Subject: Re: SPAM procmail filter for Bcc?

From: Steve Machol <[email-masked]>
Date: Sun, 30 Mar 1997 11:51:58 -0800

On Sun, 30 Mar 1997, Felix Tilley wrote:

> Send any spam you get to /dev/null.  I recommend using Procmail to trigger
> off the Received: line in the mail header.  Very few spammers know how to
> forge Received: lines.   All spammers know how to forge the From: line.

Thanks Felixx, but wouldn't this then force me to know know ahead of
time where the spam is coming from?  What about spam from such sites
as AOL or Netcom?  I don;t want to trash all messages from users on
these sites just because of a few bad apples. 

The point of my question was - how do I filter on the "Bcc:" field?
If I could do this, then I can effectively eliminate any spam sent to
me usinf Bcc.

Another idea occurs to me.  How about automatically filtering any
email that does NOT have my address in the "To:" field?  Obviously,
this isn't perfect, but I would at least like to know how to do this
with procmail.

Steve
 ___  ____  ____  _  _  ____
/ __)(_  _)( ___)( \/ )( ___) Steve Machol
\__ \  )(   )__)  \  /  )__)  [email-masked]
(___/ (__) (____)  \/  (____) http://www.optiboard.com/steve

---

From: Robin S Socha <[email-masked]>
Date: Sun, 30 Mar 1997 22:25:14 +0200 (CEST)

-----BEGIN PGP SIGNED MESSAGE-----

  >On Sun, 30 Mar 1997, Felix Tilley wrote:

Hello, Steve?

Are you still with us? As Paul wrote, this is a procmail question... Here's
the address again:

There  exists  a mailinglist for questions relating to any program in the
procmail package:

	<[email-masked]>

for submitting questions/answers.

	<[email-masked]>

for subscription requests.

Here's what the FAQ *hinthint*

Pine does not perform delivery filtering; that is the function of other
programs, such as (on Unix hosts) "procmail" or "mailagent." For details on
selection and configuration of such programs, see the Filtering Mail FAQ (by
Nancy McGough) at one of the following locations:

     http://www.cis.ohio-state.edu/hypertext/faq/usenet/mail/filtering-faq/
     faq.html
     http://www.smartpages.com/faqs/mail/filtering-faq/faq.html
     ftp://ftp.halcyon.com/pub/ii/internet/filtering_mail_faq.txt
     ftp://rtfm.mit.edu/pub/usenet/news.answers/mail/filtering-faq

  >> Send any spam you get to /dev/null.  I recommend using Procmail to
  >> trigger off the Received: line in the mail header. Very few spammers
  >> know how to forge Received: lines. All spammers know how to forge the
  >> From: line.
  >Thanks Felixx, but wouldn't this then force me to know know ahead of time
  >where the spam is coming from? What about spam from such sites as AOL or
  >Netcom? I don;t want to trash all messages from users on these sites just
  >because of a few bad apples.
  >The point of my question was - how do I filter on the "Bcc:" field? If I
  >could do this, then I can effectively eliminate any spam sent to me usinf
  >Bcc.
  >Another idea occurs to me.  How about automatically filtering any email
  >that does NOT have my address in the "To:" field? Obviously, this isn't
  >perfect, but I would at least like to know how to do this with procmail.

- -----
Robin S. Socha,
Political Science Dept., Bonn University, Bonn
Key fingerprint = 7F F2 84 73 CF E9 2C 92  F6 6E F9 B4 8F FE AC 1E
To get my pgp public key, send an e-mail with the subject "get pgp-key"

GMC d++ s+:+ a- C++ UL++$>+++$ P+>++$ E>+ W- N+ o@ w--- M-- PS--- PE+++ Y+
PGP++>+++ t+() 5-- tv++(+) b+++ DI++ D+(++) G++>+++ e++>+++ h r++>+++ y+**

---

From: Steve Machol <[email-masked]>
Date: Sun, 30 Mar 1997 13:05:00 -0800 (PST)

> Are you still with us? As Paul wrote, this is a procmail question... Here's

Thanks Robin.  Yes, I saw Paul's message and responded to him
directly.  I had seen other message about procmail on the pine
newsgroup so I inadvertantly thought mine would be ok too.

And thanks for the mailing list addresses, butI didn't want to have to
subscribe to a whole mailing list just to get the answer to one
question.

Best regards,

Steve
 ___  ____  ____  _  _  ____

---

From: Robin S Socha <[email-masked]>
Date: Mon, 31 Mar 1997 00:57:43 +0200 (CEST)

-----BEGIN PGP SIGNED MESSAGE-----

>>It appears that many of the more recent spammers may be using Bcc to send
>>me their e-mail drivel. In order to combat this, I am trying to add a
>>procmail filter which will send any e-mail with my username in the Bcc
>>field to a default folder. This is what I've put into my .procmailrc file:

>>:0:
>>* ^Bcc.*smachol
>>IN.testing

Come to think of it, Bcc means Blind Carbon Copy... There is no Bcc field in
the header, at least none I can find. Wouldn't make sense, anyway, would it?
:-)

Cheers,
Robin

  Robin S. Socha	  | Bonner Talweg 56  | Tel:   +49 228 22217-8
  Political Science Dept. | 53113 Bonn        | Fax:   +49 228 22217-9
  Bonn University  	  | Germany           | email: [email-masked]

       On the package it said: "Requires MS Windows 3.11 or better"  
	       			      ...  so I got myself Linux.

---

From: Chip Old <[email-masked]>
Date: Sun, 30 Mar 1997 19:01:19 -0500 (EST)

On Mon, 31 Mar 1997, Robin S Socha wrote:

> Come to think of it, Bcc means Blind Carbon Copy... There is no Bcc
> field in the header, at least none I can find. Wouldn't make sense,
> anyway, would it?  :-) 
 
The BCC line is in the header when it leaves the sender, but at the
receiving end it is stripped off by Sendmail (or whatever MTA your local
system uses) before the message is delivered to your local MDA and
then to your Inbox.
 
-------------------------------------------------------------------
Chip Old (Francis E. Old)                  [email-masked]
Administrator, Internetworking Services    Voice:      410-887-6180
Baltimore County Public Library            FAX:        410-887-2091
320 York Road                              ICBM:     39.39910 North
Towson, Maryland 21204 U.S.A.                        76.60300 West

---

From: Edward M Greshko <[email-masked]>
Date: Mon, 31 Mar 1997 08:14:55 +0800 (GMT)

> system uses) before the message is delivered to your local MDA and

	*Not* always true.  It is only true in the case of a badly
designed UA.  Most UA's will not put the Bcc: header there, they will
simply call sendmail (or whatever) to deliver the mail with a complete
list of receipients (sendmail makes no distiction between To: and Cc:)
and only have To: and Cc: fields in the header portion.  They do this
since they can't rely on a particular version of sendmail or other
MTA to strip out the Bcc: header.  Remember, the Text you see in the
headers are generally not used by the MTAs.  They are used only by
the UAs.  The MTAs use envelope information which is conveyed via a
different channel.

	Ed

-- 
Edward M. Greshko                  Technical Manager, Electronic Commerce
                                   Control Data Asia/Pacific Region
Voice: +886-2-715-2222 x287        6/F, 131 Nanking East Road, Section 3
FAX  : +886-2-712-9197             Taipei, Taiwan R.O.C

---

From: [email-masked]
Date: Mon, 31 Mar 1997 10:51:51 GMT

In article <Pine.GSO.3.95.970330114601.26609A-100000@shell>,

>If I could do this, then I can effectively eliminate any spam sent to

There is no perfect method for detecting spam.  Either you will be to 
restrictive, and lose non-spam mail or let some spam in.  

However, there are several places on the web that list the domains where 
spam is all that is sent.  Make a filter from such a list.  

Another thing to do, is read the headers of the spam you get.  A lot of 
spammers use the generic spam mailers (i.e. Floodgate), and you can kill 
this sort of stuff off like so:

:0
*^X-mailer:.*floodgate
/dev/null

>this isn't perfect, but I would at least like to know how to do this

:0
*!(To|Cc):.*smachol@
/dev/null

make sure you filter your any mailing lists you are subbed to, before 
doing this though.  

And when filtering mailing lists, you are best off filtering on something 
the list puts into the headers.  Not the site where the list came from.  
-- 
You cannot kill time without injuring eternity.