Spam Opt-out Link Triggers Malicious Code Attack

Maestro4k writes "The Register is reporting on a new spam E-mail circulating out there. In it, clicking on the 'Click here to remove' link launches a site, that when the user scrolls the page, triggers a drag-drop javascript exploit. Scarily the E-mail actually complies with the CAN-SPAM act as it only requires spammers to put an opt-out link in their mailings. As The Reg says "It comes as little surprise that this feature is been taken advantage of in a social engineering exploit; but it does illustrate the security problems of the opt-out approach that were always apparent to security experts - and ignored by legislators." The link in questions points to www. xcelent.biz (As in The Reg story, space intentionally included) so even if you can't block the mail yet it should be easy to block access to the site with the exploit. I suspect this is just the beginning and most spam will include "features" such as this in the near future."

Comments

devious

[hendridm]

Fortunately, there is a patch for it, Mozilla is unaffected, and Norton and McAfee (at minimum) seem to detect it. That just leaves the millions of unpatched Windows machines that are running out-dated or low-grade antivirus!

Re:devious

[interJ]

What patch? This vulnerability affects Win XP SP2 with all updates installed. See here for more info and a harmless demonstration.

This is a bug that has been known publicly for over a month, but apparently Microsoft have other priorities.

Microsoft says "No Problem"

[Anonymous Coward]

Don't worry, this isn't a real problem:

"Given the significant amount of user action required to execute an attack, Microsoft does not consider this to be a high risk for customers," a company representative said, adding that the software giant's security experts are continuing to research the issue.

I mean, using a scrollbar. Come on, what kind of ignorant user is going to use a scrollbar an a site they don't trust? ;-)

Re:Microsoft says "No Problem"

[Anonymous Coward]

Here is the pertinent CERT advisory for this flaw.

The idea is that all the website designer has to do is make an image that LOOKs like a scrollbar. The user goes and clicks and drags it to scroll down, not knowing it's fake. If there is a DYNSRC="..." attribute specified in the <IMG...> tag, Internet Explorer downloads and runs whatever program is specified, without any kinds of prompts whatsoever.

Even with SP2 installed.

Re:Microsoft says "No Problem"

[Anonymous Coward]

This is my favorite part:

III. Solution

Disable Drag and drop or copy and paste files
Disabling the zone security preference "Drag and drop or copy and paste files" prevents drag and drop operations.

Note: This preference is not honored with Windows XP operating systems.

Oh-well, at least it won't affect my Linux and OS/2 boxes if I turn that off.

Re:Microsoft says "No Problem"

[fymidos]

oh, come on now, it was just a typo, what they meant was that it is not a high risk for MS *intellimouse* customers.

Re:Microsoft says "No Problem"

[bheerssen]

Yep, exactly right.

For the curious, here is an interesting post that describes the exploit at some length. Essentially, it uses an HTML 'dynsrc' attribute (proprietary Microsoft extension) to allow IE to download the executable, and javascript to use the 'shell:' protocol to execute it. It's not a particularly new flaw, but this is the slickest exploit of it I've seen.

I dont know about you

[OverlordQ]

but my AntiVirus has detected this exploit for a *long* time.

JS/Exploit-DragDrop.b.gen

Re:I dont know about you

[orangesquid]

A simple string analysis of the trojan reveals some intimidating-looking strings:
GetSystemDirectoryA, xProxyBot v 1.0.0, 1.0.0 , w32.exe,
Windows Service Application, www.earthlabs.biz,
sockproxy/rec.php.
Software\M icrosoft\Windows\ CurrentVersion\Run
Software\Microsoft\Windows\ CurrentVersion\RunServices
%s?&p=%d&v=%s
VisitWe bPageThread , Socket4RandomThread, Socket4ServerThread
SYSTEM\CurrentControlSet\ Control\SafeBoot\
explorer.exe
Mozilla/4.0 (compatible)
InternetCloseHandle, InternetGetLast ResponseInfoA
InternetReadFile , InternetCrackUrlA
InternetOpenUrlA
InternetOpenA , InternetConnectA
FtpPutFileA, FtpGetFileA
HttpSendRequestA, HttpOpenRequestA
InternetGet ConnectedStateEx, InternetGetConnected State

interesting strings

[Anonymous Coward]

the executable contains the strings "xProxyBot v 1.0.0" and www.earthlabs.biz/sockproxy/rec.php.

Re:interesting strings

[Anonymous Coward]

Virus Scan for Linux v4.32.0
Scan engine v4.3.20 for Linux.
Virus data file v4394 created Sep 22 2004

Identified it as:

$ uvscan --secure windows-update32.exe
/home/recall/windows-update3 2.exe
Found the BackDoor-CHP trojan !!!

More Legislation Needed.

[FearTheFrail]

So now that we have a legal, malicious attack, we'll only have to wait a few -more- years for bills to be passed to have the law catch up with some watermark of digital exploitation. Super.

Re:More Legislation Needed.

[auzy]

Actually, I think thats the wrong approach. I just think vendors like Microsoft need to take responsibility for the poor security in their products.. Many exploits against windows products for instance were long known to come out before they were released, amongst many others. There was a time when eeye had serious exploits listed that took Microsoft longer then 100 days to fix.

Also, from past experience, legislation is often abused in computer cases (as demonstrated by people like the RIAA). Personally, its been pretty rare to see decent laws against computer crimes (I haven't heard of any I agree with so far).

I think the development of sender verification frameworks for Email will also eventually help, provided that MS is willing to accept the open standards for once.

Re:More Legislation Needed.

[stratjakt]

There's nothing legal about this.

It's not specifically illegal under the CAN-SPAM act, but it's just as illegal as any other exploit, trojan or worm.

Re:More Legislation Needed.

[gcaseye6677]

The government could crack down on most spam sources anytime they feel like taking the problem seriously. With all the business, tax code, interstate commerce, and other regulations on the books already, any spammer is bound to be violating a bunch of existing laws. And since many spamvertized products and services are fraudulent or blatantly illegal, simply prosecuting with traditional laws would be adequate.

If the IRS started auditing every known spammer with operations or residence in the United States, that would have a very chilling effect on spam. I'd bet my life savings that spammers don't report all of their income for tax purposes. If other countries then followed suit, spam would be relegated to the far corners of the world and easily firewalled.

Re:More Legislation Needed.

[Red Alastor]

And many situations don't need a completely different law when it happens with computers. A fraud is a fraud no matter what the medium you use is and there is already good laws about it.

Re:More Legislation Needed.

[mdfst13]

"You went to the web page of your own free will, using something known to be bad. Caveat Emptor."

Obviously people here are aware that the site is bad. However, people who actually get the link in an email would be under the impression that the site is an opt out link. Providing them a virus instead is fraud and illegal.

If "known to be bad" refers to IE, that doesn't excuse anything. That's like saying that if you forget to lock your door, then it's all right for people to steal your stuff. In reality, it's still just as illegal.

Re:More Legislation Needed.

[FuzzyBad-Mofo]

Assent is a perfectly good word, but noone is not.

Your braking my hart, I hate to be a looser grammar nazi, but it's these errors witch need two bee preventated.

Re:More Legislation Needed.

[xouumalperxe]

Oh, they'll agree to the standards alright. and 2 days later they publish the new and improved version of your standard, with super-duper (and highly exploitable) proprietary extensions that mean MS is so much better than the competition. Accepting open standards isn't the problem with MS. It's the staying within them that's the trick

Another good reason...

[Three Headed Man]

...to get SpamAssassin.

Re:Another good reason...

[Anonymous Coward]

..to get SpamAssassin.

No. A good reason to hire a Spammer Assassin,
perhaps.

Violent, painful death is, after all, the only thing these sleaseballs fear.

Re:Another good reason...

[d_jedi]

Only link I found for this was:
http://www.openhandhome.com/howtosa300.html

Which is a pretty fricking long installation procedure.. most likely beyond the capabilities of anyone who would actually be affected by this exploit (ie. people who haven't applied recent patches, who don't have an up-to-date virus scanner, who click on links in spam messages..)

In particular, even I (and I consider myself quite knowledgeable) had no clue with this step:

# Critical: Next, find \perl\bin\spamasasssin.bat (it is probably read-only, which will cause you grief in a second), and add at the beginning (well, nearly: right after the @ECHO OFF line.)

SET RES_NAMESERVERS=ipaddress
SET LANG=en_US

Now, for people running their own DNS server, this isn't a big deal.. but for the rest of us..

Greeting from Malaysia

[politicsie04]

Whois says that the website is operated by Anandan Krishan from Malaysia, so lets all send him an email, win2save@yahoo.com , complaining that he has discrimnated against Firefox, and Linux users of his website, and that in future he should have a more inclusive virus.

Re:Greeting from Malaysia

[Nos.]

I tried to post the whois for the site as well as the whois for the IP that it's hosted on but gave up when /. said I had too many "junk" characters. Sheesh... here's a quick summary of the IP owner though:

Yu, Shao
4F, No. 7, Aly. 7, Lane 355, Sec. 2, Neihu Rd.
Taipei City
TW
Shao Yu (SY167-TW) hn87788676@hn.hinet.net
+886-9-36-045496

Dumb

[sl8r]

Also, the programmer seems to have had fun writing the javascript on that xcelent.biz page. From the source:

// probably the dumbest scrollbar emulation on this planet ;)

Re:Dumb

[Benanov]

That comment means it was ripped from a proof-of-concept website published a while ago: http://www.mikx.de/scrollbar/ Amazingly shameless. They stole this guy's code, AND they're using it for phishing attacks.

Why is the site still up?

[jarich]

The article says they know the name of the website... why is it still there? Why is the EXE still available?

I realize that another spammer will take advantadge of the hole next week but if the hosters were blacklisted from DNS servers, the offending files might get removed a little faster.

Re:Why is the site still up?

[gorbachev]

Two possible reasons:

1. Law enforcement agencies asked to keep it up

2. Hinet Taiwan doesn't give a shit

I'm betting on option #2.

Useful slashdotting!!

[Evan Meakyl]

The link in questions points to www. xcelent.biz (As in The Reg story, space intentionally included)

There should be a real link, in order to /. it!!!

Use your powers for good

[Mignon]

Why don't we non IE-users use the Slashdot effect for good? Let's all visit the evil site and soon it will be a steaming pile of rubble.

Re:Use your powers for good

[datastalker]

It's a text site... it will take a lot to Slashdot it!

Re:Use your powers for good

[ElNeo]

Like this nice link?
(click link below to show link...)

New News?

[Kartik3]

Spammers have often used an "unsubscribe" link or something similar only to verify your email address and send you more spam. While not the same as triggering an exploit, I've been under the impression that spammers have taken advantage of users with an "opt out" type of link in this way for quite a while now.

lamer is hosted on hinet.com

[Indy1]

host www.xcelent.biz
www.xcelent.biz has address 61.218.79.53
host 61.218.79.53
53.79.218.61.in-addr.arpa domain name pointer 61-218-79-53.HINET-IP.hinet.net

and people wonder why i firewall 60/7

MIME Defang

[alatesystems]

This is a good reason to use mime_defang with spamassassin. Either do that or what I do, have it actually attach the message as a .eml file(rfc 822 or whatever) and then you can view it in whatever you want and even reimport it into your mailbox.

I hate spam, but I haven't had a false positive or negative in forever combining the bayes inside spamassassin with the bayes inside thunderbird.

Chris

Re:MIME Defang

[gmuslera]

Or better yet, Anomy Sanitizer. It disables "active" html content (i.e. javascript) attached to mails, can quarantine/rename files by extension, and of course, can call a configurable antivirus to check and take actions.

That is mostly the way i use it, disabling html, checking attached files for virus, and the windows executable extensions that passed the antivirus check gets renamed anyway to make them not executable without strong user action. Attached HTML pages sometimes don't look/work as desired, but I not have to worry about someone receiving this particular piece of spam.

Exploit

[jargoone]

The article didn't give much explanation about the drag-and-drop exploit itself. Understandably, given the audience, but I was curious. Here's a good link: http://xforce.iss.net/xforce/xfdb/13679

interesting ports on the spammer's site

[Indy1]

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2004-09-22 09:54 MDT
Interesting ports on 61-218-79-53.HINET-IP.hinet.net (61.218.79.53):
(The 1651 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
135/tcp filtered msrpc
443/tcp open https
445/tcp filtered microsoft-ds
3306/tcp open mysql
6000/tcp open X11

Nmap run completed -- 1 IP address (1 host up) scanned in 54.453 seconds

Re:interesting ports on the spammer's site

[TCM]

$ telnet 61.218.79.53 22
Trying 61.218.79.53...
Connected to 61-218-79-53.HINET-IP.hinet.net.
Escape character is '^]'.
SSH-1.99-OpenSSH_3.5p1

Hmm.. Isn't 3.5p1 vulnerable to some exploit? Not that I'm implying anything!

Re:interesting ports on the spammer's site

[caluml]

bash-2.05b$ mysql -h 61-218-79-53.HINET-IP.hinet.net
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 658 to server version: 3.23.54

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> show databases;
+-----------------+
| Database |
+-----------------+
| earth_bizzads |
| herbalmarketing |
| mysql |
+-----------------+
3 rows in set (0.45 sec)

mysql>

Re:interesting ports on the spammer's site

[TCM]

That link is for 3.1. Stupid AC must have been confused 3.5 with 2.5.

That AC is not me.

*runs*

Re:interesting ports on the spammer's site

[sfe_software]

3306/tcp open mysql

Interestingly they never disabled the default "test" user for MySQL. Not that much can be done (user "test" has no privileges on any databases) but I was in fact able to log in...

Re:interesting ports on the spammer's site

[Anonymous Coward]

earth_bizzads
Interesting, one of the string literals in the downloaded binary is "www.earthlabs.biz/sockproxy/rec.php", a database of infected clients perhaps?

Re:interesting ports on the spammer's site

[5m477m4n]

hmmm, their certificate, issued to SomeOrganization expires on 9/21/2004.

Re:interesting ports on the spammer's site

[ravydavygravy]

Heh - this is what it looked like a few minutes ago...

mysql> use test;
Database changed
mysql> show tables;
+----------------+
| Tables_in_test |
+----------------+
| SPAMMERS_SUX0r |
| w00t |
+----------------+
2 rows in set (0.84 sec)

Re:interesting ports on the spammer's site

[BillX]

mysql> show databases;

(snipped thanks to lameness filter)

4 rows in set (11.56 sec)

mysql> use test;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
...and there it's been sitting for the past half hour or more. I love that 12-seconds just to display the list of DBs. Congratulations Slashdot, you slashdotted the spammer's sql server!

The only thing I click on in a Sapm is...

[vasqzr]

The only thing you should be clicking on, in a spam message, is the delete icon/key.

A SPAM opt-out trojan...

[nologin]

... that would turn your machine into a Spambot; now that would be funny. :)

CAN-SPAM may require an opt-out option in the e-mail to remain legal. However, the legislation DOESN'T protect you from the consequences of using that opt-out option.

It's legislated social engineering at its finest. Good luck out there.

Not Surprising

[Trolling4Dollars]

IT Geeks - 1
Politicos without "tech savvy" - 0

This is the way it will always be unfortunately. Unless the whole population eventually can understand all the technical aspects of computers and the internet, or computers and the internet become so rock solid/secure AND easy to use, it will always be this way.

Javascript console

[saned]

Firefox's Javascript console reports many errors:

Error: unterminated string literal Source File: http://focusin.ads.targetnet.com//ad/id=dmitryivan ov&opt=hjj&rw=468&rh=60&cv=220&uid=673 475 Line: 3, Column: 17 Source Code: document.writeln('

Error: newPopup has no properties Source File: http://mediamgr.ugo.com/js.ng/Network=ugo&size=1x1 &adtype=over&affiliate=ultimate-guitar&suba=ultima te-guitar&channel=music&subchannel=tic&category=ti c&PT=ct&CR=ei&pez=tic Line: 11

Error: document.getElementById("clientcall").click is not a function Source File: http://www.xcelent.biz/o/ Line: 74

Error: event is not defined Source File: http://www.xcelent.biz/o/frame.html Line: 84

...and many more similar to this
-P@

send it to the MCSE boys

[codepunk]

I just sent a link to that to the MCSE slags at work. How long till they figure out they just got owned.

Re:send it to the MCSE boys

[Maestro4k]

• I just sent a link to that to the MCSE slags at work. How long till they figure out they just got owned.

I predict about 5 minutes before they call security and 10 minutes before you get to clean out your desk and go home early. :)

Slightly OT-Malicious spam opt-outs and MYPOINTS

[CdBee]

I recenived an email from MyPoints asking me to activate an account set up on my Gmail address a few days ago, and hit the CAN-spam opt-out link (I hadn't signed up for it)

Since then I'm getting a LOT of spam, I received none prior. All have the same recipient name as the Mypoints mail and some other common characteristics, but none of the opt-out stuff. Thankfully, gmail is autofiltering them without any need for intervention, but I can't help but feel MyPoints are behind it.

Has anyone else had the same thing happen?

Even better - choose a link with graphics on.

[cliveholloway]

After a little guessing:

a b c d. "d" looks pretty heavy on graphics.

.02

cLive ;-)

Re:Even better - choose a link with graphics on.

[Coward Anonymous]

Don't forget the good services of SSL.

You should use https for everything so that you get a b c d

Well I went to look at the virus

[3terrabyte]

I thought it would be neat to see how good their fake-jpeg scrollbar was, so I loaded the page. I had no plans on 'scrolling down'.

Didn't get that far. Just loading the page launched it. Anti-virus kicked in with a warning, home page was attempted to change, and then I got a call from headquarters to follow the delousing drill, since they also get all of our warnings.

Well that was fun. Didn't get to see any scroll bar :(

Windows 2000 - IE 5.50.4807.2300

Re:Well I went to look at the virus

[Naikrovek]

the scrollbar is the real IE scroll bar but there's an invisible image on top of it. When you click and drag you're actually dragging this image onto a small square that follows the mouse cursor - you can't avoid dropping it into that small image.

the js code scrolls the page for you, instead of the actual scroll bar. since you're scrolling the page (via javascript) the real scroll bar reflects the new page position, making you think you actually were dragging the scroll bar.

as you learned, the code doesn't need to be executed to trip the anti-virus. oddly enough my corporate anti-virus didn't catch a thing (it didn't tell me it did anyway), and when i dropped, the empty .exe was installed.

I won't tell you where I work but I will tell you that its a place where you don't want viruses or spyware getting at the very personal data we have on 1:4 of you. You all opted-in for the data collection too. (very large insurance company) I will tell you that we're mandated to use IE and Outlook. Firefox installations will get anyone in this company in deep trouble - thanks SCO, for promoting fear of open source for your own selfish gain!

Win32.Sokeven.D

[davidwr]

39,936 bytes
Added to Computer Associates database 9/21/04

What do other vendors call this?

Why is this a surprise?

[mykepredko]

Seriously.

