- Discuss - Mailman 3

RE: [SURBL-Discuss] Hmmm....what if?
by Chris Santerre 04 Aug '04

04 Aug '04

>-----Original Message----- >From: Patrik Nilsson [mailto:patrik@patrik.com] >Sent: Tuesday, August 03, 2004 3:10 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Hmmm....what if? > > >At 17:47 2004-08-03 +0100, Karanbir Singh wrote: >>Chris Santerre wrote: >>>What if I placed an SURBL server in the beginning of my DNS >query list? Then >>>users would actually check SURBL for a domain in a web page. >If it is in >>>… [View More]

3 2

Re: [SURBL-Discuss] Hmmm....what if?
by Patrik Nilsson 04 Aug '04

04 Aug '04

At 12:11 2004-08-03 -0400, Chris Santerre wrote: >What if I placed an SURBL server in the beginning of my DNS query list? Then >users would actually check SURBL for a domain in a web page. If it is in >SURBL they will get a 127.0.0.x and get error. Which is good! > >Am I missing something, or is it that easy? Your users would query for the RR host.domain.com, not the RR domain.com.multi/xx.surbl.org. Patrik

3 2

Hmmm....what if?
by Chris Santerre 03 Aug '04

03 Aug '04

What if I placed an SURBL server in the beginning of my DNS query list? Then users would actually check SURBL for a domain in a web page. If it is in SURBL they will get a 127.0.0.x and get error. Which is good! Am I missing something, or is it that easy? Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

3 2

RE: [SURBL-Discuss] Hmmm....what if?
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Karanbir Singh [mailto:mail-lists@karan.org] >Sent: Tuesday, August 03, 2004 12:48 PM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Hmmm....what if? > > >hey, > >Chris Santerre wrote: >> What if I placed an SURBL server in the beginning of my DNS >query list? Then >> users would actually check SURBL for a domain in a web page. >If it is in >> SURBL they will get a 127.0.0.x and get error. Which … [View More]

1 0

Possible FP in WS - imagestation.com
by Patrik Nilsson 03 Aug '04

03 Aug '04

imagestation.com is listed in WS. It's a Sony domain. Searching NANAS, I can't find any recent reports mentioning imagestation.com. Outgoing imagestation.com mail servers, such as zms0.imagestation.com, are listed in AUDNSBL and SORBS - as servers sending to spamtraps. But they are not listed in SBL or Spews. So... it's ambiguous. I assume that there are quite a few willing subscribers to the imagestation news letters though, so there is probably a high level of collateral damage if it's listed. Patrik

2 1

RE: [SURBL-Discuss] FP's in ws.surbl.org
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Monday, August 02, 2004 4:48 PM >To: Jeff Chan; SURBL Discussion list >Subject: Re: [SURBL-Discuss] FP's in ws.surbl.org > > >Hi! > >> > OUCH I'm farther behind then I thought!! I have 2 lists, >one 416 domains, >> > the other 347 domains. All to be checked. And that's not >all!!!! So if two >> > people would each take a list, I could work … [View More]

1 0

Please whitelist ebooks.com
by Bitz 03 Aug '04

03 Aug '04

This is a legit site -- X-Spam-Status: No, hits=5.0 required=10.0 tests=WS_URI_RBL=5 http://www.ebooks.com Thanks, -B.

2 1

RE: [SURBL-Discuss] FP's in ws.surbl.org
by Chris Santerre 03 Aug '04

03 Aug '04

>-----Original Message----- >From: Joseph Burford [mailto:joseph.burford@gmail.com] >Sent: Monday, August 02, 2004 4:29 AM >To: discuss(a)lists.surbl.org >Subject: [SURBL-Discuss] FP's in ws.surbl.org > > >Hi all, > >just wondering if anyone else has reported FPs for ws.surbl.org, if so >how long did the removal take? > >While I'm here, can anyone else confirm that spam submissions to >http://www.rulesemporium.com/cgi-bin/uribl.cgi?report=1 get read. &… [View More]

