Category Archives: Development

Python SDK for the RBLTracker REST API

Originally Posted on RBLTracker.

We’re extremely excited to announce the release of the office RBLTracker Python SDK. Developers can us this simple wrapper library to integrate all the features of the RBLTracker API into their existing processes.

Installation

The Python SDK can be installed via the Python package manager:

pip install rbltracker

Or if you prefer, you can clone the source code from the official GitHub repository.

API Access Token

To authenticate API requests, you must use the Account SID and Access Token, available from the Account -> API Access section of the RBLTracker Portal.

Example Usage

Using the Python SDK only requires a few lines of code. In this example, we’ll request a list of hosts from our account:

import rbltracker

try:
 client = rbltracker.Client('Your Account SID', 'Your Auth Token')

data = client.hosts.get();

except rbltracker.RBLTrackerException as err:
 print(err)

In this example, we’ll start a manual check process, using the real-time check features of the RBLTracker API:

import rbltracker

try:
 client = rbltracker.Client('Your Account SID', 'Your Auth Token')

data = client.check.start({

"host": "10.10.10.11",
 "callback": "https://your.website.com/callback.php",
 "details": 1
 });

except rbltracker.RBLTrackerException as err:
 print(err)

See our API Reference for a complete list of all the Python SDK features.

Net_DNS2 v1.4.3 – Interim Bugfix Release

I’ve released version 1.4.3 of the PEAR Net_DNS2 library- this release is primarily just bug fixes.

You can install it now through the command line PEAR installer:

pear install Net_DNS2

Or, you can also add it to your project using composer:

composer require pear/net_dns2

Version 1.4.3

  • fixed an issue when looking up . or com., when using the strict_query_mode flag.
  • fixed a bug in the caching logic where I was loading the content more than once per instance, when really I only need to do it once.
  • changed the Net_DNS2::sock array to use the SOCK_DGRAM and SOCK_STREAM defines, rather than the strings ‘tcp’ or ‘udp’.
  • fixed a bug in the Net_DNS2_Header and Net_DNS2_Question classes, where I was using the wrong bit-shift operators when parsing some of the values. This only became apparent when somebody was trying to use the CAA class (id 257); it was causing this to roll over to the next 8 bit value, and returning 1 (RR A) instead of the CAA class.
  • fixed a bug that occurs when a DNS lookup request times out, and then the same class is reused for a subsequent request. Because I’m caching the sockets, the timed out data could eventually come in, and end up being seen as the result for a subsequent lookup.
  • fixed a couple cases in NSAP.php where I was comparing a string to an integer.

Net_DNS2 v1.4.2 – SMIMEA and AVC Resource Records and SHA-256 SSHFP

I’ve released version 1.4.2 of the PEAR Net_DNS2 library- you can install it now through the command line PEAR installer:

pear install Net_DNS2

Or, you can also add it to your project using composer:

composer require pear/net_dns2

Version 1.4.2

  • changed the role for the README.md file to doc.
  • parse the resolv.conf options line; right now I just support the timeout and rotate options.
  • the options values only work if you set the new option use_resolv_options to true; this is to keep backwards compatibility.
  • added support for RFC 6594; support for SHA-256 and ECDSA in the SSHFP resource record.
  • added the SMIMEA resource record; this just extends the TLSA record.
  • added the AVC resource records; this just extends the TXT record.
  • added error and EDNS0 defines for DNS Cookies (RFC7873).
  • added EDNS0 defines to the lookup class.
  • dropped the Net_DNS2_Packet::formatIPv6() function; this was deprecated in v1.1.3.
  • re-wrote the Net_DNS2::expandIPv6() function. Based on testing, the new version is about twice as fast.

RBLTracker: Facebook Threat Exchange, New Website, and More!

After more than six month of design and development, we’ve launched a brand new version of the RBLTracker Blacklist Monitoring service and website. This release includes some long sought-after features, including a completely redesigned management portal, support for the Facebook Threat Exchange, and much much more.

New Management Portal

With a completely redesigned web portal, customers can easily manage all aspects of their RBLTracker account.

interface

Some key new features include:

  • Improved reporting and graphing features.
  • Additional payment options, including credit card payments, and auto-recharging account balances.
  • Easier management of accounts with large number of hosts.
  • Support for sub-accounts to split up account management roles for billing, development, and for read-only access users.
  • Support for contact groups by host, which allows custom alerting options by host.

Facebook Threat Exchange

threat_exchange_logosSupport for the new Facebook Threat Exchange service is now part of the standard RBLTracker monitoring process.

Facebook Threat Exchange is a shared network of malware and phishing attack targets, shared by a collaborative of social media and SaaS organizations, including Facebook, Pinterest, Tumblr, Dropbox, and Yahoo.

RBLTracker monitors your host IP addresses and domains, against data collected from sources like Facebook posts, Dropbox files, and Pinterest pins. If your domain or IP address was used to try and spread malware or viruses on any of the supported platforms, you’ll receive alerts from RBLTracker.

RBLTracker.com: Now with DNSSEC and TLSA

The RBLTracker domain is now signed with DNSSEC, and we’ve published the website certificate fingerprint via a TLSA record (also known as DANE), so that you can be 100% sure you’re interacting with the RBLTracker servers. dnssec

This can be validated through the Verisign Labs Test Tool.

What is DNSSEC, and why do I care?

The point of DNSSEC is to provide a way for DNS records to be trusted by whoever receives them. The key innovation of DNSSEC is the use of public key cryptography to ensure that DNS records are authentic.

DNSSEC not only allows a DNS server to prove the authenticity of the records it returns. It also allows the assertion of “non-existence of records”.

What about DANE, what’s that all about?

DANE, or “DNS-based Authentication of Named Entities”, is a way for domain and website owners to publish SSL certificate fingerprints, so that visitors can validate that the certificate being used on a website is valid for that site.

Over the last few years, there have been several security breaches with Certificate Signing Authorities (CA’s)- companies that sign certificates that you use for your secure website- allowing the issuance of certificates for domains, not owned by the domain owners.

Using DANE, you can define exactly which certificate or CA is valid for your website, restricting the ability for a would-be hacker to masquerade as your website, by gaining access to your CA.

This obviously only makes sense in tandem with DNSSEC, as you need to validate that the DNS information providing the certificate fingerprint is valid, and not modified along the way.

How can I tell if a site is using DNSSEC/DANE?

Until there is more mainstream support for DNSSEC/DANE- for example, building support for it directly in the OS layer and in web browsers- there is a great browser plugin by cz.nic, that will show you when a site is protected with DNSSEC and DANE.