Slashdot Mirror
Lycos Anti-Spam Site Compromised [Updated]
An anonymous reader writes "Lycos, shortly after producing a screen saver to fight spammers using a DoS-style attack appears to have been hacked. Attempting to download the screen saver from lycos results in this message 'Yes, attacking spammers is wrong, you know this, you shouldn't be doing it. Your ip address and request have been logged and will be reported to your ISP for further action.' Or maybe it's just a joke -- can you ever tell?" Update: 12/01 15:07 GMT by T : According to Lycos, the defacement reports were actually just a hoax.
Lad Vampire is still going strong. It's similar to the Lycos thing but only targets 419 scammers.
If anyone is interested, this link still works:
/ MLNS_screensaver_en.exe
http://download2.makelovenotspam.com/screensavers
I downloaded the installer on 11/26 when the first /. article came out and the MD5 sum of that file was: 237ee99dc7f35d2e2c0a8640086167bf
Really well said.
Vigilante style justice does not always work out. For one, you open yourself up to illegal attacks from them, too.
If I legally took a spammer to court and if he DDoSed me, it would only strengthen my case. I have the legal recourse to support my stand.
However, if you did something like what Lycos did, what're you going to tell the judges? They hacked me for hacking them?
As much as I'd love to see spammers get kicked in the nuts, this is not the path to take. It makes us no different from them.
The screensaver put my processor usage up to 100% though, so I stopped using it after one day.
or else!
The point of this screen saver is to increase the running costs of those website.
Who do you believe?
TODO: 753) write sig.
The following are clearly completely untrue:
All the rest are HIGHLY unlikely to be correct. For instance you suggest this is illegal by selecting several options, yet you haven't pointed to any laws outlawing it.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Including an image from a spam server != *diplaying* it. Just size it 1x1 pixels or something. The bandwidth usage will still be the same.
I'm trying to improve my English. Please correct me on any spelling/grammar errors in this post.
BTw, we sell hardware. We do not send out unsolicited email. Your method would wrongfully harm a number of upstanding companies that hate spam too. YOu have to identify which ones are the culprites before your proceed down a road like that.
You dont get the blacklists from lycos.
i sp am_screensaver/
"The sites targeted will come from blacklists generated by Spamcop and other anti-spam organizations"
http://www.spamfo.co.uk/News/Software/Lycos_ant
From a previous news article I had read lycos is just making it available to download, and marketing it so to speak, but another company developed it, and im guessing since the site is down/comprimised,and that you can not access the black list its hosted somewhere other then lycos. But I could be wrong.
TruePunk | Games
Can anyone in the U.S. who is getting the h4x0r3d message verify this IP?
Querying a U.S. DNS server and a European DNS server yeilds the same result:
Both have the same Authority Section as well:
Does anyone know of a DNS server that yeilds something differnet?
I can, and the IP comes back to a DGC Systems in Sweden
If someone else can pull the whois information and verify that as well?
person: Jimmie Clareus
address: Softroom GDC
address: Box 1088
address: S-161 02 BROMMA
address: SE
e-mail: jimmie.clareus@softroom.se
phone: +46 8 410 22 600
mnt-by: DGCSYSTEMS-MNT
nic-hdl: JC2251-RIPE
He downloaded and ran it. That problem was solved. Shame he didn't realise that there were other viruses in there too (or wasn't told that there might well me). Still, it's more than many ISPs do...
Paul "Say no to feeping creaturism"
Anybody can write a message like that. The interesting part is not what the message says, but where it comes from.
Try finding out exactly what URL you are looking at, and preferrably also what IP address the server name resolves to (in case someone has messed with the DNS). Then fetch a copy of the page, HTML and everything, using wget or some similar tool. Examine it offline, perhaps using a browser with a non-contaminated cache, to determine if the message is indeed found in that page.
I have always considered page visit counters evil. Even more so when they come as inline images, from an external site. It's ten o'clock. Do you know where your inline images are?