Fake User-Agent on PDF

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Hugo van der Kooij wrote:
> Hi,
>
> So far all SPAM PDF files that did not get killed on other issues seem 
> to use a fake User-Agent header: User-Agent: Thunderbird 1.5.0.12 
> (Windows/20070509)
>
> According to 
> http://www.mozilla.com/en-US/thunderbird/releases/1.5.0.12.html the 
> release date is impossible however.
>
> I have not written a SA rule (yet). I wrote a detectline in my header 
> checks of postfix:
> /^User-Agent: Thunderbird 1.5.0.12 \(Windows/20070509\)/    REJECT    
> This is a fake version of Thunderbird
Here's a SA rule that will do the same thing:
header JKF_FAKE_TBIRD User-Agent =~ /Thunderbird 1.5.0.12 
\(Windows\/20070509\)/
describe JKF_FAKE_TBIRD Fake version of Thunderbird
score JKF_FAKE_TBIRD 1.5

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.2 (Build 2014)
Charset: ISO-8859-1

wj8DBQFGhoufEfZZRxQVtlQRAj60AKCUkI80DcGHsT1AwZ06XwpWMOeXGACghST9
PoG5L+bPCn6qNJt8BKT57pE=
=NuSY
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk