0

So the past few weeks we have been trying to cut back on the amount of spam reaching our users in our organization. We have been successful in implementing hard filtering rules like if an email subject or body contains "my bitcoin address" that usually means the email is a spam email along the lines of "I hacked your email now send me bitcoins". This rule has been good but some are still getting through. Upon inspecting the raw of the emails that make it through we see that they are using some utf-8 encoding to escape the filter.

Here is an example:

Raw shows:

=E2=80=8BMy=E2=80=8B b=E2=80=8Bit=E2=80=8Bco=E2=80=8Bin=E2=80=8B a=E2=80=8Bdd=E2=80=8Bre=E2=80=8Bss=E2=80=8B (=E2=80=8BBT=E2=80=8BC =E2=80=8BWa=E2=80=8Bll=E2=80=8Bet=
=E2=80=8B) =E2=80=8Bis

But decodes to:

My​ b​it​co​in​ a​dd​re​ss​ (​BT​C ​Wa​ll​et​) ​is

Does anyone have experience in defeating this form of obfuscation? Specifically using Exchange 2010 filtering rules to help defeat this.

bumped to the homepage by Community yesterday

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • That looks to UTF-8 encoding so your rule that should match on the subject should have support for this. Detect that is UTF-8, decode and apply your regex or logic of your system – camp0 May 24 at 8:27
0

After some serious digging we were able to find a solution to this problem. The UTF-8 encoding that we were seeing specifically =E2=80=8B encodes to a no width space. This is used to bypass the filter by breaking up text but still look normal on the recipients end.

Filtering It Out

We were able to copy the character from this website:

https://codepen.io/chriscoyier/pen/iLKwm

We pasted this character into exchanges filtering rules and it was able to detect and properly filter the encoding. Be warned this character is fairly common in day to day emails apparently so if you are going to filter based off of this character be sure to send it to a moderator do not just delete it without notifying anyone.

Hope this helps some people as this took a lot of work to figure out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.