Discuss July 2004

discuss@lists.surbl.org

65 participants
151 discussions

SURBL DoS possible?
by Mariano Absatz 29 Jul '04

29 Jul '04

I was wondering... I didn't look at the source code for the SpamCopURI or the SA 3.0 plugin but I guess it just looks for URI's within the messages and issues a DNS query to the configured SURBLs for every different canonicalized domain name... is it? What would happen if a spammer intentionally starts putting hundreds of different invisible random URIs within the message trying to DoS SURBL? Does the SA plugins check for this condition? Or have a limit as to how many SURBL queries will it issue for a given message? TIA -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com

3 2

RE: [SURBL-Discuss] RFC: SURBL flyer
by Chris Santerre 29 Jul '04

29 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, July 29, 2004 4:09 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] RFC: SURBL flyer > > >On Thursday, July 29, 2004, 12:55:10 AM, John Andersen wrote: >> On Tuesday 27 July 2004 12:58 am, Jeff Chan wrote: >>> On Tuesday, July 27, 2004, 1:36:53 AM, Daniel Kleinsinger wrote: >>> > http://mailscanner.info >>> > MailScanner doesn't include or depend on SA (without SA >one can still >>> > check for viruses and do old fashioned RBL lookups), but >the only way to >>> > have MailScanner check SURBLs is to utilize its ability >to call SA 2.63 >>> > + SpamCopURI or SA 3.0. >>> >>> OK Thanks for that. I've taken MailScanner off the flyer. >>> >>> http://www.surbl.org/flyer.html >>> >>> Does anyone have any other comments for me? >>> >>> Jeff C. > >> Yeah... SURBLs don't BLOCK anything. >> Blocking is up to the user. >> That point should be made. Surprisingly, lots of people get >> bent out of shape if you use the word BLOCK and EMAIL >> in the same sentence. > >True, but I never said SURBLs block anything. I said: >"SURBLs... are used to block messages." Technically >SURBLs don't block anything. Programs that use SURBLs >do the blocking.... > >Jeff C. > It needs an attention grabber. How about these titles: Sexy Underwear Really Black Lace (SURBL) She Used Really Big Lemons (SURBL) Some United Redheads Bring Love (SURBL) Simultaneous Ugly Rats Bite Leroy (SURBL) Sorry the medicine is kicking in........ --Chris

1 0

Re: [SURBL-Discuss] RFC: SURBL flyer
by Jeff Chan 29 Jul '04

29 Jul '04

On Thursday, July 29, 2004, 12:55:10 AM, John Andersen wrote: > On Tuesday 27 July 2004 12:58 am, Jeff Chan wrote: >> On Tuesday, July 27, 2004, 1:36:53 AM, Daniel Kleinsinger wrote: >> > http://mailscanner.info >> > MailScanner doesn't include or depend on SA (without SA one can still >> > check for viruses and do old fashioned RBL lookups), but the only way to >> > have MailScanner check SURBLs is to utilize its ability to call SA 2.63 >> > + SpamCopURI or SA 3.0. >> >> OK Thanks for that. I've taken MailScanner off the flyer. >> >> http://www.surbl.org/flyer.html >> >> Does anyone have any other comments for me? >> >> Jeff C. > Yeah... SURBLs don't BLOCK anything. > Blocking is up to the user. > That point should be made. Surprisingly, lots of people get > bent out of shape if you use the word BLOCK and EMAIL > in the same sentence. True, but I never said SURBLs block anything. I said: "SURBLs... are used to block messages." Technically SURBLs don't block anything. Programs that use SURBLs do the blocking.... Jeff C.

3 2

[SURBL-Discuss] Re: ANNOUNCE: How to report false positives in ph anti-phishing list to MailSecurity
by Jeff Chan 29 Jul '04

29 Jul '04

On Tuesday, July 27, 2004, 11:44:54 PM, Rakesh Rakesh wrote: > And where to report domains to be blacklisted ? Currently there is no phishing reporting form, though one may eventually be forthcoming. Let's ask David Hooton of MailSecurity to clarify this if he can. Jeff C.

2 1

Praise for SURBL
by David Groce 29 Jul '04

29 Jul '04

After just one day of getting SURBL's to work in my SA 2.63 install, I can't say enough good things about it. I haven't been able to keep up with updating rules and spam was becoming a big problem again, more getting through then getting filtered. Until yesterday. To the people who thought this up, Thank you very much, you have made me and my ~1000 users very happy. David Groce CCNA Network Server Analyst/Coordinator North Kitsap School District

2 1

RE: [RD] Bigevil future looks bleak.
by Chris Santerre 29 Jul '04

29 Jul '04

>-----Original Message----- >From: Fred [mailto:spamassassin@freddyt.com] >Sent: Wednesday, July 28, 2004 11:32 AM >To: Chris Santerre; Spamassassin-Talk (E-mail) >Subject: Re: [RD] Bigevil future looks bleak. > > >Chris Santerre wrote: >> OK, BigEvil is out of control. My own mail server went into "Now >> everyone just hang on a minute!" mode :) >> >> There are just toooo many dang domains to use it anymore. Daemons >> spin out of control, queues fill, and babies cry! > > >I have an idea for it's rebirth. Use the same type of setup I >have going >for sc_top200.cf, take the top 200 hitters or maybe the previous 200+ >domains (that were added) and keep bigevil updated with those. > >I wrote a script for the sc_top200.cf updates, I just run it >once a day or >more when I update my rules. Having some type of interface >like this will >allow bigevil to live on, in a fully automated way (we love >not working). >Worth an idea, I always like to code things up, keep it in mind! > Hmmm.....but how would we know which would be the top 200? Get reports from the top DNS lookups from the surbl servers? Possibly use bigevil in the eval file format we talked about before? WIll have to test the speed of that later. --Chris

2 1

URGENT --- com listed at sc and multi
by Jose Marcio Martins da Cruz 28 Jul '04

28 Jul '04

Hello, "com" is listed at sc and multi.... Big error.... Many people are complaining here.... 8-( -- --------------------------------------------------------------- Jose Marcio MARTINS DA CRUZ Tel. :(33) 01.40.51.93.41 Ecole des Mines de Paris http://j-chkmail.ensmp.fr 60, bd Saint Michel http://www.ensmp.fr/~martins 75272 - PARIS CEDEX 06 mailto:Jose-Marcio.Martins@ensmp.fr

5 12

[SURBL-Discuss] RE: ANNOUNCE: How to report false positives in ph anti-phishing l ist to MailSecurity
by Chris Santerre 28 Jul '04

28 Jul '04

In general the only way to report one for Blacklisting for WS is to go to http://www.rulesemporium.com/cgi-bin/uribl.cgi do a lookup, if not in WS there is a report button that shows up. Placing a copy of the spam will get it listed MUCH faster, then if you don't. These are always hand checked. As for MailSecurity reporting, nothing yet. --Chris >-----Original Message----- >From: Rakesh [mailto:rakesh@netcore.co.in] >Sent: Wednesday, July 28, 2004 2:45 AM >To: Jeff Chan >Cc: SURBL Announce; SpamAssassin Users >Subject: Re: ANNOUNCE: How to report false positives in ph >anti-phishing >list to MailSecurity > > >And where to report domains to be blacklisted ? > >Jeff Chan wrote: > >>We've updated the SURBL Lists document to add information about >>how to contact MailSecurity with reports about false positives in >>ph, the anti-phishing list included (only) in multi.surbl.org: >> >> http://www.surbl.org/lists.html#ph >> >>"Please report false positives on the ph list to: postmaster >> at corp.mailsecurity.net.au. Be sure to include supporting >> reasons explaining why the domain should not be listed." >> >>Jeff C. >> >> > >

1 0

Re: RE: [SURBL-Discuss] Phone Number Spam
by Rob McEwen 28 Jul '04

28 Jul '04

Matt, I'll gather a list over the next week or so and I'll send them to you. Then, I'll try to send them as I get them. You are correct in that these types of spam are rare. But they do expose a weakness in the system and they are more noticeable now that so much else is blocked. On the other hand, it has to take guts for a spammer to expose something so traceable as a phone number within an obvious spam message. You'd think that fear of prosecution from authorities and/or harassment from vigilantes would be enough of a deterrent. Thanks, Rob McEwen

1 0

Re: RE: [SURBL-Discuss] Phone Number Spam
by Rob McEwen 28 Jul '04

28 Jul '04

Bret: That is exactly what I'm talking about. Only, that list seems small and I wonder if there is a good system in place to submit phone numbers and to get these spam phone #s listed within hours instead of days. Also, is there another similar list somewhere else? Rob McEwen PowerView Systems rob(a)pvsys.com (478) 475-9032

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss July 2004