Bypassing Spam Filters Using Homographs. Fa d y Moh a med Os ma n www. d a r kma s ter. d y_os ma n

Size: px

Start display at page:

Download "Bypassing Spam Filters Using Homographs. Fa d y Moh a med Os ma n www. d a r kma s ter. tk @fa d y_os ma n"

Stanley Harper
8 years ago
Views:

1 Bypassing Spam Filters Using Homographs By Fa d y Moh a med Os ma n www. d a r kma s ter. d y_os ma n

2 Bypassing Spam Filters 1 A few d a ys a g o i d is cover ed a n ew tech n iq u e to bypa s s s pa m filter s u s in g h omog r a ph letter s th e id ea is pr etty s imple yet ver y effective, a n ywa y befor e we s ta r t we s h ou ld fir s t u n d er s ta n d h ow s pa m filter s wor k in or d er to u n d er s ta n d h ow to bypa s s th em. Understanding spam filters: I n g en er a l s pa m filter s typica lly looks for th r ee impor ta n t th in g s to d eter min e if th e mes s a g e is a ctu a lly a s pa m th en s ta r t a d d in g s cor es wh en it fin d s s ometh in g s u s piciou s a n d th e fin a l s cor e d eter min es wh eth er th e mes s a g e is a s pa m or n ot th es e th r ee th in g s a r e: 1- Where the message came from : Th e s pa m filter ch ecks if th e mes s a g e ca me fr om a tr u s ted s ou r ce th is is d on e by lookin g for th e n etwor k wh er e th e mes s a g e ca me fr om in s ever a l RBL ( Rea ltime Bla ckh ole Lis t) a n d ea ch time th e n etwor k a ppea r s in a lis t th e s pa m s cor e is in cr ea s ed a little th is ch eck ca n be bypa s s ed by u s in g a tr u s ted n etwor k ma y be on e of th e pu blic ma il s er vices. 2- Software that sent the message: Spa m filter s looks for clu es in th e mes s a g e h ea d er s th a t th e mes s a g e wa s s en t by a s pa m en g in e r a th er th a n a r ea l ma iler. I f th e s pa m en g in e is clever en ou g h to s imu la te a r ea l ma iler th is ch eck ca n be bypa s s ed a ls o by u s in g a r ea l ma iler it ca n be bypa s s ed a n ywa y wh en u s in g a r ea l ma iler th e r is k of bein g tr a ced is in cr ea s ed. 3- Contents of the message: Th is is a ctu a lly wh a t we a r e in ter es ted in in th is pa per. Spa m filter s ch eck th e con ten ts of th e mes s a g e for s pa mmy ph r a s es like " CLI CK HERE! " or " FREE! BUY NOW" a n d ea ch time it fin d s on e it a d d s mor e poin ts to th e s pa m s cor e. Th is is a s a mple cr iter ia fr om Spa m As s a s s in on e of th e mos t popu la r s pa m filter s : Ta lks a bou t lots of mon ey ( poin ts ) Des cr ibes s ome s or t of br ea kth r ou g h (. 232 poin ts ) Looks like mor tg a g e pitch (. 297 poin ts ) Con ta in s u r g en t ma tter (. 288 poin ts ) Mon ey ba ck g u a r a n tee ( poin ts ) Wh y Pa y Mor e? ( poin ts ) a fter ch eckin g a ll th a t if th e tota l s pa m s cor e exceed s a cer ta in th r es h old you r ma il is s en t to the j unk folder. I n th e r es t of th is pa per we will d is cu s s a n ew tech n iq u e to bypa s s s pa m filter s u s in g h omog r a ph letter s. What are homographs and how can they bypass spam filters?? h omog lyph is on e of two or mor e ch a r a cter s with s h a pes th a t eith er a ppea r id en tica l or ca n n ot be d iffer en tia ted by q u ick vis u a l in s pection. Exa mples of h omog r a ph s in en g lis h a r e th e ca pita l " O" a n d z er o " 0" a ls o th e n u mber " 1 " th e lower ca s e " l" a n d th e u pper ca s e " I ". Homog r a ph s pr es en ts s ecu r ity r is ks in va r iety of s itu a tion s s ee: h ttp: / /http: / /en. wikiped ia. or g /wiki/i DN_h omog r a ph _a tta ck for a n exa mple of th es e a tta cks. Als o you ca n ch eck th is a r ticle i wr ote a wh ile a g o a bou t th is a tta ck: h ttp: / /www. d a r kma s ter. tk/in d ex. ph p/articles /1 - h omog r a ph - ph is h in g - a tta ck Wh a t we a r e in ter es ted in h er e is th e u n icod e h omog r a ph s in la n g u a g es like cyr illic a n d g r eek th ey con ta in letter s th a t looks exa ctly th e s a me like s ome en g lis h letter s bu t with d iffer en t u n icod e s in ce th ey h a ve d iffer en t u n icod e th e s pa m filter will n ot r ecog n iz e th em for exa mple if you wr ote " CLI CK HERE!! " with s ome cyllir ic ch a r a cter s th e s pa m filter will n ot be a ble to fin d it even if it looks exa ctly th e s a me a s th e on e wr itten in en g lis h letter s.

