Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Fri, Aug 22, 2003 at 10:21:06AM -0400, Sil Greene wrote:
> 
> Anyone gotten spammed by Sobig?  I've gotten somewhere around 10 emails in 
> the last 24 hours, all containing a variety of .pif files and all from 
> different (and unrecognized) email addresses.  But each and every one of 
> them contains this line in the header:
> 
> Received: from CHRIS-0QU83G05Q (rdu163-45-117.nc.rr.com [24.163.45.117])
>         by smtp.unc.edu (8.12.9/8.12.9) with ESMTP id h7MDUwp4027527
>         for <Sil_greene AT unc.edu>; Fri, 22 Aug 2003 09:30:59 -0400 (EDT)
> 
> Anyone else had similar experiences?

Heh. Yeah, we've gotten some 200+ copies here (all quarantined, just
like all the rest of the Windows executable attachments we get) and
rejected some 3600+ more. We block on broken HELO (e.g.,
CHRIS-0QU83G05Q) so we have managed to avoid the vast majority of them.
Stick this into your LOCAL_RULESETS and smoke it:

KCheck_BogusHELO2 regex -a@MATCH ^[-0-_]+$
R$*                    $: $1 $| $(Check_BogusHELO2 $&{s} $)
R$* $| @MATCH          $#error $@ 5.7.1 $: "550 Mail not accepted from bogus 
HELO. Please use a hostname, " $&{s} ", not a Windows NetBIOS name."
R$* $| $*              $: $1


-- 
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
Book publishing is second only to furniture delivery in slowness. -b. schneier