Inside the SPAM cartel: trade secrets from the dark side

433 Pages·2004·7.17 MB·English

by  Spammer-X (author)

313_Spam_Fm.qxd 10/22/04 2:47 PM Page i
Register for Free Membership to
s o l u t i o n s @ s y n g r e s s . c o m
Over the last few years, Syngress has published many best-selling and
critically acclaimed books, including Tom Shinder’s Configuring ISA
Server 2000, Brian Caswell and Jay Beale’s Snort 2.0 Intrusion
Detection, and Angela Orebaugh and Gilbert Ramirez’s Ethereal
Packet Sniffing. One of the reasons for the success of these books has
been our unique [email protected] program. Through this
site, we’ve been able to provide readers a real time extension to the
printed book.
As a registered owner of this book, you will qualify for free access to
our members-only [email protected] program. Once you have
registered, you will enjoy several benefits, including:
(cid:2) Four downloadable e-booklets on topics related to the book.
Each booklet is approximately 20-30 pages in Adobe PDF
format. They have been selected by our editors from other
best-selling Syngress books as providing topic coverage that
is directly related to the coverage in this book.
(cid:2) A comprehensive FAQ page that consolidates all of the key
points of this book into an easy to search web page, pro-
viding you with the concise, easy to access data you need to
perform your job.
(cid:2) A “From the Author” Forum that allows the authors of this
book to post timely updates links to related sites, or addi-
tional topic coverage that may have been requested by
readers.
Just visit us at www.syngress.com/solutions and follow the simple
registration process. You will need to have this book with you when
you register.
Thank you for giving us the opportunity to serve your needs. And be
sure to let us know if there is anything else we can do to make your
job easier.
313_Spam_Fm.qxd 10/22/04 2:47 PM Page ii
313_Spam_Fm.qxd 10/22/04 2:47 PM Page iii
Inside
The
SPAM
Cartel
T R A D E S E C R E T S F R O M T H E D A R K S I D E
Spammer X
Foreword by
Stu Sjouwerman
Editor in Chief, W2Knews
Jeffrey Posluns
Technical Editor
313_Spam_Fm.qxd 10/22/04 2:47 PM Page iv
Syngress Publishing,Inc.,the author(s),and any person or firm involved in the writing,editing,or produc-
tion (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be
obtained from the Work.
There is no guarantee of any kind,expressed or implied,regarding the Work or its contents.The Work is
sold AS IS and WITHOUT WARRANTY.You may have other legal rights,which vary from state to
state.
In no event will Makers be liable to you for damages,including any loss of profits,lost savings,or other
incidental or consequential damages arising out from the Work or its contents.Because some states do not
allow the exclusion or limitation of liability for consequential or incidental damages,the above limitation
may not apply to you.
You should always use reasonable care,including backup and other appropriate precautions,when working
with computers,networks,data,and files.
Syngress Media®,Syngress®,“Career Advancement Through Skill Enhancement®,”“Ask the Author
UPDATE®,”and “Hack Proofing®,”are registered trademarks of Syngress Publishing,Inc.“Syngress:The
Definition of a Serious Security Library”™,“Mission Critical™,”and “The Only Way to Stop a Hacker is
to Think Like One™”are trademarks of Syngress Publishing,Inc.Brands and product names mentioned
in this book are trademarks or service marks of their respective companies.
KEY SERIAL NUMBER
001 HJIRTCV764
002 PO9873D5FG
003 829KM8NJH2
004 BNDR452SDC
005 CVPLQ6WQ23
006 VBP965T5T5
007 HJJJ863WD3E
008 2987GVTWMK
009 629MP5SDJT
010 IMWQ295T6T
PUBLISHED BY
Syngress Publishing,Inc.
800 Hingham Street
Rockland,MA 02370
Inside the SPAM Cartel
Copyright © 2004 by Syngress Publishing,Inc.All rights reserved.Printed in the United States of
America.Except as permitted under the Copyright Act of 1976,no part of this publication may be repro-
duced or distributed in any form or by any means,or stored in a database or retrieval system,without the
prior written permission of the publisher,with the exception that the program listings may be entered,
stored,and executed in a computer system,but they may not be reproduced for publication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN:1-932266-86-0
Publisher:Andrew Williams Page Layout and Art:Patricia Lupien
Acquisitions Editor:Christine Kloiber Copy Editor:Judy Eby
Technical Editor:Jeffrey Posluns Indexer:Julie Kawabata
Cover Designer:Michael Kavish
Distributed by O’Reilly Media,Inc.in the United States and Canada.
For information on rights and translations,contact Matt Pedersen,Director of Sales and Rights,at
Syngress Publishing;email [email protected] fax to 781-681-3585.
313_Spam_Fm.qxd 10/22/04 2:47 PM Page v
Acknowledgments
Syngress would like to acknowledge the following people for their kindness
and support in making this book possible.
Syngress books are now distributed in the United States and Canada by
O’Reilly Media,Inc.The enthusiasm and work ethic at O’Reilly is incredible
and we would like to thank everyone there for their time and efforts to bring
Syngress books to market:Tim O’Reilly,Laura Baldwin,Mark Brokering,Mike
Leonard,Donna Selenko,Bonnie Sheehan,Cindy Davis,Grant Kikkert,Opol
Matsutaro,Steve Hazelwood,Mark Wilson,Rick Brown,Leslie Becker,Jill
Lothrop,Tim Hinton,Kyle Hart,Sara Winge,C.J.Rayhill,Peter Pardo,Leslie
