Slashdot Mirror
Spam Opt-out Link Triggers Malicious Code Attack
Maestro4k writes "The Register is reporting on a new spam E-mail circulating out there. In it, clicking on the 'Click here to remove' link launches a site, that when the user scrolls the page, triggers a drag-drop javascript exploit. Scarily the E-mail actually complies with the CAN-SPAM act as it only requires spammers to put an opt-out link in their mailings. As The Reg says "It comes as little surprise that this feature is been taken advantage of in a social engineering exploit; but it does illustrate the security problems of the opt-out approach that were always apparent to security experts - and ignored by legislators." The link in questions points to www. xcelent.biz (As in The Reg story, space intentionally included) so even if you can't block the mail yet it should be easy to block access to the site with the exploit. I suspect this is just the beginning and most spam will include "features" such as this in the near future."
Fortunately, there is a patch for it, Mozilla is unaffected, and Norton and McAfee (at minimum) seem to detect it. That just leaves the millions of unpatched Windows machines that are running out-dated or low-grade antivirus!
I mean, using a scrollbar. Come on, what kind of ignorant user is going to use a scrollbar an a site they don't trust?
Your hair look like poop, Bob! - Wanker.
the executable contains the strings "xProxyBot v 1.0.0" and www.earthlabs.biz/sockproxy/rec.php.
So now that we have a legal, malicious attack, we'll only have to wait a few -more- years for bills to be passed to have the law catch up with some watermark of digital exploitation. Super.
___ In the words of Gen. Douglas McArthur: "I'll be right back."
...to get SpamAssassin.
I'm probably at the karma cap. Mod up a funny troll instead, it lightens the mood
Whois says that the website is operated by Anandan Krishan from Malaysia, so lets all send him an email, win2save@yahoo.com , complaining that he has discrimnated against Firefox, and Linux users of his website, and that in future he should have a more inclusive virus.
I realize that another spammer will take advantadge of the hole next week but if the hosters were blacklisted from DNS servers, the offending files might get removed a little faster.
Agile Artisans
The link in questions points to www. xcelent.biz (As in The Reg story, space intentionally included)
/. it!!!
There should be a real link, in order to
for all the other lists...
Why don't we non IE-users use the Slashdot effect for good? Let's all visit the evil site and soon it will be a steaming pile of rubble.
Spammers have often used an "unsubscribe" link or something similar only to verify your email address and send you more spam. While not the same as triggering an exploit, I've been under the impression that spammers have taken advantage of users with an "opt out" type of link in this way for quite a while now.
host www.xcelent.biz
www.xcelent.biz has address 61.218.79.53
host 61.218.79.53
53.79.218.61.in-addr.arpa domain name pointer 61-218-79-53.HINET-IP.hinet.net
and people wonder why i firewall 60/7
Lawyers, MBA's, RIAA? A jedi fears not these things!
This is a good reason to use mime_defang with spamassassin. Either do that or what I do, have it actually attach the message as a .eml file(rfc 822 or whatever) and then you can view it in whatever you want and even reimport it into your mailbox.
I hate spam, but I haven't had a false positive or negative in forever combining the bayes inside spamassassin with the bayes inside thunderbird.
Chris
The article didn't give much explanation about the drag-and-drop exploit itself. Understandably, given the audience, but I was curious. Here's a good link: http://xforce.iss.net/xforce/xfdb/13679
Blacklisting from DNS by anyone other than the domain-owner or the DNS-server-ownser should not be easy.
The real question is why the people providing connectivity haven't pulled the plug at least temporarily. Any REPUTABLE provider would.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2004-09-22 09:54 MDT
Interesting ports on 61-218-79-53.HINET-IP.hinet.net (61.218.79.53):
(The 1651 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
135/tcp filtered msrpc
443/tcp open https
445/tcp filtered microsoft-ds
3306/tcp open mysql
6000/tcp open X11
Nmap run completed -- 1 IP address (1 host up) scanned in 54.453 seconds
Lawyers, MBA's, RIAA? A jedi fears not these things!
Look at the links in the original post. Notice the added URL at the end of the supposed "Google invites" link? If you klick on these you deserve what you get.
Somewhere on this planet there is a bunch of fscking losers whose sole means to get satisfaction is to redirect newbs to shock sites à la goatse or tubgirl. How utterly pathetic.
And I'm feeding them, I know, I know...
not a word
The only thing you should be clicking on, in a spam message, is the delete icon/key.
CAN-SPAM may require an opt-out option in the e-mail to remain legal. However, the legislation DOESN'T protect you from the consequences of using that opt-out option.
It's legislated social engineering at its finest. Good luck out there.
IT Geeks - 1
Politicos without "tech savvy" - 0
This is the way it will always be unfortunately. Unless the whole population eventually can understand all the technical aspects of computers and the internet, or computers and the internet become so rock solid/secure AND easy to use, it will always be this way.
Un-news
Firefox's Javascript console reports many errors:
n ov&opt=hjj&rw=468&rh=60&cv=220&uid=673 475
Line: 3, Column: 17
Source Code:
document.writeln('
1 &adtype=over&affiliate=ultimate-guitar&suba=ultima te-guitar&channel=music&subchannel=tic&category=ti c&PT=ct&CR=ei&pez=tic
Line: 11
...and many more similar to this
Error: unterminated string literal Source File: http://focusin.ads.targetnet.com//ad/id=dmitryiva
Error: newPopup has no properties Source File: http://mediamgr.ugo.com/js.ng/Network=ugo&size=1x
Error: document.getElementById("clientcall").click is not a function Source File: http://www.xcelent.biz/o/ Line: 74
Error: event is not defined Source File: http://www.xcelent.biz/o/frame.html Line: 84
-P@
signal_connect(0, "test_top.dut.my_sig", "clk");
... time to send one of these babies to each legislator....
I've been getting spam for years that have an opt-out option. The only problem is that it almost never works. It's usually a bad link or it may just display a screen that says you've been removed but I believe it's a dummy screen to make you think you've been removed.
The Truth About Slashdot
I just sent a link to that to the MCSE slags at work. How long till they figure out they just got owned.
Got Code?
I recenived an email from MyPoints asking me to activate an account set up on my Gmail address a few days ago, and hit the CAN-spam opt-out link (I hadn't signed up for it)
Since then I'm getting a LOT of spam, I received none prior. All have the same recipient name as the Mypoints mail and some other common characteristics, but none of the opt-out stuff. Thankfully, gmail is autofiltering them without any need for intervention, but I can't help but feel MyPoints are behind it.
Has anyone else had the same thing happen?
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
a b c d. "d" looks pretty heavy on graphics.
.02
cLive ;-)
-- Trinity in high heels carrying a whip: The donimatrix - there is no spoonerism
Didn't get that far. Just loading the page launched it. Anti-virus kicked in with a warning, home page was attempted to change, and then I got a call from headquarters to follow the delousing drill, since they also get all of our warnings.
Well that was fun. Didn't get to see any scroll bar :(
Windows 2000 - IE 5.50.4807.2300
Why are there only 19 people folding@home for slashdot?
Why are spammers so malicious? Maybe they're terrorists (half-joking). Should someone who gains unauthorized entry to millions of citizens' computers, and who burdens the economic infrastructure (Internet) with garbage be considered perhaps a terrorist?
Only 10 million
39,936 bytes
Added to Computer Associates database 9/21/04
What do other vendors call this?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Seriously.
It's not like spammers are a class of people to be trusted. I always felt the opt-out requirement was joke and prime for abuse. By opting out, you are telling the spammer that you read every email that comes your way and they add it to their list of email addresses that actually respond to spam.
So what do they do with this list? If they follow the letter of the law, they will stop spamming - but, they have a list of high quality email IDs that they can sell to other spammers.
Users should always follow these simple instructions with regards to email spam:
1. Make sure you have an incoming mail spam filter, like SpamAsassin.
2. Delete any spam that gets through.
3. If you are interested in the product, do not contact the email (spam) source, reply to the email, click on "helpful" buttons. Find reputable mainstream vendors - if it's great then Wal-Mart, Best Buy, Circuit City, etc. will stock it.
myke
Mimetics Inc. Twitter
Mod down link whoring troll. Take your spam somewhere else, ya douche! And don't come crying to us when they don't give you your free crap.
Why, exactly, is anybody reading SPAM? It is not like you cannot tell just by looking at the subject and the From line.
Secondly, why are people viewing emails as anything but text?
"Those who make peaceful revolution impossible, make violent revolution inevitable" - JFK
What we need is a productive exploit of this. Here's how it works.
.exe that pops up a window on the users machine the next time they reboot (this is how the exploit works).
.exe gets installed when they drag on any image that has the exploit tag added. These images can be added all over the web to lots and lots of websites.
.exe could actually run every time the person's computer is rebooted, but only shows itself when the person doesn't have Firefox installed.
