Slashdot Mirror
Prosecuting Spamming Crackers?
lnixon asks: "As a recent Slashdot article mentioned, the latest trend in spamming is to use cracked Windows machines for sending spam and hosting spamvertised web sites, 'spacking', as Wired terms it. A couple of weeks ago, I started tracking one of these cracker rings down, carefully documenting the trail as I went.Mostly through luck, I actually found the originating server. This information should seriously put a crimp in their activities...if only I could get the law interested. I have tried to get the attention of CERT, of FBI and of my local police authorities, but nobody seems to be interested. Now, what should I do? Organize a posse?"
Post it on the web and let the public take the law in to thier own hands
If it is near me I can scrounge up a few buddies with the promise of beer afterwards and make the spacker an offer he cannot refuse.
"Those who make peaceful revolution impossible, make violent revolution inevitable" - JFK
1. get their attention
/.
2. be the end of their spam operation (for a while)
3. ???
4. profit
So, whats the url/IP of this/these clowns...
...as I prepare the morality guage for
No more Micro$oft bashing from me. Its like bashing at the special olympics.
You're mistake was referring to them as "spammers" instead of "terrorists". Isn't anybody who cracks a system now official considered a "digital terrorist"?
"Freedom means freedom for everybody" -- Dick Cheney
You guys are making me hungry!
Give the information to your local newspapers and TV news programs. The spotlight might spur the authorities into action, and the reporters will love you because you saved them from doing any pesky work for themselves.
One slashdot posse, coming up!
I'll get the pitchforks, you get the caffeine...
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
You said their servers are distributing the MS Proxy Server. Why not let MS know about this, I'm sure they'd fire off a memo to the hosting companies letting them know that the sites are hosting pirated software.
Hack the source web site and turn it into an Al Quaida home page. The terrorist reports will flood in and the spammers will be shut down. That is, until tomorrow when they start up again from somewhere else.
Yuh, it's always them Midwest crackers spamming my Inbox.
Karma: Chevy Kavalierma.
spamming crackers?
why is it always a race issue on this site?
But seriously folks, if you can discover and take down the master host hiding behind all these proxies, you have a much better chance of taking them down.
Another idea, subvert their own network, let a machine or two get into their network of proxies so you can track their future activities.
This kind of computer fraud (yes fraud, there are pretending to be something they're not) needs to be taken much more seriously by the authorities.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
So I got out my Internet Explorer (cause that's what the article says the website needed) and clicked on all those websites mentioned in the article, but nothing loaded... The page was just blank. Oh, my firewall did ask me something about something called DNS, so I clicked 'OK'.. Could someone please email me what was on the site that I was supposed to look at? He said it might be pron ;)
Thanks in advanced.
If you're willing to compromise on the "living" detail, I know where you can get some sweet lovin... just wear your raincoat.
Now, what should I do? Organize a posse?"
Why not? Worked for Andre the Giant.
Contact the congresscritters for your local district. They certainly know that any effort to fight spam will look good come re-election and they have the power to "make a couple calls".
~~~~~~~
"You are not remembered for doing what is expected of you." - Atul Chitnis
Mmmm... spam and crackers...
Mmmm... Spam and crackers.... :)
That would be great. I always wanted a posse. If you get one together you should make them all wear MC Hammer pants. .... And everytime you say something a bunch of them should go "Word!" Then you could give them shout outs and stuff.
A lot of folks who might know some folks watch the list. Plus, your analysis is the best one I've seen so far on what's going on - this is of interest to others doing security, if nothing else.
I forget what 8 was for.
The FTC also has some jurisdiction over this.
I'm not a lawyer, but the lawyers at those places will be happy to but your investigational talent to use. Keep up the good work!
Bureaucrats hate paper trails. It's very easy to blow off a phone call. A written report has to be handled more carefully.
Mea navis aericumbens anguillis abundat
It is tempting to think that simply closing off the known holes in the target machines should suffice. That's just wishful thinking. There will always be other ways for the spammers to enter, not yet discovered. The only way to keep the spammers out of those hosts is to wipe them clean. Eventually the owners will either leave them disconnected from the internet, or wiped, or will install something secure. Until then, they need to be wiped as many times as needed to get the message across.
