“…that we all feared might happen someday…”? Where has this chick been? ANYWAY…..

Whenever I hear about an email worm going around an infecting people left and right, I kind of chuckle to myself. These are absurdly easy to block, yet no one seems to do it. I’m in charge of all the network operations at the company that I work for and it’s a relatively small company, yet we’ve never been hit by any of the major email worms that have surfaced over the years. Why?

Well, it’s simple.. just like spam, there are certain characteristics that are static across all of the emails that are being generated. Yes, sometimes they’re more difficult to pinpoint than others, but usually (as is the case here), it’s trivial.

From all of the samples that I’ve seen, we’re dealing with two different subject lines. Obviously, the creators of this worm were not interested in filter evasion, otherwise they would have created an array of thousands of different subject lines and messages. That, in addition to thousands of random file names and websites that are hosting the file, and you’ve got yourself a worm that’s moderately difficult to block. So, you future worm writers of the world, go big or go home.

Anyway, as I’ve mentioned in a previous post, I rely heavily upon Mimedefang to filter email at the gateway. It’s a very straight forward milter for Sendmail that allows you to write custom filters in Perl. And, since I’m sure all of you know about my love for Perl, you can see why I’m immediately drawn to this.

If you’ve never played with Mimedefang, I highly recommend you check it out.

So, on to the filtering. My filter file has, well, lots of rules that accomplish a variety of different tasks. In order to filter this one, though, it’s a simple pattern match:

   if(/^.*?Subject\:\s+here you have.*/i || /^.*?Subject\:\s+just for you.*/i) {
      foreach $recip (@Recipients) {
      delete_recipient($recip);
   }
   add_recipient('spam@localhost');
   action_change_header('Subject', "BANNED - VIRUS - $Subject");
}

Trivial. You place this under the “filter_begin” routine. Also, in order to get access to the headers, there are two files which Mimedefang stores. One is called “COMMANDS” and one is called “INPUTMSG”. You’ll want to open the “INPUTMSG” file in order to parse the subject line.

Example:

open(F, "./INPUTMSG") || die "$!";
while() {
   if(/^.*?Subject.......blah blah blah
}

Anyway, this is just a simple example of a way to take care of some of these lame worms at the gateway so that your end users never even see them. Mimedefang, like pretty much everything else I use, is free. So, it always gives me a warm fuzzy when large companies (ABC, NASA, etc.) get pwned by some lame worm when they run like, $50,000 email filtering systems, yet my simple little Perl script and Mimedefang somehow has kept us protected.

Some of you are probably thinking, “Yeah, but if you had the amount of emails coming through that those guys do, your Perl script would kill your box”

Trust me, I thought about that ahead of time. The one nice thing about milters, in general, is that they’re written in C and are usually pretty quick and not super resource intensive.. so the idea of running a milter that delegates the task of filtering to a scripting language was definitely a concern. However, on this box, which is a Pentium 2.8ghz dual core (11,205.53 bogomips total), the load average stayed below 2 all the way up to 250 emails a minute. Sure, this is not a solution for the Gmail’s and Yahoo’s of the world, but does your company receive 250 emails a minute? Probably not.

Also, I’ve written in some throttling to ensure that it backs off if the load increases too significantly.

Anyway, if you have any questions about filtering with Mimedefang, let me know.. if inadvertently become pretty well versed in it.

Related posts:

1. Handling Spam at the Network Level
2. ALERT: New virus spreading
3. UPDATED: Picpaste & Filename Enumeration. Or, How To Get Free Porn.
4. New Adobe 0day Demonstration
5. p0f and (mostly) Passive Finger Printing