Create a small
This
The user visits the site, clicks the image, the program gets installed, and the next time they reboot they get a very real looking message from Microsoft advising them to install Firefox because Internet Explorer is being abandoned as a non-profitable product.
Voila', we've done them all a favor and patched their machines for them.
The
It could also remap any IE shortcuts to Firefox...
You click the opt-out link, bad things happen. Before it was even more spam, now it's malicious attacks.
How many people really trust spammers to honor an opt-out?
I am disrespectful to dirt! Can you see that I am serious?!
It is so much better to unsubscribe from this spam using the ssl connection (443). I checked, and it presents the same exploit page as the port 80 page with the benifit (for us) that it requires the extra computational resources of setting up an ssl session. Use the FOX and update often! https://61.218.79.53/o/
This is dangerous stuff. Mod the parent article down (which includes a working link to the malicious address) so that people don't click on it.
SPAM Proposal Rejection Form
This article advocates a
( ) technical (x) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work.
(One or more of the following may apply to your particular idea, and it may
have other flaws which used to vary from state to state before a bad federal
law was passed.)
( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
(x) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(x) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(x) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
(x) Jurisdictional problems
(x) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
(x) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
(x) I don't want the government reading my email
(x) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
(x) You are a spammer
There is a slew of sites on that same server according to Webhosting Info that are infected, some with windows-update.exe and others with windows-update32.exe
Pete Carr Owner Chatmag.com
it is a site worthy of a good slashdotting, if just to keep the unwary from reaching it.
It's all fun and games until someone loses the key to the handcuffs.
Great. Now someone will use this as FUD against public security alert email lists.
Yetl orer.
Another
Reason
To
Not
Use
Internet
Exp
"The best laid plans of mice and men gang oft agley..." - ROBERT BURNS
Of course, anyone who installs that on a non-isolated, non-virtual machine pretty much deserves the results. It looks like it has the standard "Software\Microsoft\Windows\Current Version\Run", "Software\Microsoft\Windows\Current Version\RunServices", and "SYSTEM\CurrentControlSet\Control\SafeBoot\" registry hooks. (Unix "strings" is your friend....)
//Information does not want to be free; it wants to breed.
There is an actual company backing this spam and website, couldn't someone sue for damages?
Is there anything better than clicking through Microsoft ads on Slashdot?
Of course there's always a stupid person or two that uses opt-out links on spam...
If you are caught killing a spammer, get a jury that has e-mail -- they will never convict.
Fight Spammers!
No, I can't really conceive of that happening unless it wasn't an e-mail from us. I can definitely testify that, getting mail from them on my hotmail account, they send 4-5 pieces of mail a day on average. But I have talked to enough people on my floor that are concerned with unintentionally sending spam that they aggressively make sure they have their backs covered.
Probably not the answer you were looking for, but that's how I see things from here.
The url you want to hit to DDOS this is:
http://www.xcelent.biz/d/
It's heavy in images.
There used to be a Firefox extension that you could use to refresh a page every N minutes, anyone know what that was?
If enough people set this to refresh every 1 minute, and left if open all day, this server would just cease to exist.
Since this same machine is FULL of spam and malicious sites:
http://whois.webhosting.info/61.218.79.53
This seems like a good idea...
How about creating a new DB? Some mySQL exploits?
We could populate that sucker with crap records for eternity and fill his HDD...
I can't do it right now because I'm at work... how about somebody with 'leet mySQL hacking skills that's at home right now?
"Request blocked by WebBlocker" Thanks for the heads-up /.! Now none of our users will be affected.. no matter what the browser :)
Some other strings give a few clues about what it does:
- Software\Microsoft\Windows\CurrentVersion\Run - It installs itself in the registry.
- Mozilla/4.0 (compatible) - It grabs stuff of the web and tries to look like IE in the logs.
- SYSTEM\CurrentControlSet\Control\SafeBoot - Tries to get started in safe mode too.
It installs itself in Software\Microsoft\Windows\CurrentVersion\Run as 'w32.exe'. I don't see it doing very much though. I've let it loose on a VMWare '98 session. No opened ports (unless it responds to portknocking), no attempts at outbound communication, maybe '98 is too old for it!Like tinyurl, but one letter less! http://qurl.co.uk/
I decided to try it out on my Windows machine, so opened the link in IE. I had Win XP SP2 and an updated Norton Antivirus and the (new ) Win XP firewall on. . .exe and ran that in the protected mode too. It ran !! It tried to access the internet but I hope the WinXP 2 firewall stoppped it. Anyway got sort of scared since my Win Laptop is not junk and I use it whenever I need a Laptop with standby and Powerpoint. So now I have deleted the files. Cant see any new services in the registry either so hopefully my machine isnt yet a spam mail relay.
