	FML Security Advisory 2000-003: Love Letter Worm
	========================================

Topic:	Love Letter Worm

			Ken'ichi Fukamachi <fukachan@sapporo.iij.ad.jp>

	Copyright (C) 2000 Ken'ichi Fukamachi
		All rights reserved.

[Abstract] 
   * add the rule to config.ph

   &DEFINE_FIELD_PAT_TO_REJECT("Subject", "ILOVEYOU");

   $DISTRIBUTE_FILTER_HOOK = q#
      if ($e{'Body'} =~ /Content.*\.vbs|filename=.*\.vbs/i) {
           return 'VB script attatchment';
      }
   #;

   &ADD_CONTENT_HANDLER('multipart/.*', '.*/.*', 'reject');

[References]
  "CERT Advisory CA-2000-04 Love Letter Worm"
	http://www.cert.org/advisories/CA-2000-04.html

	http://www.f-secure.com/v-descs/love.htm
	http://www.sophos.com/virusinfo/analyses/vbsloveleta.html
	http://www.sophos.com/virusinfo/analyses/trojloveleta.html
	http://www.thepope.org/index.pl?node_id=140
	http://www.datafellows.com/v-descs/love.htm
	http://www.symantec.com/avcenter/venc/data/vbs.loveletter.a.html

-------------------------
------------------------------------------------------------
1	Love Letter Worn
1.1	original Love Letter
1.2	Variant 1
1.3	Variant 2

I	Filtering

2	Filtering Function
2.1	FML Filtering
2.2	use "makefml config"
2.3	write cf 
2.4	write config.ph
2.5	make secure

3	Add a new filtering rule
3.1	cf
3.2	config.ph
3.3	reject every MIME Multipart mails

4	other solutions
4.1	vf.exe
Appendix A	Information
Appendix A.1	Bugtraq
Appendix A.2	postfix filtering
Appendix A.3	sendmail
Appendix A.4	uuencoded ?
------------------------------------------------------------

-------------------------

See INSTALL manual for more details on how to configure fml.

	http://www.fml.org/fml/INSTALL/

"CERT Advisory CA-2000-04 Love Letter Worm"

1	Love Letter Worn

	http://www.f-secure.com/v-descs/love.htm

1.1	original Love Letter

Subject: ILOVEYOU

Attachment: VB script

1.2	Variant 1

  Subject:    Susitikim shi vakara kavos puodukui...
  Body:       kindly check the attached LOVELETTER coming from me.
  Attachment: LOVE-LETTER-FOR-YOU.TXT.vbs

1.3	Variant 2

  Subject:    fwd: Joke
  Attachment: Very Funny.vbs

I	Filtering

2	Filtering Function

2.1	FML Filtering

Fml has filtering mechanism based on mail header and body after fml
2.2 (2.2 officially but fml 2.1 current unofficially). You can
deny/reject mail with some patterns. If you can find
$USE_DISTRIBUTE_FILTER in fml source, the version has filtering
function.

In default fml filtering is off. Firstly you should turn on it. 
Consider elena ML hereafter as an example.

To enable filtering function, you can do one of the following methods
which are the same. Please use one you are familliar with.

2.2	use "makefml config"

   "makefml config elena" -> security -> USE_DISTRIBUTE_FILTER -> "y" (yes)

2.3	write cf 

Write

   USE_DISTRIBUTE_FILTER 1

and run to remake config.ph

	% make config.ph

2.4	write config.ph

   $USE_DISTRIBUTE_FILTER = 1;

2.5	make secure

To enable all typical security options, run

   % cd /var/spool/ml/elena
   % make secure

3	Add a new filtering rule

The following ruels are the same. Please use one you are familliar with.

3.1	cf

To add

&DEFINE_FIELD_PAT_TO_REJECT("Subject", "ILOVEYOU");

$DISTRIBUTE_FILTER_HOOK = q#
      if ($e{'Body'} =~ /Content.*\.vbs|filename=.*vbs/i) {
           return 'VB script attatchment';
      }
#;

to the last of "cf" (after "LOCAL_CONFIG" line) and run

	% make config.ph

3.2	config.ph

To write 

&DEFINE_FIELD_PAT_TO_REJECT("Subject", "ILOVEYOU");

$DISTRIBUTE_FILTER_HOOK = q#
      if ($e{'Body'} =~ /Content.*\.vbs|filename=.*vbs/i) {
           return 'VB script attatchment';
      }
#;

to the last of config.ph (but before the last "1;").

3.3	reject every MIME Multipart mails

       &ADD_CONTENT_HANDLER('multipart/.*', '.*/.*', 'reject');

4	other solutions

4.1	vf.exe

Message-ID:  <000d01bfb914$214863e0$2102020a@ELYSIUM>
Date:         Mon, 8 May 2000 18:37:48 +0100
Subject:      Contemplations : Melissa, I love you - not!

	http://www.cerberus-infosec.co.uk/

Appendix A	Information

Appendix A.1	Bugtraq

Bugtraq
Message-ID:  <20000504095618.N24513@securityfocus.com>
Message-ID:  <20000504173015.2246.qmail@web612.mail.yahoo.com>
Message-ID:  <001901bfb5f1$e6baf0a0$85755ad1@iboats.com>
Message-ID:  <20000504110932.N15104@securityfocus.com>
Message-ID:  <20000504121550.B20905@securityfocus.com>
Message-ID:  <20000504163541.D14933@securityfocus.com>

Appendix A.2	postfix filtering

ATTENTION! postfix-19991231-pl08 has "body_checks" directive for
content filtering. Please check it out!

    [/etc/postfix/main.cf]
    header_checks = regexp:/etc/postfix/header_checks
    
    [/etc/postfix/header_checks]
    /^Subject.*ILOVEYOU/  REJECT

Appendix A.3	sendmail

	http://www.sendmail.com/loveletter/

Appendix A.4	uuencoded ?

    To: postfix-users@postfix.org
    Message-ID: <20000505100443.N3160@alcove.wittsend.com>
    
    	... snip ...
    
    they are using Microsoft Information Server and it's configured to send
    attachments to exterior addresses in uuencoded form.  
    
    	... snip ...

