7 ms·
Spammers expose their entire operation through bad backups
- wiredfool 10y agohttps://news.ycombinator.com/item?id=13802559 https://news.ycombinator.com/item?id=13802559 is a better article, now marked as a dupe.
- dang 10y agoOK, we've changed the URL above to that from https://mackeeper.com/blog/post/339-spammergate-the-fall-of-an-empire https://mackeeper.com/blog/post/339-spammergate-the-fall-of-....
- scandox 10y agoThese Mackeeper guys had some high pressure dude on a live chat get my mother to pay and install their software. Worse - she was having trouble installing it and the guy suggested a remote session. Luckily she got wise at that point. I wouldn't even visit their site to be quite frank.
- joering2 10y agoOut of curiosity - what do you think a guy that is hired to make that software to work on your mom computer would do more than help her install said software, even if through a remote session?
- Sunset 10y agoDownload a trojan of some sort.
- DashRattlesnake 10y ago> Out of curiosity - what do you think a guy that is hired to make that software to work on your mom computer would do more than help her install said software, even if through a remote session? Because that is literally part of the modus operandi of the Windows tech support scammers?
- eis 10y agoMacKeeper? The company that aggressively advertises something that looks like scareware? Surprised that they are now supposedly the good guys. The Wikipedia intro reads "The software is heavily promoted and has been the subject of a class-action lawsuit for false advertising.". They are now writing about a data leak of some spammers because these accidently left their repo open while MacKeeper had their own nice similar leak: "In December 2015 security researcher Chris Vickery discovered a publicly accessible database of 21GB of MacKeeper user data on the internet, exposing the usernames, passwords and other information of over 13 million MacKeeper users. According to Kromtech this was the result of a "server misconfiguration""
- sequence7 10y agoFrom the bottom of the article it looks like MacKeeper hired that security researcher: Attention - Portions of this article may be used for publication if properly referenced and credit is given to MacKeeper Security Researcher, Chris Vickery.
- tyingq 10y agoThe guy that found it says "On my own. Not hired", here: https://www.reddit.com/r/apple/comments/3wq9fc/massive_data_breach/ https://www.reddit.com/r/apple/comments/3wq9fc/massive_data_...
- tyingq 10y agoNote my comment above is apparently related to a different breach that involved MacKeeper. Please ignore, too late to edit.
- altern8tif 10y agoMacKeeper has 13 million users?? Who would install MacKeeper willingly?
- sna1l 10y agoI'm assuming most of them aren't doing it intentionally.
- janwillemb 10y agoI'd rather see Troy Hunt handling this... hoping they add the database to HIBP
- laurencei 10y agoIs it a "pawn" though? Your email address in their database does not necessarily mean your security has been compromised - just that your on a spam list somewhere?
- dpcx 10y agoEven if not, it would be nice to know if my email address(es) were included.
- duskwuff 10y agoYes, it appears to be -- the article implies that backups of data from the spam operation were exposed to the public.
- Klathmon 10y agoThey have added the "GeekedIn" leak from mid last year in the database even though technically none of the information was private (IIRC it was all scraped from GitHub's public API). Sometimes getting on these lists is fairly harmless by itself, but they can end up leaking a large amount of data about some people. Just knowing that an email address is used and active is a start, but combine that with other information that could be grabbed like rough location data, IP address information, knowledge that the email was associated with that service, active usage dates, and more can end up being much worse.
- shadowcodex 10y agoWho doesn't already have our email addresses? I get spam email all the time...
- otterley 10y agoThe number of emails in the database isn't even the interesting part. What's more noteworthy is the fact that the spammers have figured out how to evade Google and Yahoo SMTP servers' rate-limiting techniques, and the sheer amount of volume they have at their disposal relative to the compute resources they have.
- altern8tif 10y agoI hope Google does something about this. The problem with spam is that once you're on the spammers' lists, it's virtually impossible to get off it.
- xanderstrike 10y agoThat's interesting, I never get spam in my inbox in Gmail, but my "spam folder" is constantly full. I wonder if gmail makes these spam emails appear as if they're "inboxing" to the spammers.
- gregmac 10y agoAt the SMTP level, you can't tell the difference (spam or not). A bounce return message will tell you it fails, but the absence of a bounce message doesn't mean it was received, let alone got into an inbox. The only way a sender can tell for sure their e-mail was delivered is to have tracking links: images and/or clickable links that include something to uniquely identify which address received the mail. Most if not all e-mail clients block images, and many even disable links for unknown senders and/or messages that even remotely look like spam (eg: a non-zero spam score that is below the threshold to automatically reject or filter to a junk folder). If you get tracked by one of these images or links, presumably you move from the "maybe working" e-mail address list to the "reads our messages" or "clicks our links" list, and at the very least means you contribute to making more money for the spammer when they sell that (higher-value) list.
- dsl 10y ago> The only way a sender can tell for sure their e-mail was delivered is to have tracking links Thats not true. Both spammers and legitimate email delivery services have hundreds if not thousands of accounts at the major email providers that they seed into their lists. As they are delivering email they periodically check their own accounts to see if mail is ending up in the inbox or the spam folder. You can also request a "Feedback Loop" from major email providers that will forward spam complaints from your network back to you.
- ucaetano 10y agoSo now MacKeeper will use those 1.4B accounts to lure people into installing their own software, and giving them more information?
