GUIDE TO (mostly) HARMLESS HACKING 

Vol. 1 Number 4 

Its vigilante phun day! How get Usenet spammers kicked off their ISPs. 
_______________________________________________________ 

How do you like it when your sober news groups get hit with 900 number sex ads and Make Money Fast pyramid schemes? If no one ever made those guys pay for their effrontery, soon Usenet would be inundated with crud. 

Its really tempting, isnt it, to use our hacking knowledge to blow these guys to kingdom come. But many times thats like using an atomic bomb to kill an ant. Why risk going to jail when there are legal ways to keep these vermin of the Internet on the run? 

This issue of Happy hacker will show you some ways to fight Usenet spam. 

Spammers rely on forged email and Usenet posts. As we learned in the second Guide to (mostly) Harmless Hacking, it is easy to fake email. Well, its also easy to fake Usenet posts. 

***************** 
Newbie Note #1: Usenet is a part of the Internet consisting of the system of on-line discussion groups called "news groups." Examples of news groups are rec.humor, comp.misc, news.announce.newusers, sci.space.policy, and alt.sex. There are well over 10,000 news groups. Usenet started out in 1980 as a Unix network linking people who wanted -- you guessed it -- to talk about Unix. Then some of the people wanted to talk about stuff like physics, space flight, barroom humor, and sex. The rest is history. 
***************** 

Heres a quick summary of how to forge Usenet posts. Once again, we use the technique of telnetting to a specific port. The Usenet port usually is open only to those with accounts on that system. So you will need to telnet from your ISP shell account back into your own ISP as follows: 

 telnet news.myISP.com nntp 

where you substitute the part of your email address that follows the @ for myISP.com. You also have the choice of using 119 instead of nntp. 

With my ISP I get this result: 

 Trying 198.59.115.25 ... 
 Connected to sloth.swcp.com. 
 Escape character is '^]'. 
 200 sloth.swcp.com InterNetNews NNRP server INN 1.4unoff4 05-   Mar-96 ready (posting) 

Now when we are suddenly in a program that we dont know too well, we ask for: 

 help 

And we get: 

 100 Legal commands 
    authinfo user Name|pass Password|generic <prog> <args> 
    article [MessageID|Number] 
    body [MessageID|Number] 
    date 
    group newsgroup 
   head [MessageID|Number] 
   help 
   ihave 
   last 
  list [active|newsgroups|distributions|schema] 
  listgroup newsgroup 
  mode reader 
  newgroups yymmdd hhmmss ["GMT"] [<distributions>] 
   newnews newsgroups yymmdd hhmmss ["GMT"]       [<distributions>] 
    next 
    post 
    slave 
    stat [MessageID|Number] 
    xgtitle [group_pattern] 
    xhdr header [range|MessageID] 
    xover [range] 
    xpat header range|MessageID pat [morepat...] 
    xpath MessageID 
 Report problems to <usenet@swcp.com> 

Use your imagination with these commands. Also, if you want to forge posts from an ISP other than your own, keep in mind that some Internet host computers have an nntp port that requires either no password or an easily guessed password such as post. But-- it can be quite an effort to find an undefended nntp port. So, because you usually have to do this on your own ISP, this is much harder than email forging. 

Just remember when forging Usenet posts that both faked email and Usenet posts can be easily detected -- if you know what to look for. And it is possible to tell where they were forged. Once you identify where spam really comes from, you can use the message ID to show the sysadmin who to kick out. 

Normally you wont be able to learn the identity of the culprit yourself. But you can get their ISPs to cancel their accounts! 

Sure, these Spam King types often resurface with yet another gullible ISP. But they are always on the run. And, hey, when was the last time you got a Crazy Kevin Amazing Free Offer? If it werent for us Net vigilantes, your email boxes and news groups would be constantly spambombed to kingdom come. 

And -- the spam attack I am about to teach you is perfectly legal! Do it and you are a certifiable Good Guy. Do it at a party and teach your friends to do it, too. We cant get too many spam vigilantes out there! 

The first thing we have to do is review how to read headers of Usenet posts and email. 

The header is something that shows the route that email or Usenet post took to get into your computer. It gives the names of Internet host computers that have been used in the creation and transmission of a message. When something has been forged, however, the computer names may be fake. Alternatively, the skilled forger may use the names of real hosts. But the skilled hacker can tell whether a host listed in the header was really used. 

First well try an example of forged Usenet spam. A really good place to spot spam is in alt.personals. It is not nearly as well policed by anti-spam vigilantes as, say, rec.aviation.military. (People spam fighter pilots at their own risk!) 

So here is a ripe example of scam spam, as shown with the Unix-based Usenet reader, tin. 
  
Thu, 22 Aug 1996 23:01:56        alt.personals       Thread  134 of  450 
Lines 110   >>>>FREE INSTANT COMPATIBILITY CHECK FOR SEL   No responses 
ppgc@ozemail.com.au      glennys e clarke at OzEmail Pty Ltd - Australia 
  
CLICK HERE FOR YOUR FREE INSTANT COMPATIBILITY CHECK! 
http://www.perfect-partners.com.au 
  
WHY SELECTIVE SINGLES CHOOSE US 
  
At Perfect Partners (Newcastle) International we are private and 
confidential.  We introduce ladies and gentlemen for friendship 
and marriage.  With over 15 years experience, Perfect Partners is one 
of the Internet's largest, most successful relationship consultants. 
  

Of course the first thing that jumps out is their return email address. Us net vigilantes used to always send a copy back to the spammers email address. 

On a well-read group like alt.personals, if only one in a hundred readers throws the spam back into the posters face, thats an avalanche of mail bombing. This avalanche immediately alerts the sysadmins of the ISP to the presence of a spammer, and good-bye spam account. 

So in order to delay the inevitable vigilante response, today most spammers use fake email addresses. 

But just to be sure the email address is phony, I exit tin and at the Unix prompt give the command: 

 whois ozemail.com.au 

We get the answer: 

 No match for "OZEMAIL.COM.AU" 

That doesnt prove anything, however, because the au at the end of the email address means it is an Australian address. Unfortunately whois does not work in much of the Internet outside the US. 

The next step is to email something annoying to this address. A copy of the offending spam is usually annoying enough. But of course it bounces back with a no such address message. 

Next I go to the advertised Web page. Lo and behold, it has an email address for this outfit, perfect.partners@hunterlink.net.au. Why am I not surprised that it is different from the address in the alt.personals spam? 

We could stop right here and spend an hour or two emailing stuff with 5 MB attachments to perfect.partners@hunterlink.net.au. Hmmm, maybe gifs of mating hippopotami? 

*************************** 
You can go to jail note! Mailbombing is a way to get into big trouble. According to computer security expert Ira Winkler, It is illegal to mail bomb a spam.  If it can be shown that you maliciously caused a financial loss, which would include causing hours of work to recover from a spamming, you are criminally liable.  If a system is not configured properly, and has the mail directory on the system drive, you can take out the whole system.  That makes it even more criminal. 
*************************** 

Sigh. Since intentional mailbombing is illegal, I cant send that gif of mating hippopotami. So what I did was email one copy of that spam back to perfect.partners. Now this might seem like a wimpy retaliation. And we will shortly learn how to do much more. But even just sending one email message to these guys may become part of a tidal wave of protest that knocks them off the Internet. If only one in a thousand people who see their spam go to their Web site and email a protest, they still may get thousands of protests from every post. This high volume of email may be enough to alert their ISPs sysadmin to spamming, and good-bye spam account. 

Look at what ISP owner/operator Dale Amon has to say about the power of email protest: 

One doesn't have to call for a mail bomb. It just happens. Whenever I see spam, I automatically send one copy of their message back to them. I figure that thousands of others are doing the same. If they (the spammers) hide their return address, I find it and post it if I have time. I have no compunctions and no guilt over it. 

Now Dale is also the owner and technical director of the largest and oldest ISP in Northern Ireland, so he knows some good ways to ferret out what ISP is harboring a spammer. And we are about learn one of them. 

Our objective is to find out who connects this outfit to the Internet, and take out that connection! Believe me, when the people who run an ISP find out one of their customers is a spammer, they usually waste no time kicking him or her out. 

Our first step will be to dissect the header of this post to see how it was forged and where. 

Since my newsreader (tin) doesnt have a way to show headers, I use the m command to email a copy of this post to my shell account. 

It arrives a few minutes later. I open it in the email program Pine and get a richly detailed header: 

Path: 
sloth.swcp.com!news.ironhorse.com!news.uoregon.edu!vixen.cso.uiuc.edu!news.stealth.net!nntp04.primenet.com!nntp.primenet.com!gatech!nntp0.mindspring.com!news.mindspring.com!uunet!in2.uu.net!OzEmail!OzEmail-In!news 
From: glennys e clarke <ppgc@ozemail.com.au> 
NNTP-Posting-Host: 203.15.166.46 
Mime-Version: 1.0 
Content-Type: text/plain 
Content-Transfer-Encoding: 7bit 
X-Mailer: Mozilla 1.22 (Windows; I; 16bit) 
  
The first item in this header is definitely genuine: sloth.swcp.com. Its the computer my ISP uses to host the news groups. It was the last link in the chain of computers that have passed this spam around the world. 

******************* 
Newbie Note #2: Internet host computers all have names which double as their Net addresses. Sloth is the name of one of the computers owned by the company which has the domain name swcp.com. So sloth is kind of like the news server computers first name, and swcp.com the second name. Sloth is also kind of like the street address, and swcp.com kind of like the city, state and zip code. Swcp.com is the domain name owned by Southwest Cyberport. All host computers also have numerical versions of their names, e.g. 203.15.166.46. 
******************* 

Lets next do the obvious. The header says this post was composed on the host 203.15.166.46. So we telnet to its nntp server (port 119): 

 telnet 203.15.166.46 119 

We get back: 

Trying 203.15.166.46 ... 
telnet: connect: Connection refused 

This looks a lot like a phony item in the header. If this really was a computer that handles news groups, it should have a nntp port that accepts visitors. It might only accept a visitor for the split second it takes to see that I am not authorized to use it. But in this case it refuses any connection whatever. 

There is another explanation: there is a firewall on this computer that filters out packets from anyone but authorized users. But this is not common in an ISP that would be serving a spammer dating service. This kind of firewall is more commonly used to connect an internal company computer network with the Internet. 

Next I try to email postmaster@203.15.166.46 with a copy of the spam. But I get back: 

Date: Wed, 28 Aug 1996 21:58:13 -0600 
From: Mail Delivery Subsystem <MAILER-DAEMON@techbroker.com> 
To: cmeinel@techbroker.com 
Subject: Returned mail: Host unknown (Name server: 203.15.166.46: host not 
found) 
  
The original message was received at Wed, 28 Aug 1996 21:58:06 -0600 
from cmeinel@localhost 
  
   ----- The following addresses had delivery problems ----- 
postmaster@203.15.166.46  (unrecoverable error) 
  
   ----- Transcript of session follows ----- 
501 postmaster@203.15.166.46...  550 Host unknown (Name server: 203.15.166.46: 
host not found) 
  
   ----- Original message follows ----- 
Return-Path: cmeinel 
Received: (from cmeinel@localhost) by kitsune.swcp.com (8.6.9/8.6.9) id 

OK, it looks like the nntp server info was forged, too. 

Next we check the second from the top item on the header. Because it starts with the word news, I figure it must be a computer that hosts news groups, too. So I check out its nntp port: 

telnet news.ironhorse.com nntp 

And the result is: 

Trying 204.145.167.4 ... 
Connected to boxcar.ironhorse.com. 
Escape character is '^]'. 
502 You have no permission to talk.  Goodbye. 
Connection closed by foreign host 

OK, we now know that this part of the header references a real news server. Oh, yes, we have also just learned the name/address of the computer ironhorse.com uses to handle the news groups: boxcar. 

I try the next item in the path: 

telnet news.uoregon.edu nntp 

And get: 

Trying 128.223.220.25 ... 
Connected to pith.uoregon.edu. 
Escape character is '^]'. 
502 You have no permission to talk.  Goodbye. 
Connection closed by foreign host. 

OK, this one is a valid news server, too. Now lets jump to the last item in the header: in2.uu.net: 

 telnet in2.uu.net nntp 

We get the answer: 

 in2.uu.net: unknown host 

There is something fishy here. This host computer in the header isnt currently connected to the Internet. It probably is forged. Lets check the domain name next: 

whois uu.net 

The result is: 

UUNET Technologies, Inc. (UU-DOM) 
   3060 Williams Drive Ste 601 
   Fairfax, VA 22031 
   USA 
  
   Domain Name: UU.NET 
  
   Administrative Contact, Technical Contact, Zone Contact: 
      UUNET, AlterNet [Technical Support]  (OA12)  help@UUNET.UU.NET 
      +1 (800) 900-0241 
   Billing Contact: 
      Payable, Accounts  (PA10-ORG)  ap@UU.NET 
      (703) 206-5600 
Fax: (703) 641-7702 
  
   Record last updated on 23-Jul-96. 
   Record created on 20-May-87. 
  
   Domain servers in listed order: 
  
   NS.UU.NET                    137.39.1.3 
   UUCP-GW-1.PA.DEC.COM         16.1.0.18 204.123.2.18 
   UUCP-GW-2.PA.DEC.COM         16.1.0.19 
   NS.EU.NET                    192.16.202.11 
  
  
The InterNIC Registration Services Host contains ONLY Internet Information 
(Networks, ASN's, Domains, and POC's). 
Please use the whois server at nic.ddn.mil for MILNET Information. 

So uu.net is a real domain. But since the host computer in2.uu.net listed in the header isnt currently connected to the Internet, this part of the header may be forged. (However, there may be other explanations for this, too.) 

Working back up the header, then, we next try: 

telnet news.mindspring.com nntp 

I get: 

Trying 204.180.128.185 ... 
Connected to news.mindspring.com. 
Escape character is '^]'. 
502 You are not in my access file.  Goodbye. 
Connection closed by foreign host. 

Interesting. I dont get a specific host name for the nntp port. What does this mean? Well, theres a way to try. Lets telnet to the port that gives the login sequence. Thats port 23, but telnet automatically goes to 23 unless we tell it otherwise: 

telnet news.mindspring.com 

Now this is phun! 

Trying 204.180.128.166 ... 
telnet: connect to address 204.180.128.166: Connection refused 
Trying 204.180.128.167 ... 
telnet: connect to address 204.180.128.167: Connection refused 
Trying 204.180.128.168 ... 
telnet: connect to address 204.180.128.168: Connection refused 
Trying 204.180.128.182 ... 
telnet: connect to address 204.180.128.182: Connection refused 
Trying 204.180.128.185 ... 
telnet: connect: Connection refused 

Notice how many host computers are tried out by telnet on this command! They must all specialize in being news servers, since none of them handles logins. 

This looks like a good candidate for the origin of the spam. There are 5 news server hosts. Lets do a whois command on the domain name next: 

 whois mindspring.com 

We get: 

MindSpring Enterprises, Inc. (MINDSPRING-DOM) 
   1430 West Peachtree Street NE 
   Suite 400 
   Atlanta, GA 30309 
   USA 
  
   Domain Name: MINDSPRING.COM 
  
   Administrative Contact: 
      Nixon, J. Fred  (JFN)  jnixon@MINDSPRING.COM 
      404-815-0770 
   Technical Contact, Zone Contact: 
      Ahola, Esa  (EA55)  hostmaster@MINDSPRING.COM 
      (404)815-0770 
   Billing Contact: 
      Peavler, K. Anne  (KAP4)  peavler@MINDSPRING.COM 
      404-815-0770 (FAX) 404-815-8805 
  
   Record last updated on 27-Mar-96. 
   Record created on 21-Apr-94. 
  
   Domain servers in listed order: 
  
   CARNAC.MINDSPRING.COM        204.180.128.95 
   HENRI.MINDSPRING.COM         204.180.128.3 

********************* 
Newbie Note #3: The whois command can tell you who owns a domain name. The domain name is the last two parts separated by a period that comes after the @ in an email address, or the last two parts separated by a period in a computers name. 
********************* 

Id say that Mindspring is the ISP from which this post was most likely forged. The reason is that this part of the header looks genuine, and offers lots of computers on which to forge a post. A letter to the technical contact at hostmaster@mindspring.com with a copy of this post may get a result. 

