Internetworkers: http://www.ibiblio.org/internetworkers/

["Steve Steele" <Steve AT mindbenderstudios.com>]

Can you explain that triangulation thingy you did to determine the
Klez infected sender?

Also below is the contact and server information on the offending adult
site. Unfortunately they are off shore, where your ability to strike
back is even further hampered.

I'm thinking that one of the reasons these entities can keep doing what
they're doing is because most of us lack the time, know how and expertise
to track and nail the perpetrator. When I read articles on how to stop
Spam they are frequently great descriptions of how the Spam works but
the methods for stopping Spam are usually a simple blocking method,
that doens't provide as robust a solution as I would like.

I want to know how to identify the offender, shut-em down, and then
promote how to do so to others.

So here is what I did and maybe your efforts and/or information can build
off of this.

A month ago I was struck by an offending email that linked to an adult
/animal site. My niece and nephews are coming to stay for the summer so
I was determined to figure out how to track one of these offending SOB's
down.

I checked the URL with Network Solution's Whois. No luck
http://www.netsol.com

So I went to domain.com. They seem to have a more comprehensive database
of URLs. Ureka! Pay dirt! http://www.idomains.net

Although the company was offshore, a phone number was listed. I called
a number of times over a couple of days. The phone would pick up but no
one would respond. I thought this phone number is probably the offshore
equivalent to a US 900 number, and they're me chargin $20 a minute to be
on hold.

So I went back to the information I was able to get from Domain.com
and did a Whois search on the hosting server DNS. I was hoping
that the hosting company would shut down the offending web site.

I did get a hold of a body. Who told me that yes the server is a part
of their server farm, but the box is actually owned by another company.
He gave me the contact information, which turned out to be another number
but in the same city/country as the first number I had.

And that's where I stopped. Any add on information? I'd love to take
this topic up off-list. Any knowledgeable persons want to explore on
methods that can trip up Spammers?

Sorry for the long-windedness.....

Steve S.

YOUR CULPRIT----------------------------------------------
Registrant:
ENVIROVISION 2010 Inc. (CYBERNAUTE-DOM)
   142 rue Girard
   LATERRIERE, QUEBEC G0V1K0
   CANADA
   Domain Name: CYBERNAUTE.COM
   Administrative Contact, Technical Contact:
      Duguay, Sylvain  (SD274)          sylvain AT DEVICOM.COM
      Devicom
      393 Racine Est
      CHICOUTIMI
      QUEBEC
      G7H1T2
      CA
      418-690-2774 (FAX) 418-690-9108
   Record expires on 01-Nov-2006.
   Record created on 31-Oct-1995.
   Database last updated on 21-Jun-2002 05:56:57 EDT.
   Domain servers in listed order:
   VR3D.CYBERNAUTE.COM          205.236.155.97
   JUPITER.DEVICOM.COM          205.236.153.94
----------------------------------------------------------

-----Original Message-----
From: InterNetWorkers digest
[mailto:internetworkers AT franklin.metalab.unc.edu]
Sent: Friday, June 21, 2002 12:00 AM
To: internetworkers digest recipients
Subject: internetworkers digest: June 20, 2002


INTERNETWORKERS Digest for Thursday, June 20, 2002.

1. Re: Help! I've been abused!
2. Re: Help! I've been abused!
3. Re: Help! I've been abused!
4. Re: Help! I've been abused!
5. Re: Help! I've been abused!
6. [Fwd: RE: [Fwd: Help! I've been abused!]]
7. Re: Help! I've been abused!

----------------------------------------------------------------------

Subject: Re: Help! I've been abused!
From: "Josep L. Guallar-Esteve" <jlguallar AT maduixa.net>
Date: Thu, 20 Jun 2002 14:04:18 +0000
X-Message-Number: 1

El dia Dijous 20 Juny 2002 03:05, no tenies res mes que fer i vas i m'envies
aquest e-mail:
> Talk about makin' a body real mad.... It's happened again! I'm getting a
> slew of failed mail notifications because some spam [nasty] has
> appropriated my e-mail address! I reported it to the Mindspring/Earthlink
> abuse desk, but don't know if they can/will do anything (I sent a copy of
> the full text of one of the 30 failure notifications).... Anyone have any
> further ideas? I do have the failure notifications, some of which include
> an attachment of the filthy spam....


