Slashdot Mirror
Examining an Automated Spam Tool
Saint Aardvark writes "SecurityFocus has published an excellent column detailing how spammers r00ted an Apache server, and used it to send spam. The tool they used is (I hate to admit it) pretty sophisticated: it has macro capabilities, picks up email addresses from and reports success or failure to the master server. It's a very frightening read...and so is this: Message Labs reports that they now intercept 27 spam emails per second, up from 2 per second this time last year. Virus-created proxies are mainly to blame."
One day I noticed that one of my remote servers was sending 24 hours a day a continuous 11Kbytes stream, using the 100% of the upload bandwidth (128Kbits).
Seems greed has once again turned around and bit someone in the ass (in this case it was a good thing). So all these spammers really need to do is slow down the avalanche of spam somewhat, and throttle their speeds when relaying. Otherwise, how long would this have went on for if he hadnt noticed his upload being maxed?
Although I haven't experienced spam that goes so far, I have received (in my special spam account for playing with Nigerians and lottery managers) quite a few mails with requests to confirm my e-mail address. It works like this - you get a mail saying something a la: "I am controlling the e-mail sent to my inbox for the following address: sucker@born.every.minute.com. By asking for you to confirm that you really sent email to me I can ensure that I receive no spam and that your email address really exists. This is a one time confirmation, please click the link below and your email will be delivered straight away, now and in the future. Regards, Alberto Huber"
The funny thing about it was that the "I" in question was neither someone I sent mail to nor someone I know at all.
Now if they think I'm going to go click the link to confirm that my e-mail address exists, then they would surely be willing to buy some property on Mars I have for sale. Radiation-free. Really.
People say I'm crazy, I got diamonds on the soles of my shoes...
Actually, and yeah yeah yeah, I know there are probably settings around this, but that default of cgi variables automatically being turned into global variables of the form $same_name_as_in_the_form has always seemed to be asking for trouble.
PHP, at least when I was looking at it a year and a half ago, always felt half-baked to me.
SO YOU'RE GOING TO DIE: The Comic for Dealing with Death
I think it's time we get a new mail protocol.
If we can somehow get a list of relays authorized for the sender's domain, it would be easier to flag a message as SPAM.
Also, I think the messages should be stored on the relay, with just a URL sent in the mail body. It would solve two problems:
* The size of the message will be limited by the size of the sender's mailbox.
* It will use more resources on the relay, and the admin should be less likely to run an open relay.
Death has been proven to be 99% fatal in lab rats.
This is going to make me move my web server to OpenBSD 3.4-stable on macppc even sooner. It would have two layers of defense against this kind of attack, even if the PHP hole was there.
Running under systrace might also help stop it from opening outbound connections.
I dont see what the technical or social barriers are. For example, it would not require any change in the way mail is transported. Instead it would all be handled by the recipient's browser.
consider the following straw man scheme. I send you an e-mail.
1) If I am in your white list the e-mail is accepted.
2) if not then the e-mail is examined for a signed, serial numbered e-stamp and if present a short message is sent to central post office to debit the senders account one penny, and a receipt is returned to my e-mail program which then lets the message in.
3) Finally if the message does not contain a stamp and is not white listed, the message is put in a spam folder and a memo sent to the sender (me) telling me that I need to request permission to send e-mail.
The last step is how for example Earthlink's highest level spam blocker works. If most messages are spam then of course it doubles the total number of messages sent, but does not double the total message sizes or hand shaking. To the extend that it works, the post offices will only be consulted if the sender is not in the white list so unused stamps can be reclaimed. Moreover one could have the option of refunding the senders stamp if the message were welcome.
I dont see what the sociologocal or technical hurdles are. Not every one has to be using the stamp processing client program. When stamps are not present it defaults to the earthlink system. When they are is skips that nuiscance.
the best part is that legitimate direct mailers might very well be willing to pay the postage to send you an advertisment but presumbaly in many cases these would be targeted ads to people with potential interest.
Some drink at the fountain of knowledge. Others just gargle.
I remember an old story months (or years) ago about a spammer, got tracked down, the whole nine yards, the ISP refused to cut them off because they were paying the ISP over $50,000 a MONTH to send spam. These days they pay even more.
Because SPAM as a whole is becoming illegal in many areas, and much of what spammers do is already illegal. If the ISP is allowing the spammer to continue operation, and he is pumping illegal products/scams/etc then the ISP will be on the line.
It's one thing to profit for unscrupulous activity, it's another to knowingly allow an illegal one.
Making it easier to certifiably track spammers is part of the solution because if you can say with strong surety that an ISP is supporting the spammer... then you can take action against the ISP.
In my dorm we have blocked port 25 from LAN to internet. It was thought to keep viruses from propagating from out network and keep people from setting up a spamserver. Now it looks like a very good decision. (they can actually only use our DMZ smtp gateway, which is antivirus protected).
All ISP or the like should block port 25 outbound by default, and make people use the smtp server of the ISP. If people (1 out of 10.000) would like to use port 25 outbound, they should contact the ISP through a bureaucratic procedure. That would close the trojan hole at least.
Are there any other ports (priviledged/unpriviledged) that one can safely block to avoid trojans and the like???
You will need an ICBM version and Putin's agreement to let it through and not pay you back in the same currency with interest.
Jokes aside, while not being compromised myself I have gone through a similar process investigating distributed server farms on cable and DSL serving counterfeit software (once again advertised by SPAM). In all cases the final step ended up being somewhere in Russia at least 600km from of Moscow.
The method of intrusion is different though. In all cases it is windows software. Common examples are the one which copies DVDs to CDs (with all offers seen over the last 2 months being a trojan). Basically this, along with several similar common SPAM sucker gatherers is used for guess what - to gather suckers. The software actually works, but it contains a fairly sofisticated remote access trojan.
This has recently been extented to include sucker gatherers introduced in counterfeit branded software. Basically, you pay 39$ for a counterfeit Win XP pro at "OEM Clearance Sales" and get a Win XP pro with a "surprise".
Servers are all over the world, mostly on cable networks (strangely enough very few DSL ones). DNS (which is the weakest link) is run by known "questionable" marketing hosting sites usually in the US.
With the number of suckers around trying to copy DVDs onto CDs frankly I do not see a reason for all the effort into hacking sites with vulnerable lame PHP software. So I guess these were some "new kids on the block"
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
The spam contains ads for the "Asta Design Group", which has been widely spamvertized. A bit of searching turns up this address:
360 NE 49 St
Fort Lauderdale, Florida USA 33334
E-mail: seafish1@ix.netcom.com
Another lead gives us
SeafishNET
360 NE 49 St.
Oakland Park, Florida 33334 USA
(954) 351-7961
seafish1@ix.netcom.com
Same address and zip code, but in Oakland Park, a Ft. Lauderdale neighborhood. Now we have a phone number. Google gives us
Checking the satellite imagery, that's a tract house backing up to a six-lane highway. It's not a mailbox service.
Since we're talking about felony computer intrusion here, that's the address to give the cops. This may or may not be the intruder, but they probably know who it is.
I was very impressed with the forensics this guy did. It was fascinating. Too bad it's necessary. I wonder how many machines out there are compromised without anyone even knowing it.