This level of conflict was inevitable once the spammers encountered enough interference in their old methods. Now there's no going back. We need to ensure, positively, that any host that is connected to the net really is secure enough not to be hijacked by the spammers, and there's only one way to do that.
The only practical problem with this method is that the spammers have a vector available that anti-spammers don't. Spammers can put their viruses in their own spam, and booby-trap their own web pages referenced by their spam, but anti-spammers can't use those vectors without themselves spamming. Fortunately there are so many holes in the target systems that it will be some time before that difference actually protects the target hosts.
You'll want to get a whole team of volunteers in on this. Make sure it's
clear, the goal is to investigate, to obtain information. No threats are
to be made, and no physical harm-inducing action to be taken. Just a big
fat trainload of investigation. Spamming itself, though highly objectionable
socially, is not per se illegal, but given the stigma attached to it, there's
an excellent chance that spammers, *especially* ones that also use cracking
techniques, may have the kind of morals that may lead them to view other
illegal actions as "only illegal if you get caught", which could mean that
by investigating you can turn up some real dirt. Can't hurt to check.
An important secondary goal is to make sure, without telling them, that they
KNOW that they are being investigated, but not by whom. So, spare nothing
when it comes to forms of investigation that they'll notice. If you can find
out where they work, phone up their employer and start asking questions.
Don't do anything illegal, but whatever you can do legally, do it. The
going-through-the-garbage trick is fairly well-known now, having been used in
the movies, so if you can determine that it's legal in the jurisdiction in
question, do it -- repeatedly if possible. You want them to *see* their
trash being pilfered by somebody other than trashmen, but not have any way
to track who it was (so, don't let them see your license plates or anything).
The reason you don't want them to know who it was, is because it's scarrier
for them that way. Yeah, taking their garbage may be legal, but even if
you'll win that court case, they'll feel better just by being able to *do*
something about you. Plus, if they know who you are, they'll know also who
you *aren't*, namely, various types of people by whom it would be scary to
be investigated, such as the police, FBI, tv newspeople, professional
investigators, or whatever. You don't want them to be able to rule out
those possibilities. Even if they strongly suspect it's just anti-spam
activists clowning around, you want doubts in the back of their minds.
Basically, there are two things you want to accomplish. First, if they've
done anything illegal, you want to know and, if possible, be able to document
it. Second, and at least as important, you want them so worried about being
investigated that they're up nights, stressed out, irritable, crabby and, in
short, miserable. Bonus points if you can get their families worried about
it too. This will all be most effective if, rather than warning them that
you will investigate them, you let them figure it out on their own. That way
they wonder what *else* is going on. You cannot make any threats that will
scare them as much as what their own immaginations will come up with when
they realise they are being investigated. So don't make threats. If they've
done anything illegal, you want them wondering if the FBI might be involved.
If they haven't, you want them wondering who on earth would be investigating
them and why, and whether possibly a major news network is doing a story on
them for primetime the next time a slow news day rolls around, or some
equally life-disrupting thing. You don't want to hint at anything specific,
of course, because vagueness is scarier. You want them stressed out,
enumerating unpleasant possibilities in their minds, biting their nails,
taking heartburn medications and headache pills.
Ultimately, your goal is for them to decide to get out of spamming. Unless
your investigation turns up anything you can interest the authorities in.
In that case, of course, by all means do that.
Cut that out, or I will ship you to Norilsk in a box.
- bubra.biz, down
- vhost01.768men.info, down
- hosthype.com, down
- ucp6.biz, 127.0.0.1 huh?
Looks like posting to slashdot gets results.
The IE exploit exe file should be posted to all the anti-virus companies, at least then some windoze lusers will be protected. Leif has left it on his website here.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
As to the law enforcement agencies, spam is simply not a serious crime in their eyes, especially given the amount of effort they need to effect a successful prosecution. Sure, the network is being used for spam now, but a simple change to the .exe being hosted by FDCServers (or whatever hosting company the spammer is using at the time) could change that into *anything*. Make sure that you make that clear. Give them a list of any compromised IPs you have identified and suggest that they see if any of those IPs have also been used to launch DoS attacks, etc (likely, given the lack of patching). If you can establish a link to a high profile case then that might be sufficient to kick start an investigation.
Good hunting!
UNIX? They're not even circumcised! Savages!
what good are they if nobody wants to actually ENFORCE them?
Well, if you'd been paying attention, you'd notice that the anti-spam laws in most states make it a civil penalty, not a criminal one. So enforcement would be up to the victim.
And (again, if you'd been paying attention, you'd also realize) these spammers are cracking machines - so the submitter is not trying to get them prosecuted under anti-spam laws, but under computer crime laws.
If they hijacked these machines, why can't you hijack them and patch??
...short of being a corporation that makes millions each year, is to get the media involved. The best thing in the world to make law enforcement do something is bad PR. I know a couple reporters at a few large newspaper that might run a story about it. Let me know if you want me to put you in touch.
Read what I have below, but I think that your best bet is to go to the local university and find a Computing Science professor who's willing to listen to what you have to say. Once you can get the backing of someone like that and their willingness to walk into a meeting with you, then you should be able to go to almost anybody and get their ears perked.
Most University professors are used to having random people (students mostly) coming to to talk to them. Take advantage of this, but remember that you've probably only got a few minutes to get their attention.
Even if they can't help you directly, they can probably point you to someone who can.
____________
Chances are, however, that you do know somebody who can get you an inside track. People like that include would include friends who know high ranking public officials, media people politicians, etc.
Ask around.. see who can get you an appointment of interest. Once you have contacts lined up, your next step is to figure out, for each person of interest, where you can generate a common interest... Your end goal is to get a fire lit under an appropriate police investigator.
A journalist, for example, is going to want a story. On thing you'll need to do here is get their agreement to embargo the story until the hacker's been nailed, or it's clear that some publicity is needed to get some action. My worry here is that once the story breaks, the spammer is likely to destroy lots of evidence.
Politicians, of course, want fame and glory. Knowing that you've got a journalist on the line will help get their attention. The story that will make them look good is "Representative Muck-a-Muck, having been contacted by a constituent, got the appropriate authorities involved and active". Once the story actually breaks, then they can claim to have been on top of it almost from day one.
Police officers are generally overwhelmed. More than anything, they just want to get their assigned jobs done and get home by midnight. There are two ways to approach this (depending on what end of the totem pole they're on).
On the lower end, you're probably looking for someone who knows enough about computers to vette your evidence and verify that it's legitimate. You may have to go through a few officers to get to someone who can understand your evidence well enough to explain it to someone who can get action.
. Remember... they hate spam too. If you can get this spammer 5 years in jail, this will probably set back spamming volume by a year or two as the rest of the spamming community drops these hacking tools for fear of Mr. Bendover.
On the upper end of the totem pole, You're probably best to go in with the backing of a journalist or a computing science professor. Journalists will put the fear of the pen to them. Professors will give you an air of serious credibility.
Let it be known just how much time you've but into the investigation so far, and how mudh more you're willing to put in. Also let them know that your primary interest is putting this b*stard behind bars, and you'd prefer to see the investigation complete before this breaks in the press than afterwards (mostly because it will result in more usable evidence).
Free Software: Like love, it grows best when given away.
Let me make sure I'm understanding you correctly. We should illegally hack into innocent users machines to "teach them a lesson" in security... repeatedly, until they either disable their network connection or disable their vulnerabilities? Isn't that like shooting the hostage?
To make a more accurate, real-world example, that would be like walking down the street, shooting at anything that moves, in an attempt to make sure that no one walks outside without adequate protection from... well, people like you. After all, we'll have no terrorists taking hostages if we kill all of the potential hostages, right?
I hope no one depends on you for network security or sysadmin support.