Slashdot Mirror
Spammers Use Holes In Democrats.org Security
Attila Dimedici writes "According to Cloudmark, 419 spammers are using the democrats.org website to relay email and bypass spam filters. 'The abuse, which dates back at least to the beginning of this month, helps evade filters that internet service providers employ to block the messages. ... The messages were sent courtesy of this page, which allows anyone with an internet connection to send emails. The PHP script employs no CAPTCHA or other measure to help ensure there is a real human being behind each email that gets funneled through the service. The service allows messages to be sent to 10 addresses at a time and even provides a way for people to import contacts they have stored in their address book.'"
That wasn't so much a security hole as just bad programming. The equivalent of not merely leaving the barn door open, but designing the barn with no doors. Who thought that was a good plan? None of the developers spoke up and said, "Hey, this is a really bad idea!"
And, last I checked, the page was still up.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
If Democrats cant even design their website to keep people out or prevent people from doing whatever they want in it, how are they going to keep pedophiles out of our schools? Think of the children!
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Spammers are making liberal use of a democrat website?
It's not like the Democratic party has a policy of encouraging spammers, while the Green party argues for locking up people who send unsolicited emails. This isn't a political story, folks.
Just another clueless web designer putting up an open relay form. I thought I'd seen the last of these back in the 1990s! I'm sure the web site in question has been blacklisted by all the major DNSBL lists by now.
My goodness. I believe the reason you can't collect benefits is because most states only provide unemployment insurance for 6 months after the termination of employment. That might not be entirely correct, but it's some period of time. Secondly, The "government compassion" you're whining about was actually doubled in the stimulus bill. The bill vastly expanded unemployment benefits both in terms of length of time, amount of money provided, and tax breaks for the unemployed. See http://employeeissues.com/blog/arra-unemployment-assistance/
There's your frickin' government compassion. And now you want to refuse to pay into it? Conservatives who utilize government services then complain about how they shouldn't exist at all kill me. Either advocate for smaller government OR take the benefits. Don't do both. I just can't believe it. This is the type of crap that brings our country down.
These are the same geniuses who want to be able to take down the internet when problems arise. They can't even manage themselves but want to control everything else. Go figure...
It's not a hole..It works exactly like it was designed to work..making it easier for people to spread their word.
But somewhere in the line there was an executive/manager who said "there isn't a problem" or "spammers won't bother with us" or some such.
It's very difficult to explain a problem BEFORE it happens to someone who has a vested interest in not understanding the issue.
None of the developers spoke up and said, "Hey, this is a really bad idea!"
In point of fact, I spoke up. Loudly. And eventually resigned when the problems were not adequately addressed.
In August 2006 I wrote a white paper detailing the issues, including the "mail your friends" code that the invite URL falls under:
http://bill.herrin.us/composer.html
In fairness, the director of technology at the time no longer works for the DNC. The current guy inherited the problem.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Who here can honestly say the first couple email forms they created *did not* get shut down by spammers? The first I created looked almost like the one linked in this article--no security checks, no throttling and the ability to completely alter the message and subject.
The the second one I created let you add extra headers in the mail message--course part of that was thanks to the shitty, insecure mail api provided by PHP. Their API is more than happy to let you add linefeeds in the "From" or "To" parameters and thus let you add extra headers (say BCC). The reason it was my fault was for using PHP in the first place!
No sir, we've all done this. Every developer who ever created something that let the public generate email has created a gateway for spammers at least once.
My hunch is an intern did this :-)
I thought it was just standard propaganda from them.
Silly me.
Professional Politicians are not the solution, they ARE the problem.
Nearly everything coming out of Washington looks like a 419 scam anyway.
Waiting 9 months until you might get a job back in January is a pretty shitty reason for not getting off your ass and finding another job. Heaven forbid you actually use unemployment as a bridge to finding new employment. No, you should be able to sit on your ass and collect it until the same people who laid you off decide that maybe they can afford you again for a short time? Come on.
Maybe you see these problems on the democratic domain, because the conservatives in this country are still trying to figure out what the internet is.
http://www.huffingtonpost.com/2008/06/11/mccain-admits-he-doesnt-k_n_106478.html
http://www.youtube.com/watch?v=f99PcP0aFNE
I think when I finally get back to work (probably January when managers get new budgets and fresh money), I'm going to refuse to pay the Unemployment. Why should I pay for a program that doesn't help me out when I need it?
In Michigan at least, employees don't pay for unemployment insurance, the employers do. Yes, in the end, everything comes out of our pockets in some way (i.e. they could pay you higher wages if they didn't have to pay for your unemployment insurance). However, you don't pay x% of your paycheck every week into Unemployment.
John McCain never left his email server open for this sort of exploit!
668: Neighbour of the Beast
I must "out" myself as being another clueless web designer who left exactly this vulnerability in my own "email page to a friend" link, as recently as April 2009. Doh!
See, creative people have no "barrier to entry" and as long as I can write simple perl scripts, I can run them in my CGI bin. Not everyone is a gifted web designer, many of us have had no formal education in programming or security, and of course we are all struggling against spammers with a financial interest in locating exploits.
I feel empathy for those that you smarter people scoff at. Be kind! It wasn't for us dolts you woudn't *be* smart, you'd just be average!
Wendy Northcutt, the Darwin Awards