SpamAssassin / MIMEDefang
As of Friday January 3, 2003 NETDOOR has implemented our mail filtering
system. We have been hard at work developing a system to stop the scourge of
spam and email-borne worms and viruses from tormenting our valued customers.
The spam detection software we decided upon is SpamAssassin. SpamAssassin matches words and phrases that are common in spam and
legitimate mail. Phrases that are common to spam increase a message's
score. Phrases that are common to legitimate mail decrease the score. Any
message whose score is above a certain threshold is flagged as spam.
There are several ways to interface SpamAssassin with our mail servers. We
chose a system called MIMEDefang. Its design is solid and
its hooks for SpamAssassin allows us to efficiently scan all messages that
pass through our servers. MIMEDefang also has many more features that will
allow us to help fight email-borne worms and viruses.
Nearly all of these worms and viruses take advantage of holes in the
security of Microsoft's Outlook and Outlook Express and Microsoft Windows
itself. To help stop the spread of these email-borne worms, the easiest
thing to do is to remove attachments that are windows executables, or
somehow render them harmless. This is the main purpose of MIMEDefang. As it
stands, we block these attachments.
bat, cmd, com, dll, exe, pif, scr, vbs
We feel that most legitimate senders of such attachments would normally use
some type of compression utility (such as Winzip which is included on our
CD) before sending these types of files, which would in turn change the file
extension to one that would not be blocked. Any text/plain or text/html
parts will be intact with the beginning of the message having the following
statement.
===
WARNING: This e-mail has been altered by MIMEDefang. Following this
paragraph are indications of the actual changes made. For more
information about your site's MIMEDefang policy, contact
NETDOOR Support . For more information about
MIMEDefang, see:
http://www.roaringpenguin.com/mimedefang/enduser.php3
An attachment named (name of file goes here) was removed from this document as it
constituted a security hazard. If you require this document, please contact
the sender and arrange an alternate means of receiving it.
===
For those with email clients that have built-in filtering systems, you can
also use the spam filtering system! All messages are tagged with a spam
score. The header to look for is "X-Spam-Score". The value to the header is
a number. The higher the number, the greater the possibility of spam.
NETDOOR decided upon a threshold of 7.0 to be tagged as spam at this time.
All messages that exceed this threshold will have a header added
"X-Spam-Flag" and its value will always be "YES".
For those that don't have such an email client, or would like for us to
filter the messages into one's own filtered mailbox on NETDOOR's mail
server, click here.
|
