[SURBL-Discuss] Simon's complex redirection

[Justin Mason]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Simon Byrnand writes:
> Just spotted the following redirected URL in a spam. Doesn't look like it
> will be getting caught yet with the current redirector rules:
> 
> http://images.google.ca/imgres?imgurl=gmib.free.fr/viagra.jpg&imgrefurl=http://www.google.com/url?q=http://www.google.com/url?q=%68%74%74%70%3A%2F%2F%77%77%77%2E%65%78%70%61%67%65%2E%63%6F%6D%2F%6D%61%6E%67%65%72%33%32
> 
> Using images.google.ca as a redirector ? Thats a new one.... I'm not game
> to click on the link to see where it goes though... its from the same
> spammer that was blatently abusing the yahoo redirectors and msn ones...

it might work.  I won't check where it goes, just in case it confirms
your addr or similar ;)

it's a 3-level redirect:

    http://images.google.ca/imgres , redirecting to
    http://www.google.com/url , redirecting to
    http://www.google.com/url , encoded, redirecting to
    the real URL, encoded.

kind of pointless, since it's caught. (or should be at least.)
spamassassin -D -t gives:

debug: uri found: http://images.google.ca/imgres?imgurl=gmib.free.fr/viagra.jpg&imgrefurl=http://www.google.com/url?q=http://www.google.com/url?q=%68%74%74%70%3A%2F%2F%77%77%77%2E%65%78%70%61%67%65%2E%63%6F%6D%2F%6D%61%6E%67%65%72%33%32
debug: uri found: http://images.google.ca/imgres?imgurl=gmib.free.fr/viagra.jpg&imgrefurl=http://www.google.com/url?q=http://www.google.com/url?q=http%3A%2F%2Fwww.expage.com%2Fmanger32
debug: uri found: http://www.google.com/url?q=http://www.google.com/url?q=http%3A%2F%2Fwww.expage.com%2Fmanger32
debug: uri found: http://www.google.com/url?q=http%3A%2F%2Fwww.expage.com%2Fmanger32

It's double-encoded.  We can catch that easily.  But first, my question --
does this *work* in an MUA, ie. should we?  Simon, could you try it?

> Is this a sign that the current system used in SpamCopURI (checking HTTP
> responses of specifically mentioned redirectors) is just going to play
> catchup all the time ?

not this one, no ;)   it's handy though, they've tipped their hand
on this trick.

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFAjuLIQTcbUG5Y7woRAjKhAJ9n8U6QBCxzqkVNu9Huh2KY0FpFLwCfaaY5
BKiRX9NSPmBsX6V73ZRZll0=
=UNhw
-----END PGP SIGNATURE-----