Re: [Spambayes] Latest spammer trick stymied
In message: <3E893DA7.31420.20D35DB@localhost> "Richard Jowsey" <richard@jowsey.com> writes:
We have to be careful with this. It would be relatively simple to stymie, by simply adding two urls, the spam one, and an unrelated innocent site. Or three urls, or whatever...
Spammers are simple folk. They won't be putting no innocent url's in these spams...
Spammers might be simple folk, but serious crackers (not the script kiddies) certainly are not. If there comes to be a widely deployed tool with this sort of fetch-what-I-tell-you-to behaviour, then it will get exploited by people wanting to do a denial of service attack or similar. Why bother sending out your own IRC-controlled worm, when there's already remote-controllable spamfilters ready and waiting to pound a site into the ground? After all, writing (and releasing) a worm is already recognized as a crime, but the legality of just sending out a not-as-innocent-as-it-looks email blast is still in contention... - Alex
Spammers might be simple folk, but serious crackers (not the script kiddies) certainly are not. If there comes to be a widely deployed tool with this sort of fetch-what-I-tell-you-to behaviour, then it will get exploited by people wanting to do a denial of service attack or similar.
There's literally dozens of DOS "attack tools" out there already. They're unfortunately very easy to build. A determined site-slammer is going to use quite different technology than my crawler, in any case, e.g. http://grc.com/dos/grcdos.htm What I've built is a simple url-slurper, which resides on a proxy server (not deployed on desktops), and is only invoked under very particular circumstances. The results are immediately incorporated into the server's database, so that anyone else receiving that spam benefits from the extra information. Under this kind of deployment scenario, a spam site only needs to be crawled once. Then we've got him nailed! :) Cheers, Richard
T. Alexander Popiel wrote:
If there comes to be a widely deployed tool with this sort of fetch-what-I-tell-you-to behaviour, then itwill get exploited by people wanting to do a denial of serviceattack or similar.
I'm not convinced by this. In order to mount a good DOS attack, the attacker must effectively multiply his bandwidth as much as possible, so his paltry broadband link can compete with a well connected server farm. The standard techniques are to use small ping packets that require large, 64K responses, and to use zombies that make continuous requests. A URL sent in an email via SMTP represents a sizeable amount of data, and unlike ping packets involves establishing a TCP link. Only a fraction of the recipients will follow the URL. Bandwidth-consuming images are not going to be downloaded by the crawler, just text. So I don't believe an attacker will consider spamming URLs to millions of recipients an effective way to use his bandwidth to eat up the target's bandwidth. Cheers, Chris.
participants (3)
-
Chris Lowe -
Richard Jowsey -
T. Alexander Popiel