But the exploit worked !! I was expecting to get a pop up from NAV with an exciting alarm sound
(Un)Fortunately since it worked now I know what it does :
1) Add thw windows-update.exe in the startup folder
2) Add a new file cmd.dat to the startup folder.
Anyway since I had gone so far, I tried running the Windows-udpadte , but that gave me the error that it was not a valid exe file. I ran it in the protected moded (available when u slecet run as.. in Win XP). Then I renamed the dat file to
BTW if anyone else has tried it out and know about something else that should be done pls let me know. And does anyone have a clue why NAV does not detect this ?? Maybe u need to activate it for IE or make IE the default browser ???
Flash Lynch Mobs.
---If you can't trust a nerd, who can you trust?
Has anyone ever documented how much spammers contribute to politicians campaigns? They certainly have been effective in keeping significant legislation from being passed and significant enforcement from taking place.
I thought it was "gang aft agley"?
I've got more mod points and GMail invi
view page source (not frame source).
;-)
cLive
-- Trinity in high heels carrying a whip: The donimatrix - there is no spoonerism
Duh... How stupid do you want to present yourself as? You are having foreign code executing on your computer. How many friggin computers infected does this need to present a problem for before people get a clue?
Bottom line: EXECUTING FOREIGN COMPUTER CODE (be it Javascript or Java) IS A POTENTIAL HAZARD. Solution: Disable the execution of such code in your browser. Don't reactivate it until providers (of Javascript or Java) allow you to sue them for liability). Until then they don't trust their own code and neither should you.
Disclosure -- there are extensive other hazards being exploited by SPAMers, etc which involve executable programs that may be communicated via email. People should be aware of them. Perhaps the best diagnosis and intervention in this situation would be -- if you are running Windows? Don't.
Here is the perfect way to DDOS a site like this... Pick a non-malicious, graphics intensive site on the same server: http://www.xcelent.biz/d/ If you have a website, particularly a high traffic one, add a 1 x 1 IFRAME to your site that loads their site. Now, everyone that comes to your site loads their site. The best part is, your IP and URL never show up in their logs. With only a few high traffic sites doing this, I'm not sure how their server could survive. And if it did, their bandwidth bill certainly would not.
Lose Weight and Feel Great with Isagenix
Go ahead, spam me. Gmail has some of the best spam filternig out there.
P.S., its great to see Slashbots show their hypocrisy - they don't like spam themselves but they are happy to try (and fail) to subject other people to it.
Since xcelent.biz is in the news I decided that it would be a reliable place to place an order for Viagara.
So went to their order site : Order Viagara and here is what they claim
This is a SECURE server and your personal and credit card information is protected.
Now if they have a certificate then I thought they would be easily tracable, but unbeliveably the server was not secure ( I mean their server could be secured and stored in the darkest dungeons but they did not use https ). Now that gives us all a really cool incentive for using Firefox 1.0 (it shows a lock in the address bar for secured site. Of course I am still ging to stick around with IE, the automated install is simple awesome, just scroll down and you are done, no clicking on pesky warning messages and shit.
Next time, give them an email address of username+mypoints@google.com. That way, if spam comes in, you'll be able to tell whether or not mypoints were the people that sent it or sold the address to spammers.
I like a good practical joke as much as the next person. Can we just track down one of these people, drag him/her outside chop them up with bolo knives hunt down their families, rape mutiliate and murder them set fire to their houses, kill their dogs and piss all over the corpses already?
I figure 10, 20 thousand of these losers tops and the problem will go away.
If SA 3.0 is running with SUBL support, how can we add: www.xcelent.biz to the SUBL list? In that case, SA 3.0 would block this email alltogether. I think this is a killer feature of SA now, and I'm waiting to learn more about it so I can update my current 2.x version running on my home mailserver.
PCB$@#
free ipod and free gmail!
Honestly, if you "surf" the web these days with:
1) Flash
2) Java
3) Javascript
You are simply asking for an anal reaming. The answer is to use a "secure" browser for common everyday browsing, which will display html and pictures. No cookies, flash, java, or javascript.
And then use a second browser and copy/paste the url when you need more functionality.