It's not like spammers are a class of people to be trusted. I always felt the opt-out requirement was joke and prime for abuse. By opting out, you are telling the spammer that you read every email that comes your way and they add it to their list of email addresses that actually respond to spam.

So what do they do with this list? If they follow the letter of the law, they will stop spamming - but, they have a list of high quality email IDs that they can sell to other spammers.

Users should always follow these simple instructions with regards to email spam:

1. Make sure you have an incoming mail spam filter, like SpamAsassin.
2. Delete any spam that gets through.
3. If you are interested in the product, do not contact the email (spam) source, reply to the email, click on "helpful" buttons. Find reputable mainstream vendors - if it's great then Wal-Mart, Best Buy, Circuit City, etc. will stock it.

myke

MOD PARENT (with malicious address) DOWN!

[kabloom]

This is dangerous stuff. Mod the parent article down (which includes a working link to the malicious address) so that people don't click on it.

Re:MOD PARENT (with malicious address) DOWN!

[darc]

Security via obscurity your thing? It makes no sense to hide stuff that can hurt you, rather than to be able to TELL what might. Your ostrich defense isn't very effective.

Other sites on same server doing the same thing.

[Chatmag]

There is a slew of sites on that same server according to Webhosting Info that are infected, some with windows-update.exe and others with windows-update32.exe

But then again . . .

[harley_frog]

it is a site worthy of a good slashdotting, if just to keep the unwary from reaching it.

Re:But then again . . .

[mdfst13]

http://www.xcelent.biz/d/ is a link to another page in that domain. Also has more graphics for better slashdotting potential.

P.S. Still be careful. They could always move the pages around.

Hazardous link

[abb3w]

Now, now, there might be someone who might go to that page with IE. However, no doubt the Slashdot community would be interested in attempting their own effort at reverse engineering the trojan that they want you to download.

Of course, anyone who installs that on a non-isolated, non-virtual machine pretty much deserves the results. It looks like it has the standard "Software\Microsoft\Windows\Current Version\Run", "Software\Microsoft\Windows\Current Version\RunServices", and "SYSTEM\CurrentControlSet\Control\SafeBoot\" registry hooks. (Unix "strings" is your friend....)

Quick .EXE Analysis

[terrencefw]

As one other poster pointed out, running 'strings' on the executable reveals itself it be 'xProxyBot'.

Some other strings give a few clues about what it does:

• Software\Microsoft\Windows\CurrentVersion\Run - It installs itself in the registry.
• Mozilla/4.0 (compatible) - It grabs stuff of the web and tries to look like IE in the logs.
• SYSTEM\CurrentControlSet\Control\SafeBoot - Tries to get started in safe mode too.

It installs itself in Software\Microsoft\Windows\CurrentVersion\Run as 'w32.exe'. I don't see it doing very much though. I've let it loose on a VMWare '98 session. No opened ports (unless it responds to portknocking), no attempts at outbound communication, maybe '98 is too old for it!

I just got exploited

[iMaple]

I decided to try it out on my Windows machine, so opened the link in IE. I had Win XP SP2 and an updated Norton Antivirus and the (new ) Win XP firewall on.
But the exploit worked !! I was expecting to get a pop up from NAV with an exciting alarm sound .
(Un)Fortunately since it worked now I know what it does :
1) Add thw windows-update.exe in the startup folder
2) Add a new file cmd.dat to the startup folder.
Anyway since I had gone so far, I tried running the Windows-udpadte , but that gave me the error that it was not a valid exe file. I ran it in the protected moded (available when u slecet run as.. in Win XP). Then I renamed the dat file to .exe and ran that in the protected mode too. It ran !! It tried to access the internet but I hope the WinXP 2 firewall stoppped it. Anyway got sort of scared since my Win Laptop is not junk and I use it whenever I need a Laptop with standby and Powerpoint. So now I have deleted the files. Cant see any new services in the registry either so hopefully my machine isnt yet a spam mail relay.
BTW if anyone else has tried it out and know about something else that should be done pls let me know. And does anyone have a clue why NAV does not detect this ?? Maybe u need to activate it for IE or make IE the default browser ???

The Final Solution to Spam

[cryptochrome]

Flash Lynch Mobs.

Can't we just deal with this already

[gelfling]

I like a good practical joke as much as the next person. Can we just track down one of these people, drag him/her outside chop them up with bolo knives hunt down their families, rape mutiliate and murder them set fire to their houses, kill their dogs and piss all over the corpses already?

I figure 10, 20 thousand of these losers tops and the problem will go away.

Re:Can't we just deal with this already

[Maestro4k]

• I like a good practical joke as much as the next person. Can we just track down one of these people, drag him/her outside chop them up with bolo knives hunt down their families, rape mutiliate and murder them set fire to their houses, kill their dogs and piss all over the corpses already?

  I figure 10, 20 thousand of these losers tops and the problem will go away.

While I appreciate the sentiment (personally I'm thinking boiling oil would be appropriate for spammers) I doubt it'd help. Even with the death penalty in the US we still have far far too many murders/rapes/etc. so it doesn't seem to work as a deterrent. All we'd end up with is lots of dead spammers (good) but plenty more rushing to take their places (bad). Just look at the meth problem, last night on the news we heard that the county sheriff in one of the nearby counties ended up busting his wife's cousin for cooking meth. People just get greedy and completely overlook the possible consequences. We're not going to be able to stop these problems with laws or conventional punishments.

That said we need to find a way to make spam stop paying. If there's no money in it, or it gets to where it's a near certainty you'll lose all you made (and then some) from hefty fines people will move on to something else to try to make a quick buck.

Test new Spamassasin 3.0.0 against this!

[Chuck Bucket]

If SA 3.0 is running with SUBL support, how can we add: www.xcelent.biz to the SUBL list? In that case, SA 3.0 would block this email alltogether. I think this is a killer feature of SA now, and I'm waiting to learn more about it so I can update my current 2.x version running on my home mailserver.

PCB$@#

Good thing I use Macs and Linux then...

[Cybertect]

I don't have to worry about Windows viruses *and* fake scroll-bars will stick out like sore thumbs :)

And people say ICANN is worthless...

[miu]

By creating the .biz TLD they created a shyster scum ghetto I can easily ignore.

Thank you ICANN! :)

I block all .biz

[emptybody]

what, you dont have a .com?
get over it.

Simple really...

[johannesg]

They hired Slashdot to take it down, and we are working on it even as I type this.

Err...no

[kolly kibber]

The requirement is that they have a link to opt out. There is a link to opt out.

Wow, you mindlessly repeated the mistaken conclusion of the article submitter.

If the link doesn't allow you to opt out, it's not an opt out link, is it?

If the law requires that I have a valid licence when driving, is it OK if I call my dog "a valid licence" and have him sit in the back seat? "Everything is in order, officer. I have 'a valid licence' back here..." Just because you call a thing something, doesn't make it that thing.

Fill his database

[caffeine_monkey]

It looks like he's not checking the field length of that "email addr" input before inserting it into the DB, so it should be a simple matter for someone to write a script to continuously loop through a POST to http://61.218.79.53/o/cgi-bin/removeme.cgi with a large amount of data in the field name "email". If a few people do this, his DB should fill up pretty quick.

Re:Fill his database

[gad_zuki!]

Because people typing their email addresses into that box means its a "known-good" email address. A list of known-goods beats a list of dead addresses any day of the week.

Just forward these e-mails to your legislators ...

[smoyer]

asking that they revisit the CAN-SPAM act. When they click the scrollbar in the forwarded message, they'll finally understand why we didn't think the original bill was tough enough.

