Huge Database Leak Reveals 1.37 Billion Email Addresses and Exposes Illegal Spam Operation (betanews.com)

One of the largest spam operations in the world has exposed its entire operation to the public, leaking its database of 1.37bn email addresses thanks to a faulty backup. From a report: A faulty backup has inadvertently exposed the entire working database of notorious spam operator River City Media (RCM). In all, the database contains more than 1.37 billion email addresses, and for some records there are additional details such as names, real-world addresses, and IP addresses. It's a situation that's described as "a tangible threat to online privacy and security." Details about the leak come courtesy of Chris Vickery from macOS security firm MacKeeper who -- with a team of helpers -- has been investigating since January. River City Media's database ended up online thanks to incorrectly-configured Rsync backups. In the words of Vickery: "Chances are you, or at least someone you know, is affected." The leaked, and unprotected, database is what's behind the sending of over a billion spam emails every day -- helped, as Vickery points out, by "a lot of automation, years of research, and fair bit of illegal hacking techniques." But it's more than a database that has leaked -- it's River City Media's entire operation.

Comments

Redundant

[Anonymous Coward]

How many spam operations are legal?

Re:Redundant

[Obfuscant]

You signed up for it when you bought a product or made an inquiry on their site and did not uncheck a box that signed you up for them most-likely.

That's the lie every spammer uses to justify their garbage. De-selecting the "send me all kinds of email about stuff I don't want" checkbox does nothing.

If you're still getting it you're just too lazy to unsubscribe.

I SHOULD NOT HAVE TO UNSUBSCRIBE FROM JUNK EMAIL LISTS THAT I DID NOT SUBSCRIBE TO IN THE FIRST PLACE. THE FIRST PIECE OF SPAM IS STILL SPAM.

Re:Redundant

[SeaFox]

Spam is UNWANTED e-mail.

No, spam is UNSOLICITED commercial email. When you did whatever action you did on their site to receive it, you solicited them to send it to you as part of it. True spam is from companies you never heard of and never had a business relationship with.

Re:Redundant

[Anonymous Coward]

That's the lie every spammer uses to justify their garbage.

Yes, Rule #1, spammers lie; that doesn't mean it isn't a legitimate justification for a lot of commercial email. If I order a pizza on PizzaHut.com, and next week Pizza Hut sends me an email with their weekly special offers, that isn't spam. It isn't mail I particularly want, but it isn't spam. I agreed to receive those emails by joining up with PizzaHut.com.

Spam is all the completely unsolicited boner pills, home mortgage, weight loss, and other garbage coming from randos who bought or harvested my email address somewhere, like the assholes who are the subject of this article.

Re:Redundant

[RobinH]

I'm not sure why some people have such a huge problem with spam. I use a service where I make up a unique email address for each account I sign up for. That (paid, but cheap) service forwards the mail to me. If I ever get unsolicited email on that address, I go to the service and delete the address, or if I really care, I make a new one and update that account, because they probably got hacked.

When an account sends me a mailing list, I click the unsubscribe button, and I would say 9 times out of 10 that works. If it doesn't, I delete or disable that email address.

Which means I don't have a spam problem.

Re:Redundant

[Obfuscant]

that doesn't mean it isn't a legitimate justification for a lot of commercial email.

It is not a legitimate excuse for the commercial email I receive based on such lies. I ALWAYS uncheck this "pre-selected opt-in" (an oxymoron), and the spammer ALWAYS tells me that I opted-in.

If I order a pizza on PizzaHut.com, and next week Pizza Hut sends me an email with their weekly special offers, that isn't spam.

Yes, it is. Unsolicited commercial junk email. UCE. BY DEFINITION.

Spam is all the completely unsolicited boner pills, home mortgage, weight loss, and other garbage coming from randos who bought or harvested my email address somewhere,

Spam is not defined by topic. It is defined by UNSOLICITED COMMERCIAL EMAIL. Yes, there are many sources of spam. The fact that you bought a pizza at Pizza Hut does not excuse their unsolicited commercial email, which is spam.

Re:Redundant

[nukenerd]

Spam is UNWANTED e-mail.

No, spam is UNSOLICITED commercial email. When you did whatever action you did on their site to receive it, you solicited them to send it

Bullshit. My "action" is to buy something online (it is getting hard to find some types of stuff any other way). Buying something is not "soliciting" for email adverts for ever after.

Anyway, I use disposable email addresses for purchasing. After it's delivered, I turn off the address and their spam is going into a black hole somewhere, not even as far as my spam directory. But I can look at the stats and see that some companies I have bought from (including a gardening supplier I bought a $10 item from 5 years ago) have sent me thousands of emails - a situation that is ridiculous

Re:Redundant

[admin7087]

That's not how it works. Many companies let you sign up with email and will send you email years later even if you untick the "yes, please send me bullshit news" box. Others trick you into inadvertently subscribing to their newsletter by showing the preselected box again and again during updates. It's illegal spam in both cases, but they get away with it.

Re:Redundant

[JoeMerchant]

In the 1990s, any acknowledgment of a spam e-mail was an invitation to more SPAM.