Are you sure is someone taking over your identity for spam pouropses?

The Klez virus has a behavious that, first, made me think that someone hasd
taken over my email address. Then, I learnt some more about Klez. Now I know
that it was the Klez virus.

How the Klez virus work?

First, infects someone

Then, checks for e-mail addresses in the addressbooks, cached-webpages, sent
messages, received messages, newsgroup messages (if you are into usenet)...

Now, the virus decides to use one of those collected email addresses as the
forged "From" field, to make more difficult to detect the infected machine.

The last step is the "reproduction": the virus sends itself to all the
collected e-mail addresse, using the "From" (and, I think, "Retrun-To")
field(s) forged so they point to someoneelses's adress.

So, when an infected email bounces, it bounces to an uninfected,
unsuspecting
email address (the one used in the "From" field).

Of course, using the "Sender-IP" field you can verify that it was not you
who
sent the email.

With some triangulation, SamSpade and a few friends, I was able to get to
one
of my "Windows-friends" infected with the Klez viirus that was using my
e-mail address in the "From:" field.

Hope that this is your case.



Salut,
Josep
--
Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.
http://www.ibiblio.org/sinner/

----------------------------------------------------------------------

Subject: Re: Help! I've been abused!
From: Jason Laughlin <jason AT jasonlaughlin.com>
Date: Thu, 20 Jun 2002 10:41:28 -0400
X-Message-Number: 2

This actually happened to me on a yahoogroup that I'm the admin for.  The
list was set so that only I, as owner, could send messages to the
list.  However, a subscriber's computer was infected with Klez.  The virus
sent out an email with a forged "From:" field to the list.  Unfortunately,
the Yahoogroups software only looked at the From: field to determine
whether it was from me, and allowed the message to go through to my entire
group.  Since no other fields were forged, it was a simple matter to
identify the originating email account, but the email had been sent, and an
hour later I had multiple messages from friends and servers mistakenly
telling me that I had the Klez.

(To prevent problems in the future, I've changed the group settings to
strip all attachments.)

Jason



At 10:04 AM 6/20/2002, you wrote:

>Are you sure is someone taking over your identity for spam pouropses?
>
>The Klez virus has a behavious that, first, made me think that someone hasd
>taken over my email address. Then, I learnt some more about Klez. Now I
know
>that it was the Klez virus.
>
>How the Klez virus work?
>
>First, infects someone
>
>Then, checks for e-mail addresses in the addressbooks, cached-webpages,
sent
>messages, received messages, newsgroup messages (if you are into usenet)...
>
>Now, the virus decides to use one of those collected email addresses as the
>forged "From" field, to make more difficult to detect the infected machine.
>
>The last step is the "reproduction": the virus sends itself to all the
>collected e-mail addresse, using the "From" (and, I think, "Retrun-To")
>field(s) forged so they point to someoneelses's adress.
>
>So, when an infected email bounces, it bounces to an uninfected,
unsuspecting
>email address (the one used in the "From" field).
>
>Of course, using the "Sender-IP" field you can verify that it was not you
who
>sent the email.
>
>With some triangulation, SamSpade and a few friends, I was able to get to
one
>of my "Windows-friends" infected with the Klez viirus that was using my
>e-mail address in the "From:" field.
>
>Hope that this is your case.
>
>
>
>Salut,
>Josep
>--
>Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.
>http://www.ibiblio.org/sinner/
>
>---
>Come and play at the InterNetWorkers Web
>site!  http://www.ibiblio.org/internetworkers/
>You are currently subscribed to internetworkers as: jason AT jasonlaughlin.com
>To unsubscribe send a blank email to
>$subst('Email.Unsub')


----------------------------------------------------------------------

Subject: Re: Help! I've been abused!
From: <beeline AT mindspring.com>
Date: Thu, 20 Jun 2002 10:41:27 -0400
X-Message-Number: 3

None of these email addresses are in my address book or would be in the
(primarily news site) pages that I visit. The message is sex site spam and
links to a real site (although whois doesn't recognize the site location). I
have a current v of Norton Antivirus working for me. None of my friends have
contacted me with expressions of !!! because I sent them a sex site spam. I
do
not think this is a virus. Surely there is something that I can do about
this
since it is a form of identity theft? At the least I should be able to get
the
advertised site shut down.



