Category Archives: ORF

ORF-related posts.

A New Showshoe Spam External Agent

Leave a reply

UPDATE: The External Agent discussed in this article no longer works against the snowshoe spam campaign discussed below. Visit our latest article regarding this type of spam.

In the past few days, we have received reports of a snowshoe spam campaign hitting many of our US-based clients heavily. The campaign is characterized by a sudden influx of spam in high volumes from a continuous range of IP addresses. Outbreaks last for 2-4 hours before the spammer moves to another provider. Due to the nature of this campaign, the usual heuristics provided by ORF do very little to stop these emails.

We are now releasing a quick relief External Agent to address this campaign specifically. The agent relies on DNS-based heuristics to safely identify and blacklist these emails.

A typical example of the snowshoe campaign in the ORF logs.

A typical example of the snowshoe campaign in the ORF logs.

Is it for me?

You only need this agent if you are affected. If you are located in the US and suddenly started to see spam coming through ORF in numbers, you can verify if you are affected by opening a recent log file in the ORF Log Viewer and sorting the events by the Related IP column. When you scroll through the sorted list of events, look for large, continuous network blocks (e.g. a /24) with spammy email subjects. If the sender email addresses look like FirstnameLastname@subdomain.domain.tld, you are affected and you should install this agent.

How do I install this?

Download the agent from

http://vamsoft.com/downloads/agents/agent-snowshow-c15q1-01/agent.zip (95kB ZIP)

and extract the archive contents to any local directory on your server.

If you have used Windows Explorer to extract the archive contents, the ARSoft.Tools.Net.dll file in the arsoft-resolver folder may be blocked by Windows as being potentially harmful for its Internet origin. To verify and unblock the DLL right-click on the file, select Properties and click Unblock on the General tab, if required.

Import the External Agent definition agent-definition.xml. Once this is done, customize the definition to your system:

  • On the Run tab, set the Agent Executable to your powershell.exe binary. This is usually found under \Windows\System32\WindowsPowerShell\1.0\powershell.exe.
  • On the same Run tab, in the Command-Line Parameters box, replace the path in the -File parameter with the path of your script, e.g. “C:\ORF\snowshoe\agent-showshoe-c15q1-01.ps1”.
  • In the same edit box, replace “8.8.8.8” with your DNS server IP address. Note that you must specify the DNS server by IP address, names will not work.

Once you’re done with editing, be sure to save your configuration.

What else should I know?

  • The agent is written in PowerShell and was tested with PowerShell 3.0 and .NET Framework 4.0. The minimum system requirement should be PowerShell 2.0 and .NET Framework 2.0.
  • As this is a quick relief agent, it was not subjected to the stringent standards of testing we usually apply to our code. Use with caution.

Honeypot: trap the spammer!

Leave a reply

Don’t just defend yourself: attack! Did you know that you can set up traps for spammers? These are fake email addresses that you create and publish just for those who would like to send you unwanted emails. We call it Honeypot.

So how it works? It’s quite easy. First, you need to compile a list of bogus addresses which will be used as bait. It can be anything in your domain, like 1234@example.com or peter@example.com.

When you have them set up, you need to place them right in the face of spammers, where they can easily find them. Make sure that legitimate users will not run into the honeypot addresses, so when you get any emails to these “fake” addresses, you will know that they are malicious. Anyone sending to these spam trap addresses will be automatically blacklisted, so make sure you publish the honeypots on your website where only address harvester robots can pick them up (and not real users).

Ready to declare war? Read this article for detailed instructions.

 

Addressing the Self-Spam Problem

Leave a reply

Have your users ever complained about spam which they apparently received from themselves? Spammers have a tendency to forge the sender address so they can bypass filtering  –  they either spoof a legitimate (trustworthy) sender address, or they simply insert the recipient address in the From: field to confuse their target. The latter is a phenomena what we call self-spam (for obvious reasons). There are several methods to address this problem:

Solution 1: Comparing addresses

The first method is comparing the sender and recipient addresses, and if they match, blacklist the email: it is unlikely a user will ever send an email to himself/herself which is relayed through an external server. To perform this comparison, Vamsoft provides a so called “External Agent”. External Agents can be used to extend the core functionality of ORF to address specific campaigns, among other things. To download the agent, click here. Setup instructions can be found in the readme.txt file shipped with the Agent.

 Solution 2: Sender Policy Framework record

The second method is publishing an Sender Policy Framework record. The SPF policy allows you to tell others which hosts are allowed to send emails from your domain. If a spammer tries to spoof your domain, the recipient can check your policy online, and if the sender host is not authorized to send emails from your domain, reject the email. As your own server can also check this policy, you can effectively use it to stop self spam emails. To learn more about SPF, visit this website.

Solution 3: Blacklist yourself

The third method is blacklisting your own domain name: since ORF ignores internal and outgoing emails, this will not block legitimate emails, only spoonfed ones.

To learn more about these solutions, possible caveats when implementing them, and other type of self-spam campaigns, read this article.