Text File

precedence: bulk Subject: Risks Digest 20.89x

RISKS-LIST: Risks-Forum Digest Monday 29 May 2000 Volume 20 : Issue 89x

FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <URL:http://catless.ncl.ac.uk/Risks/20.89x.html> and by anonymous ftp at ftp.sri.com, cd risks .

Contents: Junk-mail filters: full version of excerpt in RISKS-20.89 (Gary Cattarin) [NOTE: ARCHIVE COPY ONLY; NOT DISTRIBUTED]

----------------------------------------------------------------------

Date: Fri, 19 May 2000 11:41:41 -0700 From: "Gary Cattarin" <gcattari@nortelnetworks.com> Subject: Junk-mail filters: full version of excerpt in RISKS-20.89

This I'm sure has been covered before, but here's an interesting example of filters gone awry.

I recently upgraded (?) to MS Office 2000, which, among other things, lets you have more than 8 email filters active at once. In my glee I started turning things on, including junk mail filtering. Surprise! I found 8-10 important messages - all replies to a query I sent out to a personal mailing list - all dumped into the Junk Mail folder.

What was it? I'm riding in a charity bicycle ride, and I needed to tell my pledge-ees that I needed their money now. So I sent them an email updating my training status and asking them to send their checks. Obviously, this message had at least one dollar sign "$" in it - and because I'm an excitable guy it had at least one multiple exclamation mark "!!", and since, at the end, I chided my manager to make good on my exaggerated version of his pledge:

>> Mark, didn't you promise $5,000 or something like that?

...we also hit the magic phrase ",000".

Now, the fine folks in Redmond have determined that if these three elements converge, you have received Spam. The actual rule (from their web site) is:

Body contains ",000" AND Body contains "!!" AND Body contains "$"

Who'd have guessed? In fact, even looking at their filter list, it took me a long time to figure out which rule I'd hit. (OK, I'm slow sometimes.)

I guess the rule is (a) don't get too excited ! - one "!" at a time! (b) specify your currency as "USD", and (c) use European periods ("5.000") instead of North American commas in large numbers. OK, that's silly. But just as silly is the fact that any spammer can read the list of rules and tailor their email to avoid them.

Of course, you might never read this, because if you have junk email filtering turned on, Outlook will catch THIS message and do with it as you've requested for junk mail.

Two other interesting points:

(1) In the adult filters you'll find these two: Subject contains " sex" Subject contains "free" AND Subject contains "sex" The first is set up with a leading space to only accept the *word* "sex", so those of us who live here in Middlesex county don't lose any local-related mail. But the writer of the second wasn't so careful - what if the Middlesex News offers free subscriptions? That's Spam, yes, but not porn (I guess that's why that newspaper changed its name...).

(2) Don't address your dear friend as such - note the rule: Body contains "Dear friend" My golly! I can't send some good old-fashioned heartfelt feelings to my dear friends!! (oops, double "!!" - I got excited!)

This stuff can be very dangerous...

The entire list is at http://officeupdate.microsoft.com/Articles/newfilters.htm - I've also included it here but the editor may choose to cut it from the journal in the interest of space.

Junk E-mail Filter

First 8 characters of From are digits Subject contains "advertisement" Body contains "money back " Body contains "cards accepted" Body contains "removal instructions" Body contains "extra income" Subject contains "!" AND Subject contains "$" Subject contains "!" AND Subject contains "free" Body contains ",000" AND Body contains "!!" AND Body contains "$" Body contains "Dear friend" Body contains "for free?" Body contains "for free!" Body contains "Guarantee" AND (Body contains "satisfaction" OR Body contains "absolute") Body contains "more info " AND Body contains "visit " AND Body contains "$" Body contains "SPECIAL PROMOTION" Body contains "one-time mail" Subject contains "$" Body contains "$$" Body contains "order today" Body contains "order now!" Body contains "money-back guarantee" Body contains "100% satisfied" To contains "friend@" To contains "public@" To contains "success@" From contains "sales@" From contains "success." From contains "success@" From contains "mail@" From contains "@public" From contains "@savvy" From contains "profits@" From contains "hello@" Body contains " mlm" Body contains "@mlm" Body contains "///////////////" Body contains "check or money order"

Adult Content Filter

Subject contains " xxx" Subject contains "over 18" Subject contains "over 21" Subject contains "adult s" Subject contains "adults only" Subject contains "be 18" Subject contains "18+" Body contains "over 18" Body contains "over 21" Body contains "must be 18" Body contains "adults only" Body contains "adult web" Body contains "must be 21" Body contains "adult en" Body contains "18+" Subject contains "erotic" Subject contains "adult en" Subject contains " sex" Body contains " xxx " Body contains " xxx!" Subject contains "free" AND Subject contains "adult" Subject contains "free" AND Subject contains "sex"

Gary Cattarin <cattarin@ma.ultranet.com>

------------------------------

End of RISKS-FORUM Digest 20.89x ************************