Discuss

discuss@lists.surbl.org

1 participants
1867 discussions

RE: ZDNET redirecting to spammer websites?
by Chris Santerre 22 Mar '05

22 Mar '05

>-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Tuesday, March 22, 2005 7:23 AM >To: users(a)spamassassin.apache.org; SURBL Discuss >Subject: Re: ZDNET redirecting to spammer websites? > > >On Tuesday, March 22, 2005, 4:13:33 AM, Bobby Rose wrote: >> Even though zdnet.com shouldn't be in SURBL, wouldn't having >> chkpt.zdnet.com (the actually site doing the redirect) be in SURBL? > >Good thought, but there are two problems with that: > >1. SURBLs usually list only registered domains like zdnet.com >and not subdomains. Obviously we're not going to blacklist >zdnet.com; it has too many legitimate uses. > >2. Similarly we can't list chkpt.zdnet.com. It's being abused, >but it clearly has legitimate uses too. > C&C warning. I agree with Jeff :) However I don't agree with a new mechanism in SA for scanning being the solution. ZDnet needs to shut this down and secure it. End of story. Even with a simple rule for SA you can tag it, but that doesn't help the people who don't use SA and will be fooled into installing malware thru this redirect. It has to be fixed. Its already been too long. --Chris

1 0

RE: ZDNET redirecting to spammer websites?
by Rose, Bobby 22 Mar '05

22 Mar '05

Even though zdnet.com shouldn't be in SURBL, wouldn't having chkpt.zdnet.com (the actually site doing the redirect) be in SURBL? -----Original Message----- From: Jeff Chan [mailto:jeffc@surbl.org] Sent: Tuesday, March 22, 2005 12:38 AM To: users(a)spamassassin.apache.org Cc: SURBL Discuss Subject: Re: ZDNET redirecting to spammer websites? On Monday, March 21, 2005, 11:32:45 AM, Bobby Rose wrote: > Wouldn't this just be something that SURBL should take care of? If > this URL is the source of spam then it should be in SURBL regardless > if it's in the zdnet.com domain. Right!? Which domain are you referring to? zdnet.com should not be in SURBLs because it has too many legitimate uses. If we listed zdnet.com that would surely result in false positives. On the other hand viags.com and simply-rx.net should be listed in SURBLs, *and they are*. What's needed is for applications like SpamAssassin to parse the redirection correctly and check both zdnet.com and viags.com. zdnet.com should not match SURBLs, but viags.com should. QED. Jeff C. __ > -----Original Message----- > From: Rosenbaum, Larry M. [mailto:rosenbaumlm@ornl.gov] > Sent: Monday, March 21, 2005 10:35 AM > To: users(a)spamassassin.apache.org > Subject: ZDNET redirecting to spammer websites? > We received a drug spam containing the following URL: > http://chkpt.zdnet.com/chkpt/supposedtoallow/fdl%2ev%69%61%67%73.co%6d > /p > /b/kmioa > This URL will actually take you to fdl.viags.com (which then goes to > www.simply-rx.net). As far as I know, the SA SURBL check will check > zdnet.com, not the spammer domain viags.com. What is going on here, > and what should we do about it? > Larry Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

2 1

Re: ZDNET redirecting to spammer websites?
by Frank Ellermann 22 Mar '05

22 Mar '05

Jeff Chan wrote: > What's needed is for applications like SpamAssassin to parse > the redirection correctly That's very near to the point where it could outsmart itself. There's no general rule to identify redirections in URLs, I'd try to stay away from it. Bye, Frank

1 0

New redirector: www.nate.com
by David B Funk 22 Mar '05

22 Mar '05

Ugg, just ran across another open redirector abused in spam www.nate.com/r/XY12/target.domain where XY12 seems to be any combination of 4 letters and digits. Looks like some Korean ISP thingie. -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{

3 2

Re: ZDNET redirecting to spammer websites?
by Jeff Chan 22 Mar '05

22 Mar '05

On Monday, March 21, 2005, 11:32:45 AM, Bobby Rose wrote: > Wouldn't this just be something that SURBL should take care of? If this > URL is the source of spam then it should be in SURBL regardless if it's > in the zdnet.com domain. Right!? Which domain are you referring to? zdnet.com should not be in SURBLs because it has too many legitimate uses. If we listed zdnet.com that would surely result in false positives. On the other hand viags.com and simply-rx.net should be listed in SURBLs, *and they are*. What's needed is for applications like SpamAssassin to parse the redirection correctly and check both zdnet.com and viags.com. zdnet.com should not match SURBLs, but viags.com should. QED. Jeff C. __ > -----Original Message----- > From: Rosenbaum, Larry M. [mailto:rosenbaumlm@ornl.gov] > Sent: Monday, March 21, 2005 10:35 AM > To: users(a)spamassassin.apache.org > Subject: ZDNET redirecting to spammer websites? > We received a drug spam containing the following URL: > http://chkpt.zdnet.com/chkpt/supposedtoallow/fdl%2ev%69%61%67%73.co%6d/p > /b/kmioa > This URL will actually take you to fdl.viags.com (which then goes to > www.simply-rx.net). As far as I know, the SA SURBL check will check > zdnet.com, not the spammer domain viags.com. What is going on here, and > what should we do about it? > Larry Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