t we s h ou ld fir s t u n d er s ta n d h ow s pa m filter s wor k in or d er to u n d er s ta n d h ow to bypa s s th em.

3 Bypassing Spam Filters 2 homographit tool: r epla cin g ch a r a cter s ma n u a lly or u s in g " fin d a n d r epla ce" in you r fa vor ite text ed itor cou ld be pr etty a n n oyin g s o in s tea d i cr ea ted a tool th a t will r epla ce th e ch a r a cter s with th ier h omog r a ph s for you. you ca n d own loa d it h er e: h ttp: / /www. d a r kma s ter. tk/in d ex. ph p/tools /1 0- h omog r a ph it Testing against spamtest.com ema ils pa mtes t. com is a webs ite for tes tin g s pa m ma ils. To tes t my n ew meth od i g r a bbed a copy of one of the spam mails in my spam box this is the message body and i set the subj ect to " ma ke s ome mon ey" with th e followin g bod y: How a r e you d oin g? Hope you h a ve n ot for g otten me, I a m Dr. Da vid Ma r k. I Secu r ed th e r elea s e of s ome mon ey a ccr u ed fr om th e over in voicin g of a con tr a ct/ in h er ita n ce th a t wa s a wa r d ed by my g over n men t s ome time a g o d u r in g th e milita r y r eg ime. Th ou g h you wer e n ot a ble to a s s is t me con clu d e th e tr a n s a ction, I ' m h a ppy to in for m you a bou t my s u cces s in g ettin g th os e fu n d s tr a n s fer r ed u n d er th e a s s is ta n ce a n d cooper a tion of a n ew pa r tn er fr om Br a z il. Pr es en tly I ' m in London - United Kingdom for investment proj ects with my own share of the total s u m. Mea n wh ile, I d id n ' t for g et you r pa s t effor ts a n d a ttempts to a s s is t me in Tr a n s fer r in g th os e fu n d s, I ma d e s u r e you a r e n ot left ou t th e ben efit of th e Tr a n s a ction h en ce I kept a s id e for you s u m of Nin e Hu n d r ed An d Fifty Th ou s a n d Un ited Sta tes Dolla r s ( $950, ). I a n d my n ew pa r tn er a g r eed to compen s a te you with th a t a mou n t for a ll You r pa s t effor ts a n d a ttempt to a s s is t me in th is ma tter. I a ppr ecia ted you r effor ts a t th a t time ver y mu ch, s o feel fr ee a n d g et in tou ch with th e pa yin g ba n k Mr. Sa n tia g o J imen ez a n d in s tr u ct h im on h ow to s en d wir e you r fu n d s to you. Plea s e d o let me kn ow immed ia tely you r eceive wir e tr a n s fer s o th a t we ca n s h a r e th e J oy tog eth er a fter a ll th e s u ffer a t th a t time. I n th is momen t, I? m very busy here Because of the investment proj ects which I and my partner are h a vin g a t h a n d, s o you Need to con ta ct th e pa yin g ba n k, i h a ve in s tr u cted PNC ba n k to r emit th e pa ymen t to you I n you r own meth od. Below is th e con ta ct of th e pa yin g ba n k: spamtest. com results shows that there' s nothing wrong with the subj ect but the bod y( ema il con ten t s ection ) con ta in s s pa m a s you ca n s ee in th e follwoin g pictu r e:

th a t will r epla ce th e ch a r a cter s with th ier h omog r a ph s for you. you ca n d own loa d it h er e: h ttp: / /www. d a r kma s ter. tk/in d ex.