Crandell,Valerie Dow,Regina Aggio,Pascal Honscher,Preston Paull,Susan
Thompson,Bruce Stewart,Laura Schmier,Sue Willing,Mark Jacobsen,Betsy
Waliszewski,Dawn Mann,Kathryn Barrett,John Chodacki,and Rob
Bullington.
The incredibly hard working team at Elsevier Science,including Jonathan
Bunkell,Ian Seager,Duncan Enright,David Burton,Rosanna Ramacciotti,
Robert Fairbrother,Miguel Sanchez,Klaus Beran,Emma Wyatt,Rosie Moss,
Chris Hossack,Mark Hunt,and Krista Leppiko,for making certain that our
vision remains worldwide in scope.
David Buckland,Marie Chieng,Lucy Chong,Leslie Lim,Audrey Gan,Pang Ai
Hua,and Joseph Chan of STP Distributors for the enthusiasm with which they
receive our books.
Kwon Sung June at Acorn Publishing for his support.
David Scott,Tricia Wilden,Marilla Burgess,Annette Scott,Andrew Swaffer,
Stephen O’Donoghue,Bec Lowe,and Mark Langley of Woodslane for dis-
tributing our books throughout Australia,New Zealand,Papua New Guinea,
Fiji Tonga,Solomon Islands,and the Cook Islands.
Winston Lim of Global Publishing for his help and support with distribution of
Syngress books in the Philippines.
v
313_Spam_Fm.qxd 10/22/04 2:47 PM Page vi
313_Spam_Fm.qxd 10/22/04 2:47 PM Page vii
Technical Editor
Jeffrey Posluns,CISM,CISA,ISSAP,ISSMP,CISSP,SSCP,has over
a decade of experience specializing in the management of tech-
nology companies,with technical expertise in the analysis of hacker
tools and techniques,intrusion detection,forensics,and incident
response.Having founded,co-founded,and invested in several
e-commerce and security initiatives,he has served in the capacity of
president,CTO,and CIO.
Jeffrey speaks at seminars and conferences worldwide for corpo-
rate,law enforcement,financial,and legal audiences,where his ses-
sions are most often described as educational and thought provoking.
As one of the industry’s leading security professionals,he is a
dynamic,highly sought business and technology speaker,an author of
multiple books and white papers,and a recognized expert in identi-
fying trends,solving business problems,and resolving security issues
for many of the nation’s leading companies.
He has authored,edited,and contributed to a number of books
from Syngress Publishing including Snort 2.0 Intrusion Detection
(ISBN:1-931836-74-4),the SSCP Certification Study Guide & DVD
Training System (ISBN:1-931836-80-9),and Hack Proofing Your
Wireless Networks (ISBN:1-928994-59-8),as well as having written
and contributed to other technological books,white papers,finan-
cial and security-related software and toolkits.Jeffrey is also a trainer
for the Certified Information Systems Security Professional (CISSP)
curriculum.Up to date information on Jeffrey can be found at
www.posluns.ca.
vii
313_Spam_Fm.qxd 10/22/04 2:47 PM Page viii
Foreword Contributor
Stu Sjouwerman is the President of Sunbelt Software and the
publisher of W2Knews,the world’s first and largest e-newsletter
specifically focused on NT/W2K system managers.W2Knews has
300,000 weekly readers who have the job of keeping NT/W2K up
and running in a production environments.Sunbelt has made it into
the INC.500 Magazine list of fastest-growing,privately-held com-
panies.By 2003,Sunbelt had total revenues of $30M and Stu had
co-authored three books on Windows system administration,
including the bestselling Windows NT Power Toolkit. Sunbelt’s most-
popular product is iHateSpam,which is the best selling anti-spam
solution for Microsoft Exchange sites with 5,000 installations,and
250,000 end users using iHateSpam on their personal computers.
Stu lives in Bellair,FL.
viii
313_Spam_TOC.qxd 10/22/04 2:51 PM Page ix
Contents
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xv
Chapter 1 Inside the Head of a Spammer . . . . . . . . . . .1
Who Am I? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2
Childhood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3
The Early Days . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
My Life as a Spammer . . . . . . . . . . . . . . . . . . . . . .9
Remorse? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
Chapter 2 How Spam Works . . . . . . . . . . . . . . . . . . . .13
The Business of Spam . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Spam in the Works:A Real-World Step-by-Step Example . .17
Setting the Stage . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
The E-mail Body . . . . . . . . . . . . . . . . . . . . . . . . . . .21
Chapter 3 Sending Spam . . . . . . . . . . . . . . . . . . . . . .29
The Required Mindset to Send Spam . . . . . . . . . . . . . . . .30
Methods of Sending Spam . . . . . . . . . . . . . . . . . . . . . . . .32
Proxy Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Simple Mail Transfer Protocol Relays . . . . . . . . . . . . .36
Spam-Sending Companies . . . . . . . . . . . . . . . . . . . . .39
Botnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41
Internet Messenger Spam . . . . . . . . . . . . . . . . . . . . . .47
Messenger Spam . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
Common Gateway Interface Hijacking . . . . . . . . . . . .53
Wireless Spam . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62
BGP Hijacking and Stealing IP blocks . . . . . . . . . . . . .64
Chapter 4 Your E-mail: Digital Gold . . . . . . . . . . . . . .69
What Does Your E-mail Address Mean to a Spammer? . . . .70
Hackers and Spammers:Their United Partnership . . . . . . .72
ix