Categories
Internet, Unix en security

Implementing RFC 2142 for beginners

I stumbled on a phishing site for a Dutch-bank in my junk-folder and for once I decided to have closer look to see if the filter was working correctly. Is was, but after reviewing the phishing site I saw two things and it was time to act.

The first one was the hosting service. It was a free hosting service so no defacing or whatever. That makes live very convenient for hosting a phishing site that looks pretty safe. The seconds was the use of a free hosting service for submit and collect forms. The funny part is btw, that the seconds appears to very if a certain tag is in the referral page, but doesn’t check if it really shows up. So to eliminate the inclusion in the webpage, the have added then after the closing HTML-tag. Maybe using XPath was a better design choice over just search for a certain string to enable the service.

As the form was asking for all kind of funny details to do perfect phishing I decide to report this to all involved parties. The site being phished, Rabobank in this case, the hoster T15.org and Formbuddy for processing phishing data. After so checking and didn’t found enough leads on alternative mail-addresses to report this I decide to use RFC 2142 reserved mail-addresses and the following happend.

<abuse@rabobank.nl>: host mail01.rabobank.nl[145.72.107.42] said: 550 #5.1.0
Address rejected. (in reply to RCPT TO command)

<security@rabobank.nl>: host mail01.rabobank.nl[145.72.107.42] said: 550 #5.1.0
Address rejected. (in reply to RCPT TO command)

<security@formbuddy.com>: host ASPMX.L.GOOGLE.com[74.125.79.27] said: 550-5.1.1
The email account that you tried to reach does not exist. Please try
550-5.1.1 double-checking the recipient’s email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596
d15si7088885eei.16 (in reply to RCPT TO command)

The one that worries me the most is that a bank appears to have no working mail-addresses as described in Section 4 of RFC 2142. Those are basically key for contacting parties in case of emergencies or trouble. The abuse-reject was already noticed by someone last year, but I really wonder how a /16 network can ignore this. Also since there is no abuse-c entry know for there /16.

Update 2012-01-06: The nice guys at T15.org have taken the website down within a few hours after reporting.