5 8

FP's in ws.surbl.org
by Joseph Burford 03 Aug '04

03 Aug '04

Hi all, just wondering if anyone else has reported FPs for ws.surbl.org, if so how long did the removal take? While I'm here, can anyone else confirm that spam submissions to http://www.rulesemporium.com/cgi-bin/uribl.cgi?report=1 get read. Regards, Joseph

3 5

RE: [SURBL-Discuss] FP's in ws.surbl.org
by Chris Santerre 03 Aug '04

03 Aug '04

OUCH I'm farther behind then I thought!! I have 2 lists, one 416 domains, the other 347 domains. All to be checked. And that's not all!!!! So if two people would each take a list, I could work on the other 500+. HELP!!!! :) --Chris >-----Original Message----- >From: Raymond Dijkxhoorn [mailto:raymond@prolocation.net] >Sent: Monday, August 02, 2004 2:23 PM >To: SURBL Discussion list >Subject: RE: [SURBL-Discuss] FP's in ws.surbl.org > > >Hi Chris, > >> >… [View More]

4 8

RE: [SURBL-Discuss] Please beta test ms.surbl.org - data from Mai lSecurity
by Chris Santerre 02 Aug '04

02 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, July 30, 2004 3:32 AM >To: SURBL Discussion list >Subject: Re: [SURBL-Discuss] Please beta test ms.surbl.org - data from >MailSecurity > > >On Friday, July 30, 2004, 12:05:52 AM, Raymond Dijkxhoorn wrote: >>> This released list has been developed from actual spam >recieved since >>> the SURBL effort started. I don't doubt there are a lot of >double ups >&… [View More]

6 7

What data sources are in ws now? :-)
by Jeff Chan 02 Aug '04

02 Aug '04

I'm updating the SRUBL Lists about about ws, and may have lost track of all the data sources now going into it: http://www.surbl.org/lists.html#ws > ws.surbl.org - sa-blacklist and other domains > ws.surbl.org has entries from three SpamAssassin rulesets: Bill > Stearns' sa-blacklist, BigEvil.cf from Chris Santerre and his > SARE cohorts, and Paul Barbeau's MidEvil.cf. ws.surbl.org also > has entries from additional spam URI domain lists such as > MailSecurity's formely … [View More]

3 7

RE: [SURBL-Discuss] What data sources are in ws now? :-)
by Chris Santerre 02 Aug '04

02 Aug '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Monday, August 02, 2004 6:00 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] What data sources are in ws now? :-) > > >I'm updating the SRUBL Lists about about ws, and may have lost >track of all the data sources now going into it: > > http://www.surbl.org/lists.html#ws > >> ws.surbl.org - sa-blacklist and other domains > >> ws.surbl.org has entries from three … [View More]

2 1

RFC: SURBL flyer
by Jeff Chan 02 Aug '04

02 Aug '04

I'm making a flyer to distribute at the CEAS spam conference next week and would appreciate any feedback on it please: http://www.surbl.org/flyer.html The audience should be mostly academics and some industry and Internet types who work on fighting spam. The conference appears to be mostly about technical and some legal theories for identifying and fighting spam. Here's the program: http://www.ceas.cc/acceptedpapers.htm Please send me your comments, improvements, suggestions, typos, … [View More]

8 14

Additional data sources into ws.surbl.org
by Jeff Chan 02 Aug '04

02 Aug '04

Thanks to Raymond's efforts a couple new data sources are going into ws.surbl.org: 1. MailSecurity's own SURBL lists of about 2200 entries found in spam. 2. Joe Wein's list from his spam filter for pop mailboxes Windows client application jwSpamSpy: http://www.joewein.de/sw/jwSpamSpy/ Before I announce this more widely I thought I would ask if anyone else is noticing improved spam detection and/or any changes in FPs. Adding these two seems to have boosted Raymond's spam detection results … [View More]