Lately, the unsubscribe links mostly work pretty well. I've been able to maintain the same address for 20 years now and it's still usable, sure it gets SPAM, but with billions of legitimate SPAM targets on the planet today, just knowing that the address is legit isn't enough to make it attractive anymore.

Also, there are some penalties for not handling "unsubscribe" requests properly, never looked into enforcement and collection, but I'm sure some people have.

Re:Redundant

[nobuddy]

No need for a service, gmail will do it by default.

If your address is "mymail@gmail.com" and you are filling out an order from Pizza Hut, use "PizzaHut+mymail@gmail.com"

now you have a unique one for them that you can block off at any time. With the added benefit of being able to see who sold your email to that spammer.

Re:Redundant

[sit1963nz]

It took me over 2 years to get off one hotel chains spam list even though I ticked "DO NOT email me offers"

Now I have a spam email address I use for all hotels , real estate agents, etc etc etc that fits into the format of x.x.xspamtrap@gmail.com
so they KNOW its a spam trap
Some have complained that its not a real address, it is, but anything that ends up there is automatically deleted, I never see any of it, and they get told this
I am more than happy to show them on my phone that its real, but worthless.

Re:Redundant

[dead_user]

Hehe, I bought about $4.00 worth of capacitors from Mouser.com once and they mailed me at least 8 different 1.5" thick catalogs in the post for the next several years trying to get me to buy more. My TV only broke once. I don't NEED more. At least in the case of the emails all that was wasted are a few electrons. ;)

The truth of the matter is that for a small business like that, curating the list takes time. Just letting the script run automatically once a week does not.

Re:Redundant

[Alumoi]

Aha, and the stores don't sell your email to spammers. Ever!

Re:Redundant

[Obfuscant]

use "PizzaHut+mymail@gmail.com" now you have a unique one for them that you can block off at any time.

You don't need to block it off, it will be sent to someone else who already has the "pizzahut@gmail.com" address, with the added benefit of telling them who is using their address to sign up for pizzahut spam.

Try "mymail+pizzahut@gmail.com".

Thanks to everyone who thinks I need to know how to avoid this spam, but I already do. I am well aware and a long time user of RFC5233 addressing.

Re:Redundant

[afidel]

other way around, myemail+pizzahut@gmail.com

Re:Redundant

[whoever57]

Unfortunately, lots of websites won't accept such email addresses.

I even have one case where I registered using such an address, but the website was changed so that now it won't accept such addresses, so I cannot use it for orders, change it or even unsubscribe. Fortunately, they don't use it to send more than about one email every two months, so I really don't care.

Re:Redundant

[easyTree]

It's just so pointless;

if (customersWantOurProducts) {
    while (true) {
        waitForNewOrder();
        processCustomerOrder();
    }
} else {
    for (var c in customers) {
        for (var p in products) {
            sendEmail (c.email, "Although we recognise that this is a longshot, do you " + c.name + ", at this exact instant in time, require our product '" + p.name + "', for the currently reduced price of " + (0.9 * (p.price * 12 - 20)) + "?\r\nKind regards, spammer.-corp");
        }
    }
}

Source article

[Anonymous Coward]

Vickery's own writeup is here.

Re:Source article

[Anonymous Coward]

Wait, what? MacKeeper? The malware that advertises all over porn sites? If they "investigated" some spammer, rest assured that it's all part of a dastardly plot on MacKeeper's part.

ahem *MacKeeper*?

[fustakrakich]

I want a second opinion

Can someone post a download link?

[downright]

I want to see if I'm on it. Yeah. That's why. Just Kidding. :-)

Re:Can someone post a download link?

[Anonymous Coward]

You might be, I'm not. I want to see what kind of personal information was leaked about me or my family. I'm guessing it'll take me a day to find a torrent or magnet link for it.

Re:Can someone post a download link?

[sizzlinkitty]

I'm looking for the torrent as well, will post if i find it.

Re:They seem to have "inside" contacts.

[Zocalo]

Or maybe they just have an intrusion detection system and Vickery or one of his helpers tripped over it while exfiltrating the data. Hopefully they've got enough for law enforcement to identify at least some of those involved and, ultimately, send them for a lengthy stay somewhere where they need to worry about unsolicited male.

Send everyone an email to let them know

[jfdavis668]

Download the database, and keep email everyone on the list that they are subject to spam emails. Do this every night to make sure they know. Add a few ads to help pay for the project.

Re:BetaNews?

[b0bby]

The indignant AC didn't post the link, but I assume it's this one:
http://www.csoonline.com/artic...
And yeah, it's a way better article.

Re:BetaNews?

[SandorZoo]

I guess this article is the one AC is referring to. Seems legit, but a little too esoteric for me to follow. It has links to other sources.

Are you affected?

[andrewa]

Just provide the following details and we will search the leaked database to determine if your details are compromised.

First Name:
Last Name:
Email:
Phone:
SSN:

[Submit]

How ironic

[mandark1967]

Since the spammers had personally identifiable information, they're now required to contact those affected to notify them of the breach and what those affected by the breach should do to protect themselves, and get larger breasts naturally.