RE: HELP: RE: [SURBL-Discuss] ZDnet redirector still open.
by Chris Santerre 22 Mar '05

22 Mar '05

Well its been a week since the first report. Emails to the media have begun. --Chris >-----Original Message----- >From: Jeff Chan [mailto:jeffc@surbl.org] >Sent: Friday, March 18, 2005 11:27 PM >To: SURBL Discuss >Subject: Re: HELP: RE: [SURBL-Discuss] ZDnet redirector still open. > > >On Friday, March 18, 2005, 8:41:13 AM, Chris Santerre wrote: >>>From: Alex Broens [mailto:surbl@alexb.ch] > >>>Jeff, >>> >>>Could you pls make some extra noise so this hole gets closed. >>> >>>- or do we need to run an international press release? - or >maybe some >>>extra pressure via Slashdot? >>> >>>Alex > >> Maybe their competitors would like to run a story on it :) I >know someone on >> SPAM-L list was trying to get it removed. Lets see what they say. > >Before calling the media, let's give cnet a week to fix it. >If it's not fixed by then, we can bring it up with them >again. > >Jeff C. >-- >"If it appears in hams, then don't list it." > >_______________________________________________ >Discuss mailing list >Discuss(a)lists.surbl.org >http://lists.surbl.org/mailman/listinfo/discuss >

2 1

RE: REDIRECTOR: chkpt.zdnet.com
by Chris Santerre 21 Mar '05

21 Mar '05

It makes more sense to email him direct. Too bad I can't find he email anywhere! I guess its time to start telling the media about this open redirect. Oh well, we gave them fair amount of time. --Chris >-----Original Message----- >From: Rob McEwen [mailto:rob@powerviewsystems.com] >Sent: Monday, March 21, 2005 11:11 AM >To: discuss(a)lists.surbl.org; users(a)spamassassin.apache.org >Subject: Re: REDIRECTOR: chkpt.zdnet.com > > >(I've sent this to both SA & SURBL) > >There has been much fuss about ZDNet being slow or >unresponsive about fixing >open redirects. > >I have a suggestion. > >Someone ought to post a message on John Dvorak's blog. I did a >search to >find the most recent post on his blog relating to spam to find the best >place to post. > >Therefore, someone please go here and post a message to him to get this >message across: > >http://www.dvorak.org/blog/?p=1437 > >(I'd do it myself but I just got over the flu and I'm severely >behind in my >work. Also, I think that someone with more "pull" than me out >to do this... >someone like Chris or Jeff. Plus, Dvorak will recognize my >name from other >very unrelated topics that I've posted on his blog in the past and I >wouldn't want to confuse issues with him by using my name.) > >Rob McEwen >PowerView Systems > >

2 1

REDIRECTOR: chkpt.zdnet.com
by Alex Broens 21 Mar '05

21 Mar '05

Guys, Does somebody know someone at ZDnet This looks like a new redir. <center> <a href=http://chkpt.zdnet.com/chkpt/wenot/fvguug%2ere%74ai%6c%62%6C%6f%77s.co… target=_blank>CL1CCK HERE TO 0RDER or</a> </center> => http://chkpt.zdnet.com/chkpt/wenot/fvguug.retailblows. com/ Alex

4 5

HELP: RE: [SURBL-Discuss] ZDnet redirector still open.
by Chris Santerre 19 Mar '05

19 Mar '05

>-----Original Message----- >From: Alex Broens [mailto:surbl@alexb.ch] >Sent: Friday, March 18, 2005 9:36 AM >To: SUBL List >Subject: [SURBL-Discuss] ZDnet redirector still open. > > >Jeff, > >Could you pls make some extra noise so this hole gets closed. > >- or do we need to run an international press release? - or maybe some >extra pressure via Slashdot? > >Alex Maybe their competitors would like to run a story on it :) I know someone on SPAM-L list was trying to get it removed. Lets see what they say. I just dismantled an entire rack while everything was live. Boy was that fun! --Chris

3 2

ZDnet redirector still open.
by Alex Broens 18 Mar '05

18 Mar '05

Jeff, Could you pls make some extra noise so this hole gets closed. - or do we need to run an international press release? - or maybe some extra pressure via Slashdot? Alex

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss