Kavi Mailing List Manager Help

Chapter 19. Virus Scanning and Spam Blocking


Kavi uses f-prot anti-virus software to scan for viruses and as a contributor to Kavi's spam defenses. f-prot provides an MTA-level mail scanner that plugs directly into qmail. You can more find about f-prot at the Frisk Software International website.

Back to top

What are viruses and spam?

Virus is a generic term for malware (i.e. malicious software) or other content distributed via email including viruses, worms and trojans. There are differences in the way that these types of malware operate, but they all have two things in common: they are designed to cause trouble and are transmitted via email.

Spam doesn't contain malicious code, but it is similar to malware because it is distributed via email and contains unwelcome content. To spammers, email and mailing lists represent an irresistibly cheap way of distributing bulk advertisements. The sheer volume of spam flooding the internet is the reason it creates such problems as it misappropriates system resources and forces innumerable users to spend precious time managing the spam in their email accounts. Even if a spam message doesn't contain malicious code, it can be anything but wholesome. For more information, see The malware connection.

Your organization will want to protect its website and users against spam as well as viruses and other malware, but there are no fool-proof prevention methods. Each method has limitations and there are certain trade-offs between ease-of-use and security that need to be considered.

Back to top

Virus scanning

Virus scanning is based on identifying a unique pattern in malicious software, called a virus signature. Once a virus signature is known, it is added to virus definitions used by anti-virus software such as f-prot. The anti-virus software scans any file that may potentially contain malicious code for virus signatures and if it finds code containing that pattern, confirms the identity of the virus and neutralizes it. Updated f-prot virus signature files are released on an almost weekly basis.

If your list has virus scanning enabled—which most lists should—f-prot will be running in the background and will automatically check email, email attachments and other files on the server as they are opened.

Messages infected by executable malware (all types except hoaxes, which aren't executable) are quarantined and an email notification is sent to warn the sender that the message contained a virus or other malware.

Back to top

Spam blocking

Guarding against spam presents a greater technical challenge than guarding against viruses for a couple of reasons. First, only certain types of files can contain virus or other malware. Secondly, if programming code is going to work, it must be properly structured, which makes it easier to identify by pattern matching to virus definitions. On the other hand, spam can be distributed in any type of file and can take any form, which makes it much more difficult to detect. In fact, it's impossible to completely identify and filter all spam without human intervention (i.e., moderated posting).

That said, there are certain identifiable features that are commonly found in spam. For instance, spammers often broadcast messages in the hope that some of them will resolve to actual mailboxes. When this is the case, the contents of the 'To:' and 'Cc:' field won't match the recipient's email address. Anti-spam software checks to see if these match, and if they don't, it rejects the email.

Spammers frequently send messages with empty 'Subject:' fields, so spam filters check the 'Subject:' field to see if it's empty, and if it is, the message is classified as spam and rejected.

There are certain phrases that frequently appear in spam, such as "low-cost prescription", and spam filters search for these phrases. However, spammers use many tricks to disguise spam, and one of these is to insert non-text characters to obscure the phrase, such as "lo&w-cost pres&cription." Human readers are capable of recognizing the meaning of the phrase, but software that is looking for exact pattern matches cannot.

Since there is no guaranteed way to automatically detect spam, moderated posting is recommended.

Back to top

When Messages Are Rejected as Spam

They Fail Silently

When an email encounters a firewall, the spam and virus filters test the message to see if it qualifies as spam, and if it does, it is deleted without notifying the sender. Unfortunately, it is difficult to detect spam because it can assume so many different forms, so spam filters test on a broad set of criteria and tend to misclassify a significant number of messages as spam, particularly messages from mailing lists. When an email from a list or other automated source seems to have vanished somewhere in the network cloud, the culprit is usually a spam filter at the receiver's ISP or company.

Email rejected as spam is deleted, rather than bounced, so it fails silently. Since the volume of spam messages is to high, this approach conserves system resources while simultaneously denying the spammer any address confirmation information. Unfortunately, since there is some misclassification of legitimate messages as spam, email sometimes vanishes in the network cloud as it is rejected by a spam filter before it reaches the list, or by a subscriber's firewall afterward. If you are troubleshooting an email that disappeared en route, it may have been deleted by a spam filter.

Legitimate Messages May Be Rejected

Legitimate messages may be misclassified as spam and rejected. This happens to messages that haven't been constructed properly, such as messages with empty 'Subject:' fields. It also happens to messages that contain words or phrases most commonly found in spam. Some classification schemes implemented by spam-filtering software are especially likely to misclassify mailing list messages.

Hopcount Misclassification

Some spam filters use the number of MTA-to-MTA hops made by a message to detect spam, since spammers often specify the first portion of the 'Return-Path', routing their message through an extra set of MTAs in order to obscure the originating MTA. As with SPF, hopcount can help detect spam, but it frequently results in the misclassification of messages from mailing lists, especially if the hopcount is set too low.

Back to top