3 2

RE: {SPAM} Re: SURBL DoS possible?
by Chris Santerre 30 Jul '04

30 Jul '04

>-----Original Message----- >From: Mariano Absatz [mailto:el.baby@gmail.com] >Sent: Friday, July 30, 2004 8:32 AM >To: SpamAssassin users list; SURBL discussion list >Subject: Re: {SPAM} Re: SURBL DoS possible? > > >On Thu, 29 Jul 2004 17:27:00 -0400, Matt Kettler ><mkettler(a)evi-inc.com> wrote: >> At 04:48 PM 7/29/2004, Dougie Nisbet wrote: >> > > It picks a random sample of URLs. This was one of the >main concerns when we >> > … [View More]> started talking about this feature. We're always one >step ahead of Mr. >> > > Spammy ;) >> > >> >I'm not so sure :( >> > >> >I've just received a spam which has several embedded URLs. >Each URL is based >> >on the recipient's name, in this case djn(a)highmoor.co.uk. >So there's djn.org, >> >djn.net, djn.com etc. At the the end there's the spam URL itself - >> >> A "random sample" is a bit of an over-simplified description of the >> behavior, but is at least partly true. >> >> From looking at the source code itself, no true DoS is >possible this way, >> although it may be possible for a spammer to reduce their >chances of being >> checked. >> >> Disclaimer: I'm not a Perl programer, so my interpretation >of the code's >> behavior may be incorrect. However, clearly the code has >limits to the >> number of queries they will generate per email. >> >> Mail::SpamCopURI (the plugin for 2.63) has a hard coded >limit the number of >> URI's it will check. Once it hits that limit, it seems to >ignore the rest >> of the URIs in the email. I'm unsure if the build-order is >sequential, >> alphabetical, or random, but I suspect sequential. (This is >as-of 0.18, I >> haven't checked 0.19). You can check this yourself in SpamCopURI.pm. >> >> In SA 3.0-pre3, there is a limit defined by the config option >> uridnsbl_max_domains. First, all the domains are extracted >from the URIs of >> the email and duplicates are removed. Then up to >uridnsbl_max_domains are >> randomly selected from the list. If there are fewer domains >than the limit, >> all of them should end up being selected. You can check this >behavior in >> lib/Mail/SpamAssassin/Plugin/URIDNSBL.pm. The default for >this limit is >> 20, so your example email didn't approach that limit. >> >> So both do have limits to prevent DoS's by generating tons >of URI's. SA >> 3.0's URIDNSBL code appears to be more abuse resistant than >> Mail::SpamCopURI for 2.63 is. >> >> If any spammer tries to start evading the URI RBLs by >stuffing with tons of >> garbage URIs it should be easy to detect them by doing a >rule that counts >> URIs in the eval tests. Even in this case, the existing code >will prevent >> that stuffing from resulting in an absurd number of queries. >> >So, for what people say, the DoS part is taken care of... > >What seems to be possible is an evasive attack by adding more and more >non-relevant URIs to a message so as that the spammy ones have a >larger chance of NOT being chosen randomly by the plugin... > >Maybe when I grow up and have more time and knowledge :-) I will take >the 3.0 plugin and see if the 'randomness' can be somehow >heuristically helped... that is, ignore invisible ones, give more >chances to domains that appear more than once, etc... > >Regards. > I *think* I remember the devs saying 3.0 will ignore blank (invisible) URL links. BUt that might have been a discussion on SARE or the SURBL list. The threads start to blur together sometimes :) --Chris [View Less]

