Re: [Full-Disclosure] Filtering sobig with postfix

[Valdis.Kletnieks@vt.edu]

On Wed, 20 Aug 2003 10:17:16 +0200, vogt@hansenet.com  said:

> /see attached file for details/	REJECT
> 
> ever since, I've not had a single one coming through.

The reason this one works for the worm writers is because it's standard English
usage - as a result, it's *very* prone to false positives.  And you give no indication
of *why* the file was rejected, so the sender has no idea that if he re-sends but
says "Hey check out the file for the long version" instead it will get through.

If you're going to do this, scan for something that's almost certainly unique to
the worm(s) you're fighting, and give the user a hint what the problem is....

PGP signature