On The Trail Of Super-Zonda

Dynamoo writes "BBC Radio 4 has been on the trail of the notorious Super-Zonda spammers and crackers, according to this article. Super-Zonda's trick is to find insecure hosts and pressgang them into webservers for mail order brides, viagra and other spam favorites. In this case a server is traced back to a hacked machine at a major international airline. The BBC investigate some of the people allegedly behind the spam in an investigation starting on the Spamhaus houseboat in London and ending in the Netherlands via Moscow. The BBC point the finger at Martijn Bevelander of MegaProvider as being not the innocent party he seems. The BBC provide some evidence to back this up, and are not known for rash accusations."

Comments

Open HTTP Proxies

[kiolbasa]

The trick they use, as I understand it, is to rig their DNS servers to respond differently based on the IP address querying the spammed domains. The DNS responds with the address of an open HTTP proxy normally, and when the open HTTP proxy does the lookup, it gets a different address - the spammer's webserver. That webserver then only responds to those open proxies. The moral of the story is to be more careful when you put any proxy on the internet.

Re:Hate the sin, Love the sinner

[ShaiHulud-23]

Oft-quoted blurb from NYTimes article "Tangled up in Spam" (PDF) by James Gleick:

Many people who hate spam believe, honorably enough, that it's protected as free speech. It is not. The Supreme Court has made clear that individuals may preserve a threshold of privacy. ''Nothing in the Constitution compels us to listen to or view any unwanted communication, whatever its merit,'' wrote Chief Justice Warren Burger in a 1970 decision. ''We therefore categorically reject the argument that a vendor has a right under the Constitution or otherwise to send unwanted material into the home of another.''

Re:Hooray!: inaccurate though

[Anonymous Coward]

First, it was not a "hacked" web server.
Second, it appears that Super-Zonda just recently moved the actual host (well, it too was a proxy) to CyberAngels (they had been on servepath.com for a long time, then ev1 [I think it was] for a weekend, then ...

The spammer uses network scanning tools to find an open web proxy. A system where, with the proxy located at {PROXY_IP} as its IP address,

telnet {PROXY_IP} 80
GET / HTTP/1.1
Host: www.nytimes.com

gets the front page of the NY Times.

He then does the following.

He uses something like the following:

telnet {PROXY_IP} 80
GET / HTTP/1.1
Host: [a_hostname_of_his_own]

and looks at his nameserver's records to see whence came a request to resolve his hostname. Now he knows the location of the nameserver/resolver used by the open proxy. He does this a few times (the proxy may use several nameservers - just as in configuring your windows system for the 'net, you enter two nameservers in the settings). He also checks at his web server to see whence comes the connection (the proxy may or may not make its outgoing connections using the same IP address).

Now he sets his nameserver to do the following:

1: It responds to requests to resolve his spam site which come from the nameserver(s) used by the proxy with the correct IP address (of his spam site).

2: It responds to ANYONE else with the IP address of the open web proxy.

He then sets up his web server itself to drop all packets to port 80 (maybe to all other ports as well) EXCEPT packets to his port 80 *which come from the abused proxy*.

The result? Everyone resolves his spamvertized host to the abused, hacked, illegally accessed web proxy and sends HTTP packets thither. That server/proxy attempts to get and serve up the pages by getting the IP address from its resolver which then gets the IP address of the hacker/spammer's actual site and accesses it and gets the page to return to the victim. Even if one happens to guess at the location of the actual spammer's machine, one cannot verify it since it appears dead to anyone except the proxy.

The trick to locating him is to find out what resolver the proxy is using and have your resolver, nslookup or dig in Linux, say, do a lookup, but not via your ISP's nameserver - instead use the proxy's nameserver/resolver. Then you find whence the proxy got what it served up.

[By the way, this is a pro-spam operation and the spammer's site may host some clients' stuff and in some cases, at least, it actually proxies the pages from another site.]

It is not a matter of the spammer "hacking" anything. It is simply his hijacking web servers which serve as proxies but which allow anyone to use them as proxies.

Why "super-zonda"? The names he used for his nameservers were ns1.super-zonda.com, etc. For other spamertized domains he registered different names for the nameservers, but they were located at the same IP addresses/locations.

One of the web servers/open proxies he hijacked was a British Airways travel shop server. He also hijacked a mideast bank web server. A K12 server in Colorado, I think it was. Several in Korea. He would spam for many clients at once, hijacking several web servers (one for every one or two of the hostnames).

The article on the BBC says:

"When Paul and Matt looked up which computer the website was using to host its service, the IP address belonged to British Airways."

Wrong. That was what it appeared to be. The pages were not there.
That site was proxying them.

BBC funding

[evilandi]

Their satelite channels run adverts as well

The channels aimed at British audiences (ie. for those who pay the licence fee) do not carry adverts. These are BBC1, 2, 3, 4, Children's BBC, CBebbies (for toddlers), News 24 and BBC Parliament. Same goes for audio services Radio 1,2,3,4,5,6,7, Asian Network, BBC Cymru (Welsh language), BBC Local Radio etc. These are almost entirely funded by the licence fee.

In the case of advert-free satellite signals these are quite literally "aimed"; the BBC broadcast advert-free from a satellite with tight coverage of the UK mainland with only very minimal bleed into the rest of Europe.

The channels aimed at international audiences (ie. for those who do not pay the licence fee) are funded by a mixture of foriegn office taxpayer's money, adverts and in some cases subscriptions. These include BBC World, BBC Prime and BBC America and are handled by a slightly seperate commerical company called BBC Worldwide and are broadcast on a number of satellites with coverage for most countries.

The international audio stations such as BBC World Service and BBC English By Radio are funded solely by the foreign office (similar to the funding for the Voice of America).

British viewers can also see BBC programming on non-BBC channels with advertising such as S4C (Welsh language), UK Gold (comedy & soap repeats) and UK History (documentary repeats). Some of these channels are entirely funded by advertising, some also have small injections from various government departments such as the Welsh Office, Scottish Office and European Union, in the case of regional language programming such as Welsh or Scots Gaelic. For instance, the popular Welsh soap opera Pobl Y Cum (Valley People) is made by the BBC but broadcast on independent station S4C supported by both advertising and government funding [PDF, Welsh and English].