I don't have to worry about Windows viruses *and* fake scroll-bars will stick out like sore thumbs :)
Thank you ICANN! :)
[Set Cain on fire and steal his lute.]
We probably cannot bring it down using the 80 link, but the SSL link will peg the spammer's CPU without much effort on our part.
**********HAZARDOUS LINK****************
This is the link to the page. DO NOT CLICK on this if you are running IE.
https://61.218.79.53/
i've added the 10000 digits of pi link as a referer to my wget of d, should help with the log filling and bandwidth at the same time
...verify that your e-mail is valid.
Never reply to an opt-out even if running a secure e-mail application.
Loading...
- using IE for anything!?!
- not updating antivirus definitions (or apt-get upgrade or equivalent) to keep up-to-date on security patches!?!
_and_ clicking on active-x controls in those windows!?!I can't imagine this would be dangerous for anyone here.
what, you dont have a .com?
get over it.
comment directly in my journal
They hired Slashdot to take it down, and we are working on it even as I type this.
My knowledge of RFCs is a little sketchy. Am I right in saying that if you use (in my case) richardjharris+mypoints@gmail.com, the email still gets through but has a different To: header? That would be ideal... except for the fact I'd still get spam. But it'd be ideal on one of my junk accounts.
The point is this exploit doesn't ask you if you wish to download the problem code, it does it without asking. Are you really so Naive that you think all the spyware/adware/virus comes from people clicking "ok" to those confirmation boxes?
Are you really that confident that you AV software is working? Would you tell a bad guy its OK to shoot you because you are wearing a Kevlar vest?
Oh yeah, you've passed all the tests you mentioned, yet are still too dumb/lazy to remove the space the author told you he inserted on your own.
Dang it, where's the "-1 Bitch Slap" mod when you need it?
MOD PARENT DOWN!
That link just (after a few steps) sends you back to the trojan.
the entire idea sounds good in theory, but in practice it doesnt even touch the problem at hand. Also on that same note, it was only a matter of time before someone discovered that they can trick users *gasp* into clicking opt out for a few nasty suprises.
Lawmakers, get a clue!
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Opt-In Email Lists Are Best!
You can get a free open-source one at:
http://www.technobreeze.com/php/emaillist/
Wow, you mindlessly repeated the mistaken conclusion of the article submitter.
If the link doesn't allow you to opt out, it's not an opt out link, is it?
If the law requires that I have a valid licence when driving, is it OK if I call my dog "a valid licence" and have him sit in the back seat? "Everything is in order, officer. I have 'a valid licence' back here..." Just because you call a thing something, doesn't make it that thing.
With that reward money, I could afford this life-sized chocolate God, filled with an infinite number of smarties.
The "Email Addr" field at the bottom of the page doesn't use a maxlength property to limit the input. Here's what happens when you try to insert too much data:
Now let's go fill his DB from the front end!
...thank god I have a Mac!
/.ing) and the script tried twice to download the .exe file to my computer without my even touching the scrollbar.
I went to the website to see for myself (and to do some
Sig cancelled due to lack of interest
...is the very concept of allowing HTML code: clickable links and active crap to be put into the main body of SMTP emails at all. SMTP email was never intended for that in the first place. It was intended for simple text transport only to convey messages. Even just adding on binary attachments was an afterthought, and should have been left at that. At least attachments can be easily isolated and scanned for malware.
Brings to mind the old saying: "Just because you *can* do something doesn't mean that you *should* do it."
Domain Name: EARTHLABS.BIZ
Domain ID: D7451374-BIZ
Sponsoring Registrar: ENOM, INC.
Domain Status: clientHold
Domain Status: clientTransferProhibited
Registrant ID: DANIDANAE15B3AD6
Registrant Name: Domain Administrator
Registrant Organization: Askfind Ventures
Registrant Address1: GPO Box 8912
Registrant Address2: Central
Registrant City: Hong Kong
Registrant Postal Code: Nil
Registrant Country: Hong Kong
Registrant Country Code: HK
Registrant Email: askfindpay@yahoo.com
Administrative Contact ID: DANIDANAE15B3AD6
Administrative Contact Name: Domain Administrator
Administrative Contact Organization: Askfind Ventures
Administrative Contact Address1: GPO Box 8912
Administrative Contact Address2: Central
Administrative Contact City: Hong Kong
Administrative Contact Postal Code: Nil
Administrative Contact Country: Hong Kong
Administrative Contact Country Code: HK
Administrative Contact Email: askfindpay@yahoo.com
Billing Contact ID: DANIDANAE15B3AD6
Billing Contact Name: Domain Administrator
Billing Contact Organization: Askfind Ventures
Billing Contact Address1: GPO Box 8912
Billing Contact Address2: Central
Billing Contact City: Hong Kong
Billing Contact Postal Code: Nil
Billing Contact Country: Hong Kong
Billing Contact Country Code: HK
Billing Contact Email: askfindpay@yahoo.com
Technical Contact ID: DANIDANAE15B3AD6
Technical Contact Name: Domain Administrator
Technical Contact Organization: Askfind Ventures
Technical Contact Address1: GPO Box 8912
Technical Contact Address2: Central
Technical Contact City: Hong Kong
Technical Contact Postal Code: Nil
Technical Contact Country: Hong Kong
Technical Contact Country Code: HK
Technical Contact Email: askfindpay@yahoo.com
Name Server: NS1.WEBSOUTH.WS
Name Server: NS2.WEBSOUTH.WS
Created by Registrar: ENOM, INC.
Last Updated by Registrar: ENOM, INC.
Domain Registration Date: Thu Jul 29 06:02:08 GMT 2004
Domain Expiration Date: Thu Jul 28 23:59:59 GMT 2005
Domain Last Updated Date: Wed Sep 22 15:41:04 GMT 2004
------
added to stop lame filter
Nostrud sit lobortis aliquam velit consequat lobortis dolor autem augue consequat exerci blandit esse consequat delenit. Duis iriure aliquip ut, vel nulla ex consectetuer dolor dolore dolore lobortis delenit nibh eu, te et in, dolore eros ut enim dolore diam. In facilisis facilisis delenit aliquip laoreet at ut quis. Dolore nulla et aliquam quis, facilisi velit hendrerit eros ut dolore commodo, eu duis vero. Ex, suscipit autem, qui facilisis odio ad vel esse ad ad commodo.
Facilisis nostrud nisl suscipit suscipit at ullamcorper illum nulla tincidunt blandit nulla, dignissim in vulputate consequat dolore autem in et iriure zzril. Consequat odio, suscipit dolor wisi nonummy volutpat duis vero ut elit zzril, te duis duis minim ea erat et. Exerci vel vel molestie consequat tincidunt hendrerit at in esse ullamcorper vulputate te tation luptatum ex. Zzril quis laoreet minim dolor iusto consequat euismod te, dolor eum lorem tation vel ad dignissim minim wisi.
Nulla, consequat duis dolore feugiat augue, facilisis lorem vulputate esse at et te adipiscing nulla, zzril, blandit. Duis consectetuer volutpat vero autem veniam hendrerit consequat te quis suscipit iriure consequat in. Te zzril, diam hendrerit, ad et wisi, odio elit eu feugiat odio ut minim ut velit nulla dolore. Facilisis esse accumsan dignissim veniam blandit nibh ex vero praesent duis exerci magna nibh enim. N
It looks like he's not checking the field length of that "email addr" input before inserting it into the DB, so it should be a simple matter for someone to write a script to continuously loop through a POST to http://61.218.79.53/o/cgi-bin/removeme.cgi with a large amount of data in the field name "email". If a few people do this, his DB should fill up pretty quick.
Why would you subject an important machine with important software/data to a potentially dangerous and well-known attack with as-of-yet unknown consequences?
It would have been much more prudent to format, install a clean copy of the OS, perform the test and reformat. Or try the attack in a virtual OS on a different parent OS.
I hate to say it, but it sounds like you deserved what you got
asking that they revisit the CAN-SPAM act. When they click the scrollbar in the forwarded message, they'll finally understand why we didn't think the original bill was tough enough.
It's not an email standard, according to the RFCs everything before the @ is called the "local part" and is interpreted in a system-specific manner once it arrives on the server. However the use of +suffix or -suffix is quite common and gmail supports it - so if you send an email to the address you mentioned, it would appear in the same mail account as richardjharris@... but with a different destination address, so you could filter on it or simply find out which address spam was sent to after the fact.
"Scarily the E-mail actually complies with the CAN-SPAM act as it only requires spammers to put an opt-out link in their mailings."
I would think that unless the link actually lets you opt out that it wouldn't qualify as an opt out link. No matter what you titled it.
only outlaws will have malicious attacks!
