Daily Archives: February 21, 2005

It sounds like a belch you’re trying to suppress, but SURBL is actually a pretty cool spam/phish-blocking tool. I think “phishing” is probably a term familiar primarily to tech weenies, so I’ll give here the description provided at antiphishing.org: “Phishing attacks use ‘spoofed’ e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc.” In other words, all those emails you get from PayPal and Citibank and other financial organizations you have no affiliation whatsoever with telling you that you need to log in and provide your credit card number in order to avoid fraud are in fact from fraudulent sites. You can read more on phishing (and pretty much anything else) at WikiPedia.

Surbl.org provides a pretty cool system for testing whether or not sites are phishing sites. The system uses DNS to offload lookups onto an existing robust distributed network that’s pretty much never going to be down. This keeps surbl.org from having to maintain their own huge infrastructure to manage all the traffic they stand to get. The basic mechanism is that when you’ve found a possible phishing site (a link in a questionable email, for example), you prefix the domain to one of several possible surbl.org domains. For example, sc.surbl.org does a lookup against SpamCop’s blocklist database. Probably the most useful surbl.org domain is multi.surbl.org, which appears to aggregate results from all the lists. So for example, if I get an email with xxx.yyy.com listed as a domain, I’d do a lookup on xxx.yyy.com.multi.surbl.org. If the query returns an NXDOMAIN result, the domain’s not on any of the lists. If it returns an IP (it’ll be a 127.0.0.* IP), it’s on one of the lists and should be considered not fit for consumption. Of the following two queries I ran, the first isn’t listed as a phishing site, but the second one is:

[houston@localhost daryl.learnhouston.com]$ nslookup confirm.keydataonline.net.multi.surbl.org
Server:         69.1.30.34
Address:        69.1.30.34#53

** server can't find confirm.keydataonline.net.multi.surbl.org: NXDOMAIN

[houston@localhost daryl.learnhouston.com]$ nslookup 80.248.127.210.multi.surbl.org
Server:         69.1.30.34
Address:        69.1.30.34#53

Non-authoritative answer:
Name:   80.248.127.210.multi.surbl.org
Address: 127.0.0.12

If you’re testing an IP address (phishing emails often use these rather than domains but mask the IP in the status bar so that it actually looks to less savvy users as if the link is pointing to a valid site), you have to reverse it before sending the query. The actual IP address that appeared in my email for the query above was 210.127.248.80.

Of course, this isn’t very practical or user-friendly. Even as a pretty savvy user, I’m not going to go do this query before reading each suspicious email (luckily, I have a pretty good nose for phish anyway), and, surely, less savvy users can’t be expected to use a tool like nslookup to do these queries. The info is provided really for those who would write tools to tap into it and make reading email safer. An enterprising programmer might write an extension for Thunderbird, for example, that does this lookup for any links in an email and changes the appearance of the email if a positive result is returned so that it’s obvious that the email is a phishing attempt.

When I first began reading about the mechanism surbl.org provides, I thought it seemed awfully clunky and sort of jury-rigged. And in a way, it is. But it’s also ingenius in its piggybacking on top of DNS, and as scalability is one of my hot issues right now, I found this very interesting. Continue reading →