4 Bypassing Spam Filters 3 n ow let' s s a ve ou r mes s a g e in to file a n d g ive it to h omog r a ph it tool a n d u s e th e ou tpu t of th e tool in s tea d of th e or ig in a l mes s a g e to s ee if th e ema ils pa mtes t will s till compla in : a s you ca n s ee th e s pa m s cor e d r opped fr om 4. 5 to 0 a n d n ow it s a ys th a t th e mes s a g e is s a fe. Case study : Apache spamassassin s pa ma s s a s s in is a popu la r s pa m filter fr om a pa ch e fou n d a tion. I d ecid ed to tes t my tool a g a in s t it s o i u s ed th e s a me ema il wh en pa s s in g it to s pa ma s s a s s in it g a ve th e followin g r es u lts ( you ca n ig n or e th e compla in s a bou t mis s in g h ea d er s s in ce i d id n ' t pu t th em in th e tes t file for s implicity) th e s cor e of th e mes s a g e wa s 8. 6 a n d con s id er ed a s pa m with th e followin g pr oblems : 1. 2 MI SSI NG_HEADERS Mis s in g To: h ea d er 0. 1 MI SSI NG_MI D Mis s in g Mes s a g e- I d : h ea d er 1. 8 MISSING_SUBJECT Missing Subj ect: header 1. 4 MI SSI NG_DATE Mis s in g Da te: h ea d er 1. 4 ADVANCE_FEE_3_NEW Appea r s to be a d va n ce fee fr a u d ( Nig er ia n 41 9) 1. 0 ADVANCE_FEE_3_NEW_MONEY Ad va n ce Fee fr a u d a n d lots of mon ey 0. 6 ADVANCE_FEE_2_NEW_MONEY Ad va n ce Fee fr a u d a n d lots of mon ey 1. 2 MONEY_FRAUD_3 Lots of mon ey a n d s ever a l fr a u d ph r a s es Th e la s t fou r on es is wh a t' s impor ta n t for u s n ow. Feed th e mes s a g e to h omog r a ph it tool a n d th en pa s s th e ou tpu t file to s pa ma s s a s s in th e r es u lt is pr etty a ma z in g with a ll th es e mis s in g h ea d er s th e ma il is n ot con s id er ed a s pa m s in ce it h a ve a s cor e of 4. 5 a n d th e r eq u ir ed s cor e is 5!!!. You will a ls o n otice th a t th e la s t fou r r u les h a ve n o s cor es wh ich mea n s s pa ma s s a s s in ca n ' t s ee a n y pr oblems with th e con ten ts of th e ema il. Fixing the issue: Th e pr oblem ca n be fixed by r epla cin g a n y h omog r a ph s befor e ch eckin g th e ma il for s pa m, a n ywa y th is ma y ca u s e a pr oblem in s itu a tion wh er e th es e h omog r a ph s wer e a d d ed in a leg tima te wa y. An oth er wa y to fix th is is by a d d in g a ll th e va r ia tion s of ea ch tes t with h omog r a ph s.

pa mtes t will s till compla in : a s you ca n s ee th e s pa m s cor e d r opped fr om 4. 5 to 0 a n d n ow it s a ys th a t th e mes s a g e is s a fe.

5 Bypassing Spam Filters 4 References: filter.html spam filters think/ homograph phishing attack

1.- L a m e j o r o p c ió n e s c l o na r e l d i s co ( s e e x p li c a r á d es p u é s ).

1.- L a m e j o r o p c ió n e s c l o na r e l d i s co ( s e e x p li c a r á d es p u é s ). PROCEDIMIENTO DE RECUPERACION Y COPIAS DE SEGURIDAD DEL CORTAFUEGOS LINUX P ar a p od e r re c u p e ra r nu e s t r o c o rt a f u e go s an t e un d es a s t r e ( r ot u r a d e l di s c o o d e l a