Spammers Using Hacked Machines as Decoys

avi33 writes "This Wired story shows a disturbing alliance between hackers [sic] and spammers. Interestingly, they blame part of the alliance on market forces, leading some skilled engineers to the dark side for profit's sake. A Polish firm claims to have control of 450,000 Trojaned systems that it uses to mask the IP addresses of its hosted sites. In other words, you could host your Viagra-peddling site with a company that has a stringent no-spam policy, but a DNS lookup will point to a home user's compromised machine. Not quite bulletproof, but certainly ups the ante in the spam war."

Comments

Firewall

[JohnGrahamCumming]

Of course if broadband ISPs were to implementing a simple inbound firewall
for every user then they'd eliminate most of these problems overnight:
trojaned machines would be unreachable, worms like CodeRed that scan for
vulnerabilities would be halted.

The few users of broadband who actually need to run an Internet visible
server would then have to contact their ISP for a port to be opened, but
that seems like a small price to pay for cutting off 1000s of machines that
have been hacked.

Naturally, this would cause file steal^H^H^H^Hharing applications to stop
working.

John.

Re:Firewall

[vasqzr]

Our ISP (Charter Communications) does block the common ports, but they don't/shouldn't block EVERYTHING. People would go nuts if every port was blocked except 80, for example. Then they'd all drop cable connections and go back to dial up and the Internet would be screwed.

The few users of broadband who actually need to run an Internet visible
server would then have to contact their ISP for a port to be opened, but
that seems like a small price to pay for cutting off 1000s of machines that
have been hacked.

Re:Firewall

[Frostalicious]

an Internet visible server would then have to contact their ISP for a port to be opened

Considering the quality of customer service at my ISP, I'd better hurry up and request an open port for my Duke Nukem Forever server to be up in time.

Re:Firewall

[loknor]

Yes and it is worth the jump backwards in technology to help OS manufacturers continue to pedal sub par product and services that are the real cause of the problem. Attacking a problem at somewhere other than its source has always been such a great way to deal with challenges like this.

Re:Firewall

[geoffspear]

Or ISPs could just ban Windows machines from their network, which would have the same effect without inconveniencing people with real computers.

Re:Firewall

[stratjakt]

That doesn't mean shit. If you get a trojan somehow, you're machine will connect to the hacker (usually joining an irc channel or something similar).

Cutting off inbound ports wouldn't do jack.

Re:Firewall

[Carnildo]

The problem with putting in an inbound firewall is people running game servers. ISPs and game companies would get deluged by clueless users wanting to know why they can't set up a game of Duke Quakem or whatever.

Re:Firewall

[fractalus]

This actually would block quite a few things.

1. Personal web servers. Given the quality of most of these sites, probably not a great loss.

2. Game servers. No more running a CounterStrike servers for your buddies.

3. IM file transfers (AIM, ICQ). These require open ports.

4. VoIP, unless that VoIP implementation routes connections through a third computer.

The problem is, when you advocate blocking inbound connections, you force the bulk of the net to only be passive consumers of prepackaged content, rather than equal participants in the net. Blocking specific ports for specific reasons (like outbound port 25, although that has problems too) is one thing, but just deciding everything should be blocked but "approved" stuff means a lot of apps are dead in their tracks... stuff that isn't web/mail.

Re:Firewall

[Anonymous Coward]

Right on brother! Mod this UP!

Re:Firewall

[Shamashmuddamiq]

I'm all for ISPs performing automatic blocking as long as the user has the option of opening all ports. I wish ISPs would charge, say, an extra $5/month for users that want no port blocking. I just bought a house and am moving into a neighborhood that has no DSL. That means that (1) if I get cable, I can't run my services (here in Indianapolis, all the cable companies do port blocking), and (2) if I get satellite, it's really expensive and I can't play the RTS games I always enjoyed. I LIKE running my low-traffic mail, http, and ssh servers. I LIKE being able to do nerdy stuff like accessing my computer from the remote world without having to do all kinds of port redirecting. I don't care what measures the ISP takes to make sure I'm not spamming my neighbors, just as long as they don't take away my basic capabilities. If they want to do relay tests on my machine once a day or limit my outgoing SMTP traffic, then fine. But I'd like to buy an *INTERNET CONNECTION*, and I like to do more than use my connection to look at advertisments.

Re:Firewall

[Karamchand]

Of course one can continue this: The real problem aren't the broken OSs, but the computers. Or the internet itself. Or whatever.

. If you want to attack the real cause of a problem you will have to assassinate every single human being. Because human being have the property to make problems.

Re:Firewall

[cmowire]

And also prevent the eventual proliferation of any applications built around running a personal server on your household computing devices.

Re:Firewall

[JohnGrahamCumming]

I never said just "approved" applications. I just said that the default should be everything is off. If you need a port open then it's a service request with the ISP.

That would be a bad idea, but just because someone can't *by default* start running a web server on their machine accessible from the Internet does not make them into "passive consumers". If they want to they can, they just ask the ISP.

A close family member's Windows 2000 box was 0wn3d within days of getting broadband even though they never need any "server" capabilities on the net. Which would have cost the ISP more... dealing with his complaint or dealing with others' requests to open certain ports?

John.

Re:Firewall

[loknor]

haha, yes and people are the cause for exploding gas tanks on Ford Pintos but that does not mean that the way to stop it is to kill the people or blame the gas. It does not mean that you make moving roads so that they do not have to use gas and therefore do not have a risk of exploding. The solution is to fix the car.

Re:Firewall

[WindBourne]

Oh, you must be on comcast.

Re:Firewall

[Karamchand]

Of course my posting was quite exaggerated, but I hope you got the point: It's not always that easy to find the real "root of the evil".

Re:Firewall

[GigsVT]

So you create a huge support burdon, to eliminate one attack vector.

People will still be cracked when they use an insecure web browser and hit a malicious site, or download an email that exploits their client, or open a PDF with malicious code, or any millions of other ways to get broken into.

To be honest, I see many more of those kinds of viruses, like bugbear et al, among home machines, than I see the passive kinds of attacks that simply require ports be exposed.

Besides, if you want companies to do something about this problem, why they hell don't you just ask the OS vendors to not have any ports open by default, that's a much more reasonable request, and accomplishes the same thing. They are also the ones usually responsible for the problems, at least moreso than the ISPs, who are just a third party that happens to provide infrastructure.

It's like saying that the power company should install UPSs on every outlet in your house, because your cheap poorly designed electronics keep dying when lightning hits your house.

Re:Firewall

[str8]

Unfortunately an ISP level port block doesn't stop infection. My ISP blocks 80 and 443 but my Apache logs show continual hits for both Code Red and Nimda because there are infected hosts inside the network.

How they got there is an exercise left to the reader.

Needless to say, IPTABLES is my friend, I don't see many reasons someone from my own ISP would be using my server.

Re:Firewall

[nsxfreddy]

Usually when a machine is trojaned, it communicates with the trojan creator actively, meaning it connects to an IRC channel, sends an email, somehow communicates on it's own. Most trojans would not be affected by an inbound firewall block since they would still be able to connect to the controller.

It would not be that difficult to modify a trojan that gets it's commands through an IRC channel to send a spam through that same channel.

Re:Firewall

[AnotherBlackHat]

Of course if broadband ISPs were to implementing a simple inbound firewall
for every user then they'd eliminate most of these problems overnight:
trojaned machines would be unreachable, worms like CodeRed that scan for
vulnerabilities would be halted.

It's already pretty common -
My DSL provider requires everyone to use a router/firewall/dsl-modem.
(It's part of the installation package)

Suppose you get 99% of the users behind a firewall.
That still leaves over a million computers vulnerable.

How did you plan on bringing that last 1% into compliance?

-- this is not a .sig

Re:Firewall

[NickFortune]

I have broadband and a good solid firewall. I use a deny-by-defualt iptables script on my gateway box and and a second layer filtering outbound connections on my desktop machine. I have neither need nor desire for my ISP to provide a firewall. If they start closing my ports for me, then I get myself a new ISP.

How easy do you suppose it's going to be to get ISPs to open one of those ports? If it's too hard, written confirmation and three days notice perhaps, then its no good if I want to, say, open a port of ssh for a few days.

On the other hand, if it's too easy then it's going to be easy for some hacker to social engineer himself access to port X, should he or she so desire.

Lastly, if ISPs get to thinking that ports are some sort resource that they control, then its only a matter of time before they start charging for them. If I wanted to subscribe to one of those browser only services then that's what I would have done.

I'd have no problem with a ISP based firewall that I had administrative control over. It should be easy enough to design a web-based interface, similar to the webmail pages you see everywhere. Allow me to configure firewall rules at the ISP and I'll use that as well as my own setup. But the minute they start dictating what I can do with which, or messing around with my settings, I look for a new provider.

But I'll not willingly be locked in a cage. Not for my own protection, nor for anyone else's.

Re:Firewall

[loknor]

Yes I do. I just thought that maybe in my ranting I had been less than clear on my point.

BTW: According to my mother money is the root of all-evil and according to my father women are the root of all evil. My mother now has all my dads' money so he might have been on to something.

Re:Firewall

[Anonymous Coward]

So get a commercial internet connection. ISDN, T1, etc.

Re:Firewall

[Dr. Manhattan]

Hell, a lot of ISPs can't even be bothered to do outbound filtering to drop packets with spoofed source addresses. If they did that, it would make DOS attacks vastly more difficult. But try getting anyone to care... until they get DOSd.

Re:Firewall

[Karamchand]

Yeyea, money's the root of all evil - send $20 for more info ..as the saying goes ;-)

Re:Firewall

[FrzrBrn]

Yes and it is worth the jump backwards in technology to help OS manufacturers continue to pedal sub par product and services that are the real cause of the problem. Attacking a problem at somewhere other than its source has always been such a great way to deal with challenges like this.

Or, we could realize that blocking some ports would be part of a defense-in-depth strategy. You know, that "layered" thing security experts always talk about? That way, when someone writes or uses a vulnerable app, the community at large still has a chance of minimizing potential damage.

I agree that just blocking all ports except those used for web browsing and email would be overkill. However, blocking ports 135-139 and 445 alone would probably help a lot.

Re:Firewall

[grub]

Wow, top posting on slashdot!
Outlook has a slashdot import function now?

Re:Firewall

[iantri]

This is an incredibly bad idea, and it would break tons of things for users.

Online games? Nope.. need open ports. How about IM? Nope.. only if it was all proxied through Microsoft/Yahoo/AOL's servers, breaking file transfers and voice chat.

What if I want to connect to my Linux machine via ssh remotely? Can't do that either.

Re:Firewall

[Suidae]

Most cable companies will be happy to sell you a 'commercial' account too, they'll turn off the port blocking.

Its not any faster, the customer service still sucks, and you don't get any more IP's, but you do get to pay three times as much.

Re:Firewall

[Kaa]

Of course if broadband ISPs were to implementing a simple inbound firewall
for every user then they'd eliminate most of these problems overnight:
trojaned machines would be unreachable, worms like CodeRed that scan for
vulnerabilities would be halted.

Of course then the broadband ISP's better come clean that they are not selling me a pipe to the internet any more. Rather, they are selling me the ability for my Internet Explorer (tm) to access the web and show it to me -- kinda like cable TV, only in the internet age :-/

And, by the way, the firewall will do exactly zilch about trojans and email viruses...

Re:Firewall

[AVee]

I wish ISPs would charge, say, an extra $5/month for users that want no port blocking. ... here in Indianapolis, all the cable companies do port blocking

Come to the Netherlands ;-)
Here we have an ISP that charges Eur 1.95/mo for a PC Firewall. Main selling argument is protecting agains the Blaster virus.
IMHO, it would be dumb to charge extra for a fully open connection, just make it configurable on some web page, somewhere around the advanced setting. Together with a bit a technical talk to make sure people that don't understand it won't touch it.
Why, it think the users that want to run their own server are way less likely to cause problems than users that don't even know they are running servers.

I don't care what measures the ISP takes to make sure I'm not spamming my neighbors, just as long as they don't take away my basic capabilities. If they want to do relay tests on my machine once a day or limit my outgoing SMTP traffic, then fine. But I'd like to buy an *INTERNET CONNECTION*, and I like to do more than use my connection to look at advertisments.

I can only agree with you there. My current cable ISP forbids running your own server in the AUP, yet in practice they will only use it against people when they cause trouble. They know damned well i run my own smtp server, they even to an open relay check once in a while...

Re:Firewall

[fishbowl]

"The few users of broadband who actually need to run an Internet visible server"

It might be *relatively* few, but it's not really just a few users. Lots of peoples livelihood rests on the Internet being a bidirectional medium.

Re:Firewall

[Anonymous Coward]

Why didn't your family friend ask someone with a clue about basic precautions before mindlessly connecting to a hostile network? (the Internet)

Why should the ISP have to fool with their customers' incompentance? No, I don't work for an ISP and I have a low opinion of ISP support people in general. But on this one, its up to the customer unless the ISP is explictly claiming to be providing a secure connection.

Another aspect of this is that you and I already paid for the foundation of the Internet through our tax dollars. I don't mind continuing to pay for it through an ISP, but damned if I'm going to be forced to petition said ISP every time I want to open a port and run a service.

Re:Firewall

[Anonymous Coward]

Dear John (ha!)
You're a fucking moron.

Re:Firewall

[Trolling4Dollars]

Yes, it's partly due to subpar products from Micrsoft. But it's also based on the culture of users that don't see themselves as targets. Just the other day I was talking to a fellow admin and happened to mention that on the one Windows XP box I have to use for work (at home) I run as a Power User and just use the RUNAS command to become the administrator. His jaw dropped and he said, "You actually DON'T run as an administrator"? He couldn't believe that I would inconvenience myself for a little extra security. THAT is the problem. Even someone as knowledgable as another Windows admin simply doesn't want to deal with the inconveniences of not running as Administrator (or root in *nix).

Since Microsoft encourages that people run as Administrator by the way the defaults are set up, there's going to be many situations where there are security problems until this practice changes. The real answer is that anyone using broadband should be behind a gateway of some kind. It makes all the difference in the world. If ISPs were really smart, they'd include a broadband router/firewall box with the DSL/Cable modem or have an all-in-one box. They'd also provide the users with access to the administrative functions on that box *if* they plan to run servers. It won't stop every security problem that Windows has, but it would alleviate many as there wouldn't be a direct connection to the internet.

Re:Firewall

[Anonymous Coward]

" I'm all for ISPs performing automatic blocking as long as the user has the option of opening all ports. I wish ISPs would charge, say, an extra $5/month for users that want no port blocking."

No way, go to hell, stupid idea. YOU pay the extra $5.00 to have your ports blocked for you. If something is going to be charged, a service should be provided. I dont want to get charged extra for someone NOT to provide me with a firewall.
Besides, what is $5.00 based on? Is it to punish someone who dosent want their ports blocked or to cover some cost caused by users not having blocked ports? If it is the first, that is just stupid. If is the later, thats just stupid too because there is no way to distribute that money back to where the costs were encourred. Your whole scheme is going to be abused and end up like some kind of baseless FCC connectivity charge on a phone bill.
sorry...i know, i'm rude but i dont want to pay $5 because you dont want to be the one to be sure your equipment isnt serving spamm. Everyone should be responsible for securing their own stuff and at the same time, law enforcment should be responsible for going after people who are trying to use other peoples equipment without authorization.

Re:Firewall

[Anonymous Coward]

GAFL

Re:Firewall

[4of12]

not always that easy to find the real "root of the evil"

I have to smile when I think of how true that is. All of the onus of responsibility for computer viri and worms these days is conveniently placed on the writer and dispatcher of the virus or worm. And, yes, they should be held responsible for their primary role.

Fewer people take the time to think that such viri and worms would be fewer and farther between if the underlying OS were designed and implemented better.

Fewer still concede that they have some personal responsibility to apply patches and updates in a timely manner, or that they have to take the time to understand how to harden their systems.

But it's a whole lot more convenient and comfortable to place blame onto the "hacker" than to think that we all have a hand in the creating environment where exploits flourish. Despite how comfortable we feel about placing blame in a simple-minded way, it doesn't seem to have been an effective framework for a policy for improving the situation. At least, not if the past 5 years are any guide, it hasn't.

It's consistent, though. Along with an incorrect view of the problem will come an incorrect solution. TCPA will be foisted upon us in the name of curing "The" problem of "hackers", just as the "Patriot" Act has cured us of the problem of "terrorists."

Re:Firewall

[benjamindees]

Why would your friend complain to his ISP?

Since when did it become the ISP's responsibility to deal with everyone's viruses and trojans?

Remind me to short all of the national ISP's for allowing that perception to arise. They'd be digging their own graves trying to support all the security holes in the MS products that 95% of people insist on using. Just ask Packard Bell.

Re:Firewall

[the_mad_poster]

A close family member's Windows 2000 box was 0wn3d within days of getting broadband

That's a problem at a level the ISP should be blind to. I think the question is: "Why did this person have a business-based OS running on a home box?" Ok, so, if they needed Win2k, they should know how to administer it. If not, they should have XP Home. Home should be where all the port-blocking occurs by default.

Putting the burden on the ISP is fixing the wrong problem. The ISP should be able to remain blissfully unaware of security at the customer level. The system should either be hardened and limited by default so that home users can't hurt themselves and have to learn the technology to use it, or it should be made brilliantly clear that if you're going to use this system, you'd better understand the risks associated with doing so.

My own anecdote is in order. I want to use Windows on the 'net so I'm setting up a Linux proxy for it. I'm accepting the responsibility for making sure that I don't hurt myself with my Linux system. Unfortunately, I'm doing that because my gaming rig - the Windows box, despite being billed as a "Home" system, doesn't seem to take ANY responsibility for not letting me get hurt. What's the problem again? I have to understand networking technology to set up a proxy server so my Windows box that's supposedly aimed at people who don't want to know technology doesn't hurt me because I don't know networking. THAT'S the problem, and it's not the ISP's responsibility to take care of it.

Re:Firewall

[JohnGrahamCumming]

> Why would your friend complain to his ISP?

What happened was the people using the machine were sucking up the DSL bandwidth. First the user sees is "my Internet connection is slow". So who do they call...

John.

Re:Firewall

[Anonymous Coward]

The problem with putting in an inbound firewall is people running game servers. ISPs and game companies would get deluged by clueless users wanting to know why they can't set up a game of Duke Quakem or whatever.

Duuno why. Charter already prohibits servers of any kind, as do many other cablecos.

Re:Firewall

[sketerpot]

Yeah, the quality of support at ISPs varies widely. I used to use an ISP which just read you some standard instructions for setting up dialup and then paid no attention when your ethernet card suddenly stopped working. I later switched to one which actually came and installed a switch for two computers to share a connection and a box for converting from ethernet to whatever type of cable my broadband connection used, and didn't charge for it. Needless to say, I'm staying with them.

Re:Firewall

[Anonymous Coward]

"Hello, I'm Clippy

It appears you were trying to insult someone by
saying 'GAFL'. Would you like help with this?

Yes, I'm an idiot.

Yes, I'm the one in need of a L to FG.

No, please reboot Windows"

Re:Firewall

[Anonymous Coward]

Maybe you consider an Internet connection nothing more than a way to surf pr0n but to me, being nat'd is about as cool as not being connected. I know punishing everyone for the action/inaction of the ignorant has been a popular trend for a long time, but it's not one I care to embrace.

Re:Firewall

[JohnGrahamCumming]

And you don't have the guts to fling your insult without hiding behind "Anonymous Coward". Either insult me to my face, or provide a constructive criticism of what I said.

John.

Re:Firewall

[dogbowl]

So to follow your example; my kitchen sink breaks and water is flowing all over the floor.

Who do I call? I call a plumber of course, certainly not the water department.

Re:Firewall

[jawtheshark]

I wish ISPs would charge, say, an extra $5/month for users that want no port blocking

Wait a second... You want those with a clue to pay more? Some people actually use their DSL lines mostly from the outside. At least that is how it works for me. I'm just like you: low-traffic mail, http and ssh... but I fail to see why I would need to pay *more* for that. The internet has been built with the philosophy "every node is a server", and it has been that way since the dial-up days (and before...)
I have DSL for the "always on" feature, not for the "lotsa bandwidth".

Re:Firewall

[CaptainTux]

People would go nuts if every port was blocked except 80, for example. Then they'd all drop cable connections and go back to dial up and the Internet would be screwed.

Ummm, just *why* would the Internet be "screwed" if people went back to dialup? It functioned quite nicely when most people had dialup. Looks like broadband is contributing more to the demise of the net than dialup ever did. Last I checked I don't see very many spammers stalking dialup users to exploit their machines for spamming. Sure, it happens, but they aren't the main targets.

Re:Firewall

[homer_ca]

If you can entice a user to run your trojaned executable with a built in proxy server, no current desktop OS can resist that attack. A personal firewall could catch the connections, but then they'd just give it an innocuous name like iexplor.exe. Sandboxing executables would stop it too, but no current email client does that for attachments.

Re:Firewall

[Anonymous Coward]

Funny nobody ever mentions the bullet-ridden installs of Red Hat, or the mess of other UN*X boxes running vulnerable packages of Sendmail, Bind, whatever.

Running Windows as administrator is really not the same as running a UNIX box as administrator, a Windows machine is vulnerable 99% of the time regardless of who you are running as--even if you never login. :)

And I've been on all the major cable ISPs in the California area and all of them do at least some kind of port filtering on all of the obvious ports, but who the heck runs things on the obvious ports anymore, I mean come on, does anyone still run NetBus or BO anymore?

Re:Firewall

[Battle_Ratt]

What they really need to do is build into everyones cable/DSL modem an easy to configure (Read http accessable) firewall, that defaults to blocking inbounds.
People would have to make the choice to open thier own ports, but at least it would make it the users choice, and not require contact with the ISP just to use the internet. Us geeks would just do it ourselves and the clueless would be safe 99% of the time.
It would also help the ISP's legally if they could prove the users made the choice to become a target.

Re:Firewall

[AlphaSys]

[Charter's Customers would] all drop cable connections and go back to dial up and the Internet would be screwed.

Are You high? Charter's customers going to dialup would hardly be a bad thing. Maybe we'd finally see the end of "default.ida..../n/n/n/n" ad infinitum in our logs.

Re:Firewall

[phre4k]

I don't know about about you, but i have had a shell script scanning my apache access.log for /scripts/../cmd.exe and that kind of stuff, and if the client was from the same isp as i the script would send a letter. They often replied that they informed the user about it.

I also agree that it is the isp's responsible. It is their ip and thus they are responsible for that as long as the user is on their net they obey netiquitte... No having a hacked box online is not good netiquitte.

/Phre4k

Re:Firewall

[Scottaroo]

Greetings:

I have comcast in Indy and while they might block an odd port here and there, I've had no trouble running ssh & msrdp inbound. I don't run web or mail, but the last time that I checked, the only ports that they were blocking were BackOrifice and something else that I can't remember right off the top of my head. You might try it out and see what you get.

Re:Firewall

[the_archivist]

No No No it should be fixed at the user (murder M$ make them read secure programming in any fcking language). I dont want the isp to know what I'm serving we're running dns etc on adsl + subdomains. Its probably not in their rule book.

Re:Firewall

[Anonymous Coward]

Excommunication! Follow the Church's example!

Re:Firewall

[Have Blue]

OK, you keep thinking that until your cable modem becomes unusably flooded. I, meanwhile, will be using an ISP that actually tries to *fix* problems with its network.

Re:Firewall

[placeclicker]

Although marked 'funny' there should be absolutely NO reason you would have to contact a person to open a port. This should and (probably) would be a simple HTML page or something automated. I say probably because, if its automated, its free for the ISP.

Re:Firewall

[Anonymous Coward]

Having happily had a webserver working from home for months up till yesterday and being a Charter customer I think they started blocking some things. How would I check?

Re:Firewall

[cduffy]

Bad example. If water is flowing all over the floor, it's obvious where the problem is.

If you're only getting a trickle of water, though, and you don't have the skills to determine whether it's your internal plumbing or not -- calling the water department is reasonable.

Re:Firewall

[LWATCDR]

I have issues with paying for someone to not do something. Why do I have to pay for an unlisted phone number I should get a rebate. Why should I pay for my ISP to not block my ports because the vast majority of people can not set up there own firewall. Naw they should pay me for not having to provide me with a firewall.

Re:Firewall

[domsol]

Actually, a good reason to require a call-in is to have some level of bullshit filter -- yes, this is the account holder, yes, here's my firewall model, yes, I have read the TOS regarding what I'm going to be doing with this potential security hole.

I originally was unhappy about having to call in for my extra mailboxes. However, when I asked, they were trying to avoid having script-kiddies order new mailboxes without their parents' knowledge. Not such a stupid idea.

Re:Firewall

[firewood]

Besides, what is $5.00 based on?

If you don't have inbound ports open, your machine will tend to generate less inbound traffic for their routers to have to handle, and a lower probability of complaints due to an unblocked machine getting hacked and then used for dDoS, et.al.

I think all inbound ports should be blocked by default unless the user is clueful enough to specify the exact port numbers and services that he/she specifically wants (e.g. almost all linux admins, but much fewer windows users).

Re:Firewall

[LostCluster]

You know, that's not a bad idea. A user-configurable firewall at the ISP that in its default settings allows Web, e-mail, IM, and FTP to work, but nothing else. If you want something else to work, no human contact is required, you simply have to understand TCP/IP to the level that you know which port number you would like released, follow the instructions of an automated web interface to do so, and wait for the next batch process to put that into effect.

So, the default config creates a web user who can't unknowlingly do too much damage. If somebody wants to be more advanced and set up servers, they can, but they've got to prove they at least know what port numbers those things run on... which is a decent level of Internet skill...

Re:Firewall

[Anonymous Coward]

well you can open all ports on your firewall, then go to grc.com and do their port scanner, and whatever ports show stealthed are they ones your isp is blocking

Re:Firewall

[Bellhead]

You can get around the port blocking: there are lots of "dynamic dns" services available, and some will perform port translation in addition to mapping your domain to a "dynamic" IP address.

This feature is usually free if you use their domain (e.g., homelinux.org), or available for a modest fee if you have them point your own domain.

HTH.

Bellhead

Re:Firewall

[benjamindees]

they are responsible for that as long as the user is on their net

Sure, responsible for *removing* it (the computer), not *fixing* it. Any customer who expects their ISP to constantly fix their bug-ridden crap is a customer that that ISP would be better-off without.

If I can't have my 'unlimited' bandwidth as advertised, I'll be damned if I'm going to subsidize some idiot with an open spam relay.

Re:Firewall

[Geek of Tech]

> Yes and it is worth the jump backwards in technology to help OS manufacturers continue to pedal sub par product and services that are the real cause of the problem. Attacking a problem at somewhere other than its source has always been such a great way to deal with challenges like this.

Well, actually I've got the patch for this. To run it just type 'format c: /Q'.

For the *nix users out there...
(and be sure to be root when you do this!)

cd /boot
rm *.*

(Correct me on the syntax if I'm wrong.)

This should remove most of the vulnerabilities in your OS.

Re:Firewall

[offpath3]

Except that in this case, the point is that they're using hacked machines for webhosting, which requires a server to be visible from the rest of the internet.

Re:Firewall

[Dr_Marvin_Monroe]

Since when do we start advocating that ISP's start pre-emptively blocking ports for all customers?

I pay for ALL of those ports on my cable modem...I run services on quite a few of them. Why should my service be blocked because of others who cannot be troubled to keep their machines updated and secure?

To assume that Comcast (my provider) or any other provider will open port 443 (or any other port other than the "shopping channel") for me on my request is frankly silly. Submitting such a request would just be an invitation to start doing port sweeps! Putting services on "off ports" is the only reason that I'm still able to keep everything going!

No, blocking of MY ports in a "pre-emptive" manner is not the answer....and since this issue keeps popping up from time to time, I'll pass on the best answer I saw last time (which I didn't think of, but it convinced me it's the best)....Simply pull the plug for any user who is determined to be infected with a trojan/worm/spam-generator/whatever. Direct any/all page requests from that customer to a "customer service page" letting them know why their service has been blocked and what they can do to remedy the situation. Since these customers are most likely running MS stuff, allow a connection to their "update" site too, so that they have a way to patch their systems.

The fact that someone could propose such an answer and have it so highly ranked is irresonsible on this list.

Re:Firewall

[loknor]

haha.. See you think it is a network problem when it is not. if your car bursts into flames every time you make a right hand turn it is not a problem with the roads having right hand turns. Get a clue it's the car.

Re:Firewall

[Anonymous Coward]

I wish ISPs would charge, say, an extra $5/month for users that want no port blocking

Why would I pay extra for something that I already have? A more sensible soloution would be to charge people $5 to have their ports blocked.

The isp could give people a quiz or something, to see if they are really up the responseability of owning an always open connection.

Re:Firewall

[Anonymous Coward]

Actually blocking outbound ports would not affect IM chat. The only thing it would affect would be the file transfers.

Re:Firewall

[Ravadill]

Actually my current ISP by default blocks http, smtp and a couple of others, but allows customers to quickly turn the blocked ports on and off via a simple click in our account's "toolbox" webpage. I think this is the best solution, as people who have no idea, and arn't running servers (to thier own knowledge) have the ports blocked, but anyone with some knowledge who wants to run a server can unlock themselves easily.

Re:Firewall

[Anonymous Coward]

Guns don't kill people. Spammers bring it upon themselves. You will have something to lean against next to them when the revolution comes. The revolution with be multicast over IPv6.

Re:Firewall

[loknor]

Oh, so you're doing it for my own good? So every time some one writes a buggy app we just block a port so that we can avoid it? That does not sound like an in depth or very forward thinking strategy. It sounds like we are cutting our self off from the world one port at a time.

Re:Firewall

[Anonymous Coward]

Layered security means not blocking ports. Different applications use different ports. If there is only 1 gate and everything goes through it, not only do you have a line of trucks 50 miles long outside of Juarez, but no one even bothers to look for terrorists wading across the trickle of a stream the Rio Grande has become.

Re:Firewall

[Anonymous Coward]

Chances are you call your ISP. I've been blamed because of WordPerfect not printing fonts correctly on after installing out "internet". They wanted us to buy them a new printer. We also have been blamed for ditchdiggers severing trunks and lightning and snow storms causing power outages:

It has to be your fault, I had internet for a couple hours after the power went out, and my lights are on.

Well my lights are off buddy, you should thank us for buying a good UPS.

Re:Firewall

[Anonymous Coward]

Why should users be allowed to use FTP vs other file sharing protocols?

Which IM protocols will be supported?

What about VPN users or other power users?

What happens when everything is tunneled through port 80 anyway?

Re:Firewall

[talon77]

Now that depends on the Trojan. If the connection were initiated from the infected machine, then that would not solve the problem. A IDS system could detect the suspect the traffic, but currently the time / money /effort that it costs to implement a good network level IDS system, you're not going to see it on home broadband connections anytime soon.

Re:Firewall

[geoffspear]

# cd /boot /boot: No such file or directory.
# rm *.*
rm: No match.

Re:Firewall

[Anonymous Coward]

thanks, great tool. Yup it seems Charter is blocking port 80. Could I use any of the other open ports to server web pages if I change my server port?

Re:Firewall

[Some Dumbass...]

Yes and it is worth the jump backwards in technology to help OS manufacturers continue to pedal sub par product and services that are the real cause of the problem. Attacking a problem at somewhere other than its source has always been such a great way to deal with challenges like this.

Perhaps the logic behind using firewalls is that the people dealing with the problem actually know what they're doing and are motivated to fix it? Even if bugless OSes actually existed, expecting the average computer user to avoid doing anything which might open up their system to abuse, which may include things as simple as installing software (oops, there's a trojan in P2P program!), is going to be impossible to implement. Trying to achieve the "perfect" solution (namely perfect software and perfect users) is certainly a noble goal, but the first goal should be to implement a plan which is (far) more likely to work.

Besides, let's not forget that _spammers_ are the problem here. Both firewalls and more secure code would just deal with one particular method of obscuring their location. There are others methods they use right now, such as abuse of free popmail accounts and AOL disks, and there will probably be even more in the future. Who knows, perhaps seeding P2P networks with fake mp3s which actually contain product ads will be the next big thing?

My point is, mail proxies are just one tool which spammers use. Making that one tool difficult/impossible to use won't finish off spam. It may, however, convince them that it's not worth the time or money to use that method anymore, which would save a lot of computer users a lot of headaches. Thus it might be worth the trouble to implement a quick, effective solution, even if there are some drawbacks.

Re:Firewall

[Anonymous Coward]

Most larger ISPs will not implement this for one simple reason. Cost.

Since they don't have firewalls the only means of restricting traffic is router ACLs. It works as long as you have a small number of ACLs - so blocking port 80 and 25 globally for instance will be OK, but if they are going to have thousands of permits the routers will kneel. A cisco 6500 or similar costs money, that reduces profitability of the ISP and the choice is simple. It will not be implemented, or price will go up significantly.

Also for global blocks you can implement on the borders, the only way of handling individual permits would have to be on headend level. This again adds management overhead.

Finally, most ISPs have DHCP assigned IP addresses and that simply breaks all static firewall and/or static router acls.

Re:Firewall

[berzerke]

...let's not forget that _spammers_ are the problem here...

Actually, spammers and those stupid enough to send them money are the problem. Without people responding to spam, spammers would go out of business.

Re:Firewall

[mrogers]

Call me stupid if you want, but thanks to spam I now have half a million dollars in a Nigerian bank account and a penis like a club.

Re:Firewall

[Atrax]

> A close family member's Windows 2000 box was 0wn3d within days of getting broadband

hey, hell, I got a laptop infected within about ten minutes back in the Code Red flap. brand bleeding new, needed some patches, didn't have access to a patched machine to get the patches off of (lots of reasons), took the risk, got hit. What the hell do you do?

In that case, with hindsight, leaving IIS off the thing would have saved my ass while getting the patches, but how many home users know this stuff when they hit broadband? Man, some people buy an OEM-installed machine patch-free from the corner computer shop and just plug the thing right in, which is tantamount to saying 'Hi, come get me!'

ideally, ISPs should have better division in their account structure. Home users : no inward ports beyond what's absolutely necessary. Want to run a game server? $5 extra a month for a given set of ports. Want to access your own machine remotely through VNC? welcome to the 'expert' level, $5 extra a month. Want to host a small website? $5 more, cheers. If the financial thing's not attractive, hey, different AUP for you guys. get infected, lose service.

In utopia, this would result in cheaper broadband for all - no 'my machine's gone crazy' support calls from broadband level #1, because they're worm-free. less calls from the next level up, because (hopefully) they have some idea of what they're doing, and so on.

shame we're not in utopia

Re:Firewall

[phre4k]

Sure. I agree. They should remove it, but that still takes time.

Re:Firewall

[jrockway]

how about a good 'ol rm / -rf instead.

-or-

Q: I have a problem in windows.
A: OK, just type format c: and all your troubles should soon cease to be.

Re:Firewall

[Anonymous Coward]

People are so fucking dense. It doesn't matter: if by default the machine can not be a server (due to a firewall), the spam proxy problem virtually disappears.

Re:Firewall

[hamster foo]

It becomes a network problem when its effecting the network. Since you like the car analogy, it's like a car running into a gas pump at a gas station. It's not the pumps fault the car ran into it, yet they still surround pumps with rather large pillars to try to prevent things actually making it to the pump.

It wouldn't be a good idea to use firewalls or other preventative measures and not try to fix the underlying problem of insecure OSes, but to discount other security measures would be negligent. Improving the security of OSes should be a priority for all OS developers, but firewalls should play an important part in security as well.

Re:Firewall

[fataugie]

I *think* the idea the OP had was the clueless would be price-consious and would instinctivly opt for the cheaper cost solution.

If the ISP's said "Hey clueless, we're charging $5 for port blocking, you want it?" what do you think the answers would be?

Re:Firewall

[pqdave]

If broadband ISP's would stop effectively discouraging firewalls...First step in tech support is "turn off your firewall...And if it's an email problem, install Outlook Express, then we'll help you"

Hmmm...maybe the hacker/spammers have infiltrated the ISP helpdesk...

nailing the bastards

[tarzan353]

It's not that hard to take down a spammer who causes you problems beyond just sending you unwanted email... I had one friend who had a spammer run a couple hundred thousand emails thru his system (a bug had made it into an open relay). It took one stern call to the ISP hosting the advertised websites to get his hosting and DNS cut off at the knees.

This is more than just sending off a single email to a scantly watched abuse email.. This means getting hold of a real person and explaining, realistisay, what sort of legal liabilities they might be open to if they continue to support the spammer's actions. (Hacking laws, aiding and abetting, Trademark infringement and vicarious liability) often fit in there.

If more people would do this, life would get a lot harder for spammers.

Re:nailing the bastards

[avi33]

Right, the point of the article is that this makes it almost impossible to determine which ISP to contact (without ordering a bottle of Viagra and tracing the money trail.)

Re:nailing the bastards

[Karamchand]

This group isn't in Poland purely by chance - many of the countries of the former Soviet Union don't have laws for these things - usually simply because they have other, more practical problems to attack than shutting down someone's server.

Re:nailing the bastards

[Anonymous Coward]

how is this relevant to Poland?

Re:nailing the bastards

[stilwebm]

Not really. If the ISP wants to be constructive and wishes to stop being targeted by this type of spammer, all they have to do is monitor the hacked machine a little while to determine where the sockets are being forwarded. After a few seconds, they can shut down the site. Until the spammer can get on a new site with new DNS entries, the spamvertised site will be dark. Best of all, they still have to host their domain on some DNS server unless they want to risk advertising an IP address. I have received increasingly positive responses from ISPs hosting the DNS zones for spamvertized domains. If they can't shut the site down, shutting the domain down is more effective anyway.

Re:nailing the bastards

[Anonymous Coward]

AFAIK Poland was never a part of Soviet Union...
And no - they do have laws for these things, but I guess if they break into machines in US or wherever, the Polish government has nothing to say. And, anyway, did not you notice that they operate incognito?

Re:nailing the bastards

[Anonymous Coward]

anyway, did not you notice that for example murderers usually operate incognito as well ?

Am I missing something here

[zymano]

Just sue the owner of the company that they're advertising.

Make some $$$.

Re:Am I missing something here

[jqh1]

My site/service got mentioned in a spam "newsletter" once without my knowledge or consent. I was promptly strung up on spamcop as a business that had advertised in spam -- and my site/service is a spam *fighting* service to begin with!

The point here is there's so much spam with so many variations on the base set of presumed facts, that hair-trigger lawsuits will cause many friendly-fire victims. I doubt the spammer I mentioned above meant to cause me any harm by mentioning me in his "newsletter", but I doubt it would be too hard to find a situation where it's done on purpose -- i *have* been "joe jobbed" several times (used as the reply address on spam) and that gets pretty nasty, too, and presents a similar situation where spammers falsely implicate others. Add in swift and sure legal consequences, and it would be much worse. Even assuming the courts have the ability to determine a false positive defendant when they see one, just think of the expense of doing that.

Re:Am I missing something here

[Animats]

Exactly. Until recently, penalties have been too low. I have a check for $50 from a mortgage broker in Los Angeles, obtained by threatening to sue under California's anti-spam law.

After January 1, the price of spamming goes up in California.

Re:Am I missing something here

[L-Train8]

But you can't find out who the owner is. The "companies" the article discusses are fly-by-night operations that don't provide any information about themselves. There's nothing but a website where you can input your address and your credit card number. No business license, no address, no phone number. Before this sort of thing started happening, you could at least find out who was hosting the website. Now, to actually find out something substantial about the company requires you to make a purchase, then see who billed your credit card.

Re:Am I missing something here

[zymano]

How about something like a national 'Do not buy list' run by the Better Business bureau ? So that no one could buy anything with credit cards unless approved by the Better Business Bureau.

And this Polish company could be dealt with by international law.

We could stop buying Polish sausage too ? !

Re:Am I missing something here

[L-Train8]

I think they should have an IQ test before they issue credit cards. Anyone who would input their cc# into an anonymous website would be too stupid to get a credit card.

But I think you are being generous when you refer to the polish "company." It is some hackers who troll for business in IRC chat. What they are doing is probably illegal, but try to get the FBI to expend a ton of resources tracking down an international group of criminal emailers. Boycotting Polish sausage would be like boycotting pizza to protest the mafia.

Re:Am I missing something here

[mikeswi]

Nearly the same thing happened to me recently. My site was mentioned in a newsletter that was forwarded to spamcop in a complaint. Spamcop notified the owner of my web host's data center that my site was "spamvertised" and it nearly got me shut down.

What's really cute is that the spam complaint was bullshit anyway. It's an opt-in newsletter written by a very well known technology writer and it has a confirmation process. This was no spam, yet some dumbass reported it as spam and spamcop blindly accepted it. So much for their claim to be "the most accurate spam blocking service".

Spam would go away...

[BJZQ8]

If we broke more thumbs and kneecaps

Re:Spam would go away...

[Anonymous Coward]

I don't see how this is a troll. On our mailing list, we call and visit local spammers when possible. It makes for fun field trips.

Everyone should get to know their spammer.

Re:Spam would go away...

[Anonymous Coward]

I was telling a friend the other day... all we need is to make sure some mobsters get really pissed off at some spammers.

Re:Spam would go away...

[BJZQ8]

Obviously the person that moderated me is a spammer...

Comment removed

[account_deleted]

Comment removed based on user account deletion

I call it!

[doppleganger871]

"Not It!"

That is all.

Thank you.

Done.

interesting methodology

[fractalus]

It sounds like they run DNS which "load-balances" requests to the spamvertised sites through zombies set up as open proxies. Since the zombies are scattered throughout all IPs, it makes blocking them hard.

Of course the scumbags know their weak spot is the DNS. Blocking particular domains is easy, and changing the authoritative DNS for a zone takes a while (done that too often). It steps up the spam blacklisting to now require not just refusing mail, but also refusing to talk to certain DNS servers that are known to operate this way. They can move around, but it's harder; I'm not sure if this is better or worse than the current situation.

Damn spammers.

Re:interesting methodology

[arivanov]

The methodology is something I have expected to come for a while now.

All I can say is that the right answer is the last line of the article.

It is actually the right answer to all SPAM problems period. Especially when applied to the company which is using it to promote their trade, not the spammers. The latter will die by themselves if there will be noone to buy their product.

Re:interesting methodology

[fractalus]

I've watched the spam to my inbox go from a few messages a day at the beginning of this year to over 300 a day now. Doubling every ten weeks is a statistic I can believe.

It's clear spammers have no regard for the law. One need only look at their track record: abusing open relays to defray the cost of sending mail, forging headers to divert attention away from themselves, advertising illegal products, businesses, or outright scams, exploiting vulnerabilities in computers to turn victims into zombies for more spamming.

Educating users is futile... I can't even got most of my friends to stop forwarding the latest chain message. I barely saved one of my friends from falling for a credit card phishing scheme, and she's pretty experienced compared to most.

The only thing that is going to work is to go after the people running spamvertised sites. But that's going to cause problems by creating a new kind of "Joe Job"... hire a spammer to spam for your competitor's product; the wrath of the anti-spam crowd then goes straight to your competitor.

Damn spammers.

Re:interesting methodology

[Anonymous Coward]

This has been talked about for a bit. Check out this thread. Also, Nanog has an ongoing discussion about this DNS technique starting here.

Re:interesting methodology

[Anonymous Coward]

I doubt there's be enough Joe Jobs to keep spammers in business (once the really clients dry up).

Re:interesting methodology

[pocide]

It sounds like these spammers really have their shit together. There are plenty of legitimate websites, such as Kuro5hin.org, that can barely keep their servers up for more than one day at a time.

Perhaps spammers are crackers aren't as stupid as we all thought.

Re:interesting methodology

[pmz]

It's clear spammers have no regard for the law.

So, if in the 1950's we had westerns, what will the 1990's-era spammer tales be called in the 2050's?

Re:interesting methodology

[Micah]

> Educating users is futile...

I've thought about some, and how about this for an idea?

Write up an e-mail to educate new (and old) e-mail users about e-mail etiquette. Include the following:

1. If you get an email advertising something from a company you have not done business with it, simply delete it. Explain why this is bad. Tell them not to fight it unless they know what they're doing.

2. Overview of e-mail forward hoaxes. Tell them not to forward outrageous stories unless they know them to be true.

3. Tell them not to include everyone they talk to on their forward-list without asking.

4. Tell them to not include .DOC files or large images in an email without being sure the recipient can handle the file.

5. Tell them to disable HTML image loading in mail, as it can be used by spammers to verify your address.

6. Forward this to every new Internet user you know, and everyone who violates any of the other rules. (And let this be the LAST message you mass forward!)

7. More???

Then, put that up on a web site with a textbox for entering e-mail addresses. The system would send the message to all those addresses.

It might educate at least some people...

Re:interesting methodology

[Electrum]

The only thing that is going to work is to go after the people running spamvertised sites. But that's going to cause problems by creating a new kind of "Joe Job"... hire a spammer to spam for your competitor's product; the wrath of the anti-spam crowd then goes straight to your competitor.

It's not going to cause problems: it already does cause problems. It is simply going to get worse.

Re:interesting methodology

[Anonymous Coward]

I'm pretty sure spammers have already started to imagine beowulf clusters of comprised machines. Damn them.

Re:interesting methodology

[Anonymous Coward]

wouldnt it be easy to do a zone transfer snag ALL the address. Or just keep asking for address's till you get a GOOD amount of different ones? Then use their network against them and 'spam' the Isp's to enforce a bit of licence agreement. With a nice email of 'Hi this email came from x.x.x.x I sure could use some help cleaning up my computer'. That would clean up that network fairly quickly. Figure it out, infiltrate, and fix it.

Or just mail someone like mynetwatchman for some help? They have been agregating things and have some good contacts it looks like...

Re:interesting methodology

[silentbozo]

Good lord, you've just described the "welcome to the system" messages that sysadmins used to post for new users. Too bad more ISPs don't hold their users to any kind of social standard, or maybe we could have avoided the worst of the problems since the Internet was commercialized...

Re:interesting methodology

[Anonymous Coward]

Based on my testing your assessment sounds correct. Minor exception is that they are probably not open proxies, but rather hard coded to pull down the correct site based on the "host" parameter within the HTTP payload.

DNS may not be that much of a vulnerability for them. See a Security Focus Bugtraq post I did about a month ago titled "Permitting recursion can allow spammers to steal name server resources". I'm wondering if the group I was tracking was this same group, which would mean cutting off their name servers would not do any good because the name servers are stolen as well.

Re:interesting methodology

[Tetsujin28]

Spammer stories will be just one of many standard plots of the "Netter" movies of the 2050s.

Westerns include stories about range wars, brave lawmen versus nasty outlaws, brave outlaws versus corrupt lawmen, "Indian Wars," settler-romances, and more.

I guess Net pictures will have stories about domain wars, brave Feds versus nasty hackers, brave hackers versus corrupt Feds, spam wars, online romances, and more...

Easier solution

[Anonymous Coward]

Link this to Al-queada somehow.. The US will get Poland to deport these guys..Problem solved...

Re:Easier solution

[Evil Adrian]

Deport? Dude, they'd just fire a fucking missile and be done with it!

Re:Easier solution

[dipipanone]

Unfortunately, if recent history is anything to go by, the missile would hit everyone *except* the spammers.

morons using pateNTdead eyecon0meter to log..

[Anonymous Coward]

antics/foibles of payper liesense corepirate nazi softwar gangster stock markup FraUD execrable.

it's not that hard to do. there's so much of it to choose from.

from the grasping_for_something_to_say_besides_i'm_afraud dept.

Viruses are becoming increasingly more sophisticated and the time between the delivery of a patch from Microsoft until hackers figure out workarounds is becoming dangerously short. In the case of the Blaster virus it was 25 days, Ballmer said

"When it gets down to five or 10 days a lot of our users will be in a tough position. Their [hackers'] exploits are getting more sophisticated," Ballmer said.

you wonder how these fauxking corepirate nazi payper liesense stock markup FraUD ediots can stay out of jail for yet another daze? defense lawyers. that's how. you're paying for it, as well as everything else.

Guess Who's To Blame

[the_mad_poster]

most of them home computers running Windows with high-speed connections.

WHY wasn't ICF turned on by default in XP Home? WHY aren't there pamphlets included with new computers about keeping AV up to date and not opening unknown e-mail attachments? WHY are so many ports in Windows open by default on Home installations? WHY is Microsoft still clinging to the broken "identify executables by extension" mechanism?

We include pamphlets about how not to hurt yourself while you're using your pretty new Gateway PC, but we can't even drop in a fucking 2 page paper about keeping A/V up to date and the danger of executable attachments? Not only that, Microsoft runs on almost all of the Home PCs out there but almost nobody (sorry geeks, we're all still nobodies when we're not on Slashdot) demands any accountability or quality or security from Microsoft?

Fuck it... I'm going to become a goddamn mime.

Re:Guess Who's To Blame

[Anonymous Coward]

By including the pamphlet in the box, Gateway is then possibly opened to suits because of the hard link between Gateway and updating AV software.

Also, it can become a support nightmare, as Gateway like most vendors don't support 3rd party software for free.

Even then, troubleshooting or offering any advice to a customer becomes very subjective, and by offering advice on certain products that are not shipped with their systems, Gateway further opens its doors to possible legal action.

I remember once at Gateway about 10 years ago when there was pressure comming down because a customer had a virus on a driver disk. Even though it was obvious that the disk was infected by the persons machine, many internal changes were implemented to protect the company from litigation. Believe me, the last thing that they would want is another repeat of MOD001AAUS.

Re:Guess Who's To Blame

[mosha]

> WHY wasn't ICF turned on by default in XP Home?

This is very good question. ICF is going to be turned on by default in XP - see this CNET article for more details on how Microsoft is doubling its efforts on security.

Re:Guess Who's To Blame

[Alan]

Sadly it comes down to the almighty dollar. A company with millions of dollars in revenue (I'm guessing that their execs aren't driving 10 year old hondas to work) is protecting thier profits by not doing something that just about any sane person would say "yea, that's a good idea."

*sigh*

Re:Guess Who's To Blame

[Animaether]

WHY is Microsoft still clinging to the broken "identify executables by extension" mechanism?

For the same reason that Adobe Photoshop will tell you that a .jpg file is broken if it's actually a Targa file with a JPEG extension ?
It's easy, and it is generally trustworthy.

Your gripe should be with mis-identifying the extension, not with looking at the extension per se.

E.g. anna_kournikova.jpg.exe
Nothing wrong with that, except that you get to see ".jpg", rather than ".exe" - a stupid flaw by whoever wrote that piece of code, but the identifying of an executable by the .exe extension is by no way wrong.

In fact, I would be more worried about something the other way around.
Imagine you get anna_kournikova.jpg, which is actually an executable ?
Right now your OS will simply fail to load the .jpg, and rightly so.
If your OS were to recognize it as an executable and have no inhibitions from running it as such, then you're really screwed.

And just to plug Irfanview over Photoshop (at least in this respect, I know they are not comparable) : Irfanview will tell you that a picture is of a particular filetype with a wrong extension, and even pop up a dialog asking you if it should just rename the file for you. Excellent stuff.

Re:Guess Who's To Blame

[Anonymous Coward]

Until ICF lets me talk to other computers (it prevents me from talking to any other machine on my network, getting through my router to the Internet or even connecting to my router) it certainly won't be enabled on my machine.

I agree on the A/V info awareness - perhaps more education (yeah, that works...coughcoughgunscoughcough). In my experience, a little education can go a long way.

If someone's computer is slow and you tell them that, among other things, a defrag would help, they'll defrag every day if they think it will help.

I've gotten my fiancee's grandparents to update their virus defs and run Ad-Aware every week. They think it makes things faster.

Re:Guess Who's To Blame

[the_mad_poster]

By including the pamphlet in the box, Gateway is then possibly opened to suits because of the hard link between Gateway and updating AV software.

That may be how the idiot PHBs at these places think, but I don't buy it at all. Computer Maker A puts pamphlets into the box to tell people how not to hurt themselves while using their PC, but that doesn't open them to lawsuits from some idiot who hurts themself? What if I'm tugging blindly at cords and pull the monitor down on my head? Can I sue Computer Maker A because their pamphlet didn't warn me not to pull on cords that were attached to various components?

They don't put them in because it would cost them a precious bit of money to do so and it would also cut down on some of the garbage they shove in the box as peripheral, paid advertising, that's all. It's a simple matter of "What the customer doesn't know won't hurt them" attitude, except what they don't tell the customer WILL hurt them.

The mention of support problems doesn't hold either because they include 3rd party A/V software on a regular basis. Why doesn't that cause a support problem? If I'm the typical clueless (PC-wise) home user and I, like most typical clueless users don't RTFM, I would probably assume that if it came with the PC, it was either Computer Maker A's or Microsoft's responsibility to support this "Norton AntiVirus Thingy" that I have.

They don't do it that way because they're managed by lazy morons in management looking to keep costs cut to get big bonuses, not because they have a good reason... just like most management decisions.

Re:Guess Who's To Blame

[the_mad_poster]

But it's NOT generally trustworthy, it's just stupid. It's also "convenient", that's why they used it to begin with - simplify things for the average user who doesn't want to take a lousy 5 minutes to understand the difference between what makes a file executable (or, even worse: what the difference is between an executable and plain file).

The problem with the file extension mechanism is that it's used in conjunction with a filesystem that pretty much knows "you're an administrator" or "you're someone else". Since most people have to run in administrator mode most of the time (yet another Stupid Windows Problem), it says "yup - you're an admin and this file ends in .exe so BAM! Run it!" and then all hell breaks loose. Having to explicitly identify a file as executable and being able to specify who and what (filesystem-wise) can execute things is critical. Just saying that something can execute just because of its name is dumb but oh so convenient.

Re:Guess Who's To Blame

[Anonymous Coward]

see this CNET article for more details on how Microsoft is doubling its efforts on security.

Well, that shouldn't be hard!

-xorbe

Re:Guess Who's To Blame

[sporty]

The problem isnt' windows. The problem are broken machines on a network. MS released a patch and it never got populated as much as it should. MS doesn't edcuate users on turnning on/off certain things.

But you know what? For every reason these things should be turned off, it's turned on.

And does finger pointing solve anything? No. Did pointing fingers get most everyone to stop using telnet vs ssh? Did it stop people from sending sensitive data over non-ssl connections? No. Did it stop people from running daemons as root? No.

It was proof of concept and people learning. All finger pointing does is make you seem like a colosal jerk. Either propose a solution, help someone out, or become your goddamn mime.

Re:Guess Who's To Blame

[sweetooth]

I would think the liability issue is already there. Most of these genereic mass manufactured home computers come with some type of virus scanning software. Without providing a two page paper about how to use the damn thing aren't they making themselves more liable? In the "You gave me the tool but didn't tell me how to use it!" frivilous lawsuit sense.

Re:Guess Who's To Blame

[Anonymous Coward]

Fuck it... I'm going to become a goddamn mime.

What type?

*ducks*

Re:Guess Who's To Blame

[Anonymous Coward]

Why isn't an anti-virus program bundled with Windows so these problems can be avoided in the first place?

Oh, that's right. The Dept. of Justice.

Re:Guess Who's To Blame

[Suidae]

I understand what you are saying, but I disagree because the general population doesn't usually understand the difference between data files and the files that are the programs that operate on their data files.

All those mysterious .exe things are hidden away in that special 'program files' directory that has warnings all over it. From a regular users perspective, its 'under the hood' of their car, where they pay a professional to work. They click to get their computer to open their files, they edit their files using their computer (the part of it called 'photoshop' or 'word' or whatever), then the save their file. Thats it. They shouldn't have to care about what is 'executable' and what isn't.

Anyway, the .exe extension is just meta information about the file, same as the 'x' attribute in linux. The difference is just in if that meta info is sent with the file.

This stuff actually works pretty well if you let it, the problem is mostly a particular large software vender that thinks normal users should have email clients that can execute programs or scripts. Thats just a bad idea.

Re:Guess Who's To Blame

[the_mad_poster]

This stuff actually works pretty well if you let it, the problem is mostly a particular large software vender that thinks normal users should have email clients that can execute programs or scripts. Thats just a bad idea.

Excellent point - I meant to tie that in with my original argument, but forgot in my rambling rant.

Anyway, the .exe extension is just meta information about the file, same as the 'x' attribute in linux. The difference is just in if that meta info is sent with the file.

This is exactly my problem, though. The meta-information on files should be held by the filesystem, not tied to the file. The filename should be arbitrary and each filesystem should be responsible for containing the meta-information on the files that are placed in it. Not only does this boost interoperability (because any given file is just that: an arbitrary collection of bits on a disk), it enhances security. I suppose it could hinder performance and would be annoying to have to tell the filesystem what each file is when you add it to the fs, but that's just tough beans - give the option to contain meta-data with a file and let people sow their own seeds of destruction if they enable it. If you think about it, that's sort of how Linux works now (not that Linux doesn't have its own problems with default installs).

Generally, I'm a big fan of not letting people do much of anything by default if it could hurt them (obviously, almost anything can hurt you, so within reason) but letting them choose to do it explicitly with dire warnings about it. That way, clueful people can enable potentially dangerous things and clueless people who do it anyway can be blamed for being idiots. Right now, if someone runs an exe that says "cute_little_puppy_dog.mpg.exe", they may be naive.. but hey... the system (and mail client) let them do it. Although, I have to wonder how many stupid people would still save executable files to their disks and run them anyway even if the client couldn't do it for them?

Re:Guess Who's To Blame

[themassiah]

When you double "zero effort", you still get zero, sadly. What I don't understand is why broadband modems (DSL / Cable / Sat) don't come with a user-configureable firewall built into it. (PATENT PENDING, ALL RIGHTS RESERVED) The first time you try to go somewhere with your browser, it opens this page and you configure it or press a "Standard Configuration" button depending on your level of expertise and BAM! Protected all the way. Well, most of it.

Re:Guess Who's To Blame

[Anonymous Coward]

Please. We need more people who can communicate effectively without having to use "fuck" to emphasize a point and sound authoritative. At least when you're a mime I won't have to listen to you. They can't afford computers.

Re:Guess Who's To Blame

[Kphrak]

WHY wasn't ICF turned on by default in XP Home? WHY are so many ports in Windows open by default on Home installations?

AIM. MSNM. ICQ.

Kazaa. Grokster. Morpheus.

Counterstrike. Unreal. Quake.

Personal web servers. Blog software. Update software. File shares.

That's WHY. Much as I hate MS software, don't blame them for saying "the customer is always right." People want to turn their computers into servers (aka traps for every conceivable virus and trojan in existence). They're going to be extremely pissed off if their Aunt Tillie can't see their photos of the new puppy by downloading from their "ZeroSoft NetSharer" webserver, which happened to come packaged with their new ink-jet printer.

Incidentally, I have some personal experience with this thing. A month ago, one of the guys I do freelance work for said his file shares were not working. I looked and found that he had the error "Incorrect function" on those drives. Three hours later, I found out that there was a firewall sitting in memory, autoinstalled by some HP update (no icon, and named like an NT process, of course). That was blocking port 445 and preventing him from connecting to the SMB server. Should have suspected it in the beginning, but who can infer anything from an error message like that?

That cost him $180 in consulting fees, and he'll probably never use a firewall again. To add to his pain, his box had been NATed, so the firewall was almost completely redundant in this case.

Re:Guess Who's To Blame

[wirelessbuzzers]

I haven't seen anyone use Telnet in a while. People do, however, still transmit sensitive data along non-SSL connections.

However, here's a solution that I would propose. Make it hard for beginning users to do dangerous things. It can be something as simple as chmod 755. Something that won't bug advanced users too much, but still makes it non-trivial to execute an email attachment unless you know something about your system. Same with setting up personal webservers. Let people make such servers, but limit how much damage they can do to themselves without knowing anything about config files. Don't run as root by default. Don't put services on until people turn them on. Ship with a good firewall. Give a damn about security.

In terms of sensitive data, a root-owned encryptor that can decrypt messages without making the key available (to non-root anyway, or to non-ring-0), and verifying the applications before allowing it. Something like Keychain, but more advanced. It could be used to encrypt mail, sensitive directories, etc. You'd still have to warn people about sensitive information over the internet, but this would be a step in the right direction.

Stuff like this is why I use a Mac.

Re:Guess Who's To Blame

[Anonymous Coward]

Don't get me wrong.
I do not work at Gateway, and haven't for a long time, so I don't speak for them personally.
Attitudes may have changed since I was there, but at the time AV software was not included in the package.

We were told to not suggest any particular package, but to list out a few competing versions to give the client a way out of the problem that the virus caused. At that time, by the time they called for support it was really too late to help them past fdisk and format.

From what I understand, there is a legal concept of 'what a common man would do'. Most common men are able to recognize that by pulling on the monitor cable will cause the monitor to move. Most common men do not know what AV software is or how to use it.

Do manufacturers have a responsibility to tell the customer what AV software is and how it works? Maybe. But, more importantly, do the manufacturers have the responsibility to train the users on how to use and update the software if it didn't come with the computer?

Re:Guess Who's To Blame

[firewood]

WHY wasn't ICF turned on by default in XP Home? WHY aren't there pamphlets included with new computers about keeping AV up to date and not opening unknown e-mail attachments?

In the early days, one could drive a car, or even fly an airplane, without any licensing requirements, any seatbelts, etc. After enough costly accidents and bad publicity, nowadays one certainly can't take off piloting a large aircraft without thousands of hours of training, licenses, medical exams, inspections, following books full of regulations, etc. etc. What makes you think that the same thing won't happen to being able to run a server (any PC with open ports) on a broadband connection?

Re:Guess Who's To Blame

[pjrc]

And does finger pointing solve anything?

One could argue that all the public finger pointing at Microsoft has damaged their reputation to the point where they fear losing sales... and that has finally motivated them to improve security.

Then again, perhaps it is fear of losing sales to linux that has motivated Microsoft. But most of the finger pointing has included references to the belief that linux systems have better security.

Microsoft would like everyone to believe they are cleaning up their act due to customer frustration with infections, or perhaps just because they care about doing to right thing. But if that were the whole story, they would have turned off unnecessary services, improved default setting, included a firewall on by default, disabled automatic macro execution, and disabled executing dangerous attachments several years ago.

These are all many years old problems, most of which were widely recognized in the days of Win98 and NT4... but little progress was made to follow basic good security design in Me, 2000 and XP (notably the very simple measures of turning services and risky setting off by default) until very recently.... roughly as the public finger pointing and linux competition has intensified.

Re:Guess Who's To Blame

[Anonymous Coward]

A problem with Windows is that by default certain core applications (e.g. Windows Explorer) do not show file extension, as if to suggest that file extensions are not important.

Re:Guess Who's To Blame

[Anonymous Coward]

ICF turned on by default in XP home for me.

Re:Guess Who's To Blame

[sporty]

Yeah, there are always exceptions to the rule. When was the last time you saw an ssh capable cisco router ;)

Well, you have to remember, that things such about desktop software, is people don't want to have to learn how to set things up. THey wanna know that it works and it's easy to get to in less than 3 steps. You are right, things like making it hard is definitely worth while, and I think it's nice that XP has a firewall, but making it too complex would only aggravate the user.

I particularly like how apple did it, and have everytyhing blocked, and you can unblock services. Problem is, having services initially blocked w/ no feed back could be a real problem to a user. "File sharing don't work" is all you'd hear. Maybe MS would make a special firewall taht initially redirects recognized traffic to a watcher that says, "Hey, someone is trying to do something." Or watches for a driver presence.

I'm not sure how keychain particularly works, but it must need a key of some sort to get to the encrypted information. It may be a matter of time before someone writes something that captures that key in some way, and exploits that. It's on the same level of that entire SSL fiasco, where people were self signing their own keys and having it accepted on behalf of anyone they wanted to fake.

Re:Guess Who's To Blame

[the_mad_poster]

That's a load of hogwash, if I may say so.