1 0

Re: {SPAM} Re: SURBL DoS possible?
by Mariano Absatz 30 Jul '04

30 Jul '04

On Thu, 29 Jul 2004 17:27:00 -0400, Matt Kettler <mkettler(a)evi-inc.com> wrote: > At 04:48 PM 7/29/2004, Dougie Nisbet wrote: > > > It picks a random sample of URLs. This was one of the main concerns when we > > > started talking about this feature. We're always one step ahead of Mr. > > > Spammy ;) > > > >I'm not so sure :( > > > >I've just received a spam which has several embedded URLs. Each URL is based > >on the recipient's … [View More]name, in this case djn(a)highmoor.co.uk. So there's djn.org, > >djn.net, djn.com etc. At the the end there's the spam URL itself - > > A "random sample" is a bit of an over-simplified description of the > behavior, but is at least partly true. > > From looking at the source code itself, no true DoS is possible this way, > although it may be possible for a spammer to reduce their chances of being > checked. > > Disclaimer: I'm not a Perl programer, so my interpretation of the code's > behavior may be incorrect. However, clearly the code has limits to the > number of queries they will generate per email. > > Mail::SpamCopURI (the plugin for 2.63) has a hard coded limit the number of > URI's it will check. Once it hits that limit, it seems to ignore the rest > of the URIs in the email. I'm unsure if the build-order is sequential, > alphabetical, or random, but I suspect sequential. (This is as-of 0.18, I > haven't checked 0.19). You can check this yourself in SpamCopURI.pm. > > In SA 3.0-pre3, there is a limit defined by the config option > uridnsbl_max_domains. First, all the domains are extracted from the URIs of > the email and duplicates are removed. Then up to uridnsbl_max_domains are > randomly selected from the list. If there are fewer domains than the limit, > all of them should end up being selected. You can check this behavior in > lib/Mail/SpamAssassin/Plugin/URIDNSBL.pm. The default for this limit is > 20, so your example email didn't approach that limit. > > So both do have limits to prevent DoS's by generating tons of URI's. SA > 3.0's URIDNSBL code appears to be more abuse resistant than > Mail::SpamCopURI for 2.63 is. > > If any spammer tries to start evading the URI RBLs by stuffing with tons of > garbage URIs it should be easy to detect them by doing a rule that counts > URIs in the eval tests. Even in this case, the existing code will prevent > that stuffing from resulting in an absurd number of queries. > So, for what people say, the DoS part is taken care of... What seems to be possible is an evasive attack by adding more and more non-relevant URIs to a message so as that the spammy ones have a larger chance of NOT being chosen randomly by the plugin... Maybe when I grow up and have more time and knowledge :-) I will take the 3.0 plugin and see if the 'randomness' can be somehow heuristically helped... that is, ignore invisible ones, give more chances to domains that appear more than once, etc... Regards. -- Mariano Absatz - El Baby el (dot) baby (AT) gmail (dot) com el (punto) baby (ARROBA:@) gmail (punto) com [View Less]

1 0

RE: SURBL DoS possible?
by Chris Santerre 30 Jul '04

30 Jul '04

>-----Original Message----- >From: Mariano Absatz [mailto:el.baby@gmail.com] >Sent: Thursday, July 29, 2004 9:41 AM >To: SURBL discussion list; SpamAssassin users list >Subject: SURBL DoS possible? > > >I was wondering... > >I didn't look at the source code for the SpamCopURI or the SA 3.0 >plugin but I guess it just looks for URI's within the messages and >issues a DNS query to the configured SURBLs for every different >canonicalized domain name... is it? … [View More]

2 1

Re: SURBL DoS possible?
by Mariano Absatz 30 Jul '04

30 Jul '04

On Thu, 29 Jul 2004 09:24:31 -0500, Bob Apthorpe <apthorpe+sa(a)cynistar.net> wrote: > On Thu, 29 Jul 2004 10:40:44 -0300 Mariano Absatz <el.baby(a)gmail.com> wrote: > > > I was wondering... > [...] > > What would happen if a spammer intentionally starts putting hundreds > > of different invisible random URIs within the message trying to DoS > > SURBL? > > One can compensate for this by testing only a few, visible URIs, or > skipping the … [View More]

3 2

Fwd: Re: {SPAM} Re: SURBL DoS possible?
by Jeff Chan 29 Jul '04

29 Jul '04

This is a forwarded message From: Matt Kettler To: spamassassin-users Date: Thursday, July 29, 2004, 2:27:00 PM Subject: {SPAM} Re: SURBL DoS possible? ===8<==============Original message text=============== At 04:48 PM 7/29/2004, Dougie Nisbet wrote: > > It picks a random sample of URLs. This was one of the main concerns when we > > started talking about this feature. We're always one step ahead of Mr. > > Spammy ;) > >I'm not so sure :( > >I've just received … [View More]a spam which has several embedded URLs. Each URL is based >on the recipient's name, in this case djn(a)highmoor.co.uk. So there's djn.org, >djn.net, djn.com etc. At the the end there's the spam URL itself - A "random sample" is a bit of an over-simplified description of the behavior, but is at least partly true. From looking at the source code itself, no true DoS is possible this way, although it may be possible for a spammer to reduce their chances of being checked. Disclaimer: I'm not a Perl programer, so my interpretation of the code's behavior may be incorrect. However, clearly the code has limits to the number of queries they will generate per email. Mail::SpamCopURI (the plugin for 2.63) has a hard coded limit the number of URI's it will check. Once it hits that limit, it seems to ignore the rest of the URIs in the email. I'm unsure if the build-order is sequential, alphabetical, or random, but I suspect sequential. (This is as-of 0.18, I haven't checked 0.19). You can check this yourself in SpamCopURI.pm. In SA 3.0-pre3, there is a limit defined by the config option uridnsbl_max_domains. First, all the domains are extracted from the URIs of the email and duplicates are removed. Then up to uridnsbl_max_domains are randomly selected from the list. If there are fewer domains than the limit, all of them should end up being selected. You can check this behavior in lib/Mail/SpamAssassin/Plugin/URIDNSBL.pm. The default for this limit is 20, so your example email didn't approach that limit. So both do have limits to prevent DoS's by generating tons of URI's. SA 3.0's URIDNSBL code appears to be more abuse resistant than Mail::SpamCopURI for 2.63 is. If any spammer tries to start evading the URI RBLs by stuffing with tons of garbage URIs it should be easy to detect them by doing a rule that counts URIs in the eval tests. Even in this case, the existing code will prevent that stuffing from resulting in an absurd number of queries. ===8<===========End of original message text=========== [View Less]

1 0

SURBL DoS possible?
by Mariano Absatz 29 Jul '04

29 Jul '04

I was wondering... I didn't look at the source code for the SpamCopURI or the SA 3.0 plugin but I guess it just looks for URI's within the messages and issues a DNS query to the configured SURBLs for every different canonicalized domain name... is it? What would happen if a spammer intentionally starts putting hundreds of different invisible random URIs within the message trying to DoS SURBL? Does the SA plugins check for this condition? Or have a limit as to how many SURBL queries will it … [View More]

3 2

RE: [SURBL-Discuss] RFC: SURBL flyer
by Chris Santerre 29 Jul '04

29 Jul '04

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Thursday, July 29, 2004 4:09 AM >To: SURBL Discuss >Subject: Re: [SURBL-Discuss] RFC: SURBL flyer > > >On Thursday, July 29, 2004, 12:55:10 AM, John Andersen wrote: >> On Tuesday 27 July 2004 12:58 am, Jeff Chan wrote: >>> On Tuesday, July 27, 2004, 1:36:53 AM, Daniel Kleinsinger wrote: >>> > http://mailscanner.info >>> > MailScanner doesn't include or … [View More]

1 0

Re: [SURBL-Discuss] RFC: SURBL flyer
by Jeff Chan 29 Jul '04

29 Jul '04

On Thursday, July 29, 2004, 12:55:10 AM, John Andersen wrote: > On Tuesday 27 July 2004 12:58 am, Jeff Chan wrote: >> On Tuesday, July 27, 2004, 1:36:53 AM, Daniel Kleinsinger wrote: >> > http://mailscanner.info >> > MailScanner doesn't include or depend on SA (without SA one can still >> > check for viruses and do old fashioned RBL lookups), but the only way to >> > have MailScanner check SURBLs is to utilize its ability to call SA 2.63 >> … [View More]

3 2

[SURBL-Discuss] Re: ANNOUNCE: How to report false positives in ph anti-phishing list to MailSecurity
by Jeff Chan 29 Jul '04

29 Jul '04

On Tuesday, July 27, 2004, 11:44:54 PM, Rakesh Rakesh wrote: > And where to report domains to be blacklisted ? Currently there is no phishing reporting form, though one may eventually be forthcoming. Let's ask David Hooton of MailSecurity to clarify this if he can. Jeff C.

2 1

Praise for SURBL
by David Groce 29 Jul '04

29 Jul '04

After just one day of getting SURBL's to work in my SA 2.63 install, I can't say enough good things about it. I haven't been able to keep up with updating rules and spam was becoming a big problem again, more getting through then getting filtered. Until yesterday. To the people who thought this up, Thank you very much, you have made me and my ~1000 users very happy. David Groce CCNA Network Server Analyst/Coordinator North Kitsap School District

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss