I plugged a 98 box into a freshly installed cable modem (Time-Warner RoadRunner if it matters). Within 20 minutes the box was rooted. It was my mistake. I had brought the machine from a network that was behind a hardware router, and placed it directly on the cable modem. I had sharing enabled directly to the c: drive, password protected.
The worm reset the password to null and enabled sharing of other drives.
It then tried to write itself to all the fixed disks on the machine (that is how I detected it: I was transferring photos from a compact flash card, thru a USB, when it hanged. A copy of the virus was found on the card.
It is possible that the infection would not have been detectable without running trojan scan and online
antivirus particularly when the speed of cable is considered.
The worm installed a backdoor on a Windows box, and then tries to locate and infect and windows shares on the block.
Needless to say, surfing without a condom on a windows machine is dangerous indeed.
For quite some time their filtering has been effective. Brightmail won't say how they do it, but human screening, and subsequent filtering of emails containing links to spamvertised domains seemed to be a part of it.
Lately I have just been spammed silly. Looking at the spams (what choice do I have) the same spamvertised domains are represented over and over. This had not happened in the past.
This spam continues after desperately hitting the "Report Spam" button (available on their webmail interface only).
This supports the theory that either ATT or their contract spam filtering with Brightmail are passing or inserting certain mails.
With this development, I am not inclined to extend this service contract with ATT. I will be certain to pass on this information when the contract is terminated.
This is happening with us driving the safest and most expensive cars ever made.
How did this happen? Everyone has guesses. Some blame SUVs. My guess is driving behavior has changed. To many of us, driving is no longer transportation, but a game. In my opinion, too many people now derive their self-esteem from beating other people on the road.
Just watch car ads on television. Why is it 99% of car ads have to show the disclaimer "Profession Driver On Closed Course - Do Not Attempt." The driver is doing two, three times the speed limit. These ads are shown because they work. They appeal to the Speed Racer in all of us. You think, "With the new Pontiac 6000SUX, that damned guy in the Toyota truck who aces me out every day on the way to work no longer has a chance."
Furthermore, airbags and mandatory insurance gives rise to what I call "Superman Syndrome."
Why the hell should a guy be careful when he is not paying for his accidents and he doesn't have to worry about getting hurt. True -- to the extent that he doesn't get into a really big accident, which is happening more and more these days.
Verizon (the one US provider I am familiar with) already does this, but you have to initiate the install (*861 or something as I recall). However, after the last update, all of a sudden I couldn't get the reception I used to, and I had to punt that phone for Cingular. As I remember, Verizon was having a real problem with text spam.
This article is news? Florian Noller has been selling presentations containing moondust for quite some time. His presentations are thoroughly documented and no where near $50K.
It appears they finally did something about that. Most door pages, particularly in porn, stuffed keywords for Google to see, then send everyone else to the porn site via metarefresh=. It avoided SafeSearch and caused situations such as Junior searching on medieval castles for a book report and getting page after page of results sending him to Victoria's Torture and Bondage Castle (with popups).
Also, pages with too many advertiser-only tricks seem to be down. They are still there, but fewer. I guess this is being sidestepped by setting up apache to giving Google ip's one version of a page, and everyone else the real page.
You assume spammers will immediately sacrifice their profit motivations and use their spammer powers to joe job random people and punish all their enemies.
They ARE evil, but their primary intesert is P*R*O*F*I*T!!!!!!!!
The answer is to starve them out. For a while they might go to town on Sam Spade, but without the P,R0F;1T$ from legitimate spam runs will be forced find other lines of work.
I do appreciate your benevolent attitude to all this. But unfortunately filtering and RBLing will never do anything about the problem. It keeps you from seeing the spam, but it is still there. You obviously want to keep anti-spammers completely on the good right and moral side of this war, and those are good intentions.
But excuse me if I feel like I have to go ddos a spammer for sending me another fourteen I'ncrease* -' D*IC_K LENGT-H spams last night.
Without going into too much detail, we innocent users are all collateral damage in a one-sided war. That is the reason this is being proposed in the first place.
How much damage have you suffered so far? I can't even calculate. Just for me, from lost business (provably thousands of dollars, and interference with communication (I have two friends who have quit using email in disgust). How many friends have you lost contact with because their email is unreachable/blocked due to spam? How many times have important messages you sent get lost by being RBL'd, or trapped in spam filters?
People like you always advocate doing nothing. YOu never offer solutions, you just tell us to turn the cheek. A year ago, when this issue was first brought up, someone on your side protested because it would use up bandwidth. Well, we didn't do anything, and spammers have more than doubled the bandwidth use all by themselves, and we are receiving all that new spam.
The current proposal has one object: to raise the cost of sending spam beyond their income received from it. That is all. The issues you raise are obvious, and only the clumsy programmer would fail to account for them.
The solutions are easily implemented: load the text html only and check for banned objects, etc. If it passes the check, then retaliatory action can and will be taken.
If action is not taken, then only two scenarios can be projected: 1) A Usenet-like future for email, with almost all communication commercial in nature or 2) A legislative solution which will have to be intrusive to be effective.
No offense taken! I'd steer away from private bidding auctions unless the seller is someone you actually know - those look to have real issues. Much like what goes on in the mature category, ebay doesn't care what happens behind closed doors. I notice the advance fee scam auctions lately are all using it, probably so the scammer can email the mark directly instead of messenging thru ebay's system.
What snipe software are you using? I use esnipe.com, but they charge "bidpoints" and that adds up on larger bids. They've also missed bids in the past (about 1/2 of 1 percent). The advantage is not having to sync up to ebay's time, but if that's been figured out...
Honestly, I doubt that type of fraud is too prevalent any more. Ebay cancels accounts on shill bidding, though you can probably get past it by proxying carefully. In shilling, you also take the risk of overdoing it, that you end up winning it, and are stuck with paying Ebay's cut (a percentage of the winning bid). If you have to have a price, the best way is to set a reserve price.
To get back on topic, I would bet a good percentage of people have multiple ebay accounts, much like they have multiple Hotmail addresses.
People can and do flip thru your feedback and look at what you bid. FOr 90 days at least your bids are waving in the wind. Yahoo! auctions, your bidding record is permanent and publicly associated with your Yahoo! ID - bet you regret bidding on those worn panties now!!!
Because your bidding is public record, many people have one acct for pr0n sleaze and filth, one for gear (good idea to keep that one w/ an immaculate rating), and one bad guy when they want to do damage to a shitty seller.
Additional accounts aren't a bad idea when bidding in specialty circles (for example, antique silverware or Frida prints). You get known especially after acing out other bidders with a snipe, and this affects prices positively (bad for bidders) after the other bidders raise their conventional bids to block your snipe. Due to the anonymity of the internet, you can avoid the bidding wars that occur at live auctions.
I'm sure, by now, everybody who has a Citi or Ebay account has gotten one of those spams. (I have several ebay accounts and therefore have received each of the ones mentioned in the article.
They also target Paypal MUCH more than mentioned. I get a paypal scam every week at least.
The Ebay ones only want your login info so they can pose as a "legit" seller for a few days to run Romanian-type auction
scams.
The Paypal scammers, with only your password, can literally take you for every cent you got AND every cent of credit availability.
And where is the mention of the origin of it all, the AOL phishers? I guess you only see it on AOL but it is a huge problem over there. The main purpose seems to use compromised accounts to spam AOL members from inside, it happened to my dad, who is still "not budging" from AOL.
The ideal solution would be a distributed deliberate response, using the form provided by the spammer, by the targetted companies, who could load predetermined user/pass combinations and disinformation (I have a script) into their database. When access is attempted using the provided login/password combinations, the criminal is detected in real time (he is not safe by proxying - he is still dead meat when seen in action. Logs will exist on the proxy servers to point right to him, the more the merrier.)
There is a possibility that the high immigrant population here would not notice those errors. And that's not counting the illiterate population, nor those who choose to mis-speak English.
Believe me, there are many more pictures being taken. The main reason is the limitation of film cost and processing has been removed.
I never had that limitation and I still shoot 2-3 times as much as I did in 1999. Probably the main reason is the good cameras, like the Canon 1d, shoot 8 frames a second. A 1G CF card holds 420 shots. The largest roll of film is 36 frames.
I shot digital starting in 1996, but still primarily used film until decent digital SLRs came out. I moved over entirely to digital in 2001.
In 1996 I shot maybe 100 photos with digital (and they were small >10 kb each). That was an early Kodak.
In 1998 I shot advertising using an Olympus D620L. That thing shot images maybe 80kb. In 2000 I shot 1,643 digital images occupying 250 mb or so, aainst 4,000 or 5,000 frames of film. Of the film, only the frames for publication needed to be scanned to disk. The total amount of disk space used wasn't much.
In 2001 the Nikon D1 came out. I shot 56,066 that year (got it in March). 22 gigs worth, spanned across lots of CDRs.
So far in 2003, with the Canon 1d and 1ds, shot 50,261 frames, taking up about 32 gig, archived to DVD.
I would expect these increases to continue for the near future.
I just did another backup, so the figures are right at hand. I'm a news photographer, shooting digital. In 2002 I saved 78,742 photos to disk. (Bad images were not saved.) That worked out to 122 gig. The output was transferred fromt he CF cards and archived to DVDs. But how much of that 122 gig is really information? The image file saved by the Canon 1d is mostly empty air, as far as I can tell. There is also EXIF data and IPTC, and who knows how much hidden BS is included a'la Microsoft Word documents? Simple compression was able to whittle that down to 33.2 gig. So that's my contribution. The main beneficiary is the DVD-R blank disc makers and Western Digital, I guess.
The article does not mention the amount of outbound spam from Australia.
Which I have been getting a lot of lately.
In fact, come to think of it, exactly in the time frame mentioned in the article.
"...whereas the majority of the "customers" the RIAA is suing, did not [pay]."
I no longer pay. I have paid tens of thousands of dollars over the years, for vinyl LPs, then cassette tapes and most recently compact discs.
Some music I have on all three.
Yes I downloaded, but I also paid into the system. A lot of money, but apparently it was not enough for their Rolls Royces, their crack, their whores and now their lawyers.
I have decided to no longer pay for music, unless it is guaranteed RIAA-free. (Someone should make a logo). This is directly because of RIAA stormtrooper tactics against their customers and myself.
Though I can certify that I have purchased no RIAA-tainted discs over the last year, it still pisses me off that they get some of my money through ASCAP/BMI licensing, just because I go to a bar or store where music is played, or buy something which is advertised on radio.
To be honest, they look like they'd be fun to ride. But the barrier to entry is a little stiff. If you're looking for a fun ride, an ATV which cost less than half of a Segway is much better, particularly in the wide-open desert and sand dunes. In the city the bike is faster and also better exercise, and is also good off-road.
I'll look at Segway when the price drops and I find myself in an urban, campus or other closed-loop situation which makes them practical.
Slashdot Mirror
I plugged a 98 box into a freshly installed cable modem (Time-Warner RoadRunner if it matters). Within 20 minutes the box was rooted. It was my mistake. I had brought the machine from a network that was behind a hardware router, and placed it directly on the cable modem. I had sharing enabled directly to the c: drive, password protected.
The worm reset the password to null and enabled sharing of other drives.
It then tried to write itself to all the fixed disks on the machine (that is how I detected it: I was transferring photos from a compact flash card, thru a USB, when it hanged. A copy of the virus was found on the card.
It is possible that the infection would not have been detectable without running trojan scan and online antivirus particularly when the speed of cable is considered.
The worm installed a backdoor on a Windows box, and then tries to locate and infect and windows shares on the block.
Needless to say, surfing without a condom on a windows machine is dangerous indeed.
Triangulation requires equipment located in several places and a certain amount of nontrivial effort.
GPS allows one person to instantly pinpoint you to within two meters. Information this easily obtained is potentially valuable to abusers.
For quite some time their filtering has been effective. Brightmail won't say how they do it, but human screening, and subsequent filtering of emails containing links to spamvertised domains seemed to be a part of it.
Lately I have just been spammed silly. Looking at the spams (what choice do I have) the same spamvertised domains are represented over and over. This had not happened in the past.
This spam continues after desperately hitting the "Report Spam" button (available on their webmail interface only).
This supports the theory that either ATT or their contract spam filtering with Brightmail are passing or inserting certain mails.
With this development, I am not inclined to extend this service contract with ATT. I will be certain to pass on this information when the contract is terminated.
This is happening with us driving the safest and most expensive cars ever made.
How did this happen? Everyone has guesses. Some blame SUVs. My guess is driving behavior has changed. To many of us, driving is no longer transportation, but a game. In my opinion, too many people now derive their self-esteem from beating other people on the road.
Just watch car ads on television. Why is it 99% of car ads have to show the disclaimer "Profession Driver On Closed Course - Do Not Attempt." The driver is doing two, three times the speed limit. These ads are shown because they work. They appeal to the Speed Racer in all of us. You think, "With the new Pontiac 6000SUX, that damned guy in the Toyota truck who aces me out every day on the way to work no longer has a chance."
Furthermore, airbags and mandatory insurance gives rise to what I call "Superman Syndrome." Why the hell should a guy be careful when he is not paying for his accidents and he doesn't have to worry about getting hurt. True -- to the extent that he doesn't get into a really big accident, which is happening more and more these days.
