Slashdot Mirror

← Back to Stories (view on slashdot.org)

Spamming Trojan "Proxy Guzu"

Posted by CmdrTaco on from the brekaing-the-law dept.

squiggleslash writes "El Reg has the scoop on a trojan that actually turns your machine into a spam sending proxy. Called "Proxy Guzu", the proxy arrives in your mailbox in the usual "Outlook virus" way (ie disguised as something else so you'll run it.) It then sends an email to a Hotmail email account reporting the IP address of the infected machine and port it's running on. The spammer then merely transmits spam to the infected machine which in turn forwards it on. There's a bright side to all this: Spammers are doing this because they're desperate, with fewer and fewer spam friendly havens. And what they're doing is illegal and opens them up for prosecution."

53 of 236 comments (clear)

  1. Uhh by cscx · · Score: 3, Insightful

    Hotmail disables said account. Case closed...?

    1. Re:Uhh by fidget42 · · Score: 4, Insightful

      After the spammer harvests IP addresses of newly opened relays. Case is still open...

      --
      The dogcow says "Moof!"
    2. Re:Uhh by Anonymous Coward · · Score: 2, Interesting

      If I were going to design this, I would make it look up freshly posted email addresses on some public forum that I had cleverly and anonymously posted, rather than some single fixed address. That way when the first one gets closed, I could post another. Or some other scheme along those lines.

    3. Re:Uhh by Anonymous Coward · · Score: 2, Funny

      Err, I'd have it post to somebody else's slashdot journal.

    4. Re:Uhh by sinergy · · Score: 5, Insightful

      The virus writer would have been smarter to send notices to IRC, or muliple email addresses. Or use broadcasts a la the SQL worm.

      More clever thought behind things like these would make them much more devistating.

      --
      ...
    5. Re:Uhh by pohl · · Score: 5, Funny

      Somewhere in the world, a virus author adds a couple of bullet points to his TODO file.

      --

      The "cue the foo posts in 3, 2, 1..." posts will commence with no subsequent foo posts in 3, 2, 1...

    6. Re:Uhh by jellomizer · · Score: 2

      Why not have Hotmail just disable all OutLook send e-mails. That way Microsft doesnt have to worry about getting Spamed thew their servers. By those virus prone MS Outlook application. With Microsoft backing up blocking Outlook sent email it could help change the directon of e-mail clients to the more efficient and virus free ones.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    7. Re:Uhh by Guppy06 · · Score: 2, Insightful

      "The virus writer would have been smarter to send notices to IRC, or muliple email addresses. Or use broadcasts a la the SQL worm."

      If the spammer had two braincells to rub together to figure that one out, would they be in the spam business to begin with?

    8. Re:Uhh by dougmc · · Score: 4, Insightful
      If the spammer had two braincells to rub together to figure that one out, would they be in the spam business to begin with?
      Possibly. Spammers do seem to make money, don't they? And there are many intelligent people out there who like money. Smart people do morally wrong things to make money just like dumb people do.

      The way to stop spam is to remove the profit motive. PEOPLE NEED TO STOP BUYING STUFF THAT THEY GET SPAMMED ABOUT! Once they stop, people will stop paying spammers to advertise their wares, and the spammers will then stop spamming.

      Yes, most spammers do seem pretty stupid. But if it makes money, and it's not illegal, many people, even smart people, have no problems with doing it even if it's morally reprehensible.

    9. Re:Uhh by dougmc · · Score: 3, Interesting
      Unclear. People participate enthusiastically in pyramid schemes that will never make money, even if the participants don't realize it. I would guess that at least some spammers make money.
      Remember a few years back when Rodona Garst's (a notorious spammer) computer was broken into? ICQ logs and such were taken from her computer, and they were very interesting reading -- and she seemed to make pretty good money spamming, and even had a team of people spamming for her.

      I suspect that it's pretty easy to make money spamming if you've got half a brain and some programming experience. You could write your own simple address-collection and spam-blasting programs in under a day, and then all you need is to find some customers -- and apparantly they're out there.

      If you're clueless and you spend a few hundred on somebody's CD of email addresses, and a few more hundred on a CD of spam software and don't know anything more about your computer than how to click on things, then you're right -- you're just going to make other spammers rich and not yourself -- and it's obvious that spammers are perfectly happy to prey upon other would-be spammers.

      There's definately a lot of `spam MLM' (MLM = Multi Level Marketing) going on -- but unlike your traditional MLM, there is money to be made outside of the MLM. Kind of like Amway -- yes, it's a MLM but they do sell a real product.

    10. Re:Uhh by jafuser · · Score: 2, Insightful

      This is a good page. I especially learned a lot from reading the ICQ Chat Logs.

      Sometimes I wonder if the companies who finally benefit from the spam even know just how scummy their sources are. If you read this chat log, you will see a guy, Jeff, is gathering leads for mortgage loans from a "very professional company".

      In situations like this, I wonder how effective it would be to subvert the spam network by using decoy identities to make contact with these companies and hold them liable for their sources so that the people responsible for setting up the chain of communication to the spammers will be fired.

      --
      Please consider making an automatic monthly recurring donation to the EFF
  2. Virus...? by MrNemesis · · Score: 3, Insightful

    Are there any AV vendors out there with fixes for this yet? I didn't see any in the article.

    --
    Moderation Total: -1 Troll, +3 Goat
    1. Re:Virus...? by Anonymous Coward · · Score: 2, Informative

      well here's at least one that seems to have sorted it

  3. Spammers doing something illegal?! by Anonymous Coward · · Score: 3, Funny

    I am shocked! They seemed like such good upstanding members of society.

  4. Proxies & broken e-mail by greyrax · · Score: 5, Insightful

    Great. First we have the trojan that downloads kiddie porn (has anyone else ever heard of this one?) and now this.

    Let's face it: SMTP is broken and it needs to be fixed. There has to be some way of authenticating senders and attachments to messages?

    I'm not talking about some of the (innovative) kludges that people have come up with for SMTP, I'm talking about a bare-metal rebuild of the entire system. Sure it will be a pain, but when you move to a new place, you have to give your friends the new phone number and address -- giving a new e-mail address (on the new e-mail system) won't be all that bad will it?

    1. Re:Proxies & broken e-mail by 42forty-two42 · · Score: 3, Insightful
      Let's face it: SMTP is broken and it needs to be fixed. There has to be some way of authenticating senders and attachments to messages?

      There is - it's called PGP. SMTP is only intended to transport mail, not to authenticate it. It's the client's job to determine if it should be accepted.
    2. Re:Proxies & broken e-mail by dasunt · · Score: 4, Insightful

      SMTP is broken? Maybe, but lets look at this logic.

      1. An email attachment pretends to be something it isn't, people click on it.
      2. The email attachment opens up a relay, sends email back to an hotmail account.
      3. Spammer uses email account to spam other email accounts.

      Now lets look at this with $SMTP+1 (With spiffy authentication).

      1. An email attachment arrives from a trusted source/new source. People click on it.
      2. The email attachment opens up a backdoor, sends email back to hotmail.
      3. Spammer uses email software on that machine to spam other machines. Since we have email authentication now, the other users either get "from a trusted source" (if they already knew the person) or "from a new source (Key matches Joe Outlook Idiot)".

      Yep, that sure fixed the problem.

    3. Re:Proxies & broken e-mail by mark_space2001 · · Score: 2, Interesting
      Let's face it: SMTP is broken and it needs to be fixed. There has to be some way of authenticating senders and attachments to messages?

      SMTP is not broken and does not need to be fixed. For example, this virus would never succeed on my windows system. First, my IP address, 10.0.0.11, would not be of much use to the spammer. (And if you know anything about networks, you know why, and why I can post it and not worry.)

      Second, in between my windows machine and the rest of the internet I have a firewall. THAT'S what really renders the virus moot. Nobody connects to any machine I have from the outside, period, ever. (Now of course there's ways to defeat a firewall, but that's also a much more difficult task.)

      SMTP is not the issue. Naked machines on the 'net and crappy mail readers are. If a virus can take control of your machine, what authentication process can you devise that the virus can't duplicate now that it has control of the very same program you use to send email in the first place?

      Even typing a password with every single email you send wouldn't work, because all a virus has to do is pop up a fake password box once, record what you type, and it can send all the authenticated email it wants. PGP and cookies don't help either, becuase that virus still has control of your machine. It can run your email program directly and just send mouse clicks to drive your email program. (Yes, this is done all the time for automated testing of windows programs.)

      Basically, what's really needed is to put some or all of these SOBs in jail. And technical measures like SECURITY are the ticket, not just SMTP. This must be automatic for home users--ISPs must get involved as well as MS (and desktop Linux) to ensure that home users are adequately protected. And Outlook should just plain be made illegal. Period. Scrub that POS off the hard drive and forget it.

      /rant

      Sorry if I went off too much there. Laters.

    4. Re:Proxies & broken e-mail by FyRE666 · · Score: 2, Informative

      SMTP is not broken and does not need to be fixed. For example, this virus would never succeed on my windows system. First, my IP address, 10.0.0.11, would not be of much use to the spammer. (And if you know anything about networks, you know why, and why I can post it and not worry.)

      Second, in between my windows machine and the rest of the internet I have a firewall. THAT'S what really renders the virus moot. Nobody connects to any machine I have from the outside, period, ever. (Now of course there's ways to defeat a firewall, but that's also a much more difficult task.)

      I'm sorry, but you're so unbelievably wrong here, it's difficult to know where to begin...

      Firstly, it doesn't matter what your machine's IP is on your local network; 10.x.x.x, 192.168.x.x or anything else. If your machine can reach the net, then (obviously) so can a piece of software running on your machine (ie, a virus).

      Secondly, you can have the best firewall in the world, but if a trusted host behind it is compromised then it's "game over". The attacker doesn't have to connect to your machine through your firewall. The compromised machine can connect out and initiate a backchannel - literally punching a hole through the firewall. This would normally be to an IRC server, but could be anywhere really, using any protocol allowed out by the firewall.

      So, to sum up; a firewall and local network is not going to protect a machine from a stupid user opening a virus on the machine.

      --
      Code, Hardware, stuff like that.
    5. Re:Proxies & broken e-mail by icedivr · · Score: 2, Informative
      First, my IP address, 10.0.0.11, would not be of much use to the spammer

      The executable might report your inside IP address, but the routable source IP would be visible within the headers the smtp server it connects to prepends to the message. Knowing this wouldn't get them thru your firewall, but they'd be one step closer.
    6. Re:Proxies & broken e-mail by satch89450 · · Score: 3, Informative
      Secondly, you can have the best firewall in the world, but if a trusted host behind it is compromised then it's "game over". The attacker doesn't have to connect to your machine through your firewall. The compromised machine can connect out and initiate a backchannel - literally punching a hole through the firewall. This would normally be to an IRC server, but could be anywhere really, using any protocol allowed out by the firewall.

      You are right, the spam-virus can try to initiate a connection to something on the other side. Of course, I don't forward smtp traffic, so a spam virus would find little happiness running on any of my computers, because it will find itself in a little jail -- and the discussion was a spamming SMTP zombie.

      No host behind my firewall is "trusted". One of the beauties of my firewall implementation is that perimeter protection is both ways: protect my computers from bad-boy Internet packets, and protect the Internet from any nastiness that might creep into my computer.

      That's the power provided by IPTABLES under Linux. I can filter traffic independently in both directions, using the stateful capabilities of IPTABLES, so that my sieve can handle in-bound SMTP separately from out-bound SMTP, passing one and blocking the other. And I do, because I can.

      (N.B.: that's not to take anything away from firewall products for Windows, Macintosh, BeOS, and other systems that implement stateful filtering. There are $50 software packages that afford the same protection, if you elect to use it. The problem, of course, is that a computer virus may be able to "sneak around" a same-system firewall implementation. That's why I like separate firewall computers, and firewall appliances such as the SonicWall. A virus would have to work very hard indeed then to get past the protection.)

      In short, my firewall does protect other machines on the Internet from a stupid user opening a virus on a local machine.

  5. Filter egress port 25!! by RT+Alec · · Score: 4, Informative

    If you are running a network, it behooves you to filter outgoing port 25. SMTP is a lousy protocol, and there is no successor to replace it (anytime soon).

    E-mail server admins: Please lock down your servers! Only allow initial mail submission by authorized and authenticated clients, and only allow such subissions on a port other than 25. It's not that tough, and it's your job. Do it.

    There, no excuses.

    1. Re:Filter egress port 25!! by Webmonger · · Score: 2, Insightful

      Why would it matter whether users submit their email on the standard SMTP port?

      I can see why you'd want to block port 25 outgoing on your firewall so no one can bypass your SMTP server, but configuring your SMTP server to accept mail on port 8025 or something... what's the point?

    2. Re:Filter egress port 25!! by Corvaith · · Score: 2

      But you don't seem to have explained, here, how that solves anything, really. As more places start doing that, more other places will start providing mail on nonstandard ports, and inevitably you'll end up with poorly-secured mail servers running on all *kinds* of ports.

      And not all of us using third-party email servers have any control how the admins of those servers set them up. The one I use--because my ISP server has been known to lose messages entirely--happens to operate on port 25. I am not able to just tell the people who run that server, despite being a paying customer, that they must operate on a nonstandard port just to please me. Most people--whether they are customers of other providers or employees using work emails--are not in a situation to arrange for different ports.

      So blocking outgoing traffic on port 25 blocks a good number of people from getting to servers they have a legitimate right to use, and a *few* people from spamming. And the spammers will quickly pick up an ISP that doesn't do this, so pretty soon you'll be left with *only* legitimate customers being inconvenienced.

      So why is blocking this port outgoing a good thing again?

      The idea is almost as dumb as the places that block ports outgoing that have been known--in the distant past--to have been used by trojans and the like, despite having a good number of valid and current uses. (MUDs are beginning to see some of this.) For whatever slim benefit it might provide, it's not in any way worth the hassle.

  6. Why not by shades66 · · Score: 2, Interesting

    find out the hotmail address and send it loads of dummy IP addresses...

    --
    ---- There are 10 types of people in the world. Those that understand binary and those that don't
  7. This isnt desperation... by acehole · · Score: 5, Funny

    Desperation is when they start selling the penis enlargers door to door.

    Seriously, has anyone actually *seen* one?

    --
    Be you Admins? nay, we are but lusers!
    1. Re:This isnt desperation... by WindBourne · · Score: 3, Funny

      The real question should be: has anybody bought one or had a girlfriend/significant other that gave them one.
      Now, you have problems.

      --
      I prefer the "u" in honour as it seems to be missing these days.
    2. Re:This isnt desperation... by tigress · · Score: 4, Funny

      Oh, they come in pills now. My boyfriend tried them out for a month and he gained an amazing eight inches to his penis. Unfortunately, he also gained two cupsizes, lost 60 pounds and started receiving NBC and FOX.

  8. I think I've seen something like this... by Saint+Aardvark · · Score: 5, Interesting
    I think I might have seen something like this. In my previous life as helpdesk/abuse guy at a small ISP, I was in charge of locking accounts for spamming. (Fortunately, it never happened very often.) So one day I get this complaint from SpamCop about a dialup customer of ours -- typical pr0n spam. Check the logs, find the account and lock it -- nothing that unusual, except for what happened next: the customer called in.

    See, almost any time we've had people spam before, it's been someone who has signed up for an unlimited dialup account, then goes and spams right away before they get cut off. It got to the point where I was able to guess that someone was going to do this when I was taking down their details for an account; this happened with someone signing up for this guy, and I locked the account before it was even active. This person, like every other spammer I'd dealt with, never called back: they knew exactly what they were doing, and what I would tell them. But this customer did.

    Furthermore, she was extremely convincing when she told me she knew nothing about spam. To all appearances she was nearly clueless about computers (no offense to her -- I'm sure I couldn't do her job), could not believe her computer had done anything wrong, and was offended by the spam her computer had sent when she saw the complaint from SpamCop. She didn't argue that it wasn't really spam, or say that she didn't know that it was wrong, or that everyone had opted in, or that it was just an experiment, or anything: she didn't know what she had done, and was confused and astounded when I told her. I ended up letting her back on, against my better judgement, with a warning that if it happened again I'd close her account and that would be that. We changed her password just to be sure that no one else was using her account; unfortunately, the modem she'd dialed in on didn't have caller ID, but she swore blind that no one else knew her password or used her computer.

    So a month goes by and I get another complaint from SpamCop -- and it turns out to be the same customer. "Teach me to be nice," I thought, and locked her account. Caller-ID was recorded this time, and it was her number. I told the guy at the branch office where she lived that I'd locked this customer's account -- he had dealt with her the last time -- and he gave her a call. Again, he was convinced that she couldn't be spamming, and he convinced me that we should at least look at her computer. We brought it in to the branch office for a look.

    Unfortunately, neither one of us really knew what to do beyond the obvious. It was running Windows 98, no updates; the guy at the office knew Windows, and I know Unix, but neither one of us had experience with this sort of thing. I did a portscan and found one port open (1234), but it the banner said "Express Search"; eventually found this link, which didn't seem to offer much. Meanwhile, the guy in the office ran Trend Micro's HouseCall and Panda's online virus scanner, and didn't find much of interest.

    He ended up reinstalling Windows on her computer, adding a firewall, doing all the updates, and letting her back on; we didn't know what else to do. We kept looking around for some mention of a virus or trojan with an SMTP engine (beyond something like Klez, I mean), but couldn't really find anything -- just lots of "This is weird, anyone seen anything like this?".

    Sorry to be so vague on the details, but like I said, I really don't know Windows and I'm really not a security guy. But I'm still fairly sure that either she was a wonderful actress, or some 133t haX0r had rooted her box to send spam. Needless to say, this is going to wreak havoc with anyone who has to be the abuse guy -- "Innocent victim of a virus or spammer scum? Hm..."

    ObRant: Fucking goddamned spammers anyway. Fuckwads.

    --
    Carousel is a lie!
    1. Re:I think I've seen something like this... by Saint+Aardvark · · Score: 3, Informative
      Sorry, express search link here:

      http://archives.neohapsis.com/archives/bugtraq/199 9-q4/0317.html

      And I meant to mention that the first incident was at the beginning of March this year, and the second at the beginning of April.

      --
      Carousel is a lie!
    2. Re:I think I've seen something like this... by Caveman+Og · · Score: 5, Informative

      Well, since I'm not only an abuse guy in a previous life, but also a present and future abuse guy (for big networks, even), I can give some further insight into this sort of thing.

      1234 seems appallingly close to one of the ports sub-7 uses (1243). I would suspect some sort of back-door root-shell, and BEHOLD (through the power of Google):

      http://www.itsecurity.com/asktecs/jun1901.htm
      h ttp://www.iss.net/security_center/advice/Exploits /Ports/1234/default.htm

      There are MANY trojans which use this port. "Ultors Trojan", is perhaps best known. There's also "SubSevenJavaclient". Nasty, nasty.

      UDP traffic on port 1234 is indicative of "Infoseek Search Agent", which is the legit use for this port. The trojans do not produce UDP traffic.

      Check out http://www.neohapsis.com/neolabs/neo-ports/

      I would think that your experience predates the current round of spammer-specific trojans. This is, however, only the tip of the iceberg. Spammers are now creating entire zombie IP address allocations from abandoned or otherwise unused network space. A spammer with his own ASN and spammer-controlled BGP can create ENDLESS havok.

      Zombies on the Register of Known Spam Operations:

      http://www.spamhaus.org/rokso/search.lasso?evide nc efile=2493

      Below are the lists of DIRECT ASNs owned or pirated by spammers, including many of the zombie netblocks:

      APNIC zombies
      http://spamhaus.org/sbl/listings.lasso?is p=apnic

      ARIN zombies and spammer allocations
      http://spamhaus.org/sbl/listings.lass o?isp=arin

      RIPE zombies and spammer allocations
      http://spamhaus.org/sbl/listings.lass o?isp=ripe

      --Og

  9. It opens them up to.... by sogoodsofarsowhat · · Score: 3, Funny

    (sees seens from commercial of guy getting on plane to go visit telemarketer in person) to a brutal beat down :) (one must also be careful of the submit button early on a sunday morning ... doh)

    --
    . I love the sound of burning women and screaming rubber....
  10. Untraceable? by Old+Uncle+Bill · · Score: 5, Informative

    "It's untraceable. I hate to put that in print, but it's the truth."

