Botnet 0.6 plugin for Spam Assassin availabile

[John Rudd]

(I had a bout of insomnia last night, and got more done than I had 
pre-announced yesterday...)


The next version of the Botnet plugin for Spam Assassin is ready.  The 
install instructions are in the Botnet.txt file, and in the INSTALL file.

For those who don't know what Botnet is, it's a plugin which tries to 
identify whether or not the message has been submitted by a 
botnet/spam-zombie type host by looking at its DNS characteristics (no 
reverse DNS, reverse DNS that doesn't resolve, or doesn't resolve back 
to the relay's IP, or reverse DNS that contains things that look like an 
ISP's client address).  The places I've been using it, and the people I 
hear about who are using it, have seen a high degree of success.

It can be downloaded from:

  http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar


As usual, feedback, statistics, bug reports, feature suggestions, are 
all welcome.

NOTE: This will be the last version I announce outside of the SA users 
mailing list.  I don't want to wear out the patience of the other list 
owners.  users at spamassassin.apache.org is where I'll make all further 
release announcements.


What's new in 0.6:


1) IP in Hostname bug fix (the same IP address octet could be matched 
twice.. which was a problem if the octet was "1", and the hostname had a 
sub-string like "101" in it)

2) pass_domains, clientwords, and serverwords weren't insensitive checks

3) typo fixed in botnet.txt

4) moved to Net::DNS (finally; and it's going to be needed for To Do 
item #3)

5) perl package is now named Mail::SpamAssassin::Plugin::Botnet

6) because clientwords and serverwords are meant to be _words_, they are 
now wrapped by (\b|\d) (both before and after the word/expression). 
This is to help avoid false positives where a clientword might have been 
a substring of a larger word that shouldn't have triggered the check 
(similarly for serverwords).

7) similarly, pass_domains now have a leading (\.|\A) added to them IF 
they don't already have \. or \A in front (but it will be added if the 
expression starts with "." -- since this is a regular expression, that 
is assumed to mean any single character, so be careful).

8) added debug output for parse_config

9) added "mta" and "relay" to serverwords (used by classmates.com and/or 
reunion.com)

10) changed dsl to (a|s|d(yn)?)?dsl in clientwords (so, covers adsl, 
sdsl, ddsl, and dyndsl ... I've seen all of those except ddsl)

11) added res(net|ident(ial)?)? to clientwords (rr.com supposedly uses 
".res." in residential/customer IP hostnames, and ".resnet." is common 
at universities for dorm IP addresses)

12) contemplating adding cpe and cust(omer)? to the controversial 
clientwords (I think cpe = customer (presence/provided/?) equipment)



----


To Do before 1.0:

1) prepend __ to sub-rules, only BOTNET proper should not have that

2) separate the SA routines from the core algorithms, so that the botnet 
checks can be used in other perl programs.  Include a script that takes 
an IP addr and answers where/how it passed/failed.

3) try to do a lookup on the sender's email address domain; if it points 
back to the relay's IP address (A record, or one of the MX records), 
then that's less likely to be a botnet.  Use this like 
BOTNET_SERVERWORDS -- just a counter to BOTNET_CLIENT.  What about SPF, 
too? (I think that was a suggestion in one of the alternate meta rules)

4) credits for help I've gotten from other people

5) get listed in the wiki