You didn't just register today? heh
Verizon (the one US provider I am familiar with) already does this, but you have to initiate the install (*861 or something as I recall). However, after the last update, all of a sudden I couldn't get the reception I used to, and I had to punt that phone for Cingular. As I remember, Verizon was having a real problem with text spam.
This article is news? Florian Noller has been selling presentations containing moondust for quite some time. His presentations are thoroughly documented and no where near $50K.
It appears they finally did something about that. Most door pages, particularly in porn, stuffed keywords for Google to see, then send everyone else to the porn site via metarefresh=. It avoided SafeSearch and caused situations such as Junior searching on medieval castles for a book report and getting page after page of results sending him to Victoria's Torture and Bondage Castle (with popups).
Also, pages with too many advertiser-only tricks seem to be down. They are still there, but fewer. I guess this is being sidestepped by setting up apache to giving Google ip's one version of a page, and everyone else the real page.
They ARE evil, but their primary intesert is P*R*O*F*I*T!!!!!!!!
The answer is to starve them out. For a while they might go to town on Sam Spade, but without the P,R0F;1T$ from legitimate spam runs will be forced find other lines of work.
I do appreciate your benevolent attitude to all this. But unfortunately filtering and RBLing will never do anything about the problem. It keeps you from seeing the spam, but it is still there. You obviously want to keep anti-spammers completely on the good right and moral side of this war, and those are good intentions.
But excuse me if I feel like I have to go ddos a spammer for sending me another fourteen I'ncrease* -' D*IC_K LENGT-H spams last night.
Without going into too much detail, we innocent users are all collateral damage in a one-sided war. That is the reason this is being proposed in the first place.
How much damage have you suffered so far? I can't even calculate. Just for me, from lost business (provably thousands of dollars, and interference with communication (I have two friends who have quit using email in disgust). How many friends have you lost contact with because their email is unreachable/blocked due to spam? How many times have important messages you sent get lost by being RBL'd, or trapped in spam filters?
People like you always advocate doing nothing. YOu never offer solutions, you just tell us to turn the cheek. A year ago, when this issue was first brought up, someone on your side protested because it would use up bandwidth. Well, we didn't do anything, and spammers have more than doubled the bandwidth use all by themselves, and we are receiving all that new spam.
The current proposal has one object: to raise the cost of sending spam beyond their income received from it. That is all. The issues you raise are obvious, and only the clumsy programmer would fail to account for them.
The solutions are easily implemented: load the text html only and check for banned objects, etc. If it passes the check, then retaliatory action can and will be taken.
If action is not taken, then only two scenarios can be projected:
1) A Usenet-like future for email, with almost all communication commercial in nature
or
2) A legislative solution which will have to be intrusive to be effective.
No offense taken! I'd steer away from private bidding auctions unless the seller is someone you actually know - those look to have real issues. Much like what goes on in the mature category, ebay doesn't care what happens behind closed doors. I notice the advance fee scam auctions lately are all using it, probably so the scammer can email the mark directly instead of messenging thru ebay's system.
What snipe software are you using? I use esnipe.com, but they charge "bidpoints" and that adds up on larger bids. They've also missed bids in the past (about 1/2 of 1 percent). The advantage is not having to sync up to ebay's time, but if that's been figured out...
Honestly, I doubt that type of fraud is too prevalent any more. Ebay cancels accounts on shill bidding, though you can probably get past it by proxying carefully. In shilling, you also take the risk of overdoing it, that you end up winning it, and are stuck with paying Ebay's cut (a percentage of the winning bid). If you have to have a price, the best way is to set a reserve price.
To get back on topic, I would bet a good percentage of people have multiple ebay accounts, much like they have multiple Hotmail addresses.
People can and do flip thru your feedback and look at what you bid. FOr 90 days at least your bids are waving in the wind. Yahoo! auctions, your bidding record is permanent and publicly associated with your Yahoo! ID - bet you regret bidding on those worn panties now!!!
Because your bidding is public record, many people have one acct for pr0n sleaze and filth, one for gear (good idea to keep that one w/ an immaculate rating), and one bad guy when they want to do damage to a shitty seller.
Additional accounts aren't a bad idea when bidding in specialty circles (for example, antique silverware or Frida prints). You get known especially after acing out other bidders with a snipe, and this affects prices positively (bad for bidders) after the other bidders raise their conventional bids to block your snipe.
Due to the anonymity of the internet, you can avoid the bidding wars that occur at live auctions.
The Paypal scammers, with only your password, can literally take you for every cent you got AND every cent of credit availability.
