Slashdot Mirror

The SpamTrackers wiki has a much lengthier, though still somewhat clueless description of the EvaPharmacy hijack:

http://www.spamtrackers.eu/wiki/index.php?title=My_Canadian_Pharmacy

It doesn't look like they run from RAM (the article claims they do, but whoever wrote it clearly doesn't understand UNIX filesystem semantics). What really happens is that they copy the binary in, run it, and delete it (thus they run from a linkless inode, but it's still on disk). It should be possible to get a copy of it from /proc//exe.

The Net-Chinese registrar in Taiwan has accepted a service contract to register over 1,000 software piracy sites. It is just this sort of widespread abuse for which legislation like this is needed.

For the last 5 days alone, see the pirate sites listed at http://rss.uribl.com/nic/NET_CHINESE_CO_LTD_.html

For over 1,000 examples in October/November check http://spamtrackers.eu/wiki/index.php/Net-Chinese

If the US can't ensure compliance at home, how can anyone expect to convince the Taiwanese piracy sponsors?

That's normally between 24 hours and 7 days

Just because something is customary doesn't mean it's mandatory. RFC1035 explicitly states TTL should be set to 0 (zero) if the "[Resource Record] can only be used for the transaction in progress, and should not be cached" or "for extremely volatile data."

The article you mention (which btw. seems to be a wikipedia invention)

Damn those Wikipedians! They've poisoned SecurityFocus, Whatis.com, The EU SPAM Trackers group, and even Google!

would be done with custom DNS anyway, otherwise it's easily blocked by the ISP setting its cache to ignore a TTL less than a couple of hours (as most do.. hell, my even my home DNS does that).

It would be done by setting your DNS record (yes, a DNS RR you are responsible for) to have a short TTL. Not a custom DNS server, just administrative rights to the DNS record associated with one or more resources. And if, by setting the TTL to a low value, I tell you that my DNS record is going to be quite volatile, you can disagree with me all you want (by "ignor[ing] a TTL less than a couple of hours"), but don't be surprised when your cache goes stale.

Gosh, I wish I could live in the world you live in, with deathless and ultrastable interfaces and static network architectures. You could probably get by with just a really big "hosts" file. But out in the real world, sometimes you need short DNS TTLs for stuff like warm-failover high-availability architectures.

The "Canadian Pharmacy" in question appears to be this one according to spamtrackers:

http://spamtrackers.eu/wiki/index.php?title=Canadian_Pharmacy

Lots of good info including sponsoring registrars & nameserver info at the spamtrackers site for the adventurous souls out there.

It's the registrars who have the power to knock hundreds - even thousands - of spam sites off their perches in one shot, and in response to one complaint. You can see its success rate there.

Where is all this spam abuse people talk about in Google Blogger aka Blogspot?

First of all, anyone who has a Gmail account can create a blog. If I want to create 10,000 blogs to use for spam site redirection, I need to get 10,000 Gmail accounts. That way, when Google tries to communicate about 1 of those 10,000 sites, they will have to go to 1 out of 10,000 accounts. In the last resort, they may terminate the Blog site, and the Gmail account. 1 in 10,000 is not too bad.

So where do I get 10,000 Gmail accounts? Well, heck, that ain't hard. Some enterprising turkey called "William Lim" is selling any number up to 10 Million Gmail accounts over there in the spammer haven, BulkerForum. 10,000 is only a small portion of his portfolio.

Then I have a simple automation tool that cycles to the next one of my list of 10,000 Gmail accounts, logs in, auto-creates a site, and puts in an obfuscated java script that redirects to a spam brand, like "Canadian" Pharmacy - you know, that well documented fake pharmacy using a domain name registered in China, running on a web server in Korea, and if it ships any counterfeit pills or placebos at all, they come from India. Your credit card details and payments go to the herders in Russia, and a month later you find your details have been used to order more domain names.

So you think Google doesn't know all this? Yeah, right. You can see the rate of abuse in the site that builds a list of spamvertized blogspot URLs as they land in the spam-traps. We are talking 600-1000 abuses of the Blogspot terms of service per day. That's about one every 3 or 4 minutes, 24/7!

The abuse list for the last 5 days is updated in real time and is at the URIBL blogspot tracking site

You can even compare how the competitors, Yahoo (Geocities) and Lycos (Tripod) who have been equally abused at the same rate, are performing in handling this issue. The comparison is in the statistics for the blog site hosters

see the Spam Trackers wiki for a detailed explanation
http://spamtrackers.eu/wiki/index.php?title=Fast-flux

Is there any effective methods of fighting back against identity theves?

The tactic that I've recently started involved visiting the sites found in spam e-mails that I receive (for example, the My Canadian Pharmacy series of spams), take an identity generated from a fake name generator (that also provides CC and CVV numbers), and place an order. This series of companies tends to queue up the order for processing in 24 hours before shipping.

While fun, it doesn't seem directly productive if I'm the only one doing it (or using a modified Lad Vampire). Thus, is there some other method I can use?