    So, if I'm running a sniffer while they are sending email through my PC I won't be able to find the source? I musta missed something in IP 101.

    --
    Yes, I am an agent of Satan, but my duties are largely ceremonial.
    1. Re:Untraceable? by Mike1024 · · Score: 3, Informative

      Hey,

      So, if I'm running a sniffer while they are sending email through my PC I won't be able to find the source?

      They could put a proxy function in. The spammer contacts one computer, and that computer contacts another. Thus the second computer couldn't locate the spammer, but any e-mail messages would only have the second computer's IP address.

      If they were really crafty, they could have a web-like feature. Each infecteed system could scrape web pages for, say, 15 e-mail addresses (Could use IE's cache), and port scan computers for 5 different computers with the virus. The spammer injects one message into the network, and the infected computer forwards it to all 5 on the list, which forward it to all the systems on it's list, and so on. One day later, the network switches to 'send' mode, and each node sends out the message to it's 15 e-mail addresses.

      A sort of Gnutella network + Code red port scanning + web page scraper + mail program virus.

      Of course, such a program would get zapped by port blockers and virus scanners pretty fast.

      Just my $0.02,

      Michael

      --
      "Goodness me, how unlike the FBI to abuse the trust of the American public." -- The Onion
  11. an ounce of prevention... by WegianWarrior · · Score: 2, Informative

    ...beats a pound of medication (or something like that - I'm not to good at english proverbs).

    Don't run attachments from mails if you don't trust the sender. Do get a firewall that lets you block both ways (ZoneAlarm from ZoneLabs is my free favorite).The result? You won't get caught by this trojan, and if you should break the first rule of thumb, the second won't turn your PC into a spam-factory.

    --
    Everything in the world is controlled by a small, evil group to which, unfortunately, no one you know belongs.
  12. No, don't limit the Internet! by fmaxwell · · Score: 4, Insightful

    If you are running a network, it behooves you to filter outgoing port 25.

    Why? So that I can't test to see if the spam I received came from an open relay? So that I am forced to answer confidential e-mail from client A through client Y's SMTP server when I am at client's Y's site?

    I agree that port 25 should be, by default, locked down on residential dial-up accounts (which spammers use as throwaway accounts), but don't lock it down everywhere. It breaks too many things.

    Only allow initial mail submission by authorized and authenticated clients, and only allow such subissions on a port other than 25.

    At the HELO/EHLO, an SMTP server doesn't know if the mail coming into it is "an initial mail submission" or just a message destined for an address served by that user.

    If you set up an SMTP server on a non-standard port, then no one's mail gets there. AOL is not going to talk to your server on port 20025.

    What happens when lots of mail servers are available on non-standard ports? Suddenly your port 25 block does not work any longer. Then the spammers will look for open relays on non-standard ports. You know that there will be a lot of them because there will be the "security through obscurity" crowd who believes that, because their SMTP server is running on port 31172, they can safely leave it open.

    You're headed in the right direction, but leave port 25 alone. My SMTP server is configured to require identification and authentication to send e-mail outside of my domain. All mail servers should be configured that way. This crap of allowing anyone to send e-mail without a username and password is ridiculous.

    1. Re:No, don't limit the Internet! by RT+Alec · · Score: 2, Insightful

      My suggestion is to leave port 25 open, but only to allow incoming mail from other SMTP servers-- and only for your local users (by definition, it will not relay mail). So how does a user relay mail (i.e. initial mail submission)? The responsible admin of the user's SMTP server has set up SMTP + AUTH + SSL on that server (or perhaps a different server altogether-- an even better idea). Now this user can send mail (i.e. relay mail, or use the server for initial mail submission-- different terms for the same thing in this case). However, other people (unauthorized people) cannot. Spammers may port scan to their heart's content, but will still be unable to relay any spam.

      My server is port scanned all the time. Many have found my port 465 open, and many have found that it is running an SMTP server with SSL. However, they don't have a user name and password, and thus their attempt to spam is blocked.

    2. Re:No, don't limit the Internet! by fmaxwell · · Score: 3, Informative

      They rarely spam directly from dialups because it's slow.

      Untrue -- and I run the domain anti-spam.org, so I know a bit about the problem. By using the BCC mechanism, they are able to find an open relay, send the message once and BCC a hundred or more recipients. The open relay SMTP server then sends a copy of the message to each BCC recipient. Thus, the spammers get bandwidth multiplication.

      It's a very good reason to block email from dynamic DSL and cable modem IPs.

      Now you're grasping at straws.

  13. Untraceable Really ?? by Crashmarik · · Score: 5, Insightful

    Every Spam is selling something. Someone is paying to have it sent out. Don't trace the spammers. Hit the advertisers. Subpoena for who they are paying to send out the stuff, and then go after them criminally.

    The people that actually have their capitol tied up in penis and breast enlargers, sure as heck don't want it seized.

    1. Re:Untraceable Really ?? by isomeme · · Score: 4, Insightful

      I suspect that in many cases there is no real product (or even 'real' company) behind the sleazier spams. The whole thing is a trick to get your money, and probably your CC number for further fun and games. After all, most people will be too embarrassed to complain to the cops that their penis enlargment pills never arrived.

      --
      When all you have is a hammer, everything looks like a skull.
  14. No, actually.. by Lord+Bitman · · Score: 2, Insightful

    This is more to say "Not everyone who gets blocked deserves it"
    Prove me wrong.

    --
    -- 'The' Lord and Master Bitman On High, Master Of All
  15. A simular program used by spammers... by Anonymous Coward · · Score: 2, Informative

    Is AnalogX Proxy, which is quite popular with spammers.

    As for the not traceable, well I wouldn't count that out. What if someone really knew what was happening, deiced to download, and isolate the program with the intent of finding them?

    Yes I know they could use anon proxys, but then there is the chance that the anon proxy is not an anon proxy. I wouldn't be surprised if just like honeypots fake anon proxys start popping up with the intent of catching their real ip.

    Only problem I see is that the spammers are willing to take the risk and also start using chains of proxys. But wouldn't doning that make things too slow?

  16. This spammer uses proxies by Animats · · Score: 5, Interesting
    The "girslwhocry" spammer I mentioned yesterday makes heavy use of proxy servers. The spams come from a large number of different IP addresses. Some of the IP addresses from which they send spam are running Telnet proxy servers which answer ordinary Telnet requests. Others, though, are DSL ports from all over the world. Here are some typical "received" lines:
    • Received: from cpe-203-51-210-143.qld.bigpond.net.au ([203.51.210.143] helo=downside.com)
    • Received: from dsl-200-78-25-58.prodigy.net.mx ([200.78.25.58] helo=downside.com)
    • Received: from kawij-aw-5452.mxs.adsl.euronet.nl ([212.129.212.82] helo=downside.com)
    • Received: from 80-24-219-243.uc.nombres.ttd.es ([80.24.219.243] helo=downside.com)
    • Received: from abn134-41.interaktif.net.tr ([195.174.134.41] helo=downside.com)
    • Received: from wd-c-68dd.mxs.adsl.euronet.nl ([62.234.136.221] helo=downside.com)
    • Received: from host-148-244-79-22.block.alestra.net.mx (HELO downside.com) (148.244.79.22)
    • Received: from elog-lab.ret.forthnet.gr (HELO downside.com) (193.92.145.218)

    Those are all from a sequential block of spam bounces that we received. Look at the locations: Spain, Greece, the Netherlands, Maylasia, Turkey. That has to be some kind of distributed attack.

    They're using our name. I operate Downside, a respected financial information site, and own "Downside" as a registered US trademark. I want to find out who's behind this. They're making us look bad. I get hate mail, because this spammer is advertising "extreme rape" sites.

    Insights on how they're doing this would be appreciated. If this spammer can be clearly tied to felony computer intrusions, that would give me something solid to give my attorney.

    1. Re:This spammer uses proxies by h00pla · · Score: 2, Informative
      Sounds like the same thing that happened to Linux Online

      --
      I've been swashdotted -- Elmer Fudd
  17. Re:OE Question. by Meowing · · Score: 3, Informative

    That's why they call them trojan horses. The recipient is told that the program will enable access to unlimited free prawns or a faster internet connection or some other crap along those lines.

  18. Does this virus affect Evolution? by TooLazyToLogon · · Score: 2, Funny

    or other Oulook like unix mail programs

  19. Re:I don't get The Register by AndrewRUK · · Score: 2, Informative

    They do mention it. At the top, where it says "By Kevin Poulsen, SecurityFocus", and at the bottom with "© [SecurityFocus logo]" as a link to www.securityfocus.com. Clearly you did read it, so how did you manage to miss that?

  20. Re:Activists vs. anti-spam crowd by etrnl · · Score: 3, Insightful

    No. The antispam crowd believes that it boils down to consent. It is fine for companies to send me newsletters... only if I have given them the permission to do so. If I have not given them permission, then it's UCE.

    There is a difference between CE and UCE, and only the latter is bad.

    Don't mix Stallman's ideas about commercial interests with the antispam crowd. None of us are as rabid as he is.

    --etrnl

  21. Have your attorney attack indirectly by ArsSineArtificio · · Score: 4, Insightful

    Why don't you have your attorney sue the proprietors of the 'extreme rape' sites, as well as parties unknown who act as their mass-mailing advertisers?

    Then, you can force the site admins to turn over their records during discovery, find out who exactly the spammers are, and go after them directly as well.

    ABW

    --
    All employees must wash hands before seeking equitable relief.
  22. How about outgoing spam filtering? by Nogami_Saeko · · Score: 2, Insightful

    Would it be possible to set an ISP's router to automatically re-direct any TCP packet with a port-25 destination through a spamassasin-type filter to check it before it continues it's journey?

    Basically having a router that intercepts anything going out to port 25 from any port and pre-check it before allowing it to continue on?

    N.

    --
    "Nothing strengthens authority so much as silence." - Charles de Gaulle
  23. Untraceable by httptech · · Score: 2, Informative
    "It's untraceable. I hate to put that in print, but it's the truth."

    If the spammer uses the proxy/trojan installed by Sobig.a which listens on port 1180 (socks) and 1182 (http), it's very traceable. You need only the password to the proxy management station (it's "zaq123") and you can watch the traffic or shut it down altogether.

    See this analysis of Sobig and Spam for more details.

    Of course, this MBIWYL (may be illegal where you live)

  24. Other Methods by NetGyver · · Score: 4, Interesting

    I've had a weird instance with email going out my mail client (Outlook, but I switched to Mozilla Mail now) without knowing it. Here's the story:

    1. Just opened up outlook and looked in the "sent" folder to re-read an email i sent to a friend.

    2. I find 4-5 emails that were mailed to addresses I never heard of, with the messages saying something to the effect of: "please remove me from your mailing list." (The messages were all identical to each other).

    3. This has only happened twice, and then stopped.
    I haven't found any more suspicious sent email in my "sent" folder.

    FYI: This is a personal computer, no one else uses it but me.

    Now, i don't send alot of email, and when I do I know who i sent it to. I also know not to write emails back to spammers even with a "remove from list" message enclosed, because it just sends the spammers the signal that my email account exists and is active, which results in even more spam. (so i've heard at least)

    Any idea what caused this?

    I've also heard that the main reasons one gets an email trojan is by clicking on a link in a email, or downloading/running an email attachment.

    I also know about "drive-by downloading" that happens while visiting websites. The next thing you know you got spyware coming out the ass because of this. (and of course certian programs sneakily install them as well.)

    My second question is, could it be possible for a website to install this trojan on your computer without you knowing it? I mean, they do it with spyware, I don't see why they couldn't do this with email trojans as well.

    --
    A Penny for my thoughts? Here's my two cents. I got ripped off!
  25. This IS traceable by Anonymous Coward · · Score: 2, Insightful

    1. The spammers are doing this because they get paid to do it.
    2. Someone is paying them; paying them to advertise a product and contact the payer (somehow) to sell a product.
    3. The person paying them knows who they paid to email this crap.
    4. If the email was sent via this trojan, just follow the trail from the email sent to the payer and, from there, to the spammer.

    Even if the spammer claims that someone else (riiiight) must have sent the trojans on their way, he got paid for it and should be levied with fines equal to (or greater than) the payment. A few cases of this should stop the use of this trojan.

    Actually, given that spammers would not be doing this unless they made money, why aren't the people who pay for spam to be delivered being held responsible for spam? They do it with drugs and prostitution.