Discuss

discuss@lists.surbl.org

2 participants
1870 discussions

RE: [SURBL-Discuss] google is open redirector
by Matthew Wilson 23 Mar '05

23 Mar '05

By the way, my only suggestion to combat this is to have the surbl client send an http request to google, to see what redirect site is returned, and then check *that* site in SURBL or in the other redirects. If the use of this technique picks up, google is going to have that additional burden. Who really uses the "I'm Feeling Lucky" button anyway? > -----Original Message----- > From: discuss-bounces(a)lists.surbl.org > [mailto:discuss-bounces@lists.surbl.org] On Behalf Of Matthew Wilson > Sent: Wednesday, March 23, 2005 7:39 AM > To: SURBL Discussion list > Subject: [SURBL-Discuss] google is open redirector > > See the following link. By using "I'm Feeling Lucky", a > spammer just has to rank at the top of google's searches for > *any* search, meaningful or not. > > http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=G GLC,GGLC:1 > 969-53,GGLC:en&q=blank+check+paper%2C+magnetic+ink+for+inkjets &btnI=I'm% > 20Feeling%20Lucky > > > Matthew Wilson, MCSE (2003), MCSA-Messaging Network > Administrator matthew(a)boomer.com Boomer Consulting, Inc. > 610 Humboldt > Manhattan, KS 66502 > http://www.boomer.com <http://www.boomer.com/> > 1-888-266-6375 x 17 > > > _______________________________________________ > Discuss mailing list > Discuss(a)lists.surbl.org > http://lists.surbl.org/mailman/listinfo/discuss > > >

3 2

Re: New redirector: www.nate.com
by Frank Ellermann 23 Mar '05

23 Mar '05

List Mail User wrote: > The rfci whois listing for gambia.com-munged is one of my > favorites, because it is the only time I have seem that > particular violation. What are you talking about ? `rxwhois -a gambia.com` says: | gambia.com not found at .rfc-ignorant.org or .multi.surbl.org | whois -h whois.abuse.net gambia.com | postmaster(a)gambia.com (default, no info) And there's no old RFCI entry for gambia.com (except from the bad day when TLD .com had no working whois server). Bye, Frank

1 0

Re: New redirector: www.nate.com
by List Mail User 23 Mar '05

23 Mar '05

>... >From: David B Funk <dbfunk(a)engineering.uiowa.edu> >To: discuss(a)lists.surbl.org, users(a)spamassassin.apache.org >Subject: New redirector: www.nate.com >... > >Ugg, just ran across another open redirector abused in spam > > www.nate.com/r/XY12/target.domain > >where XY12 seems to be any combination of 4 letters and digits. >Looks like some Korean ISP thingie. > >-- >Dave Funk University of Iowa ><dbfunk (at) engineering.uiowa.edu> College of Engineering >319/335-5751 FAX: 319/384-0549 1256 Seamans Center >Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 >#include <std_disclaimer.h> >Better is not better, 'standard' is better. B{ > The domains: nate.com-munged gambia.com-munged (and actual ICANN listed registrar) sktelecom.com-munged KPPN.COM-munged and KPPINC.COM-munged all seem to be part of a group of spam support services run from Korea. The true owner is hidden behind a set of legal shells. There do not appear to be an legitimate customers (but for Jeff C.), but I have not done a thorough enough investigation to say they for sure. I can say they have been "seen" before and have listings against them. Paul Shupak track(a)plectere.com P.S. The rfci whois listing for gambia.com-munged is one of my favorites, because it is the only time I have seem that particular violation.

1 0

RE: ZDNET redirecting to spammer websites?
by Chris Santerre 22 Mar '05

22 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 22, 2005 7:23 AM >To: users(a)spamassassin.apache.org; SURBL Discuss >Subject: Re: ZDNET redirecting to spammer websites? > > >On Tuesday, March 22, 2005, 4:13:33 AM, Bobby Rose wrote: >> Even though zdnet.com shouldn't be in SURBL, wouldn't having >> chkpt.zdnet.com (the actually site doing the redirect) be in SURBL? > >Good thought, but there are two problems with that: > >1. SURBLs usually list only registered domains like zdnet.com >and not subdomains. Obviously we're not going to blacklist >zdnet.com; it has too many legitimate uses. > >2. Similarly we can't list chkpt.zdnet.com. It's being abused, >but it clearly has legitimate uses too. > C&C warning. I agree with Jeff :) However I don't agree with a new mechanism in SA for scanning being the solution. ZDnet needs to shut this down and secure it. End of story. Even with a simple rule for SA you can tag it, but that doesn't help the people who don't use SA and will be fooled into installing malware thru this redirect. It has to be fixed. Its already been too long. --Chris