On Thu, 20 Jun 2002 14:04:18 +0000 "Josep L. Guallar-Esteve"
<jlguallar AT maduixa.net> wrote:



El dia Dijous 20 Juny 2002 03:05, no tenies res mes que fer i vas i m'envies

aquest e-mail:

> Talk about makin' a body real mad.... It's happened again! I'm getting a

> slew of failed mail notifications because some spam [nasty] has

> appropriated my e-mail address! I reported it to the Mindspring/Earthlink

> abuse desk, but don't know if they can/will do anything (I sent a copy of

> the full text of one of the 30 failure notifications).... Anyone have any

> further ideas? I do have the failure notifications, some of which include

> an attachment of the filthy spam....





Are you sure is someone taking over your identity for spam pouropses?



The Klez virus has a behavious that, first, made me think that someone hasd

taken over my email address. Then, I learnt some more about Klez. Now I know

that it was the Klez virus.



How the Klez virus work?



First, infects someone



Then, checks for e-mail addresses in the addressbooks, cached-webpages, sent

messages, received messages, newsgroup messages (if you are into usenet)...



Now, the virus decides to use one of those collected email addresses as the

forged "From" field, to make more difficult to detect the infected machine.



The last step is the "reproduction": the virus sends itself to all the

collected e-mail addresse, using the "From" (and, I think, "Retrun-To")

field(s) forged so they point to someoneelses's adress.



So, when an infected email bounces, it bounces to an uninfected,
unsuspecting

email address (the one used in the "From" field).



Of course, using the "Sender-IP" field you can verify that it was not you
who

sent the email.



With some triangulation, SamSpade and a few friends, I was able to get to
one

of my "Windows-friends" infected with the Klez viirus that was using my

e-mail address in the "From:" field.



Hope that this is your case.







Salut,

Josep

--

Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.

http://www.ibiblio.org/sinner/



---

Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/

You are currently subscribed to internetworkers as: beeline AT mindspring.com

To unsubscribe send a blank email to
$subst('Email.Unsub')



----------------------------------------------------------------------

Subject: Re: Help! I've been abused!
From: "Josep L. Guallar-Esteve" <jlguallar AT maduixa.net>
Date: Thu, 20 Jun 2002 14:52:45 +0000
X-Message-Number: 4

El dia Dijous 20 Juny 2002 14:41, no tenies res mes que fer i vas i m'envies
aquest e-mail:
> None of these email addresses are in my address book or would be in the
> (primarily news site) pages that I visit. The message is sex site spam and
> links to a real site (although whois doesn't recognize the site location).
> I have a current v of Norton Antivirus working for me. None of my friends
> have contacted me with expressions of !!! because I sent them a sex site
> spam. I do not think this is a virus. Surely there is something that I can
> do about this since it is a form of identity theft? At the least I should
> be able to get the advertised site shut down.


Let me try to explain it better.

I am saying that *not* you has Klez. I am saying that *someone else", that
has
your e-mail address in a message, be it an email or a newsgroups post, or
has
in the disk-cached web-pages that happen to contain your e-mail address.

Klez , then, will "forge" the e-mail, changing the "From:" part of the
email.
This can cause people to think that it was you who send the e-mail.

The Klez virus sends itself with changing subjexct lines, and usualy sends
infected (Windows) executables and random files from the victim's hard disk.

Maybe, if you want,  you can forward me one of those emails, so I can try to
see what's going on. Select one of the e-mails and select "forward"" the
email, with all the attachements.



Salut,
Josep
--
Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.
http://www.ibiblio.org/sinner/

----------------------------------------------------------------------

Subject: Re: Help! I've been abused!
From: "Michael D. Thomas" <mdthomas AT mindspring.com>
Date: Thu, 20 Jun 2002 11:12:01 -0400
X-Message-Number: 5

>
> Can I sue someone? Can I have someone arrested for stealing my online
identity? Should I write my Congresscritters? (Actually, I'd rather get the
jerks thrown off of their ISP but whois doesn't recognize their site --
which
is teens.sexln.com (an actual working site, ugh).)
>

Thoughts of a non-lawyer....

If you could find who did it, I'm sure you could sue them for something
under
existing laws. For instance, the core of the case in NY against monsterhut
(big spammer) is false representation and fraud, which aren't new-fangled
Internet offenses. I'm sure that laws that protect you from real world
impersonation by criminals would also protect you here, just as the laws of
libel have been applied to email discussions. If they claim, "simple
mistake,"
you could argue negligence, and in the current anti-spam climate a judge may
agree. If it turns out that the site that is profiting from this
impersonation
is based in an aggressive state, like NY, you may be able to enlist the
state
AG's help, esp. if impersonation appears to be habitual.

All of the pending federal legislation prohibits the faking of headers, but
none of them, to my memory, really seem to consider the damage done to you,
the fakee. This is where CAN-SPAM's rule that prohibit individuals from
suing
really bites. This bill, which is the most likely to pass in to law right
now,
only allows your ISP and the Attorney General to sue, and you wouldn't get
to
see any of the damages.

In addition to determining the home of the advertised site, another thing
you
could definitely do is determine if the last hops are open relays and try to
get them shut down if they are.







----------------------------------------------------------------------

Subject: [Fwd: RE: [Fwd: Help! I've been abused!]]
From: Dan Smith <anilorac AT nc.rr.com>
Date: Thu, 20 Jun 2002 12:02:02 -0400
X-Message-Number: 6

Bee,

A non-INW friend forwarded this link in response to your problem.




-------- Original Message --------
Subject: RE: [Fwd: [internetworkers] Help! I've been abused!]
Date: Thu, 20 Jun 2002 11:32:16 -0400
From: "Charles Mann"
Reply-To:
To: "'Dan Smith'" <anilorac AT nc.rr.com>

This is an excellent site with SPAM info:

http://www.thisistrue.com/spam.html

Summary: ain't s*** you can do, until it becomes illegal


 > -------- Original Message --------
 > Subject: [internetworkers] Help! I've been abused!
 > Date: Wed, 19 Jun 2002 23:05:22 -0400
 > From: <beeline AT mindspring.com>
 > Reply-To: "InterNetWorkers" <internetworkers AT franklin.metalab.unc.edu>
 > To: "InterNetWorkers" <internetworkers AT franklin.metalab.unc.edu>
 >
 > Talk about makin' a body real mad.... It's happened again!
 > I'm getting a
 > slew of failed mail notifications because some spam [nasty] has
 > appropriated my e-mail address! I reported it to the
 > Mindspring/Earthlink abuse desk, but don't know if they can/will do
 > anything (I sent a copy of the full text of one of the 30 failure
 > notifications).... Anyone have any further ideas? I do have
 > the failure
 > notifications, some of which include an attachment of the
 > filthy spam....
 >
 > Can I sue someone? Can I have someone arrested for stealing my online
 > identity? Should I write my Congresscritters? (Actually, I'd
 > rather get
 > the jerks thrown off of their ISP but whois doesn't recognize
 > their site
 > -- which is teens.sexln.com (an actual working site, ugh).)
 >
 > A typical header from one of the more complete attached originals is:
 >
 > Received: from compuserve.com ([216.161.204.81]) by
 > vr2d.cybernaute.com
 >            (Post.Office MTA v3.5.2 release 221 ID#
 > 0-57027U1200L100S0V35)
 >            with SMTP id com for <cleo AT cybernaute.com>;
 >            Wed, 19 Jun 2002 18:52:38 -0400
 > To: cleo <cleo AT cybernaute.com>
 > From: beeline AT mindspring.com
 > X-Mailer: OutLook Express 3.14159
 > Subject: cleo - teen-X-teen!
 > MIME-Version: 1.0
 > Content-type: text/plain
 > Content-Transfer-Encoding: 8bit
 >
 > And here's another for comparison:
 >
 > Received: from awserver5.teledisc.com ([205.200.9.55])
 >            by awserver1.awnet.com (Post.Office MTA v3.5.1 release 219
 >            ID# 0-54873U1000L100S0V35) with SMTP id com
 >            for <dpma4009 AT awnet.com>; Wed, 19 Jun 2002 16:47:48 -0500
 > Received: from 203.42.166.49 by awserver5.teledisc.com
 > (InterScan E-Mail
 > VirusWall NT); Wed, 19 Jun 2002 16:32:58 -0500
 > To: dpma4009 <dpma4009 AT awnet.com>
 > From: beeline AT mindspring.com
 > X-Mailer: OutLook Express 3.14159
 > Subject: dpma4009 - teen-X-teen!
 > MIME-Version: 1.0
 > Content-type: text/plain
 > Content-Transfer-Encoding: 8bit
 >
 >
 > Suggestions?
 >
 > B
 >
 > ---
 > Come and play at the InterNetWorkers Web site!
 > http://www.ibiblio.org/internetworkers/
 > You are currently subscribed to internetworkers as: anilorac AT nc.rr.com
 > To unsubscribe send a blank email to
 > $subst('Email.Unsub')
 >
 >