- AdmiralAsshat 10y agoWere they held for River City Ransom? (I'm sorry, couldn't resist)
- digitalsin 10y agoCrap now the menu tune is playing non-stop in my head
- uladzislau 10y agoIt puzzles me that all these spam/fishing operations are being uncovered by an accident and there's no proactive private or nonprofit organizations pursuing these criminals. Overall our current state of (an average user) security can be described as Swiss cheese where anyone with malicious intent can poke a hole and use it without any repercussions.
- Kalium 10y agoThere are people who do this. ShadowServer comes to mind. A number of large companies (Google, Microsoft, ISPs, etc.) run anti-spam operations. It's harder than you might expect to do effectively.
- Sunset 10y agoBut is there an international interpol-style/black helicopters operation against such types. If there's one class of people I'd be glad to see have their human rights trampled, it would be spammers.
- mulmen 10y agoOr you know, we could uphold the rule of law and punish rule breakers within the framework we already have.
- gcardone_ 10y agohttps://en.wikipedia.org/wiki/Blue_Frog https://en.wikipedia.org/wiki/Blue_Frog used to do it too.
- Swannie 10y agoThere must be more, but Cisco TALOS pursues the botnets used to distribute spam. E.g. http://blog.talosintelligence.com/2016/09/the-rising-tides-of-spam.html http://blog.talosintelligence.com/2016/09/the-rising-tides-o...
- tyingq 10y agoThis talks about misconfigured rsync being the vector. However, the researcher that found it says: "The search engine at Shodan.io had indexed their IPs as running publicly accessible MongoDB instances"[1] The screenshot looks like some kind of mongo explorer type UI: http://imgur.com/DzNthuy http://imgur.com/DzNthuy Probably MongoVue: https://mongopi.files.wordpress.com/2012/11/mongovue.png https://mongopi.files.wordpress.com/2012/11/mongovue.png So it appears to be the "mongo installed with no password, and open to the internet" thing again. [1]https://www.reddit.com/r/apple/comments/3wq9fc/massive_data_breach/ https://www.reddit.com/r/apple/comments/3wq9fc/massive_data_...
- elorant 10y agoFor years I've contemplated with the idea of building a botnet that aggressively attacks companies that advertise through spam by consuming their bandwidth or DDoS the hell out of them. Every time I read an article like this I feel like I have to implement that thing sooner than later.
- jacquesm 10y agoYes, because it's a great idea to combat one illegal thing with one that is much more illegal and victimizes yet another large number of people. Better let that one sit in the contemplation folder, as soon as you move to action you'll simply be just another criminal.
- dvdhnt 10y agoThere's no such thing as "more illegal"; interpretation of the law may be subjective, however, once a determination of legality has been made, it is or isn't legal. Actually, it'd make him/her a vigilante, that while still criminal, aims to serve the public good, whether rightfully so or not. I won't suggest whether that is ethically acceptable, but it'd me more of a conversation than legality.
- sverige 10y agoWell, there are degrees of criminality, which is why penalties for certain similar acts vary depending on the exact circumstances, methods, and intentions; e.g., manslaughter vs. 2nd degree murder vs. 1st degree murder. I think this was the point. DDoS attacks potentially affect innocent people who just want to (say for instance) buy some cheap Viagra and who have nothing to do with the spammer who caused the initial irritation by sending yet another useless email.
- elorant 10y agoHow is this illegal? Unethical, for sure, but illegal I don't see why. You don't need to spread malware to build a botnet, you could easily rent private proxies.
- _RPM 10y agoHey, it can't be worse than what the airbnb founder did
- jensvdh 10y agoStory?
- tyingq 10y agoI suspect they are referencing this: http://www.businessinsider.com/airbnb-harvested-craigslist-to-grow-its-listings-says-competitor-2011-5 http://www.businessinsider.com/airbnb-harvested-craigslist-t... Harvesting emails from Craigslist and spamming people that listed properties.
- deleted 10y ago[deleted]
- johnnycarcin 10y agoReminds me a bit of this story from a few years back: https://www.wired.com/2010/04/cloud-warrant/ https://www.wired.com/2010/04/cloud-warrant/
- vonklaus 10y agoI didn't realize MacKeeper investigates other spammers, maybe helpful in develoiping their own best practices.
- r1b 10y agoCan someone please explain the difference between email marketing and spam?
- klodolph 10y agoSpam is unsolicited email marketing. Opt-out and other dark patterns make the line blurry. Yes, there are those of us who sign up for marketing emails on purpose.
- austenallred 10y agoI assume you're being facetious, but there is a literal definition of SPAM in the United States (or, at least, a definition whereby it's OK to send 'commercial email', the inverse of which could be considered SPAM). (From Wikipedia for the CAN-SPAM act - https://en.m.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applicability https://en.m.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applica...) A commercial email is legal if it complies with the following: Unsubscribe compliance * A visible and operable unsubscribe mechanism is present in all emails. * Consumer opt-out requests are honored within 10 business days. * Opt-out lists also known as Suppression lists are only used for compliance purposes. Content compliance * Accurate "From" lines (including "friendly froms") * Relevant subject lines (relative to offer in body content and not deceptive) * A legitimate physical address of the publisher and/or advertiser is present. PO Box addresses are acceptable in compliance with 16 C.F.R. 316.2(p) and if the email is sent by a third party, the legitimate physical address of the entity, whose products or services are promoted through the email should be visible. * A label is present if the content is adult. Sending behavior compliance * A message cannot be sent through an open relay. * A message cannot be sent without an unsubscribe option. * A message cannot be sent to a harvested email address. * A message cannot contain a false header. * A message should contain at least one sentence. * A message cannot be null. * Unsubscribe option should be below the message.
- r1b 10y agoWas being genuine - thank you for the detailed response.
- yuhong 10y ago