I can respect that Microsoft wants to make money, and they're good at doing it, but in all the wrong ways. There's been a good bit of suggestion that Microsoft kept it off to keep support costs down from clueless dolts who can't figure out how to punch holes in a firewall to use what they want. It's not that the customer was right, it's that they didn't want to hear from the whiny customer and ICF is an "all or nothing" deal.

Making things easier for the end user should NOT be the primary concern until security and stability are taken care of. If these people want to learn how to run servers, then let them learn some basic networking. It's not really that hard to do basic config on a firewall. I have no sympathy for people who can't read one or two pages out of a manual. IF.... IIIIFFFF there is a way to make all of this a very simple process, then by all means - go for it. I'm all for letting regular people who don't want to get bogged down in technical details use things like servers and p2p etc. But, hey, if it comes at the cost of security - especially if that has the potential to affect others like this issue does, too frickin' bad. If you want a Counterstrike server, learn how to use a damn firewall or shut up and leave ICF on.

As for the HP thing.. well, that's because HP is stupid, apparently. If I were him I'd just stay away from HP if it's going to download and install crap blindly. Mind you, unlike this HP "feature" (it's not a bug...), I wouldn't be real pleased if they just turned it on blindly and didn't tell the consumer about it. Put it in the Welcome guide or whatnot and if the end user skips the guide, well, too bad. Guess they should've been a little more patient with the handholding if they're not going to learn to use their system.

Re:Guess Who's To Blame

[phliar]

The problem isnt' windows. The problem are broken machines on a network.

I'm reminded of the Saturday Night Live skit with Dan Aykroyd hawking the popular toy "Bag of Glass." Letting Joe Blow put a Micros**t machine on a broadband connection is like giving a kid a loaded gun. Of course it's Micros**t's fault -- and they're the only ones who can actually do something about it, like not making "broken by design" operating systems.

It's time to ban Micros**t machines from the Internet -- they're breaking it for the rest of us.

Re:Guess Who's To Blame

[wirelessbuzzers]

One thing that Apple does is that when you turn on the service, it unblocks it at the firewall. But the point is that the service must be turned on.

As for the keychain, I don't know how secure it is. It may be that someone can write an exploit that would look at your keychain and read it. But it is possible to write a program that does protect the user unless the attacker can get root. You make the keyfile readable only by root, and identify programs in some secure way (MD5 or what, but you have to make sure a malicious program can't run, and then replace itself with a link to atrusted app), and if you do it all perfectly, no program can automatically decrypt stuff.

Re:Guess Who's To Blame

[Anonymous Coward]

why isn't this funny....can't you sit back an imagine this bloke going postal with a machete because there ain't two pages of keep your a/v updated.....

relax, have a few pints...it all gets better

Re:Guess Who's To Blame

[Anonymous Coward]

Funny!

Re:Guess Who's To Blame

[Suidae]

The meta-information on files should be held by the filesystem, not tied to the file

As a user of file sharing applications, I'd have to disagree. Currently people are using long filenames as meta information holders, representing the file's content, publisher type and etc. This is difficult to manage and very much sub-optimal. I really think that all files should have an alternate stream or resource fork or whatever that contains meta information about the file, including things like whether or not it contains executable code. The operating system can then know if it is supposed to be able to execute such files, and whether or not it allows the user to execute new files without a warning is up to the sytem.

I agree re not letting people do stupid stuff if it can easily be avoided. Too bad microsoft doesn't.

correction

[Anonymous Coward]

s/hackers/crackers

Re:correction

[Thuktun]

s/hackers/crackers

Unfortunately, that particular horse has already left the barn, jumped the fence, and is roaming the countryside.

Re:correction

[Anonymous Coward]

Lucky horse.

Re:correction

[Anonymous Coward]

No, a cracker is a disparaging name for a white person.

Re:correction

[Anonymous Coward]

Yeah, cause no one ever really corrects them...

s/hackers/crackers/gi

Does not seem so

[too_bad]

Did anyone here try the sites mentioned in the article:
rackshack.net seems to be a static address hosted at ev1.net
removeform.com does not even work, since it seems to always point to
bestportal.biz which has an IP address of 1.1.1.1 which is not even valid.

HuH? What are they talking about?

Even if they did somehow create cloaked IP address, you can still go after the domain name.
The article does not seem to make a lot of sense to me. Some one explain if they found anything
real.

Re:Does not seem so

[26199]

As I understand it, those are the legitimate sites being sneakily used to host illegitimate material. I don't think the article actually gives any of the 'masking' urls.

I could be entirely wrong...

Re:Does not seem so

[muzzmac]

Obviously the Polish wankers have disabled the web sites for the minute.

Sounds like a Jihad against name-services.com is needed.

The bad DNS hosts are the issue now.

Mind you. We still need to clean the zombies.

Re:Does not seem so

[schon]

Looks like they've changed it, but here is a result of a query I did earlier today.

; <<>> DiG 9.1.2 <<>> removeform.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57655
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 5, ADDITIONAL: 8

;; QUESTION SECTION:
;removeform.com. IN A

;; ANSWER SECTION:
removeform.com. 1714 IN CNAME bestportal.biz.
bestportal.biz. 35 IN A 213.106.63.234
bestportal.biz. 35 IN A 217.236.44.151
bestportal.biz. 35 IN A 12.228.210.215
bestportal.biz. 35 IN A 212.235.74.11
bestportal.biz. 35 IN A 213.44.248.219

;; AUTHORITY SECTION:
bestportal.biz. 35 IN NS ns3.bubra.biz.
bestportal.biz. 35 IN NS ns4.bubra.biz.
bestportal.biz. 35 IN NS ns5.bubra.biz.
bestportal.biz. 35 IN NS ns1.bubra.biz.
bestportal.biz. 35 IN NS ns2.bubra.biz.

;; ADDITIONAL SECTION:
ns1.bubra.biz. 6942 IN A 81.57.49.17
ns2.bubra.biz. 7114 IN A 81.49.240.135
ns2.bubra.biz. 7114 IN A 81.77.191.222
ns2.bubra.biz. 7114 IN A 81.249.14.196
ns3.bubra.biz. 7114 IN A 80.138.190.74
ns3.bubra.biz. 7114 IN A 81.77.132.153
ns4.bubra.biz. 6942 IN A 81.53.147.179
ns5.bubra.biz. 7114 IN A 82.42.127.214

;; Query time: 18 msec
;; SERVER: 192.168.20.2#53(192.168.20.2)
;; WHEN: Thu Oct 9 09:17:01 2003
;; MSG SIZE rcvd: 364

Re:Does not seem so

[nstrom]

I read the wired article earlier today, and a DNS query for removeform.com spit out 5 IP addresses - all cable modem/DSL machines. Two were ATTBI, the others were some smaller ISPs. Obviously, the DNS providers shut down at least this particular domain. It was up earlier, though.

Re:Does not seem so

[caluml]

DiG 9.1.2

Hmm, hope that's only your bind-utils package... :)

Re:Does not seem so

[L-Train8]

The article is talking about spam with a link to a web page. The web page has a form to input your credit card number, your address, and how many penis enlargers or cases of viagra you want.

Now, let's look at the removeform.com example. If you do a tracert, you do get an invalid IP address of 1.1.1.1 . However, if you ping www.removeform.com, you get a changing IP address. When I tried it a moment ago, it showed an IP address of 160.81.229.205 . A whois lookup shows that this IP address is owned by Sprint, and is probably a cable modem.

How does it work that a tracert gives one IP address result and a ping give a different result? Because the spammers/hackers have their own DNS nameservers. Their nameservers give out different information depending on the type of request the server receives. If it looks like a request from someone trying to reach a webpage, it gives out an address of a zombie machine with an open proxy. This zombie machine passes the request to either another zombie machine to help further obfuscate the trail, or onto the actual webpage. If it looks like a tracrt request, it can send out an invalid address or other misleading garbage.

I don't understand DNS enough to know why your webbrowser would go to the spammer/hacker's DNS server, rather than your ISP's or one of the root nameservers. Or, more likely, why your ISP's nameserver would go to the spammer/hacker's nameserver and not the root nameserver. How is that spoofed?

Are the zone transfers from the spammer/hacker's domain constantly changing the routes in your ISP's DNS? how often do zone transfers occur? Is it set with a TTL value, and the spammer/hacker's nameserver have a very low TTL?

The article says that the spammer/hackers change their DNS servers frequently, but it seems to me that would be the traceable point. Any smart people out there understand how this might be done?

Re:Does not seem so

[too_bad]

Rereading the articles it seems so. Well ... I am eager to see a few of these domains.
I think between the ISP, the domain name registration and DNS provider there is always a
way to trace it back to some service provider. Well, this is an interesting problem.

However the other thing I am more interested is that, it looks like the number of home winpcs that
are "hijacked" is pretty high. I just heard that my friend who is also a techie who has a windows PC at home
found a lot of unidentifiable programs installed. They all seemed to be ad related. It will be nice
if someone with a windows PC, lets their system get affected, and trace all the packets coming in,
to hack the command format. The we can write a small program to scan home PCs for signatures
of being hijacked, and probably re-hijack them, to turn them against their masters !!

Infact tracing the packets controlling these hijacked machines might give a clue about the "real" computers
being used for spamming purposes. I am almost wondering if I should buy an old windows PC just for this.
But, having a windows m/c in my home? Yuckkkk!

Re:Does not seem so

[too_bad]

Actually, look at the previous post and the current DNS query output below. Looks like name-services has kinda a screwed this domain ! BTW, another clue here is the domain registration for bestportal.biz: Billing Contact ID: 683F97442BA1D1E5 Billing Contact Name: Kura Dwa Billing Contact Organization: - Billing Contact Address1: 258 Madison Ave Billing Contact City: New York Billing Contact Postal Code: 10016 Billing Contact Country: United States Billing Contact Country Code: US Billing Contact Email: bulk@wp.pl > server dns1.name-services.com Default server: dns1.name-services.com Address: 63.251.163.102#53 > bestportal.biz Server: dns1.name-services.com Address: 63.251.163.102#53 bestportal.biz nameserver = dns1.name-services.com. bestportal.biz nameserver = dns2.name-services.com. bestportal.biz nameserver = dns3.name-services.com. bestportal.biz nameserver = dns4.name-services.com. bestportal.biz nameserver = dns5.name-services.com. > set type=any > bestportal.biz Server: dns1.name-services.com Address: 63.251.163.102#53 Name: bestportal.biz Address: 1.1.1.1 bestportal.biz origin = dns1.name-services.com mail addr = info.name-services.com serial = 2002050701 refresh = 3600 retry = 120 expire = 86400 minimum = 3600 bestportal.biz nameserver = dns1.name-services.com. bestportal.biz nameserver = dns2.name-services.com. bestportal.biz nameserver = dns3.name-services.com. bestportal.biz nameserver = dns4.name-services.com. bestportal.biz nameserver = dns5.name-services.com.

Re:Does not seem so

[too_bad]

Well here is a start: Whois query for bestportal.biz provides some real information !
(hope its real since its the billing address)
Billing Contact ID: 683F97442BA1D1E5
Billing Contact Name: Kura Dwa
Billing Contact Organization: -
Billing Contact Address1: 258 Madison Ave
Billing Contact City: New York
Billing Contact Postal Code: 10016
Billing Contact Country: United States
Billing Contact Country Code: US
Billing Contact Email: bulk@wp.pl

As for pinging the www.removeform.com, looks like I always consistently get 1.1.1.1 both from my linux m/c
and a windows pc.

When exactly did you try ? I get the same result for pings, for accesses by a browser and what not.
Maybe the DNS does something based in source IP ?

Seeing this on your servers too?

[slashhax0r]

On our Can-it (anti spam) box, i have seen an increase in messages in the pending bin. They are all the same spam, but from a multitude of different IP. All within a very short timeframe of one another. anyone seeing this too? What sucks is when a spammer decides to spoof your domain and you get a 100000 bounce messages a day. *sigh*

Re:So much spam it sucks.

[Trigun]

Spammers are winning.

I hate to say it, but they are. They're winning because they play dirty, and we can't stoop down to their level. After two weeks of battling an unusual torrent of spam, I'm ready to torture one of the bastards in a week-long live-webcast to serve as a warning to everyone else. It's time to sink below their level, so we can punch them in the nuts without throwing out our backs!

Take the profit out of spamming

[Lead Butthead]

or the problem will never go away.
Quit buying those penis enlargement pills already...

Re:Take the profit out of spamming

[Anonymous Coward]

Quit buying those penis enlargement pills already...

It only took two bottles.. and now my cock is huge! No need for me to buy again. Death to spammers!

Re:Take the profit out of spamming

[ascalon]

The spammers aren't getting paid by how much they sell, but instead how much they mail... buying or not won't effect anything.

Re:Take the profit out of spamming

[Anonymous Coward]

You're dumb.

Re:Take the profit out of spamming

[Anonymous Coward]

Problem is, that .0012% of the population shouldn't be allowed computers in the first place.

Re:Take the profit out of spamming

[iantri]

Even if only 1 out of every 10 000 emails creates a sale for them, they will stay in business. I suspect I may be out on those figures by 10's of thousands, too. The thing about spamming is that it is virtually free to send a million SPAM messages.

Re:Take the profit out of spamming

[VanillaCoke420]

Well if everyone stop buying the stuff, then no one will buy the spammer's services either. The question is, who the hell buy the stuff from them?

Firewall? Doesn't everyone know . . .

[StyleChief]

It seems that the general computing public has yet to learn that a firewall is every bit as important (if not more important?) than good virus software. With excellent free firewalls available, it seems that the word must be slow to get out to masses. I get probed about once every ten minutes or so when I'm online at home. Examination of the logs reveals that (judging from the ports) most of them are malicious probes looking for zomby bait.
How can we educate the public about this so we don't keep suffering these casualties of war (now spammers have divisions of zombies too!).

Bulletproof?

[Anonymous Coward]

"Not quite bulletproof, but certainly ups the ante in the spam war."

Actually, the viagra just makes you feel bulletproof.

Re:Bulletproof?

[Anonymous Coward]

Trouble is, that feeling is only in the pelvic area.

Illegal Activities

[Herkum01]

Of course this is just the supply attempting to meet the demand for people who are deseperate need of thicker penises, more viciodin, and larger breasts. Why else would they continue to notify use of these offers? They are just doing the world a needed service I tell you!

[/RANT OFF]

Re:Illegal Activities

[BrynM]

Of course this is just the supply attempting to meet the demand for people who are deseperate need of thicker penises, more viciodin, and larger breasts.

Mid-way transgenders strung out on vicodin is a very scary thing. Definitely someone that I don't want to meet.

hence the [sic]

[Anonymous Coward]

genius.

Re:hence the [sic]

[Anonymous Coward]

it got my karma up anyway.

Re:hence the [sic]

[Anonymous Coward]

double genius

Re:hence the [sic]

[Anonymous Coward]

isn't it cool how we can have these side conversations and the mods ignore us?

corepirate nazis use J. Public as eXPerimeNToll

[Anonymous Coward]

hostages of ?pr? ?firm? hypenosys.

fauxking ediots should be in jail. instead:

from the grasping_for_something_to_say_besides_i'm_afraud dept.

Viruses are becoming increasingly more sophisticated and the time between the delivery of a patch from Microsoft until hackers figure out workarounds is becoming dangerously short. In the case of the Blaster virus it was 25 days, Ballmer said

"When it gets down to five or 10 days a lot of our users will be in a tough position. Their [hackers'] exploits are getting more sophisticated," Ballmer said.

you wonder how these fauxking corepirate nazi payper liesense stock markup FraUD ediots can stay out of jail for yet another daze? defense lawyers. that's how. you're paying for it, as well as everything else.

white lists, not black ones

[axxackall]

Blacklists is a part of the war which will last forever.

The only way to fight the spam is white lists supported by keys which should be certified either by the user (friends and partners) or by the goverment (white book).

Everything else is an illusion of a fight and like the Cold War with the Soviet Union. But guess what? "Good" users are playing a role of the Soviet Union dreaming about the perfect cyber society, while spammers are capitalistically motivated sharks (means the western world in the cold war). And the history of the Cold War is teaching that capitalism is winning, while dreamers are losing. Do you wanna win? Change the game rules. IMHO whitelisting is the way to do that.

Re:white lists, not black ones

[Glonoinha]

I have a separate Hotmail account account for emailing a few friends that has never received spam - and it is about a year old.

The trick? Whitelist my friends. Voila! Instant no-spam email.

My other Hotmail accounts are a few years old and they get TONS of spam, for the record.

Granted Whitelisting works a lot better when you only have three friends, your mileage may vary.

Re:white lists, not black ones

[Hard_Code]

"capitalistically motivated sharks"

Hey, I'm all "ra ra comrades" like the rest of you (*glances around*) but capitalism is supposedly based on strong property rights.

Spam is (usually, and at least in the locations of the majority of victims, i.e. people in countries with money to buy stuff) a VIOLATION OF PROPERTY RIGHTS. It is not a legitimate business practice. Isn't it coincidental how a lot of spam originates from non-capitalist countries?

Re:white lists, not black ones

[Anonymous Coward]

hash cash! simpler than whitelists. although hashcash can also be used with whitelists.
http://www.camram.org/camram_works.ht ml

Re:white lists, not black ones

[swordgeek]

Blacklists don't work. They simply escalate.

Whitelists don't work. They simply escalate.

As long as spammers are allowed to send stuff, they'll waste bandwidth and server space. If they have to, they'll start forging spam to come from your friends. They'll steal keys if they have to, as they get more desparate. Or alternatively, they'll spam to MORE people, and only get the ones without whitelists.

Greylisting has great potential, because it forces up the cost of spamming. This latest 'tactic' of the spammers is wonderful news, because it's a serious enough crime to get some of them thrown in jail.

Re:white lists, not black ones

[axxackall]

The fact of property right violation in case of spamming is so questionable that it took special laws to begin fighting spammers. If it would not be so questional then there should be enough of existing laws to jail the suckers.

As an example: do we need a special law saying that steeling the TV set must be punished? No, we don't. Because we have a law protecting our property in general.

Re:white lists, not black ones

[Anonymous Coward]

Don't get enough spam at home to need it, but my plan is following:
hashcash mail gets right through, no wait.
grey list everything else
possible black list as well and white list.
But in all cases, offer a link to a page to identify yourself as a good site.
Maybe simple human verification to identify as non-evil.

Does port blocking mean it's not "Internet"

[DoofusOfDeath]

Forgive my ignorance of the relevant RFCs, but if a service provider doesn't let all valid (according to the RFCs) packets get to your box, are they actually providing "Internet" access?

I.e., isn't it a different protocol at that point?

Re:Does port blocking mean it's not "Internet"

[Angram]

Well, that would make it false advertising - if your ISP uses the words "Internet Access" but prevents you from doing something [legal] on the internet, you can sue. Same as marketing a copy-protected disk as a CD.

Re:Does port blocking mean it's not "Internet"

[nate1138]

Sure they are. Just limited access. It is still a TCP/IP connection to the internet.

Personally , I think this is a great idea. Especially if the ISP provides some kind of a web interface to allow the customer to open/close ports on their own (most wouldn't bother). Or maybe provide a router, pre-configured with the service. NAT and a basic firewall stops most k1dd3z cold. It would put a halt to the vast majority of the MS worm problems on home systems too.

Re:Does port blocking mean it's not "Internet"

[Hard_Code]

No, it's all tcip/ip/udp. Blocking an application level protocol does not really change the status of the connection you have (you can just do less with it).

Although it is a legitimate question whether stateful/content-based filters erode the usefulness of the net...

Interpol?

[Valdrax]

Is Poland honestly lawless enough for this not to be illegal there? Can no one sic Interpol on these jokers?

Re:Interpol?

[imbaczek]

I'd file a complaint personally if I knew something about this certain firm.

Yes, I live in Poland. No, I don't even know how the f$ck$rs are called.

hardly new

[Anonymous Coward]

this has been going on for years. you
think these guys are geniuses and just
came up with this a week ago and already
own 500,000 boxes?

Somebody wrote about this here six months
ago:

http://ralphmag.org/CC/letters.html

Maybe this will get those IE bugs fixed!

[VernonNemitz]

A quote from the 2nd page of the article:
"In a further effort to compromise new systems and add them to their arsenal, Tubul's group appears to be using its "spamvertised" sites to infect visitors with a malicious program. Recent reports in online antispam discussion groups indicate that an invisibly hosted site called miracleformen.com was attempting to install a suspicious executable file on visitors' computers using a vulnerability in Microsoft's Internet Explorer browser."

Re: very recent /. article

Re:Hacked machine

[Anonymous Coward]

What the hell is that link?

Log spammers

[leoboiko]

My home webserver has problems with "referrer spammers" (guys who keeps wasting your bandwidth with false referrer info to get higher scores at Google). Currently I just keep a list of spammers IPs and block them away.

Some of the "referrers" are spammed from many different IPs, usually from some DSL provider. I wonder if they're cracked machines doing the spammer's job.

Re:Log spammers

[quantum bit]

My home webserver has problems with "referrer spammers" (guys who keeps wasting your bandwidth with false referrer info to get higher scores at Google). Currently I just keep a list of spammers IPs and block them away.

I've seen this before, but never been able to figure out why. Any idea why they think doing this will inprove their Google scores? It's not like Google has access to my web server logs...

Re:Log spammers

[leoboiko]

Many people (including me) use a tool like the webalizer, wich generates a page of server statistics. This page links back to the referrers. So yes, Google has access to the server logs.

The "referrer spam" phenomenon began in the weblogging community, wich use things like the webalizer extensively.

I reccomend asking Google to not cache the webalizer stats page (via robots.txt).

RBLDNS

[vgaphil]

My blacklist runneth over....

Wow! just think if they used their powers for good

[inteller]

We'd have a cure for AIDS and the common cold by now.

rackshack.net

[Skapare]

From the article:

"Try to find the real IP," he said. "This host is in rackshack.net, the most antispam ISP."

My experience with rackshack.net (e.g. ev1.net) is quite the opposite. While one of their hosted spammers was making a 3 week long run of thousands of spam to my mail server, this was repeatedly reported to them, including by telephone call, and they did nothing about it ... at least not for 3 weeks. That is why rackshack.net and ev1.net have earned a special place in my private blacklists to block their entire network. Only their CEO can make arrangements to get it unlisted now.

Re:rackshack.net

[Anonymous Coward]

Only their CEO can make arrangements to get it unlisted now

I'm sure he doesn't sleep at nights because he can't get to "linuxhomepage.com". Oh yeah, he must be shitting his pants.

Re:rackshack.net

[Anonymous Coward]

Same here. All of rackshack/ev1 can no longer even do DNS lookups of anything on my network.

Now we know how Skynet evolved...

[naztafari]

it started as a network of hi-jacked zombie machines...

And its original purpose was more nefarious than destroying the human race: shoving SPAM down people's throats!

Re:Now we know how Skynet evolved...

[caluml]

shoving SPAM down people's throats

PAK CHOOI UNF
Shoving will protect you

Re:Now we know how Skynet evolved...

[Anonymous Coward]

NO! Pushing will protect you.

This is progress - spamming now requires felonies

[Animats]

This is an indication of real progress - spammers now have to commit multiple felonies to spam. That's enough to attract serious law enforcement attention.

The way to go after spammers, as I keep pointing out, is to follow the money. Find out where the credit card transaction goes. If a criminal offense is involved, any financial intermediary has to either reveal who's behind it or be charged with being an accessory to a felony.

Out of bad, good must come

[Digital Dharma]

Personally, I'm glad this sort of thing is happening. If it didn't, it would mean Microsoft was highly secure and it would not be possible for one to hijack their operating system so easily. Because of security issues such as this, Microsoft is making the inevitable exodus from their platform that much easier. I pray for more issues such as this. The more we have, the sooner Microsoft will fade from the scene.

Re:Out of bad, good must come

[apt142]

I fail to see how this is the point. It's not the issue of the operating system. It's the issue of the user. Users are not protecting themselves with firewalls, they aren't patching, and they aren't watching their computers. Simple as that.

Re:Out of bad, good must come

[Digital Dharma]

Let me give you a hypothetical situation: You buy a brand new car. After owning the car for a few months the manufacturer discovers a flaw in the security system that causes the car to arbitrarily become unlocked and the engine to start. The manufacturer putzes around with this knowledge for a few months and eventually releases a recall notice on their website offering a free repair. Being an average driver with no real inclination to ever ascend to the elite "power driver" status, you never check the website because you are either unaware of it or simply don't care because you're more concerned with driving the car as opposed to maintaining it. Isn't that what you pay mechanics for? One day while you are out doing some bland, mundane task the vulnerability kicks in and unlocks and starts your car while it's parked in the parking lot of some retail outlet. Someone walking by takes advantage of the situation and steals your car. Would you want to take the blame for this? Average users con't give a shit about security or anything else. They just want to use their computers.

Re:Out of bad, good must come

[bninja_penguin]

I do realize the blame lies mostly on the end-user, but at the same time I can't help but think, between Bill Gate's own "worth", and the "worth" of of Microsoft, there is just about $100 BILLION in US dollars. With that kind of capital at their disposal, I do place a vast amount of blame squarely on Microsoft. That is enough capital that Microsoft could actually close it's doors, and either do a complete, from the ground up rewrite of it's entire OS, or a complete, entire audit of it's code base, even if that took years to complete. Sure, they'd take a big hit, but Jumping Jiminy, they are not putting things right by dribbling out a few patches here and there that may or may not work. It doesn't help that Microsoft includes full productions of "how to email" training videos, which never mention security, or that they put a (very crappy) firewall in, that, if the user acutally finds where to turn it on, only looks one way.

So, yeah, the blame lies with the end-user, but Microsoft doesn't want the end user educated, nor do they want to fix their OS properly.

Why? Who knows. I do think a large part of that is Microsoft's main agenda is to become like a public utility, where they can charge a monthly fee, or shut you off. Their entire movement towards trusted computing, embedded systems, multi-media rich platforms, and information access has exactly nothing to do with empowering the enduser, no matter what the marketing arm spouts off. It is 100% about control. Not your control over your personal stuff, but Microsoft's control over information, from it's storage, it's disemmination(sp?), it's creation, and it's use.

Do I sound paranoid yet? I hope to every power there is that's all I am. But the more I find out about Microsoft, the scarier the future looks.
And, no, this information doesn't come from Slashdot, it comes from Bill Gate's mouth, in his book "the road ahead" or whatever it's called, it come from their own website, from their press releases, and from their R&D.

Re:Out of bad, good must come

[Digital Dharma]

Wow. That's a lot to think about. I don't agree with you about where to place blame for mishaps (Microsoft or end users), but from what I've seen so far about Palladium and other new technologies coming forth, it does seem possible that this is the direction Microsoft has chosen. Given the free nature of the Interweb, I wonder if they'll even come close to achieving this goal, should they choose to pursue it. It may not be technically possible for one company to control that much. If we can't even get rid of spam, I honestly doubt any one company could position themselves as a "utility".

Profit?!

[Anonymous Coward]

they blame part of the alliance on market forces, leading some skilled engineers to the dark side for profit's sake

Money?? You mean there is money to be made in spamming?! SIGN ME UP. Heck, I'll kick in my mother's family-only email address. I didn't know there was still a way to make money with computer skills.

This is news?

[Anonymous Coward]

Well, maybe from 2001...

SPEWS

[undef24]

This is why spews is great. They don't just block the machine that got spammed, but the ISP hosting the site advertised in the URL, forcing the ISP to remove the spammer completely.

I guess you could use this to take out your competion by sending fake spam though. Oh well.

Re:SPEWS

[schon]

They don't just block the machine that got spammed, but the ISP hosting the site advertised in the URL, forcing the ISP to remove the spammer completely.

If you read the article, you'll note that the ISP hosting the site never get's touched..

They use HTTP proxies installed on trojaned machines to hide the real location of the website.

Re:SPEWS

[undef24]

Yeah, so won't the people with hacked sites find out that they are "hosting" this site when their mail gets rejected?

Congratulations!

[Anonymous Coward]

That's the most incoherent /. post I've read in months. Truly a remarkable achievement in the face of such stiff competition.

We know who to blame

[jo42]

> control of 450,000 Trojaned systems

This is all Microsoft's fault.

We need to fire up a few more lawsuits in other countries against the buggers for excreting such holy software...

Re:We know who to blame

[PhreakinPenguin]

That's it, cast out that line and troll until you're tired.

This is new NEWS?

[Anonymous Coward]

Whatever,, your a few YEARS late on this one wired.

Re:This is new NEWS?

[Anonymous Coward]

I discovered this in December of 1999 and posted about it in January 2000.

http://archives.neohapsis.com/archives/incidents /2 000-01/0074.html

This spammer actually coded a trojan called digiclock.exe and put it in the vic's statup folder. After submitting it to Norton they called it the "Hidemail" trojan an put it on their def list.

Illegal for Spammers and their clients?

[WatertonMan]

The only reason to Spam is to sell a product. But surely if some seller advertises this way, utilizing hacked systems, they are in serious violation of law. Why don't the feds simply go after the clients of spammers. If that happened enough you'd think that the spammers wouldn't be able to make money and would simply stop spamming!

Re:Illegal for Spammers and their clients?

[dranga]

I imagine it might get hard to proove that the client really did pay the spammer for the activity... and someone could abuse that and send out ads for a company that they don't like, just to see that victim company get fined/sued...

Re:Illegal for Spammers and their clients?

[Anonymous Coward]

*You'd have to catch the spammer.
*Hard to prosecute if they're not US-based.
*Have to convince a jury that the spammer knew he was buying illegal services

Re:Firewall -- NO ASS

[Anonymous Coward]

its ignorant statements like that that make ISP's think its acceptable to filter ports and protocols. this is NOT acceptable.

Interesting ports on 200.138.238.253:
(The 1642 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
21/tcp filtered ftp
23/tcp filtered telnet
25/tcp filtered smtp
80/tcp filtered http
110/tcp open pop-3
119/tcp open nntp
135/tcp filtered msrpc
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
1080/tcp open socks
6667/tcp open irc
7000/tcp open afs3-fileserver
12345/tcp filtered NetBus
12346/tcp filtered NetBus
Device type: general purpose
Running: Microsoft Windows 95/98/ME|NT/2K/XP
OS details: Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP
TCP Sequence Prediction: Class=random positive increments
Difficulty=10401 (Worthy challenge)

Better Yet

[WindBourne]

The real problem is that services are becoming centralized which allows for easier spamming. In addition, there is a very easy system to crack and install a home-built forwarder.
The real answer should be distributed services. That is, companies should offer a nice set-up for doing e-mail, web-services, etc from the home. It should like wise be a service that the system is updated.

holy software...

[Anonymous Coward]

holy software...

Hallowed be thy compiler.

How to combat this

[theolein]

I was wondering how it would be possible to automatically combat this. It would need some form of tracroute combined with a DNS lookup that logs the DNS server when the end point in the trace is a cable or dsl user. The cable or dsl user should be fairly easy to identify as such in that their names usualy include in some form that refers to their ISP.

Bzzt!! Repetition

[Anonymous Coward]

You already posted this and it is as incoherent this time as that.

[sic]?

[Sebastopol]

[sic] is only meant to be used when a typo is reprinted verbatim, and it appears after the incorrect word. "hackers" appears to be spelled correctly.

Re:[sic]?

[Anonymous Coward]

Not just typos, it's whenever an "editor" cannot tidy up the original to make any sense. Although of course, here on /., the editors don't actually do *any* editing - the sic was put in there by the original submitter. I can understand why Wired used hackers - they combine spammer with hacker to get "spacker"; combining spammer with cracker leads to the much less satisfying "crammer".

Re:[sic]?

[psi_diddy]

The incorrect word was used. Said In Context is for more than typos; it is used for poor grammar and incorrect usage. Here the word "hackers" is used where the context calls for "crackers".

Re:[sic]?

[Rob Riggs]

It is spelled C-R-A-C-K-E-R-S, you maroon.

Re:[sic]?

[rscrawford]

In this case, the word should have read, "crackers". Hackers, in this case, was a typo.

Re:[sic]?

[Anonymous Coward]

From WordNet (r) 2.0 [wn]:

sic
adv : intentionally so written (used after a printed word or
phrase)
v : urge a dog to attack someone [syn: {set}]
[also: {sicking}, {sicked}]

In this case Wired used the word 'hackers' in its pejorative sense. The submitter calls attention to the misuse of the word by following with [sic], latin for "he said".

Re:[sic]?

[someonehasmyname]

Maybe he was implying that "hackers" is a term for programmers and they should have used the word "crackers" instead.

Profile of spam encourager?

[SupaSherpa]

I've seen several articles and profiles on spammers, and those that fight them, but I've never seen an honest and critical look at those who are encouraging more spam by making it profitable for them. Who buys the penis pills? Who can't find porn on their own? Ok, the answers are obviously morons with small penises, but what makes them respond to spam, when it is such a widespread problem? It worries me that as the battle continues between spammers and anti-spammers, a kind of symbiosis will thrive that'll prevent any real attempt on how to stop the problem. Look at telemarketing. The main argument for telemarketing has been jobs. Millions of jobs! How did it get to be so many? Morons with small penises? And soon enough spam and anti-spam camps alike will screaming the same things. Lets focus on the consumer and make it clear that they are the real problem here.

Re:Profile of spam encourager?

[Anonymous Coward]

Who buys from spammers? Lots of folks.

It's only a matter of time...

[Have Blue]

...Before computer use (at least on the Internet) requires a license. I realize that has some very large drawbacks, but at the rate we're going one day the benefits really will outweigh the drawbacks. Do we have to wait until network traffic is 90% spam and viruses? 99%? 100%? A computer can do more damage to the network than a car can do to a highway, and we license driving. Maybe we'll wait until poor network performance starts to kill people by interfering with hospitals and emergency services.

Re:It's only a matter of time...

[pjrc]

A computer can do more damage to the network than a car can do to a highway, and we license driving.

Human lives are at stake on highways! People are injured and can be killed in car accidents. Many people, every year.

Forget inconvenience to other drivers and passengers, disruption to the orderly flow of traffic, and overall higher costs to be borne by everybody (the rough parallels to the "damage" caused by compromised computers). Human lives are what matters. Lives can not be replaced and most serious injuries are not fully recoverable.

Try to keep some perspective here. The "more damage to the network" doesn't involve people's lives being forever lost, with the resulting loss to society, pain to loved ones, family and friends. Damage to the network doesn't put people in the hospital with serious pain and suffering, often without complete recovery thereby taking an enormous toll on the rest of a person's life.

Even economically, damage to the network doesn't involve physical propery being destroyed. Huge medical bills aren't incurred for victims who are hospitalized, not to mention ongoing therapy. Network damange doesn't leave otherwise able-bodied people with loss of productivity due to lasting pain, limited mobility and other horrible medical consequences. Network routers and computers don't even incurr dents and scratches, requiring expensive body work and repainting to properly repair.

In the grand scheme of things, all those compromized computers (presumably due to inexperienced users) cause network operations to cost more due to additional infrastructure, and occasionally they cause extra delays or even some downtime for legitimate users. To say that's more damaging that automobile accidents is horribly insensitive to the pain and dead suffered by victims of real-life car crashes.

How can anyone be so removed from reality to believe excessive network bandwidth usage is more damaging than human lives being lost and real people suffering pain and injury? Would you roll down your window and cuss and swear at a man bleeding to death on the side of the road and you pass by, for the "damage to the highway" that caused you to wait in the resulting traffic jam?

Re:It's only a matter of time...

[Dirtside]

A computer can do more damage to the network than a car can do to a highway, and we license driving.

But we don't license driving in order to protect the highways. We license driving in order to protect the people using them. (Not that your overall point necessarily fails, just the analogy. :))

Re:Wow! just think if they used their powers for g

[gbjbaanb]

don't tempt them - I mean, do you really think the "all natural penis enlargement tablets", or the "hair regrowth lotions" work?
What's to stop a spammer trying to sell AIDs-stabilising drugs? "all natural, developed by Dr Chien using ancient herbal remedies the big corporations don't want you to know about".

Immoral bastards, all of them.

I think my home machine was compromised ...

[GreatOgre]

and I caught this past Sunday. I wouldn't have noticed it if hadn't been that my user account loat privilages to "ls". I'm in the process of trying to sort out the problem and secure my machine. For the moment, I've stopped almost all service on the machine except the ones I need for internet connection sharing and only have the DSL modem on when I'm surfing and checking my email.

Since I'm not a system administrator, anybody have some good pointers for me? Since I haven't read the article yet, does it give home users (particularly Linux users) some good info on securing your computer/home network?

The most ironic thing about this, was that I was planning on taking my computer down in about a week to do most of the work I'm trying to get done now.

Re:I think my home machine was compromised ...

[Anonymous Coward]

If you have been compromised, take down your box immediately. Try to figure out how it was compromised.

And then wipe it. Completely. Full reinstall. (And remember to patch afterwards, but before connecting to the 'net.) Even the most paranoid nuts might miss a modified file somewhere, which would nullify any 'repairs' you might make.

In the US, but what about other countries???

[neilb78]

In the US, but what about other countries???

Geography 101

[Greedo]

Uh ... Poland is a country of the former Soviet Union? I don't think so.

Maybe an eastern block country. Maybe a Soviet satellite state. But hardly on the same level as Belarus or the *-stan countries (Turkmenistan, Kazakhstan, Uzbekistan, etc.).

Re:Geography 101

[rutledjw]

Two words for you:

Public School.

;)

Re:Geography 101

[Knife_Edge]

Actually, Poland was pretty much run by the Soviets during the Cold War. They were quite behind the Iron Curtain, certainly east of East Germany, which was where the Iron Curtain ended. I don't consider 'Eastern Bloc' and 'Former Soviet Country' to mean two different things, dunno about anybody else.

Re:Geography 101

[frn123]

Clearly, you did not live in either Eastern bloc nor Soviet Union. Otherwise, you'd know the difference was enourmous. Trust me, i've seen both. It's like a difference between US and Cuba.

Criminal

[dolo666]

This is totally evil, that spammers are stooping so low to... wait a minute. Never mind.

Can you say class action suit? The fear of my system being hacked by spammers has left me depressed. Give me a million dollars. Now.

Maybe if we geeks find out how to patch systems affected, that would make a good followup /. article. (I'm guessing the easiest way to patch would be to switch to Mac, or perhaps Linux (tee hee!))

How to get everyone to switch away from microsoft

[Anonymous Coward]

I read this and this and thought:
If you want to Linux to dominate and destroy Microsoft.. Start writing Windows worms, viruses, start using windows web servers to spam spam spam. Make windows so intollerable that people will have to switch, even if they don't want to.
Be a black hat for white hat reasons?

OK - so is there a fix on the user side?

[jpellino]

So if I have an off-the-shelf router this side of my cable modem, what can be done to prevent my cable connection from being used for this?

And the why is the link to the story about the guy who was seemingly the origin of lots of spam.

I'll go re-rtfa, but such a fix didn't pop out so far...

No need for a SPAM law then

[jmv]

If that's the way spammers operate, there's no need for new spam laws, no? What they're doing (unauthorized access to a machine) is already a criminal offense. Why not prosecute on that?

HERE HERE!!! Mod Parent UP UP UP

[Anonymous Coward]

I pray for more issues such as this. The more we have, the sooner Microsoft will fade from the scene.

True, and I believe that most laws today are ineffective so I think we should promote more lawlessness so the current way of doing things will fade from the scene and something better will arise from it. In the meantime, you shouldn't mind then if I steal your computer, beat your family members, and use your credit card right? Bully idea.

Yes, here it comes

[Anonymous Coward]

In Soviet Russia, trojans control 450,000 firms!

mynuts won kode blew alert

[Anonymous Coward]

sometimes the pateNTdead eyecon0meter just goes off on it's own, sensing a mistitlement or something. we'll make the appropriate adjustments directory.

Protection on a home level

[ducomputergeek]

I know that we have a NAT firewall on the Wi-fi router in my appartment and then I use Apple's IP firewall on my ibook along with several *iux based security tools and Zone Alarm on my PC and I rarely see any messaged on the PC pop-up about attempted port scan.

When I lived on the dorms, it was a different story. There were an average of 4000 attempt portscans on my machine a day.

Its almost gotten to the point of without turning to viglantism on the internet and launching counter DDos attacks on the spammers themsleves, especially those outside of countries that don't enforce or don't attempt to enfore any type of Spam laws. Most spammers now operate outside of western countries, so what's the cure?

Filtering helps, tools like Spamassassin has brought my total spams from like 80 a day to less than 10.

I for one, as much as I hate them, wouldn't mind to see a few class action lawsuits against spammers. How much longer until the pipes bust with junk and turn the Internet into a near useless medium.

I know several of my clients now call me instead of email as they say that they "Have to wade through 30 junk messages for one valid message". I have rules set up to where my customer's and family email go to seperate folders, and that helps even more, but something needs to be done.

As much as I hate to bitch and not offer any answers, I am afraid that I am stumped. I fear that any attempts to write new protocals, espically by the likes of M$, Yahoo, HP, and other major players, with result in the closing of networks, (i.e. this message was not authenticated by a pallidum enabled server, therefore it will be rejected. Please trade your Mac in for a PC with Win XP^2 for $1000) and cause a leap backwards. At the same time, while people here can say the OSS community will develop an "open" solution, the very fact that its open means that the very people we try to stop will be able to circumvent anything the community develops. Not to say this won't happen with closed-source technology, but then companies like M$ can possible use DMCA against the spammers that reverse engineer such technology.

In any case, spammers are winning and we all are losing.

Re:Protection on a home level

[Deacon Jones]

Agreed, and more so.

The problem should concern geeks not just from an annoyance level, but from a business level. Picture the average end user coming home with their shiny new computer, signing up for email acess, and excited about the internet. Only to find out that they have viruses within days, trojans within hours, and more disgusting spam than emails from relatives.

What are they going to do? They are going to turn the thing off, and take it back, its not worth the trouble. They can buy a playstation/xbox for games, and not worry about the hassle that is "the world wide web."

And they can tell all their friends and family to not bother with them, either.

Re:This is progress - spamming now requires feloni

[Anonymous Coward]

Yes, but it's only a felony in the US. None of those doing the work are in the US.

Even a US-based spammer can claim ignorance of the hired hackers' methods.

And what if the credit card is charged in Kazakhstan?

ISP/registrar?

[Hard_Code]

Who are the ISPs/registrars for these fuckers and why aren't burly men in blue suits and submachine guns breaking down the doors of their registered addresses? Isn't DNS tiered? Isn't there an upstream DNS terminating at a registrar? Why can't this be tracked?

Re:ISP/registrar?

[Anonymous Coward]

Maybe it's because:
*Registered addresses are in countries with no spam laws
*Registered addresses are fake

Re:ISP/registrar?

[Hard_Code]

"Maybe it's because:
*Registered addresses are in countries with no spam laws
*Registered addresses are fake"

May very well be true. In which case I hope our next President launches a new War Against Spam. If you give harbor to Spammers you are considered the same as Spammers. Drop the bombs, not fucking mercy.