And where is the mention of the origin of it all, the AOL phishers? I guess you only see it on AOL but it is a huge problem over there. The main purpose seems to use compromised accounts to spam AOL members from inside, it happened to my dad, who is still "not budging" from AOL.
The ideal solution would be a distributed deliberate response, using the form provided by the spammer, by the targetted companies, who could load predetermined user/pass combinations and disinformation (I have a script) into their database. When access is attempted using the provided login/password combinations, the criminal is detected in real time (he is not safe by proxying - he is still dead meat when seen in action. Logs will exist on the proxy servers to point right to him, the more the merrier.)
There is a possibility that the high immigrant population here would not notice those errors. And that's not counting the illiterate population, nor those who choose to mis-speak English.
If he wins his case, this will open up a can o' worms due to all those guys who bought 1-acre Moon tracts on ebay and elsewhere.
I doubt if they will take down the flag. More probable they will "respectfully visit" an Apollo moon landing site.
The simple fact that they can get there, and the USA cannot, will more than make the point for Chinese superiority.
Believe me, there are many more pictures being taken. The main reason is the limitation of film cost and processing has been removed.
I never had that limitation and I still shoot 2-3 times as much as I did in 1999.
Probably the main reason is the good cameras, like the Canon 1d, shoot 8 frames a second. A 1G CF card holds 420 shots. The largest roll of film is 36 frames.
I shot digital starting in 1996, but still primarily used film until decent digital SLRs came out. I moved over entirely to digital in 2001.
In 1996 I shot maybe 100 photos with digital (and they were small >10 kb each). That was an early Kodak.
In 1998 I shot advertising using an Olympus D620L. That thing shot images maybe 80kb. In 2000 I shot 1,643 digital images occupying 250 mb or so, aainst 4,000 or 5,000 frames of film. Of the film, only the frames for publication needed to be scanned to disk. The total amount of disk space used wasn't much.
In 2001 the Nikon D1 came out. I shot 56,066 that year (got it in March). 22 gigs worth, spanned across lots of CDRs.
So far in 2003, with the Canon 1d and 1ds, shot 50,261 frames, taking up about 32 gig, archived to DVD.
I would expect these increases to continue for the near future.
I just did another backup, so the figures are right at hand.
I'm a news photographer, shooting digital.
In 2002 I saved 78,742 photos to disk. (Bad images were not saved.)
That worked out to 122 gig. The output was transferred fromt he CF cards and archived to DVDs.
But how much of that 122 gig is really information? The image file saved by the Canon 1d is mostly empty air, as far as I can tell. There is also EXIF data and IPTC, and who knows how much hidden BS is included a'la Microsoft Word documents?
Simple compression was able to whittle that down to 33.2 gig. So that's my contribution.
The main beneficiary is the DVD-R blank disc makers and Western Digital, I guess.
If you did that now, every minute or two they'd be getting a "YOUR'E COMPUTR HAS A SECUTIRY FLAW!!!" popup.
But perhaps adapting spam filters to popup messaging could extend the viability of WMS, for the time being.
The article does not mention the amount of outbound spam from Australia. Which I have been getting a lot of lately. In fact, come to think of it, exactly in the time frame mentioned in the article.
I no longer pay. I have paid tens of thousands of dollars over the years, for vinyl LPs, then cassette tapes and most recently compact discs.
Some music I have on all three.
Yes I downloaded, but I also paid into the system. A lot of money, but apparently it was not enough for their Rolls Royces, their crack, their whores and now their lawyers.
I have decided to no longer pay for music, unless it is guaranteed RIAA-free. (Someone should make a logo). This is directly because of RIAA stormtrooper tactics against their customers and myself.
Though I can certify that I have purchased no RIAA-tainted discs over the last year, it still pisses me off that they get some of my money through ASCAP/BMI licensing, just because I go to a bar or store where music is played, or buy something which is advertised on radio.
Well, you are still exposed to MSIE insecurities.
It really sucks to get r00ted thru your browser.
With responses rates in the 3-4 per billion range and dropping, either spam will stop on its own, or we all all soon die in a supernova of spam.
"Drying mode on...
"Your jacket is now dry."
To be honest, they look like they'd be fun to ride. But the barrier to entry is a little stiff. If you're looking for a fun ride, an ATV which cost less than half of a Segway is much better, particularly in the wide-open desert and sand dunes. In the city the bike is faster and also better exercise, and is also good off-road.
I'll look at Segway when the price drops and I find myself in an urban, campus or other closed-loop situation which makes them practical.