1 0

RE: ZDNET redirecting to spammer websites?
by Rose, Bobby 22 Mar '05

22 Mar '05

Even though zdnet.com shouldn't be in SURBL, wouldn't having chkpt.zdnet.com (the actually site doing the redirect) be in SURBL? -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Tuesday, March 22, 2005 12:38 AM To: users(a)spamassassin.apache.org Cc: SURBL Discuss Subject: Re: ZDNET redirecting to spammer websites? On Monday, March 21, 2005, 11:32:45 AM, Bobby Rose wrote: > Wouldn't this just be something that SURBL should take care of? If > this URL is the source of spam then it should be in SURBL regardless > if it's in the zdnet.com domain. Right!? Which domain are you referring to? zdnet.com should not be in SURBLs because it has too many legitimate uses. If we listed zdnet.com that would surely result in false positives. On the other hand viags.com and simply-rx.net should be listed in SURBLs, *and they are*. What's needed is for applications like SpamAssassin to parse the redirection correctly and check both zdnet.com and viags.com. zdnet.com should not match SURBLs, but viags.com should. QED. Jeff C. __ > -----Original Message----- > From: Rosenbaum, Larry M. [mailto:rosenbaumlm@ornl.gov] > Sent: Monday, March 21, 2005 10:35 AM > To: users(a)spamassassin.apache.org > Subject: ZDNET redirecting to spammer websites? > We received a drug spam containing the following URL: > http://chkpt.zdnet.com/chkpt/supposedtoallow/fdl%2ev%69%61%67%73.co%6d > /p > /b/kmioa > This URL will actually take you to fdl.viags.com (which then goes to > www.simply-rx.net). As far as I know, the SA SURBL check will check > zdnet.com, not the spammer domain viags.com. What is going on here, > and what should we do about it? > Larry Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 1

Re: ZDNET redirecting to spammer websites?
by Frank Ellermann 22 Mar '05

22 Mar '05

Jeff Chan wrote: > What's needed is for applications like SpamAssassin to parse > the redirection correctly That's very near to the point where it could outsmart itself. There's no general rule to identify redirections in URLs, I'd try to stay away from it. Bye, Frank

1 0

New redirector: www.nate.com
by David B Funk 22 Mar '05

22 Mar '05

Ugg, just ran across another open redirector abused in spam www.nate.com/r/XY12/target.domain where XY12 seems to be any combination of 4 letters and digits. Looks like some Korean ISP thingie. -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{

3 2

Re: ZDNET redirecting to spammer websites?
by Jeff Chan 22 Mar '05

22 Mar '05

On Monday, March 21, 2005, 11:32:45 AM, Bobby Rose wrote: > Wouldn't this just be something that SURBL should take care of? If this > URL is the source of spam then it should be in SURBL regardless if it's > in the zdnet.com domain. Right!? Which domain are you referring to? zdnet.com should not be in SURBLs because it has too many legitimate uses. If we listed zdnet.com that would surely result in false positives. On the other hand viags.com and simply-rx.net should be listed in SURBLs, *and they are*. What's needed is for applications like SpamAssassin to parse the redirection correctly and check both zdnet.com and viags.com. zdnet.com should not match SURBLs, but viags.com should. QED. Jeff C. __ > -----Original Message----- > From: Rosenbaum, Larry M. [mailto:rosenbaumlm@ornl.gov] > Sent: Monday, March 21, 2005 10:35 AM > To: users(a)spamassassin.apache.org > Subject: ZDNET redirecting to spammer websites? > We received a drug spam containing the following URL: > http://chkpt.zdnet.com/chkpt/supposedtoallow/fdl%2ev%69%61%67%73.co%6d/p > /b/kmioa > This URL will actually take you to fdl.viags.com (which then goes to > www.simply-rx.net). As far as I know, the SA SURBL check will check > zdnet.com, not the spammer domain viags.com. What is going on here, and > what should we do about it? > Larry Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: HELP: RE: [SURBL-Discuss] ZDnet redirector still open.
by Chris Santerre 22 Mar '05

22 Mar '05

Well its been a week since the first report. Emails to the media have begun. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, March 18, 2005 11:27 PM >To: SURBL Discuss >Subject: Re: HELP: RE: [SURBL-Discuss] ZDnet redirector still open. > > >On Friday, March 18, 2005, 8:41:13 AM, Chris Santerre wrote: >>>From: Alex Broens [mailto:surbl@alexb.ch] > >>>Jeff, >>> >>>Could you pls make some extra noise so this hole gets closed. >>> >>>- or do we need to run an international press release? - or >maybe some >>>extra pressure via Slashdot? >>> >>>Alex > >> Maybe their competitors would like to run a story on it :) I >know someone on >> SPAM-L list was trying to get it removed. Lets see what they say. > >Before calling the media, let's give cnet a week to fix it. >If it's not fixed by then, we can bring it up with them >again. > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: REDIRECTOR: chkpt.zdnet.com
by Chris Santerre 21 Mar '05

21 Mar '05

It makes more sense to email him direct. Too bad I can't find he email anywhere! I guess its time to start telling the media about this open redirect. Oh well, we gave them fair amount of time. --Chris >-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Monday, March 21, 2005 11:11 AM >To: discuss(a)lists.surbl.org; users(a)spamassassin.apache.org >Subject: Re: REDIRECTOR: chkpt.zdnet.com > > >(I've sent this to both SA & SURBL) > >There has been much fuss about ZDNet being slow or >unresponsive about fixing >open redirects. > >I have a suggestion. > >Someone ought to post a message on John Dvorak's blog. I did a >search to >find the most recent post on his blog relating to spam to find the best >place to post. > >Therefore, someone please go here and post a message to him to get this >message across: > >http://www.dvorak.org/blog/?p=1437 > >(I'd do it myself but I just got over the flu and I'm severely >behind in my >work. Also, I think that someone with more "pull" than me out >to do this... >someone like Chris or Jeff. Plus, Dvorak will recognize my >name from other >very unrelated topics that I've posted on his blog in the past and I >wouldn't want to confuse issues with him by using my name.) > >Rob McEwen >PowerView Systems > >

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss