Re: backport 3.4.0 Ubuntu 12.04 TLS

2016-09-15 Thread Patrick Domack
Sounds like a lot of work for an old spamassassin version. https://launchpad.net/%7Epatrickdk/+archive/ubuntu/production/+sourcepub/5219815/+listing-archive-extra Quoting Marcus Schopen : Hi, I've backported 3.4.0 from Ubuntu 14.04 TLS for Ubuntu 12.04 LTS (perl 5.14.2), which comes with ver

Re: Catching well directed spear phishing messages

2016-09-15 Thread RW
On Thu, 15 Sep 2016 15:37:42 +0100 Paul Stead wrote: > > https://github.com/fmbla/spamassassin-levenshtein > > An implementation I made for SA - feedback welcome A couple of things 1. Instead of having a with/without tld option you could compute the distance without the tld and then add 1 if

Re: Catching well directed spear phishing messages

2016-09-15 Thread Olivier Coutu
No, I have not used it, although it is a good idea. Could probably be used for comparing From:names too, running after each new version of "Pay-pal, paupal, etc." is a pain. If I make any progress on that I will keep the list posted. My plugin is written in Perl with a home-made implementation

Re: spample of "data" URL in well-crafted Phish

2016-09-15 Thread John Hardin
On Wed, 15 Sep 2016, Chip M. wrote: Sadly, I have more FP data for you. :( Here's one specific example (just a single very long line from one corpse): background-image: url("data:image/svg+xml;charset=utf8,%3Csvg width='104px' height='82px' viewBox='0 0 104 82' version='1.1' xmlns='http://www

Re: Catching well directed spear phishing messages

2016-09-15 Thread Dianne Skoll
On Thu, 15 Sep 2016 15:37:42 +0100 Paul Stead wrote: > https://github.com/fmbla/spamassassin-levenshtein Cool! Not sure what the performance implications are... there are XS implementations of the Levenshtein distance... for example: http://search.cpan.org/~ugexe/Text-Levenshtein-XS-0.503/ Re

Re: Catching well directed spear phishing messages

2016-09-15 Thread Paul Stead
On 15/09/16 15:22, Chip M. wrote: The other way to fix that is to detect the lexical distance between the sender's domain and your organisation's domains, e.g. by building a plugin that uses https://en.wikipedia.org/wiki/Levenshtein_distance. That could be done for a small number of domains wit

Re: Catching well directed spear phishing messages

2016-09-15 Thread Chip M.
On Thu, 30 Jun 2016, Olivier Coutu wrote: >The other way to fix that is to detect the lexical distance between the >sender's domain and your organisation's domains, e.g. by building a >plugin that uses https://en.wikipedia.org/wiki/Levenshtein_distance. >That could be done for a small number of

backport 3.4.0 Ubuntu 12.04 TLS

2016-09-15 Thread Marcus Schopen
Hi, I've backported 3.4.0 from Ubuntu 14.04 TLS for Ubuntu 12.04 LTS (perl 5.14.2), which comes with very old version 3.3.2 (can't upgrade the complete host right now). Before installing it: is there anything to be aware of, beside better wiping bayes database and starting fresh? [1] Ciao Marcus