Too simple a solution

[djeaux]

I agree that a vendor who contracts with spammers who in turn hack systems to send spam is (or should be) as legally culpable as the spammer itself.

But how in the world do we prosecute them if all their spam is zinging off trojaned machines, their "legal" address is an abandoned oil platform in the Caribbean, their credit card processing is done in Russia, their legal department is a nonexistent address in Bangalore & they're drop shipping from East Bumfsck, Kansas?

At that point, what district attorney in the US has enough money to investigate?

Re:Too simple a solution

[Hard_Code]

"they're drop shipping from East Bumfsck, Kansas?"

Sounds like it's time for East Bumfsck to get, err, bumfscked.

Re:Too simple a solution

[meldroc]

I'm sure the FBI's capable of tracking these guys in the same way they track drug rings, who use all sorts of techniques to obfuscate their origins.

Lots of people track down spammers and publicise their home mailing addresses for free. Surely the FBI's computer crimes unit can trace some of the trojans back to spammers, throw a few of them into Pound You In The Ass prison, and get the rest to sing like canaries. If the feds concentrated their efforts on busting spammers instead of people like Dimitri Sklyarov, life would be Better.

Hmmm... Busting spammers AND crackers. That makes me smile...

Zone alarm hosed plenty of PCs

[HDlife]

I installed ZoneAlarm on several WinME and Win98 PCs. However it crashed and otherwise hosed about half of them over time. Hopefully it is better now...but there is a reason why some people are wary of it. Early consumer HW firewalls needed regular power cycling to keep them alive. Really, a very large segment of the population has no idea about how to maintain their computers. The broadband ISPs might need to provide this service. Fortunately HW NATs are making inroads. Though not perfect, they certainly help.

watch what happens when it makes sense to you?

[Anonymous Coward]

there's plenty of coherence. the remarkability is noted.

Spammers == Criminals

[str8]

Here is yet another example of how spammers have no regard for laws and where their activity is blatantly criminal. It also illustrates why spam laws will be ineffective.

It is about time for Law enforcement to find them (follow the money, duh!) and prosecute them. If they are hiding someplace that has no effective rule of law, find them and then knee-cap them. Maybe then they will appreciate law-and-order a bit more.

Psst. Hey buddy, can you spare a .sig?

Wasn't this the projected purpose of Sobig?

[Eberlin]

I've read that one of the suspected purposes of Sobig was to create this zombie network with which to propagate spam. Now this article pretty much points us in that direction. Really disturbing.

I would think that the old days created industrial spy-caliber "hackers" but now it seems that a local script kiddie with a few ways to plant trojans can now have a decent going rate in the black market.

I wonder if there will now be flourishing closed-source underground 1337 groups who don't share 0'day exploitz (and thus stopping the "information wants to be free" mantra) because it has more value sold to marketeers who want to create their zombie army of spam.

More pressure on the powers-that-be to stop viruses, trojans, and the like from getting control of a PC...or at least educate users in the possible consequences they may have.

mod this up

[sydlexic]

all these comments and this is the *only* one that really exposes the naivete of the original post. blocking inbound is useless if a machine is trojaned because the trojans can initiate the connections outbound *on or to any port*. and trojans can arrive in email so an inbound block won't prevent the infiltration of trojans.

Re:mod this up

[JohnGrahamCumming]

I agree that once a machine is trojaned it's possible that it makes an outbound connection to the Internet the inbound blocking does nothing.

But that does not deny the fact that default inbound blocking would prevent worms like CodeRed from spreading, and other "buffer overflow" style attacks initiated from across the Internet (e.g. recent Windows DCOM) problems would be eliminated. All this for the price being paid that ISPs would have to administer these blocks.

Frankly this functionality should be in the DSL/cable modem and administered by the non-Internet side user through a web interface. That's how it works on my home router and it's very easy to open a hole for say SSH if I need it.

Blocking the ports would mean that trojans would have to arrive via some other method (e.g. file transfers and email) which are easily caught using current anti-virus technologies.

John.

Contact the owners?

[AnotherBlackHat]

Seems to me that one of the biggest problems is that there's no way to contact the end user of an IP.
(there's a secondary problem - who should be allowed to contact them)

Most of these trojaned machines wouldn't be if the owner of the machine was aware that they were trojaned.

Perhaps the standard response to an abuse complaint should be;
redirect all outbound connection attempts to an explanation of the complaint,
and an explanation of how to fix a trojaned machine.

-- this is not a .sig

Re:So much spam it sucks.

[letxa2000]

Spammers are winning.

They are only winning to those that don't do anything to help themselves.

The Verisign SiteFinder was a bad thing, obviously, but I laughed at the reaction "It's breaking my spam filter." What kind of archaeic, obsolete spam filter were these people using?

Likewise, that spammers are using trojaned systems is bad, of course. Any system compromise is bad. But this is just normal virus and hacking. It doesn't make it any harder to get rid of your spam.

I've said it once and I'll say it again, Bayesian filers is the solution. It works today and it depends on no-one but yourself to start using it. Since I started using it in May, I've received 20,596 spams--of those I've seen 89 of them. I.e., only 0.43%. It comes out to one spam every other day, though that's deceptive since probably half of those that got by were cases of a single spam sent 5 times in rapid-fire mode and they all happened to get through at once--the same spam 6 hours later would've been filtered. In reality, I'd guess I see one spam per week. In a perefect world I wouldn't see any, but that's good enough for me in this imperfect world.

Now, some will say "But that doesn't solve the bandwidth problem." In the short-term, no, it doesn't. But in the short-term it doesn't waste my time which is my single largest expense when it comes to spam. And, in the long-term, if more people started using Bayesian the response rate on spam would continue to plummet making it less and less useful to spam in the first place.

But those that are being bothered by spam on a daily basis simply aren't using the tools and technology that are available to them, and have been for over a year.

2 mcH drgZ 4U?

[Anonymous Coward]

Sorry, but I only speak English, could you please try again. On second thoughts, please don't try again. Ever.

Re:So much spam it sucks.

[Anonymous Coward]

It's time to sink below their level, so we can punch them in the nuts without throwing out our backs!

Dude! That's what the toe of your steel-toed work boot is for.

Responsibility

[second class skygod]

I've always wondered why we don't place more responsibility on the owners of the systems that are being hacked to create spam or DDOS attacks. For an analogy, imagine that the owner of a sporting goods store refused to lock the door. Every night, someone would enter the store, steal a baseball bat, and hurt someone else with it. Sure, the thug doing the stealing and batting is wrong but so is the store owner. He would be help legally accountable (in the USA, anyway). Likewise, owners of insecure computers should also be held responsible for the harm caused by their negligence.

Old News

[CrazyJim0]

People have been spoofing internet addresses since man invented fire.

Whats more fun is DOS attacks like this. Trojan that pings some dot com.

Make your application really cool and useful, and some dot com is fucked.

Re:Old News

[Anonymous Coward]

I know what you mean, man. It really caused quite a stir when Gorak the Geek managed to spoof his smoke signals to appear as having been from a rival clan. Gotta watch out for those damn nomadic tribes, man -- fake smoke signal letting you know there's a herd of wild cattle and they get to raid your veggie gardens while you're out hunting.

Then there was Zippo the Slick who said he had harnessed the power of fire in a small box...and that I would get rich quick reselling his "Zippo" product. That was annoying.

Bastards, I tell you.

Shut Your Mail Server Down

[Greyfox]

Just admit defeat and shut your mail server down. You can't win, so you may as well just save yourself some frustration and withdraw from the fray completely. Let people get in touch with you some other way.

Don't blame the tools

[El]

If the spammer's father had used a Trojan, we wouldn't be having these problems now...

Re:Don't blame the tools

[DirkDaring]

But a trojan is not 100% fail proof. 98% or so.

Fair Punishment for spammers

[yorgasor]

I've said it before, I'll say it again. I'll keep saying it until it becomes law.

Give him some webmail account that he can access over dialup from prison. Publish that email far and wide so it'll end up on every spam list in the world.

Then, tell him that once a year he'll get an email with a password that if he gives the prison guard, he can leave at any time.

This email can come in any form, with any subject heading, very likely disguised as spam. His webmail account will also have a 5Mb limit, and if the email bounces because it just happens to come when the mailbox is full, he'll have to wait for the next year.

Re:Fair Punishment for spammers

[Steve B]

Give him some webmail account that he can access over dialup from prison. Publish that email far and wide so it'll end up on every spam list in the world.

Then, tell him that once a year he'll get an email with a password that if he gives the prison guard, he can leave at any time.

This email can come in any form, with any subject heading, very likely disguised as spam. His webmail account will also have a 5Mb limit, and if the email bounces because it just happens to come when the mailbox is full, he'll have to wait for the next year.

Better yet, send e-mail announcements during the day with the passwords required to obtain meals, excersize breaks, potty breaks, etc. If he can't find the legitimate mail in the flood of spam, then he'll just have to live with being hungry, flabby, and unsanitary.

Spam back in my Inbox

[Angelwrath]

A while ago, Microsoft said it had closed an exploit in Hotmail allowing spammers to bypass the spam checker of Hotmail. It looks like they've found another exploit, because spam is back in the inbox again.

And the funny thing is - it is so obvious that this spam could be easily deleted, either before reaching the inbox, or after. So much spam follows the same pattern, if there was a button to declare it spam, a sufficient number of claims of any specific email being spam could be cause enough for a script to then delete every instance of that message in the system.

Do these companies get money from spammers to turn a blind eye to the crap they send me?

The next net?

[Angram]

If the internet (or email) in its present form gets to be more bothersome than useful, I have no doubt that an "improved" internet-type system will appear. Like most new computer technologies, it starts with nerds (/.), but if it is actually useful and useable enough, others will eventually get into it. Think of how fast file sharing took off - Napster (a new concept to most) was so easy and had so much to offer that even technophobic middle-agers used it. When Kazaa came around, it took no time at all to become huge, since the concept was familiar and interface simple.

Good place for a honeypot

[russotto]

If what they're doing is redirecting to random compromised machines which in turn go to the real site, one method for combatting them is to set up a honeypot of easily-compromised machines and wait for one or more of them to get infected by these loser's trojans. Then firewall logs (or analysis of the trojan) will reveal the real addresses being relayed.

Re:Good place for a honeypot

[scosol]

Huh?

There is *no* "real address".

I've replicated my shitty site to thousands of machines across the Internet- they *all* are the "real address".
Being able to monitor the requests coming to you if you were on one of the machines wouldn't provide anything at all.

It's making decisions at the DNS layer, and as others have pointed out, that would be the best place to take it out.

How can we get a list of these IP addresses?

[El]

Shouldn't we be monitoring spam anyway, building a list of source IPs, and notifying the ISPs responsible for those IPs to pass along a message to their customers to either a) stop sending spam or b) fix the holes in their machines, or c) they will be cut off from the 'net...

Re:How can we get a list of these IP addresses?

[Angram]

We need a worldwide ISP registry that allows any individual ISP to be blacklisted - essentially anyone who doesn't want to cooperate will lose access to the rest of the world. What's necessary is an international organization representing the major players (countries or ISPs with more than x% or x million users) to vote on such issues.

The internet should be a community, not chaos. Freedom for technological innovation is not the same as freedom to do anything you want at any time. We've got enough evidence now that the current no-rules situation just doesn't work - it's time to do something.

Re:How can we get a list of these IP addresses?

[Nishi-no-wan]

Every time I get a hit for /*/FormMail.* I log it. I go through these logs and notify the ISPs from which they came that they have a user committing "Unauthorized Access" to my site, and explain that the intruder is either a spammer looking to abuse my resources or an open proxy to spammers. Most get closed after the first notice. USWest and QWest (same company?) tend to take at least three notices over a two week period. (QWest Minnisoda failed to stop these attacks after three weeks and have been firewalled out of my domain - the whole net block, not just the offending luser.)

Notifying the ISPs of these infections is very important. Unfortunately, it takes a LOT of time to do this. I go through spirts of shutting down these things, then spans where I give up thinking it's futile (and have other things that I want to get done, but reporting all the attacks takes up too much of my time).

I'm considering updating my filter to not just log these, but to keep track of attacks and, if flagged after human review, start automatically sending Unauthorized Access messages to the ISPs.

Of course, then there's the trouble that no Microsoft machine directly connected to the Internet (i.e. not behind a properly administered firewall) can get the necessary patches before getting infected. That pretty much means that after a home user cleans his/her computer up (reformats, reinstalls), she/he will immediately be re-infected.

A friend just went through this - unable to get the patches installed without being rebooted first. He couldn't even get the information on what needed to be turned off to prevent the reboots before getting rebooted.

Re:How can we get a list of these IP addresses?

[oldstrat]

"Every time I get a hit for /*/FormMail.* I log it. I go through these logs and notify the ISPs from which they came that they have a user committing "Unauthorized Access" to my site, ..."

You really need to go back to Matts's site and update your script,
http://www.scriptarchive.com/formmail.html

If your still getting spam after that, then you need to switch to a different script.
Sure the spammer is way off base using your script to spam, but if they are sending you email via your own formmail then it probably isn't a technical unauthorized access, and the ISP could face a lawsuit for freezing them out.

A good way to handle this, is for scripts to require a valid email address that the user would have to respond to in order for the formmail type program actually process the request. Then at least you make it a lot more work for the spammer.

Re:How can we get a list of these IP addresses?

[Nishi-no-wan]

I guess I wasn't clear. I don't have formmail.pl or any variant on my system at all. I don't use such a script. ALL requests to /cgi-bin/formmail.pl are from spammers looking for such a script, most using open relays of Microsoft-infected machines. The point I was trying to make is that I report such scans of my system, not that formmail is being abused.

Sorry that wasn't clear.

I have a solution to the spam problem

[Waklingshark]

Just make it legal to kill spammers and loot their bank accounts and hardware afterwards. Would solve the spam problem in about a week and a half. -Mike

Re:I have a solution to the spam problem

[Anonymous Coward]

Or convince Bush that they are the axis of evil and they are communists and terrorists.

Re:I have a solution to the spam problem

[acb]

Keep in mind that a lot of those involved in the higher-end spam operations (or giving them protection for a cut of the takings) are Eastern European gangsters, known for their ruthlessness. Do you fancy your chances against the mafiya?

Re:Wow! just think if they used their powers for g

[Anonymous Coward]

Immoral bastards, all of them.

At first I read that as "Imortal bastards, all of them."

Now THAT would be scary! ;-)

Listed in DNS

[wowbagger]

OK, so these cracked machines are listed in the bad guy's DNS servers.

1. ISPs can start preventing their DNS servers from talking to the bad guys DNS servers. Thus, all spammer domains will fail to resolve.
2. We now have a list of trojan'ed machines. Just do DNS queries, find out the ISPs involved, and have them go after the infected machines.
3. Alternatively, go after the infected machines directly - ram a worm down their throats that cleans the machine up, or at least formats the hard disk to knock it offline.
4. Hack the trojan - harvest the addresses of the spammers' web sites from the data feed.

Re:Listed in DNS

[blakestah]

ISPs can start preventing their DNS servers from talking to the bad guys DNS servers. Thus, all spammer domains will fail to resolve.

A smart spammer will simply move his DNS around. He only needs one "good" DNS, and a machine to re-direct at that address.

We now have a list of trojan'ed machines. Just do DNS queries, find out the ISPs involved, and have them go after the infected machines.

Right, this could be easy - but it is far easier to portscan and/or sniff packets to find compromised machines. But either way, this takes a lot of time. And, it is a no win situation for an ISP. Do you break into your customer's machine to fix it? Do you cut him off? Do you selectively firewall him (thus raising your administrative costs)? It is a no win situation, so the ISP just lets the machine be.

On University subnets the routers are starting to firewall bad ports when virii get loose. They do it on a moment's notice, and send all admins a list of bad IP addresses.

The real issue is that REALLY SMART REALLY GOOD hackers are leading the spam movement. They provide spammers with scripts that compromise machines and use them to re-route spam, so that the sender of the email is untraceable from the email itself. The spammers pay the hackers a LOT of money for these scripts, which are updated regularly. This is a HUGE industry, and one that will not go away easily.

There is too much money involved, and the ones with the knowledge, the hackers, are not the ones doing the spamming, so they view themselves as untouchable.

Re:Listed in DNS

[lnixon]

> 4. Hack the trojan - harvest the addresses of the spammers' web sites from the data feed.

Actually, I've done that. I have in my hand the IP number of the originating server. I have tried to get the interest of CERT, FBI and my local police authorities. No luck.

Meanwhile, the spamming continues.

Polish firm?

[captainstupid]

Why is a polish firm releasing studies about the internet? I'm not likely to believe anything that Kiwi says about the internet.

Re:Polish firm?

[Anonymous Coward]

IT'S A JOKE!
Polish, like the Kiwi Shoe Polish company. Pronounced Pawlish. MODERATORS=TEH SUCK

More technical info...

[A. Lynch]

Can be found here.

Not realy new news...

[Anonymous Coward]

About a year ago, my brother-in-law and i were working for a major drug company (drug distribution, not manufacturing). We had a strict anti-spam policy. Well, one day our network went down because a spamming company (we eventualy traced it back to "hanmail", a korean equivalent to hotmail) was hammering us trying to get into our mail servers to send out porn. About 50,000 queued messages in the course of an hour. We couldn't understand how they could be sending so much data, but we eventualy found out... They had almost an entire subnet's worth of computers hammering us! We eventualy got our people back online by letting the spammer's traffic through the firewalls, and letting the mail servers do the domain blocking so it was more distributed. Also the mail servers just dropped the incoming packets, instead of denying them like the firewalls, so we didn't have nearly any outgoing... That bought us enough time to contact the ISP, get them blocked at that level, and then set up some honey-pots just to be on the safe side. It's all better now, and usualy about once a week the honey-pots get hammered by a new set of spamming SOB's... Se' la vi.

Anyway, this has been going on for a while. I'm supprised there hasn't been a story ealier.

I'm going to take up farming for a few years...

[Anonymous Coward]

That's it. I give up.
I'm going to plow under my 1/4 acre back yard and plant a bunch of ohhhh... potatos, corn, beans, etc.
I'll be back in a few years.
I hope this whole mess is cleared up by then.

Re:So much spam it sucks.

[rutledjw]

I agree. I was contacted by my fathers church asking for help with SPAM. They are getting a combination of what appears to be a DOS (probably a dictionary attack) and now they are getting loaded with junk e-mail.

They aren't really bothered by the mortgage-type garbage, but they are getting tons of the herbal penis and breast growth pills, porn of every kind, etc...

I volunteered to help, but I'm frightened of what I'll find. I just have visions of walking into a room full of unpatched NT4 servers...

Aaaaaaaaaaagggghggghhhgggghhh.....

*breath* *breath*

Aaaaaaaaaaaggggghhh.....

Yeah, but...

[inertia187]

That's just 450,000 M.O.s, if you ask me.

Re:So much spam it sucks.

[eugene ts wong]

I've mentioned this before, but just in case you & others didn't read it, I'd like to repeat it.

I honestly think that capital punishment should be dealt out to spammers. Think about that for a second. People are used to debating about it in the context of rape, murder or other serious crimes. What makes this so different? They are literally breaking into our computers just to deliver junk that we don't want.

I would be offended if I had to unsubscribe from every spammer's list, but @ least it would be tollerable & easy enough to stay on top of things. However they aren't even allowing us to do that.

The way I see it, they are nickle & diming us every day. If we aren't allowed to defend ourselves @ their expense, then there is no real freedom. We are just slaves who are allowed to carry on a relatively normal existance.

Re:HERE HERE!!! Mod Parent UP UP UP

[Digital Dharma]

I won't mind as long as you don't mind when I start firing when you try to steal my computer, beat my family members or attempt to pick my pockets =]

Green Eggs and Spam

[mishehu]

I know it's been said before, but none of this would exist if everybody followed the simple idea that if you're not actively searching for a product, don't go to a given site. I have never clicked on the "punch the monkey and you can win a prize" banners or any links for any life insurance, viagra, penis enlargement, young hawt teens with farm animals, etc. links because I am not the one initiating the dialogue with the suppliers/service providers.

Re:So much spam it sucks.

[Anonymous Coward]

Death penalty for spammers? You are an idiot. What, are you 12 years old, or something?

I'm surprized I haven't seen this notice mentioned

[msimm]

I'm surprised I haven't seen this notice mentioned. Apparently bluebottle (wonderful anti-spam free email service) has been under attack is going down.

Spamming is an increasingly aggressive business and need to be dealt with increasing aggressiveness . Its a sad state when we can't even implement effective solutions without being strong-armed by parasites.

Bluebottle has found itself under constant attack from numerous sources over the past couple of months making it almost impossible to deliver spam free email to your account in a consistent and timely manner. We have therefore decided to cease offering protection for external accounts, and will be removing the verification protection from Bluebottle accounts.

This has not been an easy decision to make but has been necessary in light of the delays currently being experienced in email delivery. Whilst work is still being performed to address these issues, as it currently stands, Bluebottle is unable to ensure the timely delivery of mail for Bluebottle accounts. You are certainly welcome to continue using your Bluebottle account, although no verification protection will be applied to inbound mail.

We have done everything in our power to address these attacks although it has had little effect. We are obviously very disappointed that we cannot continue to provide you our service at this time.

Bluebottle's email verification system is best provided in a distributed manner making it considerably more difficult for these attacks to be effective. We will therefore be making our software freely available to any service provider or enterprise to protect their end users from unwanted email, and by doing so make it a more secure solution given that it is provided in distributed environment.

Please accept our sincere apologies for the inconvenience our decision will cause.

And we all stand around with our thumbs up our butts.

Re:So much spam it sucks.

[schon]

I'm ready to torture one of the bastards in a week-long live-webcast

Where can I sign up to view, and how much will it cost? :o)

Hacker Rights?

[Anonymous Coward]

Does this mean that people here are advocating for tougher penalties against *hackers*?

After all, how am I supposed to know the differance between some kid runnin Nmap and some eastern european 'spacker' (their term, not mine).

If we turn loose an internet equivialent of the Patriot act how many of us will be caught up in the witch hunt that would follow?

The spammer/cracker alliance

[Deacon Jones]

I've been puzzled by this one for a while. I've always thought that perhaps the crackers would receive enough spam to get pissed off and do what the government and others can't do--take down the spammers (DoS attacks, trojans, whatever nefarious magic I don't know about). I mean, lord knows I've often wished I had the skills to conduct "evil in the name of good." Ethical cracking, if there is such a thing(?)

Instead I read how spammers easily DoS whoever ticks them off, and now the crackers are aligned with them for fun and profit. I hardly find that to be the rebellious attitude I thought made up the cracker personality.

The cracker mentality would make an interesting psych. study.

how do you know?

[drxenos]

How you you really *know* your computer has been comprimised? I keep my A/V up-to-date. I repeatedly run it, adaware, and spybot. I use both a hardware and software firewalls. I run windows xp and have tuned off most everything such as messanger (both the chat tool and the net send service). I am paranoid as hell about getting cracked and someone sending crap like this through my cable. But unless one of the above programs screams at me, I really wouldn't know if I've been compromised. Zone Alarm use to catch a lot of funky crap (incoming probes) until I started using a Linksys firewall router. How do I know if I am really safe? I'm a software guy, but never really been a network guy (other than writing socket code for embedded systems). Scary stuff.

This affects us all...

[Anonymous Coward]

Not just windows users, but us linux, mac, bsd etc users who have to put up with spam infesting our boxes, and the ISPs transporting it all.

So, what will it take? The above article is obviously talking about a serious crime. Websites that try and infect PCs with a virus that turns them into a spam proxy. Spammers paying money to use such a system. People, this has RICO all over it. Not only does it involve hacking, but spammers are paying money to use compromised system to spread their spam. This is a federal case. If any bigname spammer is doing this, well, we could shut them down!

Imagine the FBI busting in, confiscating their PCs, and forbidding them from using them till the case goes to trial. We hear all the time about the FBI throwing the book at people who commit small computer 'crimes'. Let's set this frothing dog loose on those who deserve it.

1) Spread this story to your ISP. Explain it to them. Crackers and spammers are in collusion. Ask for them to talk to their local FBI office.

2) If you get spam, contact the FBI yourself. Explain the above story to them. Make sure they understand. Have your friends call them about it.

3) Call your senator, tell them there are people out there who really do deserve to be locked up in jail for YEARS.

4) This is a National infrastructure issue. They're infecting computers to spread spam. I wonder what truly malicious foreign govts could do. Be sure that the FBI and your senator understand this.

http://www.nipc.gov/incident/incident.htm

If they're going to use a distributed method to spread spam and infect computers, we need to raise a stink.

Many example CGIs are vunderable

[Mouth of Sauron]

Before you go and download GCIs from Matt's Script Archive be sure to check whether there are any updates from the maintainer's site.

Scripts such as FormMail, (a script to take the unput from a post, format and send the data as an email) often do not check for proper input or malformed data. This is not a criticism of Matt's Script Archive, there's a wealth of information there and I've done good work with the examples presented therein. However, It's important to know that these are examples, freebies, and as such they may have security problems.

I bring up FormMail, because there are spammers who search for old versions of this script and use it to forward spam message out of our own server via your website. While this isn't as bad as having a compromised computer, it can still look bad to upper management who may not know the difference between spam and a virus.

Re:So much spam it sucks.

[Anonymous Coward]

You're clueless about how spam negatively impacts quality of life. What are you, a spammer or something?

Spam is out of control (duh!) - Is this why?

[gone.fishing]

In the past week or two I have "noticed" a dramatic increase in the amount of spam in my inboxes (even the accounts that I never use except for between family and friends). This tells me that there is another relationship between virus/worm writers and spammers. When a worm sends emails from tens of thousands of address books, a savy spammer can harvest hundreds of thousands of previously unknown email addresses! I'm thinking that some of the worms that have made it around recently may have been written with that idea in mind.

I have not protected myself with anything special but I have created a couple of pretty basic filters that have done an adequate job of filtering much of the spam (who ever besides a spammer sends email with the words viagra or penis for instance). But still a lot of spam makes it past the filters and it is an amazing annoyance. But everyone knows that right?

Re:So much spam it sucks.

[sketerpot]

Now, some will say "But that doesn't solve the bandwidth problem." In the short-term, no, it doesn't. But in the short-term it doesn't waste my time which is my single largest expense when it comes to spam. And, in the long-term, if more people started using Bayesian the response rate on spam would continue to plummet making it less and less useful to spam in the first place.

I agree with you; Bayesian filtering is a solution whose time came long ago. It works outstandingly for me, and I've heard similar success stories from others---you, for example. However, the people most likely to let Bayes guard their inbox are the least likely to respond to spam. In other words, if more people start using Bayesian filtering, fewer people will be annoyed but you won't have much spam reduction, since you'll still have large numbers of stupid, clueless, or stupid and clueless people (and I refer to clueless people knowing that I'm clueless in many things) going unprotected.

However, that's why email programs and ISPs should have Bayesian spam filtering. In email programs, it should be enabled by default, preferably with some decnt default training and prominant buttons for training the filter. The ISPs should use something like TarProxy to slow any spammers who try to spam them. The clueless and/or stupid people get protected because they don't do anything about the protection, and everybody is happy who deserves to be.

Re:So much spam it sucks.

[rutledjw]

You'll get an email.

From: hotstacey@yo_baby8765.com
Subject: Watch spammer die 1234xvcgt

Re:So much spam it sucks.

[Trigun]

Right now I am installing and configuring bogofilter, spamassassin, and antivirus at the gateway. It's going pretty good, but it's a lot of work. At least with bogofilter, you can set up a dummy account to collect forwarded e-mail and automatically add it to the filters. The minus side is that it's a bit of work to get set up properly and catching only spam.

If you need advice, I can at least point you in the right direction (and cheap, all open source software)

Dudes, just dump money. Isn't it obvious

[suso]

All we need to do is get rid of money and the materiality and we'll mostly solve about half the world's problems, including spam/marketing/greed/corruption. Of course, it will create a few new ones, but I think things would generally be better.

Ok, now bring on all the slashdotters who think that they are all wise and shit.

This requires assistance of the registrar...

[Dimensio]

Without the registrar, you can't update your DNS tables to point to the hacked machines. Domain registrars who allow such criminal activity to continue after being notified of it are directly complicit in this illegal activity and their management should be prosecuted to the fullest extent of the law.

One good example of a registrar knowingly and openly aiding and abetting in criminal activity is DomainDisover, aka BuyDomains for their continued support of documented criminal outfit vano-soft.biz/soft4all.biz -- not only do they host on hijacked web proxies, but the DNS servers that they use to point to these hijacked machine are ALSO themselves hijacked machines. DomainDiscover could put an end to this criminal behaviour by dropping their criminal client, but they are content instead to assist in this illegal activity. People think that I'm going overboard when I suggest ths spammers be shot -- I'm not, I'm being realistic. It's the only way to get rid of them.

Loops on transparent proxies

[ebrandsberg]

This technique could also cause loops on transparent proxies, where a proxy captures the request, does a DNS lookup, and sends the request to another location with a proxy, that does the same thing, until either something kills the connection or it gets through to an unproxied address. It is common for proxies to make use of DNS lookups instead of the target IP, as they can determine if there is more than one IP available using DNS, and use the best one to make the request to.

Erik

Force Users to Linux....?

[khenson]

Well now there's a thought...! Let's remove the customer's right to choose by forcing their hand because, quite honestly, we know better than the user what they need to run on THEIR computer - the one that THEY paid for with THEIR money. When we get the market sequestered we can embrace standards that are "OK" and extend them to make them better. After all - we know better what those standards need to be than the common user - and we'll rule the computer world so people will have to use our stuff.

What a great idea - what should we call our empire..? How about SoftMicro...? or LinuxSoft...?

How about we win customer support by earning it with a superior product that the customer chooses because it is simply better - and we work hard to continue to make it better and more worthy of customer migration by it's very merit. A harder method but it has been done in the face of an 800lb gorilla - to wit: AMD...

A saying my father taught me: "Winners compare their accomplishments to their goals, losers compare their accomplishments to the accomplishments of others." We need to stop worrying about Microsoft and start worrying about Linux. I would rather gain customer acceptance because Linux was a great product than because Micrsoft sucked. That means we only have to suck less to win - how about we just don't suck at all... Now there's a worthy goal...

Re:So much spam it sucks.

[rutledjw]

Mind if I send you an e-mail (probably this weekend)?

To mods - yeah, yeah, Offtopic, I know

Brute force reverse DNS lookup.

[barton]

As I read it, a spammer will sit at foo.com, sending messages out through one of half a million compromised machines. Doing a DNS lookup on foo.com will, in turn, yield one of half a million IP addresses.

This makes me wonder if it would be possible to look up all half a million addresses by brute force... do a reverse DNS lookup on foo.com 5 billion times, and you should have a fairly comprehensive list of everyone who's got a compromised windows box out there... these could in turn be blacklisted.

Re:Brute force reverse DNS lookup.

[goot912]

good idea, but how would you make it work regarding when a user has "patched" their machine up to an acaptable level??

Irony

[blincoln]

Slashdot: where spammers sending you unwanted email are the scum of the earth, but media pirates are fighting the system of unfair prices.

It's like a dorky version of the middle east.

Nothing illegal with DNS

[webhat]

Although I agree with the fact that this is not a very nice thing, trojanized computers, spam relays etc. The DNS itself is not doing anything illegal, a dynamic DNS with a round-robin which updates every 5 minutes is not illegal in itself. You can't block a DNS because it does something inventive within the boundries set by the
Although I know that dynamic IPs for primary and secondary nameservers are not allowed in a number of countries, they are required to be static in the Netherlands and afaik Belgium. And afaik they are absolutely not allowed to be CNAME'd.
I think this is more a case of bad practise on the part of the root domain provider, if they allow people to do things like this, then this is result.

I could rant, but won't.

Legal Trojans?

[LWATCDR]

What happens when someone makes a legal trojan? Something like Gator that but with a EULA that says "by installing this you are giving us the right to use your computer to send email" While most of us run adaware or Linux or BSD the vast sea of "end useres" out there do not. What is worse is that it would be totaly legal!

I cant belive that even slashdotters cant get it..

[Microsofts slave]

ITS CRACKERS! Hackers are just normal computer enthusiats like me and you. Crackers are the malicious ones. http://www.catb.org/~esr/writings/hacker-history/h acker-history-3.html

Pay more to get less

[swb]

Filtering and firewalling are fine, but users should pay *more* for these services, since they take staff time and resources to implement and maintain.

Open connections require ISPs to do nothing, therefore those connections should cost nothing.

It's kind of a no-brainer idea for ISPs to charge extra for some kind of filtering/firewalling anyway, since shedloads of lusers will wet their pants with excitement to get better "protection" and will see it as extra cost for extra value.

Re:Pay more to get less

[firewood]

Open connections require ISPs to do nothing, therefore those connections should cost nothing.

Closed connections cost even less, since they consume no network bandwidth on the providers inner network, and probably generate less complaints due to unpatched hacked machines causing problems (dDoS, smtp relay, etc.) on the net. Why should a port be exposed if the user doesn't even know enough about its existance to put in an "open it please" request?

We need a few RICO cases

[swb]

The FBI, Treasury and the IRS have proven track records for following the most convoluted money trails. There's really no reason why they can't trace credit card transactions and find these people.

A RICO case against them would be great; huge fines, long-ass jail sentences, and virtually anybody that as much shared the same ashtray as these people gets to spend the next 25 years years in a the Federal pen.

Burn down the bookstores!

[Anonymous Coward]

1. Personal web servers. Given the quality of most of these sites, probably not a great loss.

Burn down the bookstores! Most of them were shitty books anyway, right?

Meanwhile, at Dubya's Secret Hideout...

[fuzzybunny]

"Colin, Donald, Karl, Paul, Condoleeza, I think the CIA's finally figured out who keeps signing up president@whitehouse.gov for all them thar porner-graphic websites."

5 minutes later, somewhere in central Poland air defense command

"Comrade Igor, I am spottink multiple very fast movink radar signatures going at mach 10, comink right at us!"

Blam-ski

Re:So much spam it sucks.

[nanojath]

It's time to sink below their level, so we can punch them in the nuts without throwing out our backs!

Well, while spamming is irritating and irresponsible but not necessarily illegal, selling "generic" equivalents of patented pharmaceuticals (whether bogus or not) and hacking people's computers are definitely illegal. Methinks it's time the law started getting serious about these people.

Verizon already takes care of this?

[Anonymous Coward]

Every domain listed in that Wired article resolves to 1.1.1.1 on my Verizon DSL account. Are they that clueful?

Re:Verizon already takes care of this?

[Anonymous Coward]

Don't know about Verizon, but looks like Neulevel, the .biz registrar, was on the ball and pointed the sites' nameserver to 1.1.1.1. More here. Unfortunately, as the article points out, the "spackers" can just move to a new nameserver ...

Question

[Goo.cc]

"This Wired story shows a disturbing alliance between hackers [sic] and spammers. "

If I can trouble the readers and posters of Slashdot, what does the "sic" in "[sic]" mean?

Re:Question

[snakeplissken]

it's usually used when quoting a misspelling and indicating that the quoter is aware that there is a misspelling but is quoting for accuracy's sake,
here i imagine the quoter is refering to the use of the word 'hacker' as being the word chosen by the person being quoted even though the quoter feels this choice of word is a mistake, personally i wouldn't have used 'sic' in this situation as it's highly unlikely that any reader would attribute the word 'hacker' to the quoter and not to the person being quoted,
it's latin for 'thus' or 'so'

snake

Re:Question

[SysKoll]

Sic is the Latin equiv of "that's what he said". It means "so" or "this way". It is used to denote a literal quotation. Here, the article's dumbass author uses "hacker" in a place where "cracker" should be used, and the "sic" is placed to distance the ./er from said Wired dumbass.

Isn't cracking 450000 machines "slightly" illegal?

[Talence]

Ok, here's a question that might be totally obvious but doesn't seem to have been really asked before: isn't the fact that almost HALF A MILLION machines got broken into a punishable offence in itself? If people like Kevin Mitnick go to jail for cracking "just a few" machines, then certainly it would count as a MAJOR offence to have obtained illegal access to a number of computers that is at least several orders in magnitude higher??

If there really aren't any laws in Poland against such MAJOR abuse, then just trick them into going to the US for some "lucrative deal" and deal with them there ;-) This is a trend that must be dealt with quickly and firmly.

Ironically, I see this as a major opportunity though - basically, they have made it trivially easy to detect massive amounts of compromised machines. Just keep resolving the spamvertised domains and you should be able to find at least a few thousand machines per day. What to do with this information? You could try the legal (good) route in contacting the ISPs and/or using such machines to trace origins of the crackers. On the other hand, it might be possible to somehow 'nuke' those machines if they are still exploitable.

I've seen the idea mentioned elsewhere... basically, what MIGHT be nice is government supported blacklisting facilities. I would gladly pay e.g. $10/year if it helped stamp out most of the spamming and DDoS activities. That way, it could be made certain that the blacklisting is fair (ok, assumption) and won't be easily DDoS'ed out of existence.

Sorry for the previous gibberish.

[too_bad]

Forgot to put plain text. However I cannot repost the same
in plain text since slashdot has some kind of semi-intelligent filter :(

Anyway, my previous post contained the Whois query for bestportal.biz and DNS query for the same domain as of today. But I think DNS query from my linux box consistently gives me 1.1.1.1 whereas the other poster
got a valid IP address when they tried accessing www.removeform.com

Needs more investigation :)

Re:So much spam it sucks.

[Anonymous Coward]

I honestly think that capital punishment should be dealt out to spammers.

Nah. Unconstitutional, and the case would take way too long to try. What we need is a few unstable whacked-out gun nuts to get so ticked off that they go hunting for spammers. How would you like to be on the jury of those murder trials instead?

Microsoft is the problem.

[twitter]

The problem isnt' windows. The problem are broken machines on a network.

Dude, Bill Gates is paying you good money to write drivel like that, can't you use his grammar checker?

The problem is windows, its design, distribution and operation. It was never ready for the desktop and it will never be ready for the internet. It's supposed to be an "easy to use" "consumer level" OS, but keeping it up is harder than other. The machines are broken because the software they run was designed to be pushed on by third parties. The end user has no control of it and can not keep others from running code on it.

MS released a patch and it never got populated as much as it should.

This is a cop out, blaming the user for Microsoft's sucky distribution method. Microsoft only distributes it's crap on CDs and CDs are dead. There's no such thing as a nice up to date network install in the M$ world, so there's no way the end user can do anything but install from a months or years old, turn everything on and rape me CD. The only way an end user could possibly get all of M$'s huge "patches" is to use ANOTHER OS, but what end user can figure out how? Computer shops can't even figure it out and Microsoft can't really keep up anyway. The diligent are getting just as burnt as everyone else, perhaps mores because Microsoft "updates" inclued nasty EULA's as well as break critical applications.

For every reason these things should be turned off, it's turned on.

Right, tell me why Outlook auto-executes porn spammer email again? Is it because Bill Gates wants my 2 year old girl to look at popups while my system is trojaned?

does finger pointing solve anything?

Yes it does. People are sick of the problems they have with M$. Just not being able to turn off pop-ups is bad enough. Having the senders of such garbage own your machine is much worse.

Did pointing fingers get most everyone to stop using telnet vs ssh? Did it stop people from sending sensitive data over non-ssl connections? No. Did it stop people from running daemons as root? No.

If you know someone who does these things on a non-Microsoft platform, kindly tell them why they should not. It does help and I don't know anyone who does these things anymore.

propose a solution

Dump M$. I've been M$ free for years and I'm better educated, less troubled and much happier. You don't need their shit, you are better off without it and so are the rest of us. Microsoft has proved itself unwilling or unable to fix their problems they need to be shunned.

Re:Microsoft is the problem.

[sporty]

Dude, Bill Gates is paying you good money to write drivel like that, can't you use his grammar checker?

Cry me a river. I made a few mistakes before submitting. Let's not forget how infallable you are, eh?

I'd go point by point over your rant about how screaming and crying at MS would solve something. All in all MS makes money for the choices it makes. It pisses off a large amount of people, but a lot of people like things the way they are.

After all, you are 100% right about how the real world works, right? 'cause Linux and *BSD are the way of the future. Unless you can write something better, quit yer' bitchin'.

A worm?

[Mr2cents]

I think this is an opportunity to be the first virus writer to be loved by everyone with an e-mail address. A worm that eats those trojans for breakfast could reduce spam dramatically within hours. Not that I want to encourage people to do something illegal, but if you're writing itanyways, instead of deleting files this could actually be more fun.. Good luck ;)

Re:A worm?

[Anonymous Coward]

It's been done -- a worm that uses the same exploit used by the SoBig worm to fix the exploit was released on our corporate network. I'm posting this anonymously because corporate IT doesn't want anybody to know...

NO current desktop OS!!

[bob_calder]

How many current desktop OSs can run .exe files?
ha ha ha ha ha ha
It doesn't matter if you run as administrator since the machine can install the file without your permission.

Re:NO current desktop OS!!

[homer_ca]

Well yes, binary executables are specific to processor architecture and OS, but my point is that if a user launches an executable by his choice, the OS has no way of knowing if this is a spam trojan proxy server or if it's a legit proxy server.

Re:NO current desktop OS!!

[Anonymous Coward]

How many current desktop OSs can run .exe files?

chmod a+x *.exe

Mine can.

Re:NO current desktop OS!!

[RoundSparrow]

Actually mono uses EXE for executable convention and can run a binary file on multiple platforms. So Linux, FreeBSD, OSX - can all run the same EXE binary.

Not to say I don't get your point.

Re:NO current desktop OS!!

[homer_ca]

Executable bit don't mean shit. If your desktop environment uses bash to open .sh files or perl to open .pl files you're screwed. Those things can be just as dangerous as an ELF executable.

Also ...

[too_bad]

Traceroute and Ping work on IP addresses. The DNS lookup happens before the traceroute or ping packets are initiated. Can you check if you consistently get different result for traceroute and for ping?

honey needle in a hay stack.

[twitter]

If what they're doing is redirecting to random compromised machines which in turn go to the real site,

With enough machines comprimised, the whole operation can be automated. From capturing new machines to distributing content from the captured boxes. The loser can go through an anonymizer from time to time as he starts new campaigns. You will never see him because his worms do all the dirty work.

Then again, you might catch someone. It's impossible to hook up a M$ box to the internet without it being owned. The problem will then be chasing down the thousands of people you will dig up. Go for it and tell us what you find.

Re:honey needle in a hay stack.

[Anonymous Coward]

just get the isp's of the hacked machines to help. Im SURE they do not like this sort of crap any more than we do...

Also this 'software' is probably not all that stable or calls home for fixes. Either compromise that software or get it to call home for a fix that wipes itself out and closes up the hole.

Its time to go on the offensive folks. Defensive waiting for them to come is just out. It was fairly harmless when they were just rooting a box and maybe DOS a site for a day. But now they have turned 'silent'. They are using these boxes for reasons im sure the owners would go ape-shit over.

Even IF we dork 1000 machines that is 1000 less machines in the 'network'. We need ISP's users and especially US to take this crap out. Hell we probably could automate it!

From the article:

[TCM]

Another site, hosted by the Polish group. offers free credit consultations. Traceroutes to the site, removeform.com, also provided ever-changing results, ranging from a computer connected to a DSL line in Israel to another provided by EarthLink. However, the title of the site's home page consistently read "Yahoo Web Hosting," suggesting it was actually located on a server run by the Internet giant.

Ok, so I tried:


$ dig removeform.com
[...]
ANSWER SECTION:
removeform.com. 25m5s IN CNAME bestportal.biz.
bestportal.biz. 25m6s IN A 1.1.1.1

AUTHORITY SECTION:
bestportal.biz. 55m6s IN NS dns1.name-services.com.
bestportal.biz. 55m6s IN NS dns2.name-services.com.
bestportal.biz. 55m6s IN NS dns3.name-services.com.
bestportal.biz. 55m6s IN NS dns4.name-services.com.
bestportal.biz. 55m6s IN NS dns5.name-services.com.

ADDITIONAL SECTION:
dns1.name-services.com. 1d9h11m38s IN A 63.251.163.102
dns2.name-services.com. 1d9h11m38s IN A 216.52.184.230
dns3.name-services.com. 1d9h11m38s IN A 63.251.83.36
dns3.name-services.com. 1d9h11m38s IN A 63.251.83.37
dns4.name-services.com. 1d9h11m38s IN A 64.74.96.225
dns4.name-services.com. 1d9h11m38s IN A 64.74.96.226
dns5.name-services.com. 1d9h11m38s IN A 212.118.244.163
dns5.name-services.com. 1d9h11m38s IN A 212.118.244.164


Surely looks fishy. Trying to go to that site fails, naturally. However, since I run my own DNS cache:

Oct 10 00:41:00 charon named[310]: unrelated additional info 'dns1.name-services.com' type A from [63.251.83.36].53
Oct 10 00:41:00 charon named[310]: unrelated additional info 'dns1.name-services.com' type A from [63.251.83.36].53
Oct 10 00:41:00 charon named[310]: unrelated additional info 'dns2.name-services.com' type A from [63.251.83.36].53
Oct 10 00:41:00 charon named[310]: unrelated additional info 'dns2.name-services.com' type A from [63.251.83.36].53
Oct 10 00:41:00 charon named[310]: unrelated additional info 'dns3.name-services.com' type A from [63.251.83.36].53
Oct 10 00:41:00 charon last message repeated 3 times
Oct 10 00:41:00 charon named[310]: unrelated additional info 'dns4.name-services.com' type A from [63.251.83.36].53
Oct 10 00:41:00 charon last message repeated 3 times
Oct 10 00:41:00 charon named[310]: unrelated additional info 'dns5.name-services.com' type A from [63.251.83.36].53
Oct 10 00:41:00 charon last message repeated 3 times

What they actually do seems to be poisoning people's DNS caches with the constantly changing info, since the real answer to the query is the CNAME which in turn points to 1.1.1.1. I cannot go to that site. My BIND thus protects me?

Re:From the article:

[Anonymous Coward]

It appears that Neulevel (the .BIZ registrar) was able to take down the site by pointing its nameserver (bubra.biz) to 1.1.1.1

John is not wrong

[bob_calder]

The great majority of users treat a computer as an appliance. Passive consumers of content. Meat.

Law enforcement has failed us

[ozzee]

It seems like the RIAA has figured it out, yet our public servants have yet to. If I had the authority I could waste most of the companies doing this blatant illegal activity in a heart beat.
It's simple - follow the trail, and we're not talking needing some ancient American Indian tracker skills.

FOLLOW THE MONEY.

Step 1. Ask (demand) the five major credit card companies to set up multiple credit card numbers that have been marked as illegal tracking cards. In other words, purchases made on these cards indicate that the merchant account is for illegal activity.

Step 2. Filter through the spam (I can donate my spam right now - I get hundreds daily) and attempt to purchase anything using credit cards in Step 1.

Step 3. Demand the banks freeze funds in the merchant accounts that the credit cards have been charged to. (discontinue the use of these credit cards to avoid DOS retaliation activity).

Step 4. Profit. All frozen funds are collected for prosecution under appropriate government statutes.

Step 5 (optional). Subpaoena all merchant account credit card activity and notify the credit card holders that the merchant they purchased their Viagra from is really an Al Qaida front....

The above technique is used for credit card purchases however, I have tracked down a number of companies offering "financial" services by submitting false identities and when they call for "Harrison Fjord" I take over the converstation with some sticky questions about their SPAM policy. It takes just a few of these and you can easily track down some very dubious commercial activity.

I am perplexed. The law enforcement activity goes after Sklyrov who has quite possibly never done any harm to anyone yet they can't seem to follow the easy steps above. I could argue that the money spent going after Lamo, Mitnick and even theoreticaly various alleged al-Qaida could be better spent on the public good by some simple detective work.

<Ding!> Headline for the next NYT article. IT HAS BEEN ALLEGED that terrorist funding is being aquired through the illegal activity of selling organ enlargement food supplements ... All I need now is some way of delivering the message ... I know SPAM !

The theory here is quite simple. Make it difficult to make money with SPAM and the reason for SPAM will cease.

Am I missing somthing ? Why is this such a difficult thing to do that the FBI or state law enforcement have not figured this out ? Is this a violation of some constitutional right, surely they nuked most of these in the last round with the "Patriot Act" ?

Re:Law enforcement has failed us

[SysKoll]

Steps 3 and up presuppose that the government that took steps 1 and 2 is able to seize spammer monies... Alas, many spammers already use foreign accounts. Once a transaction has been done, the money is essentially lost. The law-enforcement agencies would not be able to recover the funds.

Setting up such a federal agency (Federal Body Part Enlargement Products Procurement Agency?) would end up in a huge, costly bureaucracy that would immediately be stumped when all spammers start using up foreign accounts. Not all spammers are living in Florida, you know... But of course, the Agency would keep gobbling its ever-enlarging budget even if it doesn't nail a single spammer.

So that's why it hasn't been done yet.

ISPs are to Blame as Well

[Anonymous Coward]

This is why I have huge chunks of Europe and Asia in my block lists. If ISPs don't act immediately on spam complaints, then they keep getting more and more open SMTP relays and trojaned machines in their net space. Soon, the only thing to do to stem the flood is to drop entire Class Bs into the local blocklists. I don't know if our server or any of our users can even receive email from anywhere in Poland anymore.

Re:So much spam it sucks.

[letxa2000]

Bayesian filtering is a solution whose time came long ago. It works outstandingly for me

Great! I'll tell you, it almost makes spam fun for me. I look at my statistics and just grin at all the garbage my filter kept out of my life. "Let's see, how many spams did my filter block THIS month?" :)

However, that's why email programs and ISPs should have Bayesian spam filtering. In email programs, it should be enabled by default,

I agree 100%. I personally think they should be enabled by default both in email programs and by ISPs--of course with the option of disabling them. But the idiots won't bother to disable them so they'll be protected, and those that don't want the ISP meddling with filtering can disable it.

I agree, the spam volume won't go down until everyone--especially the idiots--start using Bayesian, whether they make the effort to do so (doubtful) or whether they simply don't make the effort to disable it (probable).

But still, I must say... as much as I'd like to see spam stop wasting bandwidth, the most expensive aspect of spam is the time it wastes for the receiver. And Bayesian fixes that for us whether the spam is still being sent or not.

These people need to die

[DigitalSpyder]

If cases like these were documented and escalated to Abuse helpdesks, that could help. Particularly if it was supplied with evidence of spam, DNS query/responses, etc. etc.

Even large ISPs would be quickly swamped by such queries. Most ISPs would still choke under the load (if they're not already).

From a technical viewpoint, ISPs are nearing their limits to deal with spam. It will take a significant change in either ISP policy (and the enforcement of it) and/or legislation to combat this situation.

Linford is on the ball. These people need jail time. Too bad ISPs don't have unaccountable black ops budgets....

Re:So much spam it sucks.

[Bellhead]

We don't have to sink to the spammers' level in order to fend them off: we can fight them successfully without stooping at all.

1. Go to http://www.samspade.org, and get the investigation tools that'l help you track the chickenboners down.
   
2. Always complain! Don't let a single piece of spam pass your inbox without sending a spam report (including all headers) to -
   
   • The ISP that owns the IP address it came from.
     
   • The ISP that owns the spamvertised site.
     
   • Any intermediaries (e.g., redirect pages)
     
   • If it's spam for drugs or anything else that is government regulated, complain to all the state and federal agencies that regulate the industry involved.
     
   
   
3. Monitor news.announce.net-abuse.email and the SPAM-L mailing list, to leverage your efforts with those of others and avoid wasted time.
   
4. Demand that your ISP install and keep up-to-date anti-spam software. That means blockading all "dynamic" IP ranges (which kills 90% of open proxies and zombies) and using the RBL and/or SPEWS.
   

Fighting spam is easier than it seems, and a lot more satisfying than bitching about it. I get about one piece of spam a week: I'm on so many "don't email this guy!" lists that I have to use sock-puppet addresses to get spam to fight!

Why not join the war?

Bellhead

Been there

[Anonymous Coward]

These guys are using one of my addresses as a faked From: So I'm getting all the bounces and it gave me a chance to look at their approach.

They seem to be using many trojaned Windows machines on DSL and cable modems, and rotate through them reasonably quickly. The email headers show that they typically announce themselves as compuserve.com or microsoft.com, but the reverse lookup of the ip-addresses gives them away. I couldn't easily tell from nmap what trojan they are using.

The mail itself refers to a website that has a pretty bogus whois registration (vano-soft.biz) (phone number is +000000000 etc). The DNS trick is cute. Their nameservers (ns1.uzc12.biz..ns5) (uzc12.biz seems to be registered in the same crappy way as the other domain). All nameservers resolve to about 4 differnt ip's which in turn resolve the webserver name to different sets of 5 hacked servers. The DNS timeout on the nameservers is about 2 hours, the webservers are set to 120 seconds. Probably to make sure things shuffle around nicely. The nameservers are spread out enough that I have a suspicion that they are hacked as well. There might be hidden primaries to update these.

The final webservers are again most likely hacked machines and the pages do not seem to have embedded tags or trackers and rely on forms and scripts in /cgi-bin/ that probably forward the entered data a step further down the line.

All in all plenty of information to send to various abuse departments, and I'm getting an annoying but strangely intrigueing view on what hoops these spammers are going through.

Re:So much spam it sucks.

[eriko]

I've said it once and I'll say it again, Bayesian filers is the solution.

No, it's not. Filtering is merely automating "just hit delete." It still gets sent, it still travels the wires to your box, it still hits your spool.

The core argument against spam is that it shoves the costs of advertising onto the recipents. That's why we said that "just hitting delete" wasn't an acceptable answer.

Now, you're singing "Just use Baysian to delete for you." Same spam on the wire, same hit on the spool, same copy to /dev/null -- and worse, now you're spinning extra cycles to scan the mail.

Just hit delete means you kill 1000 this month -- and 10000 a year later. I'm tired of paying for bandwidth that spammers use. I'm tired of throwing cycles at SpamAssassin to trap the spam.

Filtering is not an answer. Filtering is a bandage -- and it's one that's soaking through.

Why We Will Always Have Spam

[Aku Head]

The U.S. Congress doesn't care how much spam we get. The FBI doesn't care if some dumbass loses $500 on fake Viagra. But if one crooked record executive sees his sales drop by 1%, Congress will write huge stacks of legislation to protect those profits.

That's because those same record executives give them huge stacks of money. We don't, so we don't count.

The politicians will never lean on Microsoft to secure their product for the same reason.

The best that we can hope for is a few ineffective laws that makes it look like they care.

Possible help: complain to the registrar

[Anonymous Coward]

ICANN requires that domain registrants maintain accurate WHOIS information for their domain names. In the Wired article example, the domain name "removeform.com" is registered via Enom.com and the WHOIS information lists the registrant as:

Organization Name: Tablent
First Name: Karol
Last Name: Nowak
Address 1: Jasna 4
Address 2:
City: Kitrit
StateProvince: AS
PostalCode: 33-526
Country: US
Phone: +1.225322432
Fax: +1.243252224
EmailAddress: blah5@o2.pl

If this information is innacurate (and i'm not saying it is), you may complain to the registrar. The registrar is required to enforce this accuracy and delete the domain name if the information is not corrected by the registrant.

Here is the wording from the ICANN registrar accreditation agreement (http://www.icann.org/registrars/ra-agreement-17ma y01.htm):

3.7.7.2 A Registered Name Holder's willful provision of inaccurate or unreliable information, its willful failure promptly to update information provided to Registrar, or its failure to respond for over fifteen calendar days to inquiries by Registrar concerning the accuracy of contact details associated with the Registered Name Holder's registration shall constitute a material breach of the Registered Name Holder-registrar contract and be a basis for cancellation of the Registered Name registration.

Re:So much spam it sucks.

[letxa2000]

Filtering is merely automating "just hit delete." It still gets sent, it still travels the wires to your box, it still hits your spool.

Unless you earn only pennies per hour, "just hitting the delete key" is the most expensive part of spam. Like I said in my original message, I agree that it would be better if it weren't sent at all. But the largest cost to me--and to SOCIETY--is the time it takes to DEAL with spam, not the bandwidth--although I don't deny the bandwidth is a cost... just not as significant as my time.

and worse, now you're spinning extra cycles to scan the mail.

Better my CPU consume some cycles than spam consume my time. My CPU is cheaper than my time.

Just hit delete means you kill 1000 this month -- and 10000 a year later.

Again, re-read my above message. In the short-term, yes. But as more and more people use filters fewer people will receive spam and even fewer will respond to it. Over time spam becomes less lucrative so there is less reason to send it.

It seems to me like you are looking for an overnight fix. There isn't one. But effective and pervasive spam filtering is a solution that keeps me from having to deal with spam on a daily basis in the short-term, and will lead to a reduction of spam when it no longer becomes profitable to send spam since everyone filters it.

damn the registrars

[Anonymous Coward]

It could be stopped COLD.

For months the nameservers listed in the root servers (which are also running on trojaned machines) and the websites running on trojaned machines (likely proxies) have been reported to the registrars, the operator of the *biz root server machines and icann.

The artice gave the exmaple of www.removeform.com.

That resolved as an alias for the Canonical NAME bestportal.biz with namservers ns[1-5].bubra.biz.
That has been reported to the registrars for bestportal.biz and bubra.biz (enom and domaindiscover) and the operator of the *.biz root servers (neulevel.biz) and icann over and over and over.

For months this has been reported to the registraras and neulevel.biz and icann.

Nothing was done.

Within hours of the article appearing, it seems to have been fixed - for this ONE case.

Find the nameservers for soft4all.biz in the root servers - ns[1-5].UZC12.biz. See that those are running on (lots of things ... attbi.com customers, charter in Saint Louis, RoadRunner machines, ...). See what they resolve soft4all.biz to. See what those are running on. Those haven't been outed in the media yet. For those, it is business as usual. (NOTE: for the past week or so, it seems some "activisits" may be "doing something" and sometimes very few of the listed nameservers work - have they started securing some and leaving them as honeypots?).

It seems that the registrars and icann have one acceptable policy in the dark and another in the light of day.

biz domain: quick change of nameservers

[Anonymous Coward]

changing the authoritative DNS for a zone takes a while

The first time I saw this done was using hosted nameservers. When informed, those went down.

The next time it was in the *.com domain with namservers running on trojaned machines as well. Five or more listed. The spammer relied on at least one remaining up for a day for his spam run for he had a new set of trojaned IP addresses entered in the *.com root servers each day.

They have switched to the *biz domain. They run the nameservers on trojaned machines. One of the advantages the *biz domains advertizes is that the root servers can be updated in real time. I have seen the nameservers listed in the *biz root servers change every five minutes for this operation.

In the *biz domain, running the nameservers on trojaned machines as well, it is easy to move them at a moment's notice -

well, that is if you have a registrar who, having been informed and shown the evidence, that the nameservers are on hacked machines, will knowingly aid in the exploitation of those hacked machines.

For months this has been reported to the registrars and the operator of the *biz root servers (neulevel.biz) and nothing was done.

Within hours of the WIRED article appearing, the particular case of bestportal.biz (tne canonical name for www.formremove.com which was mentioned in the article) and its nameserver listing (ns[1-5].bubra.biz) was fixed.

Of course, the other reported cases (soft4all.biz with nameservers ns[1-5].UZC12.biz) about which the have been informed ... well, it is business as usual.

It appears that as long as they can get away with it, the registrars, the operator of the root nameservers and icann (to whom it has also been reported) are quite willing to support networks of trojaned machines.

Re:So much spam it sucks.

[pdwalker]

I hearby promise that if I serve on the jury when you are convicted of a crime that I will do everything in my power to find you innocent of all charges and blameless. I will convince the rest of the jury to do the same.

But only if your good work resulted in their complete and total termination.

A few hundred acts of public torture and execution of known and proven spammers will do wonders.

Being a known spammer should be known as a Darwin Award Winning category.

Re:So much spam it sucks.

[dipipanone]

I doubt it. Just somebody who understands the concept of proportionality in jurisprudence.

Licence?

[Anonymous Coward]

Just how do you intend to enforce this licence - I know you in America have a police state, but in many other countries, the most favoured form of government is anarchy!

If the police are entirely corrupt, and the army is fighting abducted kids on dope, don't expect any enforcement of internet licences!

However, the threat of declaring war on Poland if they don't get this guy and hang him by the balls in a public place, might get something done about the case in hand.

Re:So much spam it sucks.

[xenobyte]

Spammers are winning.

The battle, yes, but not the war.

By playing dirty like this they force us to play dirty as well.

I suggest that the always-eager-to-serve antispam vigilantees simply set up a network to do DDoS against all the trojan proxies. Remember, they run Windows and they will crash/die if you blast them with a few Gbit/s of evil traffic. Sure, it'll hurt the legitimate owners of those computers but after all it's their own fault by allowing the trojans onto their systems in the first place. Maybe they'll learn and fix their machines. If not, they are quickly taken off the net - for our safety.

With this we both remove these proxies, hurt the spamvertizers and prevent the proxies from being used for DDoS against RBLs and similar! - Not a bad outcome at all! :)

this merely legitimizes...

[Anonymous Coward]

...attacking spammers on their home turf and playing "dirty" in order to impede or stop their work. i've recently met some people who do both telemarketing and spam, and it would be trivial to put them out of commission technically speaking. so start already! :P

Re:So much spam it sucks.

[Trigun]

No problem. As long as you're not trying to sell me something :)

A Little too much too late ...

[terbo]

This isnt really news, irc haxerz have been mass owning peoples machines for years and using them for DDoS, proxies, and probaly all other types of things .. I wonder when they will start using it to crack md5 passwords? Some kids claim to own thousands and thousands of machines, blackhat seti networks would rule .. with the proliferation of new users, its alot easier to plant backdoors .. that no virus scanner [should] catch ...

Not so fast...!

[Firefly1]

Hiding known file extensions is not, in and of itself, a problem. Think about it: under such an environment, the very appearance of extensions such as .txt and .jpg - which are known extensions! - should raise a red flag with respect to the file in question.

RIAA's nightmare

[sglines]

A student of mine just e-mailed me: "I just read the article on invisible hosting, and must say, that in my opinion, it will open up a floodgate of new problems and ideas. I can't wait for somebody to take advantage of utilizing invisible hosting in combination with P2P programs. I'd like to see the RIAA control that one. Ed"

Managing Port Blocking

[billstewart]

You've got it backwards. The reason that Comcast forbids server-like activities on customer machines is that they're suicidally clueless and they haven't figured out that their real competition isn't DSL - it's apathy on the part of people who would be customers if they were given the opportunity to do cool and interesting stuff instead of just faster-downloading couch-potato services. A few DSL providers get this - I'm using Sonic.net, and Speakeasy.net is pretty well-known, and even Earthlink mostly gets it - but too many DSL providers are inspired by clueless telcos who are learning cluelessness from the cable companies. Back when Excite@Home were the people who ran cable modems, their official policy mantra was "Ugh! Servers Bad! File-Stealers Bad! Bad! Bandwidth Theives Bad!", but some fraction of their employees had the clue ("Of _course_ we like Napster, that's why people _buy_ broadband, we just can't admit it anywhere our lawyers can hear us").

The right way to implement this is to have a carrier who has a clue and lets you use your Internet connection as a real full-scale internet connection, but has most kinds of world-to-user connections blocked by default and a friendly web menu for users to turn ports on and protocols if they want. Depending on hardware choices, this may be something you implement at the ISP's router, or may be something you implement at the customer premises equipment (cable modem or DSL box) -- the CPE approach scales better for performance, but sometimes you want to block things at the big end so that attackers don't flood your narrow DSL pipe or neighborhood cable segment.

That way you can get the best of both worlds - freedom to user your system to its fullest capacity, including applications that your ISP hadn't thought of in advance, but relative safety because most people don't turn things on that they don't understand, so broken applications and operating systems are kept protected behind firewalls unless there's a good reason to enable them.