Oh, wait...
xProxyBot v 1.0.0 o ftware\Microsoft\Windows\CurrentVersion\RunServi ces
1.0.0
w32.exe
Windows Service Application
www.earthlabs.biz
sockproxy/rec.php
Software\Microsoft\Windows\CurrentVersion\Run
S
http://fudge.org
I took a look at this thing, and from the look of it, it appears to be a standard IRC bot. You know, the ones that run as whatever the logged-in user is?
Root, FTP access, HTTP access, an open proxy, the usual. Seems that the little bastard is being rather the norm these days.
It drops w32.exe in Prefetch and System32.
Removing its startup entries in Safe Mode with HijackThis and deleting the EXEs will fix it.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
The problem is many spammers set the to header to something totally bogus, or ignore it completely, yet the mail still arrives in my inbox. If only Google would allow more advanced filtering techniques, to header filtering could be much more effective. Of course, those that run their own mail server can already reap the benefits of this kind of filtering, but I know many people would enjoy using this feature with Google Mail.
Tired of free ipod spam sigs? Opt ou
Too bad,slashdot too gave the site address as [google]after the link....It only opened a porn page ,with shaking windows.Thank god i was using firefox.
I dont know what would have happened had i seen it with Internet explorer.
Even better i had images OFF when i visited.So kinda saved.But I would like to know if clicking on that link ,would cause any further harm to my computer.
And since the caption of the site name that slashdot provides been proved useless, how can i find the name of the real site that link will take me to?
Thanks.Are Malicious links the bane of slashdot?
Register may have some silly users, but all visitors of this site are, of course, cool and don't use IE, do they?
In Soviet Washington the swamp drains you.
And another guy is sayin - " what if the evil guys are reading SD and add opera and mozilla exploits " - [ not exact quote ].And then goes on to provide links to exploits in mozilla and opera [a google search link too].
By giving links to flaws in opera and mozilla , you want to help the evil guys who are reading slashdot?
Now dont argue - " You have to be stupid to click on those links, Iam annoyed how people click those links etc.
This may be slashdot , but still littering the commenst page with unsafe links does no good!
Links are to be provided where required .Not wherever possible.
The brain-dead apache admin that put this box together made all the pages available over the SSL connection. So from your browser (preferably FireFox) use this link.
https://61.218.79.53/d/
Or if you have OpenSSL on your box (most *nix boxes do or you can download it from www.openssl.org) use this line in your favorite looped script:
openssl s_client -connect 61.218.79.53:443
This sets up an SSL connection. Even if they are using a HSM (Hardware Security Module) they cannot service more than 300-400 or so connections/sec with an HSM rated for 600 connections/sec. They aren't using an HSM, so it shouldn't take more than about 50-100 of these per second to fully tax the processor.
since they use YAHOO e-mail address for registration, they are worthy of being disconnected upon complaining to YAHOO.
Hint: complain to yahoo with the subject line: "[UNAUTHORIZED COMMERCIAL USE] win2save@yahoo.com" so they can see it quicker.
Here is a gem code snippet:
The page tries to emulate a scroll bar; I got suspicious when the scoll bar did not work properly with my mouse wheel...Elsewhere in the code, it tries to download "http://www.xcelent.biz/o/windows-update32.exe" and excute it as an image... - but I can't download it as now, since it seems to be slashdotted...
http://shit.slashdot.org/article.pl?sid=04/09/22/1 355238
Why anyone would use an e-mail program that allows clicking on something is beyond me. All the comfortable features that come with clickability have their price -- which in in this case is far too high IMHO.
open (SIG, "</dev/zero"); $sig = <SIG>; close SIG;
Well, we could always call the owner of the site and tell him how much we 'so' appreciate his exploit being used on ppl.
Domain Name: XCELENT.BIZ
Domain ID: D7752456-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Status: clientTransferProhibited
Registrant ID: CNEU-105661
Registrant Name: Anandan Krishan
Registrant Organization: Iscon & Krishan
Registrant Address1: Suite 50-12
Registrant Address2: Jalan Yap Kwan Seng.
Registrant City: Kuala Lumpur
Registrant State/Province: KL
Registrant Postal Code: 50450
Registrant Country: Malaysia
Registrant Country Code: MY
Registrant Phone Number: +603.27756842
Registrant Facsimile Number: +603.27756642
Registrant Email: win2save@yahoo.com
Administrative Contact ID: CNEU-105617
Administrative Contact Name: Anandan Krishan
Administrative Contact Organization: Iscon & Krishan
Administrative Contact Address1: Suite 50-12
Administrative Contact Address2: Jalan Yap Kwan Seng.
Administrative Contact City: Kuala Lumpur
Administrative Contact State/Province: KL
Administrative Contact Postal Code: 50450
Administrative Contact Country: Malaysia
Administrative Contact Country Code: MY
Administrative Contact Phone Number: +603.27756842
Administrative Contact Facsimile Number: +603.27756642
Administrative Contact Email: win2save@yahoo.com
Billing Contact ID: CNEU-105617
Billing Contact Name: Anandan Krishan
Billing Contact Organization: Iscon & Krishan
Billing Contact Address1: Suite 50-12
Billing Contact Address2: Jalan Yap Kwan Seng.
Billing Contact City: Kuala Lumpur
Billing Contact State/Province: KL
Billing Contact Postal Code: 50450
Billing Contact Country: Malaysia
Billing Contact Country Code: MY
Billing Contact Phone Number: +603.27756842
Billing Contact Facsimile Number: +603.27756642
Billing Contact Email: win2save@yahoo.com
Technical Contact ID: CNEU-105617
Technical Contact Name: Anandan Krishan
Technical Contact Organization: Iscon & Krishan
Technical Contact Address1: Suite 50-12
Technical Contact Address2: Jalan Yap Kwan Seng.
Technical Contact City: Kuala Lumpur
Technical Contact State/Province: KL
Technical Contact Postal Code: 50450
Technical Contact Country: Malaysia
Technical Contact Country Code: MY
Technical Contact Phone Number: +603.27756842
Technical Contact Facsimile Number: +603.27756642
Technical Contact Email: win2save@yahoo.com
Name Server: NS1.GRAITHBOADER.BIZ
Name Server: NS2.GRAITHBOADER.BIZ
Name Server: NS2.TIKONDES.BIZ
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Wed Sep 15 03:53:27 GMT 2004
Domain Expiration Date: Wed Sep 14 23:59:59 GMT 2005
Domain Last Updated Date: Wed Sep 15 04:03:16 GMT 2004
**
Nessus Scan Report
: :
------------------
SUMMARY
- Number of hosts which were alive during the test : 1
- Number of security holes found : 3
- Number of security warnings found : 16
- Number of security notes found : 25
TESTED HOSTS
www.xcelent.biz (Security holes found)
DETAILS
+ www.xcelent.biz
. List of open ports
o ftp (21/tcp) (Security notes found)
o ssh (22/tcp) (Security hole found)
o www (80/tcp) (Security notes found)
o sunrpc (111/tcp) (Security notes found)
o ldap (389/tcp) (Security notes found)
o https (443/tcp) (Security warnings found)
o windows-icfw (1002/tcp)
o H.323/Q.931 (1720/tcp) (Security notes found)
o mysql (3306/tcp) (Security hole found)
o x11 (6000/tcp) (Security warnings found)
o general/tcp (Security warnings found)
o general/udp (Security notes found)
o unknown (32768/tcp) (Security notes found)
o unknown (32769/tcp) (Security warnings found)
o sunrpc (111/udp) (Security notes found)
o omad (32768/udp) (Security hole found)
o general/icmp (Security notes found)
Demonstrating that your browser is vulnerable and telling you how to fix the problem is not malicious. The program installed doesn't do anything other than showing you that you can be affected this exploit. Besides, who here actually uses IE?
A simple solution for all us poor victims of the M$IntroNet Exploder Techno-Gadget QuickTreeViews:
S BC*XML*rss
Do not click here.net[-]Auto-HYPHEN F10:EA8D:*ok*
Do not open with Yahoo! Free)ze)MAIL Client[+]
Do forward suspect message to your IAP[0]ISP[1]Let them get a put&call option M$MONEY-FYI-ADVISOR-YY-AA-HH-OO-!!-00.HTML+/-1.00
(?QUESTION MARK? What color is it??" ")
Do not pass go. Do not collect $200. Do not assume your opinion is worth a SHIT=Stow High In Transit at Pleasure Boat Captains for Truth or the Landover Baptist Church - State Functions.
Do not forget to remember memcopy.htm©(c)Copyright 1999 Microsoft Corporation. Legal Document.doc Legal Information NT Authorized meathook Web-based E-Mail mailto: info@prestongates.com Plus! SUN.COM/ENG/LAW/yours?
JSP/PS/2.01 Mouse initialized by [(hp)]click[1]otis @ sprintmail.com [IBM]MOUSE.DRV=mouse.drv[0]
Thanking you,
Anonymous Coward.
Btw, I've often noticed that my DNS registration address is the one that gets the most spam.