Spam & Virus

Contents

1. What is email spam?
2. What is the University is doing to reduce spam and viruses?
3. What products are used to provide central spam and virus scanning?
4. What do the spam scores mean?
5. What attachments are blocked?
6. How are email messages tagged?
7. How do I use the central spam/virus filtering service?
8. How do I report spam?
9. Incorrectly classified spam (false positives)

What is email spam?

Email spam, also known as unsolicited commercial email (UCE) and unsolicited bulk email (UBE), is identical or very similar email messages sent in bulk to many recipients who did not request them. Email spam is often of a commercial nature, but is not always.

For more in-depth information see Wikipedia's article on email spam.

What is the University doing to reduce spam and viruses?

The University provides a spam/virus scanning and filtering service for central email accounts. To take advantage of this service you must use your central email account, ending in either @unimelb.edu.au for staff, or @ugrad.unimelb.edu.au or @pgrad.unimelb.edu.au for students.

The University also scans outgoing external mail for viruses if it is sent via smtp.unimelb.edu.au.

Anti-spam and anti-virus system

Email sent to central email accounts first passes through the central anti-spam and anti-virus system. This system:

1. Checks for and discards messages containing known viruses and dangerous attachment types.
2. Runs spam analysis and assigns a spam score to each message based the probability of it being spam.
3. Discards messages which score extremely highly (15+).
4. Tags remaining messages with their spam score and details.

The messages are then delivered to the central mail servers.

Central mail filtering

The central mail systems (mail.unimelb.edu.au and mail.student.unimelb.edu.au) provide custom mail filtering on the server. This is done as the mail is delivered and before it is seen by email client software (such as Eudora). This filtering applies no matter how mail is read: whether with webmail or with a desktop client (via POP3 or IMAP).

Typically messages with a score of 5 or more (almost guaranteed spam) are either filed into a "Spam" folder (for staff) or discarded (for students). The staff and student webmail interfaces allow users to customise the filtering behavior.

Desktop mail client filtering

Because all email messages are tagged with their spam scores, desktop mail client software can also be configured to do spam filtering. This is of most benefit to those using the POP3 protocol or who need more fine-grained control of filtering rules.

For more information see the sections below on how mail is tagged with spam scores and how to use the central spam filtering service.

What products are used to provide central spam and virus scanning?

Central virus scanning is done with Sophos Anti-virus. Virus signatures are updated every half hour.

Central spam scanning is done with spamassassin.

What do the spam scores mean?

The spam filtering service uses a rules-based approach to detecting spam. The rules are applied to every email message and a total score generated indicating how likely the message is to be spam. A higher score means a message is more likely to be spam.

The maximum score you will see is 15.0, as any message scoring above 15 is discarded before delivery. There is no inherent minimum score but you are unlikely to see a message score below -20.0 (negative twenty). The scores are designed so that 5.0 or above is as close to being a definite spam as the system can detect.

What attachments are blocked?

To prevent the spread of viruses sent via email, the central email servers block potentially dangerous attachment types. The blocking behaviour is different for incoming email and outgoing email:

Incoming and internal University email blocking

Email attachments that are destined for the central email servers are blocked if they:

• are infected with a known virus
• are of a dangerous file type, as determined by their file extension. The current list of file types considered dangerous is:

  ade adp app asd asf asx bas bat chm cmd com cpl crt dll exe 
  xp hlp hta hto inf ini ins isp jse? lib lnk mdb mde msc msi 
  msp mst ocx pcd pif prg reg scr sct sh shb shs sys url vb vbe 
  vbs vcs vxd wmd wms wmz wsc wsf wsh
  

• are an encrypted zip file (also known as a password protected zip file) that doesn't meet the uom- naming criteria.

Outbound email blocking

Email attachments that are destined for non-University email servers and that go via smtp.unimelb.edu.au are blocked if they:

• are infected with a know virus
• are of a dangerous file type, as determined by their file extension. The current list of file types considered dangerous is:

  pif scr exe cmd bat com cpl vbs
  

• are a zip file (both encrypted and not encrypted) that doesn't meet the uom- naming criteria.

How to send .zip files

To prevent your zip file attachment from being blocked by the central email servers you can rename the file using the prefix: "uom-". Uppercase and lowercase prefixes are accepted and it doesn't matter if a "-" (dash) or an "_" (underscore) is used.

As an example, to send or receive an email attachment in password protected .zip format which is originally named "latestresearch.zip", the sender needs to add a prefix so that one of the following names is used for the attachment:

• uom-latestresearch.zip
• UOM-latestresearch.zip
• uom_latestresearch.zip
• UOM_latestresearch.zip
• UoM-latestresearch.zip

How are email messages tagged?

Email messages are tagged with an extra header: X-Spam-Score.

The contents of this header contain a star rating (a number of consecutive asterisk characters) for the score, the numerical score, and a list of the spam rules that this message triggered.

Here is an example X-Spam-Score header from an email message that has been tagged.

X-Spam-Score: ***** (5.366) RCVD_IN_BL_SPAMCOP_NET,STOCK_PICK,STRONG_BUY

This message scored 5 stars or 5.366 and is almost certainly spam. The spam detection rules that matched are "RCVD_IN_BL_SPAMCOP_NET", "STOCK_PICK" and "STRONG_BUY". If you are a technical person you can read the documentation about what each rule means.

How do I use the central spam/virus filtering service?

The central spam and virus filtering service only applies to central email accounts. You must have people email you at your @unimelb.edu.au (staff), @pgrad.unimelb.edu.au or @ugrad.unimelb.edu.au (students) email address to take advantage of this service.

Email messages containing viruses are automatically filtered and discarded. You do not need to do anything to take advantage of this service on your central email account.

To make best use of the spam filtering, you must set up extra filtering yourself. Otherwise only the most obvious spam messages are discarded.

Server filtering

Server filtering is configured via the staff and student webmail interfaces, but it applies no matter how you read your mail.

• setting up filtering with staff webmail
• setting up filtering with student webmail

Client software filtering

These instructions provide instructions for setting up basic filtering with common desktop client software. For more advanced filtering you will need to get assistance from your local IT expert.

• Eudora (MAC and PC)
• Outlook 2002 (PC)

How do I report spam?

If you receive spam email that you think originated within the University, send a copy of the message to it-abuse@unimelb.edu.au. Be sure to include the all the headers in the message (in particular the "Received" headers are necessary to track the origin of the message).

Incorrectly classified spam (false positives)

Because of the difficulties associated with identifying and classifying Spam, users should be aware that very occasionally legitimate email may be identified incorrectly as spam, and conversely some spam may still get through the Anti-Spam software unidentified.

We therefore recommend users initially take a conservative approach to their anti-spam settings, following the recommendations (and heeding the warnings) made for each email client above.