Slashdot Mirror
The Gang Behind the World's Largest Spam Botnet
tsu doh nimh writes "A Wikileaks-style war of attrition between two competing rogue Internet pharmacy gangs has exposed some of the biggest spammers on the planet. Brian Krebs uncovers fascinating information about a hacker named 'GeRa' who is supposedly behind the Grum botnet, which is currently sending about one out of every three spam emails worldwide. The story also points to several possible real-identities behind the Internet's largest spam machine."
MegaUpload: Some people love it, some people hate it. Most of their damage (much of it alleged) is limited to a single industry and affects a tiny percentage of their bottom line
Global Botnets: Universally hated with very real damage caused in terms of time spent, infrastructure upgrades, spam filtering, etc, plus I'm sure a lot of that spam is also used for phishing and other activities that cause further damage. It affects pretty much every company and individual with any sort of online presence. I don't have any numbers, but I imagine the cost of spam botnets cause damage that's at least an order of magnitude greater than what copyright infringement is even claimed to be (nevermind the smaller amount it actually is).
But hey, glad we took down the one that also served legal uses.
It affects pretty much every company and individual with any sort of online presence.
It's too bad that banks, credit companies, and others who are hurt by spam and botnets don't have public service annoucements on TV and in AARP that say something like "Consider all email to be scams!"
It' is interesting that my financial institutions no longer send links when there's some sort of update or annoucement. Their emails just say "log into your account and see ..."
It seems to be old people (70yrs+) that really get snookered - at least that age group seems to be the largest segment of victims. It's like they see it in "writing" and therefore is must be true.
OTOH, there are old people like my Dad who is constatnly forwarding me things and asking if it's true; which I rerspond with (after checking to be sure and to get links to back up what I say) "If it's in an email, it's a scam."
Email is dead. Everyone uses facebook to communicate now.
Sorry - what does this have to do with WIkileaks?
Over a 3-year period, GeRa’s advertisements and those of his referrals resulted in at least 80,000 sales of knockoff pharmaceuticals, brought SpamIt revenues of in excess of $6 million, and earned him and his pals more than $2.7 million.
...and that's why we will never be rid of spam: because at least 80,000 people are dumb enough to buy boner pills over the internet from someone who spammed their inbox with poorly-spelled sales pitches.
0 1 - just my two bits
"Syrian" hackers on a U.N. Peacekeeping Mission:
http://www.themoscowtimes.com/news/article/syria-cyber-war-opens-new-front-in-russia/452200.html
Syria Cyber War Opens New Front In Russia
02 February 2012
By Jonathan Earle
The cyber front of Syria's year-old civil war spread to Russia this week as pro- and anti-government bots splashed criticism and expressions of gratitude across the Russian Internet, and Syrian hackers attempted to commandeer the website of a Russian embassy.
The attacks are a response to Russia's ongoing resistance to proposed UN sanctions against Damascus and willingness to sell weapons to the Syrian government, which has been accused of killing thousands of civilians to stem a popular uprising that began in March.
On Sunday, the Syrian National Council, the main opposition coalition, called on Syrian expatriates to stage protests at Russian embassies and consulates and "exert pressure" on Russia.
Syrian electronic activists appear to have heeded the call, as Dozhd television said its website started receiving three to four comments per hour beginning Monday night.
Thousands of Syria-related comments have since appeared on Russian news websites and Facebook pages. Most comments are sharply critical of Russia's defense of President Bashar Assad. "Russia sold its humanity when it sold weapons to a criminal regime" user Abu Mujahid al-Hamwi wrote on President Dmitry Medvedev's Facebook page Tuesday morning.
A small percentage of the comments — which appeared in Arabic, Russian and English — expressed gratitude to Medvedev and Prime Minister Vladimir Putin, such as one from user Hamoud Youssef: "A heartfelt thank you to Russia. Thank you for the veto."
The comments were ostensibly posted by users with Syrian-sounding names, but the high number of identical entries suggests that the effort is largely automated. Several comments appeared dozens of times from multiple users on Facebook pages belonging to Slon.ru, Afisha, and Lenta.ru.
Meanwhile, a senior official at the Russian Embassy in New Delhi said Syrian hackers tried and failed to commandeer the embassy's website, Vesti.ru reported Monday. The official denied earlier reports that hackers had posted photographs of children allegedly killed by Syrian security forces.
For months, Russia and its allies have resisted growing pressure from Western governments and much of the Arab world to take a harder line against the Syrian government, which opponents say is using tanks and heavy weapons to slaughter opponents. The UN estimates that more than 5,000 have died in the crackdown.
The Syrian government says it is battling terrorist groups, and Russia has called on both sides to reject violence and come to the negotiating table. In October, Russia and China blocked a UN Security Council resolution calling for sanctions against Syria within 30 days if the government did not stop attacks on protesters.
In December, Russia agreed to sell 36 Yak-130 trainer-fighter airplanes to the Syrian government in a $550 million contract, Kommersant reported this week. Last month, a Russian-owned ship laden with munitions arrived in Syria after being temporarily detained in Cyprus.
Analysts have speculated that Russia is eager to hold on to a longtime ally and prevent a repeat of NATO's intervention in Libya. Also at play are billions of dollars worth of arms contracts and a naval base in the Mediterranean city of Tartus, Russia's only military base outside the former Soviet Union.
If actual products are being shipped (as opposed to pure fraud), then it should be possible to trace the physical deliveries back to their source. Pharmacy products are not e-product. They are physical. So if these products are being marketed through illegal means, and are probably illegal products themselves, then why not follow them back to their source.
At the very least, the govt could make a big noise and say that goods marketed through spam are being seized enroute and people will throw their money away if they purchase them.
flux hosting? Heh, they just pick one of the many hosting companies that do nothing about spam reports received via SpamCop.net or emailed directly.
Case in point? I received spam last Friday, which has redirects to: 199.10 2.228.2 19/~ lig htfoo/tracking/rd/t-a-x/main/jonxqo The IP address is with ServInt. Despite contacting them via their abuse@ address, the live chat feature on their website, and their Facebook page (from which they have blocked me by now) the site is still up. And ServInt is just one example. Reporting spam via SpamCop to ovh.net seems to be a pointless exercise. After complaining at their site I was handed an additional email address: legal@. And presto, suddenly spam I report is taken action upon if I email manually both abuse@ and legal@. No idea how long this miracle stays up, though.
What I really don't get is why don't hosting providers/ISP check sites that report IP addresses that send spam or are abusive on a daily basis. My impression is that your head in the sand just makes more money...
And that's the problem. Some big USA/European hosting companies that don't do a thing about this. As always, follow the money.
Perl Programmer for hire
One of the two hackers' names the author "uncovers" is Vasily Ivanovich Petrov which is basically one of many possible variations of John Doe in Russian. While there is a possibility for someone to be named this way (in fact, Wikipedia has an article on one http://en.wikipedia.org/wiki/Vasily_Ivanovich_Petrov), it seems highly doubtful that is the person's real name.
what does this have to do with Wikileaks?
Can I light a sig ?
I just started digging into finding Servint's upstream provider today because of all the fuckers abusing their servers (1-3 spam mails a day from as many scam companies with changing names). In my findings I also ran across 11 years old threads about their completely disgusting business practices. When reporting spam to them back then they threatened the spam reporters with reporting THEM as spammers! See the Spamcop mailing list 2000-2001 for more miserable reading.
From what I've found about Servint it looks like Network Solutions would be one possible provider - no domain name would make continuing their business a little tricky. Not sure who provides the actual network, though. I'm sure a whole article's worth of dirt could be found on those bastards.