But personally, I would simply go to their Web site and email them a protest from there. Hmmm, maybe a 5 MB gif of mating hippos? Even if it is illegal? 

But systems administrator Terry McIntyre cautions me: 

One needn't toss megabyte files back ( unless, of course, one is helpfully mailing a copy of the offending piece back, just so that the poster knows what the trouble was. ) 

The Law of Large Numbers of Offendees works to your advantage. Spammer sends one post to reach out and touch thousands of potential customers. 

Thousands of Spammees send back oh-so-polite notes about the improper behavior of the Spammer. Most Spammers get the point fairly quickly. 

One note - one _wrong_ thing to do is to post to the newsgroup or list about the inappropriateness of any previous post. Always, always, use private email to make such complaints. Otherwise, the newbie inadvertently amplifies the noise level for the readers of the newsgroup or email list. 

Well, the bottom line is that if I really want to pull the plug on this spammer, I would send a polite note including the Usenet post with headers intact to the technical contact and/or postmaster at each of the valid links I found in this spam header. Chances are that they will thank you for your sleuthing. 

Heres an example of an email I got from Netcom about a spammer I helped them to track down. 

From: Netcom Abuse Department <abuse@netcom.com> 
Reply-To: <abuse@netcom.com> 
Subject: Thank you for your report 

Thank you for your report.  We have informed this user of our policies, and have taken appropriate action, up to, and including cancellation of the account, depending on the particular incident. If they continue to break Netcom policies we will take further action. 

The following issues have been dealt with: 
 santigo@ix.netcom.com 
 date-net@ix.netcom.com 
 jhatem@ix.netcom.com 
 kkooim@ix.netcom.com 
 duffster@ix.netcom.com 
 spilamus@ix.netcom.com 
 slatham@ix.netcom.com 
 jwalker5@ix.netcom.com 
 binary@ix.netcom.com 
 clau@ix.netcom.com 
 frugal@ix.netcom.com 
 magnets@ix.netcom.com 
 sliston@ix.netcom.com 
 aessedai@ix.netcom.com 
 ajb1968@ix.netcom.com 
 readme@readme.net 
 captainx@ix.netcom.com 
 carrielf@ix.netcom.com 
 charlene@ix.netcom.com 
 fonedude@ix.netcom.com 
 nickshnn@netcom.com 
 prospnet@ix.netcom.com 
 alluvial@ix.netcom.com 
 hiwaygo@ix.netcom.com 
 falcon47@ix.netcom.com 
 iggyboo@ix.netcom.com 
 joyful3@ix.netcom.com 
 kncd@ix.netcom.com 
 mailing1@ix.netcom.com 
 niterain@ix.netcom.com 
 mattyjo@ix.netcom.com 
 noon@ix.netcom.com 
 rmerch@ix.netcom.com 
 rthomas3@ix.netcom.com 
 rvaldes1@ix.netcom.com 
 sia1@ix.netcom.com 
 thy@ix.netcom.com 
 vhs1@ix.netcom.com 

Sorry for the length of the list. 

Spencer 
Abuse Investigator 
___________________________________________________________________ 
NETCOM Online Communication Services                   Abuse Issues 
24-hour Support Line: 408-983-5970                     abuse@netcom.com 
************** 

OK, I'm signing off for this column. I look forward to your contributions to this list. Happy hacking -- and dont get busted! 

__________________________________________________________________ 

Want to share some kewl stuph? Tell me Im terrific? Flame me? For the first two, Im at cmeinel@techbroker.com. Please direct flames to dev/null@techbroker.com. Happy hacking! 
Copyright 1996 Carolyn P. Meinel. You may forward the GUIDE TO (mostly) HARMLESS HACKING as long as you leave this notice at the end. To subscribe, email cmeinel@techbroker.com with message "subscribe hacker <joe.blow@boring.ISP.net>" substituting your real email address for Joe Blow's. 
