Slashdot Mirror
Examining an Automated Spam Tool
Saint Aardvark writes "SecurityFocus has published an excellent column detailing how spammers r00ted an Apache server, and used it to send spam. The tool they used is (I hate to admit it) pretty sophisticated: it has macro capabilities, picks up email addresses from and reports success or failure to the master server. It's a very frightening read...and so is this: Message Labs reports that they now intercept 27 spam emails per second, up from 2 per second this time last year. Virus-created proxies are mainly to blame."
All this really makes me wonder when the death penalty will be approved for spammers. Or at least some harsh beatings...
Spam is profitable, and this is becoming a huge underground business. Spammers regularly compromise other systems and install sophisticated software to allow easier spamming. Here's a document that describes the link between spam and viruses
One day I noticed that one of my remote servers was sending 24 hours a day a continuous 11Kbytes stream, using the 100% of the upload bandwidth (128Kbits).
Seems greed has once again turned around and bit someone in the ass (in this case it was a good thing). So all these spammers really need to do is slow down the avalanche of spam somewhat, and throttle their speeds when relaying. Otherwise, how long would this have went on for if he hadnt noticed his upload being maxed?
This is obscene. How far will spammers go?
Although I haven't experienced spam that goes so far, I have received (in my special spam account for playing with Nigerians and lottery managers) quite a few mails with requests to confirm my e-mail address. It works like this - you get a mail saying something a la: "I am controlling the e-mail sent to my inbox for the following address: sucker@born.every.minute.com. By asking for you to confirm that you really sent email to me I can ensure that I receive no spam and that your email address really exists. This is a one time confirmation, please click the link below and your email will be delivered straight away, now and in the future. Regards, Alberto Huber"
The funny thing about it was that the "I" in question was neither someone I sent mail to nor someone I know at all.
Now if they think I'm going to go click the link to confirm that my e-mail address exists, then they would surely be willing to buy some property on Mars I have for sale. Radiation-free. Really.
People say I'm crazy, I got diamonds on the soles of my shoes...
No, not yet! I'm only halfway through my penis-enlarging regimen!
I think it's time we get a new mail protocol.
If we can somehow get a list of relays authorized for the sender's domain, it would be easier to flag a message as SPAM.
Also, I think the messages should be stored on the relay, with just a URL sent in the mail body. It would solve two problems:
* The size of the message will be limited by the size of the sender's mailbox.
* It will use more resources on the relay, and the admin should be less likely to run an open relay.
Death has been proven to be 99% fatal in lab rats.
yes it's definitely profitable, this is part of the problem, a major part of it!
even with all the crap that people are doing, new SMPT clients, new RFCs and bullshit, it's not going to work!
why? because spammers pay their ISPs tens of thousands of $ a month just for the privilege of spamming!
I remember an old story months (or years) ago about a spammer, got tracked down, the whole nine yards, the ISP refused to cut them off because they were paying the ISP over $50,000 a MONTH to send spam. These days they pay even more.
So all your "checks and balances" don't do any good, because the spammers are VALID users (at least in the eyes of the ISP hosting them).
And this is also why no one does egress filtering. AT&T US, etc won't do it because they get PAID to keep sending the stuff...
face it, spam is BIG business, it makes millions, esp for the ISPs, etc.
all your useless "valid" client checks, checksums, special SMTP servers, blah blah blah won't make a damn of difference.
the only way is with either good (huge) blacklists or bayesian all over the place.
and what someone said about "end users" not caring about bandwidth usage, not true. I'm an end-user, and I care, excess bandwidth costs me money dammit! I am my own mail server, so don't tell me a firewall on my server is gonna slow down the traffic. it doesn't.
I keep to my original proposal, a massive blacklist. headache? yes, but it'd work if kept updated...
No, and apache didn't get rooted, either. A poorly written PHP script did.
Vintage computer games and RPG books available. Email me if you're interested.
Comment removed based on user account deletion
It was a pretty good article, but he leaves off one glaring fact. If he had kept his software up to date, this would never have happened. BugTraq says August 2002 when this was identified.
This is a test. This is a test of the emergency sig system. This has been only a test.
Well, there's no accounting for spammers' tastes. Judging from some of the spams I've seen, females with enlarged cocks are apparently pretty popular with these folks...
"Time is an abstract concept devised by carbon-based lifeforms to monitor their ongoing decay." - Thundercleese
Yes. It needs to be completely blocked at backbone routers, and new and better alternative developed.
So, the steps would be
1. develop a better alternative as fast as possible, and make it as simple as possible to implement.
2. deploy the better alternative for test use.
3. develop a fixed version 2 of the better alternative after it's holes are discovered.
4. deploy the fixed version.
5. block SMTP and version 1 of new protocol at international and national backbones and national borders, so that everybody is forced to switch.
So SMTP would still be completly usable for example inside organizations, so if a company has huge installed base of legacy software, they could have internal SMTP-new protocol gateway.
Of course this would require IETF to get their act together, and various governments to agree that this must be done, and actual new protocol to be simple enough and not contain patented algorithms or any other stupidities.
So it will not happen. Then spam will overwhelm the internet transfer capacity. Then SMPT is blocked and free internet e-mail will cease to exist. Proprietary solutions will develop, but there will be a chaos. Incidentally, Microsoft will happily provide a closed proprietary system only usable from their operating systems.
Hi
s ins
I have made an eigenpoll
to find the best spamtools.
First ranking the tools you know,
the it runs some data minning and find the best tool.
Right now the list looks like.
sa-exim
Outclass
Mail Scanner
spamprobe
POPFile
SpamBayes
SpamAssas
Vipul's Razor
Blackmail
bogofilter
Infinospam
Spamthi
Shovel
SpamBouncer
Declude JunkMail
spamhole
Let's first of all say I am no fan of spam. In fact, I hate it. All spammers - and virus writers - should be strung up and subjected to some real virii.
However, some of these statistics are possibly obscuring reality. For example, let's take Messagelabs anti-spam service. Until recently, all emails from WorldPay - receipts, etc. - were marked as spam. All the traffic on an email discussion list that I have signed up for are marked as spam. Some commercial email notification lists that I have signed up for (ie. Maplin offers) are marked as spam.
But none of those emails *are* spam. Admittedly, some spam emails do get through without being flagged. So maybe it's a bit 'swings and roundabouts'. And regardless, the situation is pretty depressing anyway.
One thing I have been thinking about - and just wondering whether it should be entered as an Ask Slashdot item - are some of the 'cures' as bad as the problem itself?
I work on biology / medicine journals websites, and we offer a number of automatic notification and general update services. Note that these are *not* spam - they are requested by individuals by signing up on the website - and instructions are given in every email in how to remove yourself from the list. And they are a very valuable service to many people that do choose to receive them. Yet it only takes 1 person to not bother to read or follow the removal instructions, or otherwise hit some other temporary (accidental) issue that holds up their removal, and then submit it to a blacklist service to bugger things up for many other people.
So where is the regulation on the blacklist services? Where is the ability for *genuine* (provably genuine) companies to register their services in such a way that rather than getting blacklisted immediately, they have the opportunity to respond to the issue raised? Is this a small or large price to pay to partially stem the tide of actual spam?
The spam contains ads for the "Asta Design Group", which has been widely spamvertized. A bit of searching turns up this address:
360 NE 49 St
Fort Lauderdale, Florida USA 33334
E-mail: seafish1@ix.netcom.com
Another lead gives us
SeafishNET
360 NE 49 St.
Oakland Park, Florida 33334 USA
(954) 351-7961
seafish1@ix.netcom.com
Same address and zip code, but in Oakland Park, a Ft. Lauderdale neighborhood. Now we have a phone number. Google gives us
Checking the satellite imagery, that's a tract house backing up to a six-lane highway. It's not a mailbox service.
Since we're talking about felony computer intrusion here, that's the address to give the cops. This may or may not be the intruder, but they probably know who it is.