A rantbox

Tue 12 September 2006

Hacking spam networks

Posted by Michiel Scholten in posts   

During a quite boring class of ICT in a Social Context [mainly about the Information Revolution and Codes of Ethics], I stumbled upon the idea of hacking a spammer. More specifically, hacking his overlay network of spambots. You may know that some spammers [mostly the "normal" corporations] have their own email servers sending the mass mails [which can be targetted by anti-spam regulation]. However, my safe bet is that by far the most spam is generated by spambots from all over the world, controlled by hackers/crackers [which in itself is food for a nice debate; they aren't whitehats for sure] and I think mostly existing out of not up-to-date windows installations that are hacked really easily using automated tools and turned into IRC-/spambots.

Here you can see why regulation [like "let the sender pay CPU cycles or 0.1 cent per email"] isn't going to work: the senders are bots, running on some luser's PC without his or her knowing and with their own little SMTP server, all written by some intelligent coder. I say intelligent, because those tools are being developed by capable hackers, mostly for good money. Money from kinda shady people I guess. Then you have people using these tools to create bot networks automatically, and rent the capacity to whoever wants to advertise Viagra, Cialis, porn, big boobies, mortgages, fake Swish watches and Rolexes and goddamn palm plants.

[Now it's interesting to see how many traffic this page will generate because of those words]

OK, so what if someone starts hacking these systems, these networks of spambots and the controlling servers/machines, is he morally being bad? If it is for gathering control of the network and using it for his own services, he of course is. If it's for plugging the holes in the network [by blocking the bots from others], it's for the good of the whole online community. But what if he starts fixing the machines where the bots are installed on? What if he lets the bot download patches to plug the OS's holes? Or, the other way around, what if he punishes the people who are too lazy or too ignoring to secure their systems by whiping that so-called OS from their system? [Maybe leaving their documents in place, just to be nice]. Leaving a message saying that their system is compromised and what to do about it may be some middle way.

Also, the existence of these networks is a good reason to educate people in not stupidly pirating microsoft software; microsoft doesn't push updates their way anymore, so they are vulnerable. Also, people legally using windows, should update often, as their OS is leaky and being exploited like hell. Educating them in updating their OS, virus scanners, adware scanners etc is key there. Also, make sure to tell them their are lots of alternatives to the buggy programs they are using [Firefox, Thunderbird, OpenOffice.org etc and other OS'es, like a Linux distro, BSD or of course Apple's Mac OS X. Most of those other OS'es don't even need all those scanners].

Just some food for thought. Feel free to dump yours here too :)