending a message through an email server. yes windows mailclients can say helo with a dot in the helo either, so thay cant do a fqdn in the helo unless its a spambot

Re: False positive on forged_mua_outlook

2008-05-10 Thread D Hill
On Sat, 10 May 2008 at 10:13 +0200, [EMAIL PROTECTED] confabulated: Randy Ramsdell wrote: [snip] Scratch that and reverse it. If it does match, then it will score the message header as fake. oops :) sorry. Let me check some more things. Did outlook really generate this message-id: Message

Re: SA 3.2.4 --lint errors?

2008-05-10 Thread Benny Pedersen
On Sat, May 10, 2008 08:52, Obantec Support wrote: > looks like a lot of warnings, any advise welcomed. and you only have 3.2.4 installed now ? is all perl modules up2date ? Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: False positive on forged_mua_outlook

2008-05-10 Thread mouss
Randy Ramsdell wrote: [snip] Scratch that and reverse it. If it does match, then it will score the message header as fake. oops :) sorry. Let me check some more things. Did outlook really generate this message-id: Message-ID: <[EMAIL PROTECTED]> ?