Re: procmail recipe for e-worms

> filtering Yaha is pretty easy, even easier than you may realize:
>
> Content-Type:multipart/mixed;

sorry I don't trust headers only! when it comes to viruses only the file itself (when non polymorphic can help)

>
>
> that's in every one. also, how is this any better than the impsec procmail
> sanitizing ruleset?
>
>

exm.. I have to comment that..

I suppose you mean the rules here:
http://www.impsec.org/email-tools/local-rules.procmail

Lets take it one by one:

1. Hybris detection mainly by size and malformed To, Subject headers.. xmm.. sorry not my style
2. SirCam traped by strings: AAAAGgU0NhbTMyABCDTUlN AAAAAaBTQ2FtMzIAEINNSU1F ABkAAAABoFNDYW0zMgAQg01J

these strings where originally found at a post in procmail-list: http://www.rosat.mpe-garching.mpg.de/mailing-lists/procmail/2001-07/msg00510.html

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

as the author says he used string values from the exe body. STRING values.. anyone could change that even a kid with a hex editor..

3. Badtrans again by size and boundary stuff..

4. Klez & BugBear by base64: TVqQAAMAAAAEAAAA typical to a huge amount of legitimate windows executables..

(anyway I never said that mine is better :p I just wrote it, use it and felt like sharing it...)

But the future impact isn't gone yet.. Here is an interesting problem for all regexp magicians.. :
http://www.virusbtn.com/resources/viruses/indepth/junkmail.xml

  URLs:  
http://www.nikant.tk/
         
http://www.skiathos.tk/
         
http://agriroot.aua.gr/