Slashdot Mirror
25,000-Ton Amphibious Spam Relay
hormiga writes "The amphibious transport dock ship
San Antonio
incorporates the latest quality of life standards for the embarked Marines and sailors, including the sit-up berth, ship services mall, a fitness center and learning resource center/electronic classroom and
Unsolicited Bulk E-Mail. Now the Chinese can relay
their spam through U.S. military naval vessels." Well, Chinese spammers, anyhow.
The ship supports the Marine Corps "mobility triad," the LCAC
...
(Landing Craft Air Cushion vehicle), the "Triple A-V" (AAAV -
Advanced Amphibious Assault Vehicle) and the MV-22 (Osprey
tiltrotor aircraft),
and (apparently) spammers in Guandong. Rd China.
Furthermore, San Antonio incorporates the latest quality of life
standards for the embarked Marines and sailors, including the sit-up
berth, ship services mall, a fitness center and learning resource
center/electronic classroom
and Unsolicited Bulk E-Mail.
Of course, it's possible that one of the OTHER eleven ships, still under
construction, is the Avondale, LA dot-MIL spam relay, or trojaned boat,
or some nice-and-secure Windows box in the construction drydocks, running
Microsoft Exchange Internet Mail Service Version 5.5.2653.13
But doesn't it make all Americans feel all fuzzy and secure that a
Red Chinese spammer can abuse a US Naval Vessel of one of the newest
designs, to relay his "business proposition"?
Perhaps it's tied to the USS Green Bay, instead? or USS New Orleans?
http://www.navsea.navy.mil/newswire_content.asp?tx tDataID=8963&txtTypeID=2
The USS Mesa Verde, seems to be in Mississippi, instead
http://www.navsea.navy.mil/newswire_content.asp?tx tDataID=8663&txtTypeID=2
But the E-Mail headers finger the USS San Antonio, LPD 17, already
christened, and due for commissioning some time this coming year.
LPD 17 Looks Like a "Gator"
http://www.navsea.navy.mil/newswire_content.asp?tx tDataID=8596&txtTypeID=2
but from here, it just looks like another spammer.
[SPECIMEN]
H: Return-Path:
H: Received: from avnavfw.lpd17.navsea.navy.mil
H: (avnavfw.pms317.navy.mil [05.67.231.235])
H: by mail.gtcs.com (8.12.10/8.11.3/gtcs-6.3.8) with SMTP
H: id hBG65HO8091853
H: for ; Mon, 15 Dec 2003 23:06:39 -0700 (MST)
H: (envelope-from: )
H: X-Authentication-Warning: serv.gtcs.com: Host
H: avnavfw.pms317.navy.mil [205.67.231.235]
H: claimed to be avnavfw.lpd17.navsea.navy.mil
H: Received: from no.name.available by anavfw.lpd17.navsea.navy.mil
H: via smtpd (for [209.181.16.1]) with SMTP; 16 Dec 2003 05:53:08 UT
H: Received: from avnavfw.AVONDALE (205.67.231.5 [205.67.231.5]) by
H: swn-email.lpd17.navy.mil with SMTP (Microsoft Exchange Internet Mail
H: Service Version 5.5.2653.13)
H: id YY2BDP4P; Tue, 16 Dec 2003 00:07:28 -0600
H: From: "HuatonE-ScooterCo.,Ltd"
H: Received: from [61.145.234.62] by avnavfw.AVONDALE
H: via smtpd (for [205.66.99.30]) with SMTP; 16 Dec 2003 05:51:47 UT
H: Subject: Re.About our new product
H: Content-Type: text/html
H: Date: Tue, 16 Dec 2003 13:57:41 +0800
H: X-Priority: 3
[extract from HTML body]
B: Our company specializes in exporting electric & gas scooters, which
B: are most popular with our customers at home and abroad. Now we are
B: writing to offer you an opportunity to develop a mutual trade. If
B: you are interested in establishing business relations with us, please
B: let us know your requirements. Then we would like to forward catalogues
B: as well as detailed information to you, and offer the best price to
B: you. We assure you of our best attention to your any inquiries.
B: We anticipate your early response in respect.
B: Huaton E-scooter Co., Ltd.
B: Room.B-202,Building Si-Hai-Ming-Yuan
B: Burg Weiji,Zone Gongbei
B: City Zhuhai 519020
B: Province Kwangtung,China
B: Tel:86-756-821-6922
B: Fax:86-756-888-3037
Spam support by:
The US Navy, Avondale Lousiana Shipyard, Frewall, a
I hate to destroy part of a good story. But San Antonio is NOT, repeat NOT the spam relay. LANs on ships are NOT connected to the Internet. The military has its own non-public networks for ships. Furthermore, San Antonio has NOT been delivered to the Navy. It is still under construction. That's the good news. The bad news, is that a Navy site has been compromised. The headers give us some clues. avnavfw.pms317.navy.mil is a Navy address. PMS317 is the Navy program office responsible for building the San Antonio class of ships. Avondale Shipyard is where the ships are built.
These technicial-draftees are extraordinarily busy. They're asked to manage really complex systems that are not terribly reliable. MS Exchange and Win2k require good people to keep them going, but throw database replication systems and the rest of their suite on top, and they spend more of their time crying for help to shoreside contractors than getting things fixed. That their MS Exchange server got penetrated is hardly a surprise given the number of fires these guys are regularly trying to keep under control.
If they can get professional DBA's and Network Engineers on each ship and this happens, then I'd raise hell. But there aren't a whole lot of MSCEs and DBAs that want to go on 9 month sea deployments of 16-hour days with the starting salary of an E-3, which I guess is about $800/month. In the meantime, scream at Lockheed Martin, the contractor for the Navy-Marine Corps Internet (NMCI) project, which has hosed up more than they have fixed. NMCI dictates identical configurations across all systems, which makes it really likely that the vulnerability we see here exists virtually everywhere in the Navy. Lockheed designed it this way, and got paid an enormous pile of cash to do so.
Maybe they owe us a refund?
Do you really think anybody gets paid $800 a month in the military? Maybe if they had incurred multiple severe fines for screwing up royally. I don't know what it is nowadays but when I was an E-1 about 10 years ago the pay was *struggles to remember* more like $1400 a month for the lowiest of the low E-1 nobody.