Slashdot Mirror
Spammers Using Hacked Machines as Decoys
avi33 writes "This Wired story shows a disturbing alliance between hackers [sic] and spammers. Interestingly, they blame part of the alliance on market forces, leading some skilled engineers to the dark side for profit's sake. A Polish firm claims to have control of 450,000 Trojaned systems that it uses to mask the IP addresses of its hosted sites. In other words, you could host your Viagra-peddling site with a company that has a stringent no-spam policy, but a DNS lookup will point to a home user's compromised machine. Not quite bulletproof, but certainly ups the ante in the spam war."
Of course if broadband ISPs were to implementing a simple inbound firewall
for every user then they'd eliminate most of these problems overnight:
trojaned machines would be unreachable, worms like CodeRed that scan for
vulnerabilities would be halted.
The few users of broadband who actually need to run an Internet visible
server would then have to contact their ISP for a port to be opened, but
that seems like a small price to pay for cutting off 1000s of machines that
have been hacked.
Naturally, this would cause file steal^H^H^H^Hharing applications to stop
working.
John.
This is more than just sending off a single email to a scantly watched abuse email.. This means getting hold of a real person and explaining, realistisay, what sort of legal liabilities they might be open to if they continue to support the spammer's actions. (Hacking laws, aiding and abetting, Trademark infringement and vicarious liability) often fit in there.
If more people would do this, life would get a lot harder for spammers.
Just sue the owner of the company that they're advertising.
Make some $$$.
It sounds like they run DNS which "load-balances" requests to the spamvertised sites through zombies set up as open proxies. Since the zombies are scattered throughout all IPs, it makes blocking them hard.
Of course the scumbags know their weak spot is the DNS. Blocking particular domains is easy, and changing the authoritative DNS for a zone takes a while (done that too often). It steps up the spam blacklisting to now require not just refusing mail, but also refusing to talk to certain DNS servers that are known to operate this way. They can move around, but it's harder; I'm not sure if this is better or worse than the current situation.
Damn spammers.
People are never as simple as their stereotypes. This applies equally to Christians, Muslims, and Emacs-lovers.
most of them home computers running Windows with high-speed connections.
WHY wasn't ICF turned on by default in XP Home? WHY aren't there pamphlets included with new computers about keeping AV up to date and not opening unknown e-mail attachments? WHY are so many ports in Windows open by default on Home installations? WHY is Microsoft still clinging to the broken "identify executables by extension" mechanism?
We include pamphlets about how not to hurt yourself while you're using your pretty new Gateway PC, but we can't even drop in a fucking 2 page paper about keeping A/V up to date and the danger of executable attachments? Not only that, Microsoft runs on almost all of the Home PCs out there but almost nobody (sorry geeks, we're all still nobodies when we're not on Slashdot) demands any accountability or quality or security from Microsoft?
Fuck it... I'm going to become a goddamn mime.
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Spammers are winning.
I hate to say it, but they are. They're winning because they play dirty, and we can't stoop down to their level. After two weeks of battling an unusual torrent of spam, I'm ready to torture one of the bastards in a week-long live-webcast to serve as a warning to everyone else. It's time to sink below their level, so we can punch them in the nuts without throwing out our backs!
Forgive my ignorance of the relevant RFCs, but if a service provider doesn't let all valid (according to the RFCs) packets get to your box, are they actually providing "Internet" access?
I.e., isn't it a different protocol at that point?
it started as a network of hi-jacked zombie machines...
And its original purpose was more nefarious than destroying the human race: shoving SPAM down people's throats!
The only reason to Spam is to sell a product. But surely if some seller advertises this way, utilizing hacked systems, they are in serious violation of law. Why don't the feds simply go after the clients of spammers. If that happened enough you'd think that the spammers wouldn't be able to make money and would simply stop spamming!
...Before computer use (at least on the Internet) requires a license. I realize that has some very large drawbacks, but at the rate we're going one day the benefits really will outweigh the drawbacks. Do we have to wait until network traffic is 90% spam and viruses? 99%? 100%? A computer can do more damage to the network than a car can do to a highway, and we license driving. Maybe we'll wait until poor network performance starts to kill people by interfering with hospitals and emergency services.
Uh ... Poland is a country of the former Soviet Union? I don't think so.
Maybe an eastern block country. Maybe a Soviet satellite state. But hardly on the same level as Belarus or the *-stan countries (Turkmenistan, Kazakhstan, Uzbekistan, etc.).
Tuus crepidae innexilis sunt.
If that's the way spammers operate, there's no need for new spam laws, no? What they're doing (unauthorized access to a machine) is already a criminal offense. Why not prosecute on that?
Opus: the Swiss army knife of audio codec
When I lived on the dorms, it was a different story. There were an average of 4000 attempt portscans on my machine a day.
Its almost gotten to the point of without turning to viglantism on the internet and launching counter DDos attacks on the spammers themsleves, especially those outside of countries that don't enforce or don't attempt to enfore any type of Spam laws. Most spammers now operate outside of western countries, so what's the cure?
Filtering helps, tools like Spamassassin has brought my total spams from like 80 a day to less than 10.
I for one, as much as I hate them, wouldn't mind to see a few class action lawsuits against spammers. How much longer until the pipes bust with junk and turn the Internet into a near useless medium.
I know several of my clients now call me instead of email as they say that they "Have to wade through 30 junk messages for one valid message". I have rules set up to where my customer's and family email go to seperate folders, and that helps even more, but something needs to be done.
As much as I hate to bitch and not offer any answers, I am afraid that I am stumped. I fear that any attempts to write new protocals, espically by the likes of M$, Yahoo, HP, and other major players, with result in the closing of networks, (i.e. this message was not authenticated by a pallidum enabled server, therefore it will be rejected. Please trade your Mac in for a PC with Win XP^2 for $1000) and cause a leap backwards. At the same time, while people here can say the OSS community will develop an "open" solution, the very fact that its open means that the very people we try to stop will be able to circumvent anything the community develops. Not to say this won't happen with closed-source technology, but then companies like M$ can possible use DMCA against the spammers that reverse engineer such technology.
In any case, spammers are winning and we all are losing.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
Here is yet another example of how spammers have no regard for laws and where their activity is blatantly criminal. It also illustrates why spam laws will be ineffective.
.sig?
It is about time for Law enforcement to find them (follow the money, duh!) and prosecute them. If they are hiding someplace that has no effective rule of law, find them and then knee-cap them. Maybe then they will appreciate law-and-order a bit more.
Psst. Hey buddy, can you spare a
They are only winning to those that don't do anything to help themselves.
The Verisign SiteFinder was a bad thing, obviously, but I laughed at the reaction "It's breaking my spam filter." What kind of archaeic, obsolete spam filter were these people using?
Likewise, that spammers are using trojaned systems is bad, of course. Any system compromise is bad. But this is just normal virus and hacking. It doesn't make it any harder to get rid of your spam.
I've said it once and I'll say it again, Bayesian filers is the solution. It works today and it depends on no-one but yourself to start using it. Since I started using it in May, I've received 20,596 spams--of those I've seen 89 of them. I.e., only 0.43%. It comes out to one spam every other day, though that's deceptive since probably half of those that got by were cases of a single spam sent 5 times in rapid-fire mode and they all happened to get through at once--the same spam 6 hours later would've been filtered. In reality, I'd guess I see one spam per week. In a perefect world I wouldn't see any, but that's good enough for me in this imperfect world.
Now, some will say "But that doesn't solve the bandwidth problem." In the short-term, no, it doesn't. But in the short-term it doesn't waste my time which is my single largest expense when it comes to spam. And, in the long-term, if more people started using Bayesian the response rate on spam would continue to plummet making it less and less useful to spam in the first place.
But those that are being bothered by spam on a daily basis simply aren't using the tools and technology that are available to them, and have been for over a year.
If what they're doing is redirecting to random compromised machines which in turn go to the real site, one method for combatting them is to set up a honeypot of easily-compromised machines and wait for one or more of them to get infected by these loser's trojans. Then firewall logs (or analysis of the trojan) will reveal the real addresses being relayed.
Shouldn't we be monitoring spam anyway, building a list of source IPs, and notifying the ISPs responsible for those IPs to pass along a message to their customers to either a) stop sending spam or b) fix the holes in their machines, or c) they will be cut off from the 'net...
"Freedom means freedom for everybody" -- Dick Cheney
www.eFax.com are spammers
ITS CRACKERS! Hackers are just normal computer enthusiats like me and you. Crackers are the malicious ones. http://www.catb.org/~esr/writings/hacker-history/h acker-history-3.html
Tragek
I've said it once and I'll say it again, Bayesian filers is the solution.
/dev/null -- and worse, now you're spinning extra cycles to scan the mail.
No, it's not. Filtering is merely automating "just hit delete." It still gets sent, it still travels the wires to your box, it still hits your spool.
The core argument against spam is that it shoves the costs of advertising onto the recipents. That's why we said that "just hitting delete" wasn't an acceptable answer.
Now, you're singing "Just use Baysian to delete for you." Same spam on the wire, same hit on the spool, same copy to
Just hit delete means you kill 1000 this month -- and 10000 a year later. I'm tired of paying for bandwidth that spammers use. I'm tired of throwing cycles at SpamAssassin to trap the spam.
Filtering is not an answer. Filtering is a bandage -- and it's one that's soaking through.
Ceci n'est pas une sig.