5 ms·

Dissecting a spammer's spam script

140 points by jmadsen 10y ago

bluedino 10y ago
I've seen some code from vendors using ZendGuard and kind of wondered how it worked - I'm assuming any dissections of their obfuscation algorithm or code would be served a takedown notice real quick.
- tyingq 10y ago
  Zend is more sophisticated than the techniques described in this story. It's at the opcode level. http://xcon.xfocus.org/XCon2006/archieves/Darkne2s&A1rsupp1y-Decode_PHP_Zend.pdf http://xcon.xfocus.org/XCon2006/archieves/Darkne2s&A1rsupp1y... Somewhat similar to what Dropbox does to obfuscate their Python client. They provide a custom built python interpreter that uses a non-standard opcode mapping, as well as "encrypting/decrypting" with a key hidden in the code.
  - chris_wot 10y ago
    Sounds like a challenge for someone to write a decoder.
  - gkya 10y ago
    Why they would not just provide it with no obfuscation though? The essence of their system is the server-side anyways, why bother?
    - tyingq 10y ago
      Dropbox? My guess is that they are trying to protect the "tray login" thing where the client runs without prompting you for your dropbox credentials, but that's just a guess. There's an article about the reverse engineering of the client here: http://www.techrepublic.com/blog/it-security/researchers-reverse-engineer-the-dropbox-client-what-it-means/ http://www.techrepublic.com/blog/it-security/researchers-rev...
batat 10y ago
That was pretty straightforward. Check this http://ideone.com/VImf2v http://ideone.com/VImf2v :)
tronje 10y ago
Maybe I'm too naive, but I really don't get why people do this (the spamming, not the dissecting). Whoever did this could probably land a nicely paying programming job, no? Is spamming that lucrative or what's going on?
- dasboth 10y ago
  I often wonder this and I think that's probably the reason. Someone somewhere is offering a good deal for people to write spam software for them. A real shame, because it's not a trivial task and that skillset could be used in much better ways.
- brightball 10y ago
  My assumption has always been that a steady stream of generic spam would make it easier to make the real stuff look legit
- ryanlol 10y ago
  >Is spamming that lucrative or what's going on? Yes, it is. There's not that many programming jobs where you can easily make 500k+ a year. For example, if you're phishing for credit cards with VBV info you might very well get $20 or more per card when selling in bulk (or twice that if you aren't). 10000 emails takes a couple of minutes to send and if you get a 1% success rate that's $2000
- 1812Overture 10y ago
  Probably plenty of programmers who are felons/meth addicts/too anti-social to be employable/too lazy to work a real job.
tmaly 10y ago
I had a wordpress site hit with one of these attacks years back. I took it apart to see how it worked. It was a pretty messy hack, but I give them credit for working within the constraints they had.

140 points by jmadsen 10y ago

I've seen some code from vendors using ZendGuard and kind of wondered how it worked - I'm assuming any dissections of their obfuscation algorithm or code would be served a takedown notice real quick.

tyingq 10y ago
Zend is more sophisticated than the techniques described in this story. It's at the opcode level. http://xcon.xfocus.org/XCon2006/archieves/Darkne2s&A1rsupp1y-Decode_PHP_Zend.pdf http://xcon.xfocus.org/XCon2006/archieves/Darkne2s&A1rsupp1y... Somewhat similar to what Dropbox does to obfuscate their Python client. They provide a custom built python interpreter that uses a non-standard opcode mapping, as well as "encrypting/decrypting" with a key hidden in the code.
- chris_wot 10y ago
  Sounds like a challenge for someone to write a decoder.
- gkya 10y ago
  Why they would not just provide it with no obfuscation though? The essence of their system is the server-side anyways, why bother?
  - tyingq 10y ago
    Dropbox? My guess is that they are trying to protect the "tray login" thing where the client runs without prompting you for your dropbox credentials, but that's just a guess. There's an article about the reverse engineering of the client here: http://www.techrepublic.com/blog/it-security/researchers-reverse-engineer-the-dropbox-client-what-it-means/ http://www.techrepublic.com/blog/it-security/researchers-rev...

batat 10y ago

That was pretty straightforward. Check this http://ideone.com/VImf2v http://ideone.com/VImf2v :)

tronje 10y ago

Maybe I'm too naive, but I really don't get why people do this (the spamming, not the dissecting). Whoever did this could probably land a nicely paying programming job, no? Is spamming that lucrative or what's going on?

dasboth 10y ago
I often wonder this and I think that's probably the reason. Someone somewhere is offering a good deal for people to write spam software for them. A real shame, because it's not a trivial task and that skillset could be used in much better ways.
brightball 10y ago
My assumption has always been that a steady stream of generic spam would make it easier to make the real stuff look legit
ryanlol 10y ago
>Is spamming that lucrative or what's going on? Yes, it is. There's not that many programming jobs where you can easily make 500k+ a year. For example, if you're phishing for credit cards with VBV info you might very well get $20 or more per card when selling in bulk (or twice that if you aren't). 10000 emails takes a couple of minutes to send and if you get a 1% success rate that's $2000
1812Overture 10y ago
Probably plenty of programmers who are felons/meth addicts/too anti-social to be employable/too lazy to work a real job.

tmaly 10y ago

I had a wordpress site hit with one of these attacks years back. I took it apart to see how it worked. It was a pretty messy hack, but I give them credit for working within the constraints they had.