Use SSL version for maximum effect

[Anonymous Coward]

The brain-dead apache admin that put this box together made all the pages available over the SSL connection. So from your browser (preferably FireFox) use this link.

https://61.218.79.53/d/

Or if you have OpenSSL on your box (most *nix boxes do or you can download it from www.openssl.org) use this line in your favorite looped script:

openssl s_client -connect 61.218.79.53:443

This sets up an SSL connection. Even if they are using a HSM (Hardware Security Module) they cannot service more than 300-400 or so connections/sec with an HSM rated for 600 connections/sec. They aren't using an HSM, so it shouldn't take more than about 50-100 of these per second to fully tax the processor.

Huh?

[haraldm]

Why anyone would use an e-mail program that allows clicking on something is beyond me. All the comfortable features that come with clickability have their price -- which in in this case is far too high IMHO.

DNS trace - Lets give the address' owner a call

[Honest Man]

Well, we could always call the owner of the site and tell him how much we 'so' appreciate his exploit being used on ppl.

Domain Name: XCELENT.BIZ
Domain ID: D7752456-BIZ
Sponsoring Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Status: clientTransferProhibited
Registrant ID: CNEU-105661
Registrant Name: Anandan Krishan
Registrant Organization: Iscon & Krishan
Registrant Address1: Suite 50-12
Registrant Address2: Jalan Yap Kwan Seng.
Registrant City: Kuala Lumpur
Registrant State/Province: KL
Registrant Postal Code: 50450
Registrant Country: Malaysia
Registrant Country Code: MY
Registrant Phone Number: +603.27756842
Registrant Facsimile Number: +603.27756642
Registrant Email: win2save@yahoo.com
Administrative Contact ID: CNEU-105617
Administrative Contact Name: Anandan Krishan
Administrative Contact Organization: Iscon & Krishan
Administrative Contact Address1: Suite 50-12
Administrative Contact Address2: Jalan Yap Kwan Seng.
Administrative Contact City: Kuala Lumpur
Administrative Contact State/Province: KL
Administrative Contact Postal Code: 50450
Administrative Contact Country: Malaysia
Administrative Contact Country Code: MY
Administrative Contact Phone Number: +603.27756842
Administrative Contact Facsimile Number: +603.27756642
Administrative Contact Email: win2save@yahoo.com
Billing Contact ID: CNEU-105617
Billing Contact Name: Anandan Krishan
Billing Contact Organization: Iscon & Krishan
Billing Contact Address1: Suite 50-12
Billing Contact Address2: Jalan Yap Kwan Seng.
Billing Contact City: Kuala Lumpur
Billing Contact State/Province: KL
Billing Contact Postal Code: 50450
Billing Contact Country: Malaysia
Billing Contact Country Code: MY
Billing Contact Phone Number: +603.27756842
Billing Contact Facsimile Number: +603.27756642
Billing Contact Email: win2save@yahoo.com
Technical Contact ID: CNEU-105617
Technical Contact Name: Anandan Krishan
Technical Contact Organization: Iscon & Krishan
Technical Contact Address1: Suite 50-12
Technical Contact Address2: Jalan Yap Kwan Seng.
Technical Contact City: Kuala Lumpur
Technical Contact State/Province: KL
Technical Contact Postal Code: 50450
Technical Contact Country: Malaysia
Technical Contact Country Code: MY
Technical Contact Phone Number: +603.27756842
Technical Contact Facsimile Number: +603.27756642
Technical Contact Email: win2save@yahoo.com
Name Server: NS1.GRAITHBOADER.BIZ
Name Server: NS2.GRAITHBOADER.BIZ
Name Server: NS2.TIKONDES.BIZ
Created by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Last Updated by Registrar: CSL COMPUTER SERVICE (D.B.A. JOKER.COM)
Domain Registration Date: Wed Sep 15 03:53:27 GMT 2004
Domain Expiration Date: Wed Sep 14 23:59:59 GMT 2005
Domain Last Updated Date: Wed Sep 15 04:03:16 GMT 2004

**