----------------------------------------------------------------------

Subject: Re: Help! I've been abused!
From: <beeline AT mindspring.com>
Date: Thu, 20 Jun 2002 23:24:05 -0400
X-Message-Number: 7

As a lawyer's daughter, I believe that any citizen can indeed sue in a US
court as long as there's no *current* law specifically protecting the
to-be-sued entity (the defendant). Winning such a suit would be another
matter, but the first question would be the identity of the defendant.



As the plaintiff, I would have to prove an injury, either real or monetary.
As
a result of this spamming activity, I'm sure that my primary e-mail address
(which I've had for many years and used as a part of my professional
personna)
is now blacklisted or filtered by one or more persons. If I could show that
I
could have done business with any of those people or otherwise have a reason
to exchange e-mails with them that could have benefited one or both of us,
then that would form a base for a complaint. I think. Or, say this trick
results in more "returned unknown" e-mails than my allocated space and an
important message gets bounced. Again, if I can prove injury, I have the
basis
for a suit -- I would just need to find the perpetrator.



(Of course, if this is a virus I can't very well sue a buddy or professional
contact for failing to maintain a good virus checker... could I? Perhaps.
Would I? Probably not. Would someone else? Sooner or later, if it is
possible
to find a defendant, a cause, and an affordable lawyer, someone will sue.
Guaranteed. This is so basic a thing that I doubt that the CAN-SPAM's
prohibition is both complete and constitutional. Of course, spammers may
enjoy
several years of temporary amnesty as some really angry plaintiff with a
good
deal of dough or a very special attorney works his/her complaint through the
system.)



It's probably academic anyway -- I doubt that I'll come up with the scratch
or
the lawyer to try to track down and nail anyone. I'm cheering for whoever
does
decide to take 'em on, though....



"B"





On Thu, 20 Jun 2002 11:12:01 -0400 "Michael D. Thomas"
<mdthomas AT mindspring.com> wrote:



>

> Can I sue someone? Can I have someone arrested for stealing my online

identity? Should I write my Congresscritters?

>



Thoughts of a non-lawyer....



If you could find who did it, I'm sure you could sue them for something
under

existing laws. For instance, the core of the case in NY against monsterhut

(big spammer) is false representation and fraud, which aren't new-fangled

Internet offenses. I'm sure that laws that protect you from real world

impersonation by criminals would also protect you here, just as the laws of

libel have been applied to email discussions. If they claim, "simple
mistake,"

you could argue negligence, and in the current anti-spam climate a judge may

agree. If it turns out that the site that is profiting from this
impersonation

is based in an aggressive state, like NY, you may be able to enlist the
state

AG's help, esp. if impersonation appears to be habitual.



All of the pending federal legislation prohibits the faking of headers, but

none of them, to my memory, really seem to consider the damage done to you,

the fakee. This is where CAN-SPAM's rule that prohibit individuals from
suing

really bites. This bill, which is the most likely to pass in to law right
now,

only allows your ISP and the Attorney General to sue, and you wouldn't get
to

see any of the damages.



In addition to determining the home of the advertised site, another thing
you

could definitely do is determine if the last hops are open relays and try to

get them shut down if they are.















---

Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/

You are currently subscribed to internetworkers as: beeline AT mindspring.com

To unsubscribe send a blank email to
$subst('Email.Unsub')





---

END OF DIGEST

---
You are currently subscribed to internetworkers as:
steve AT mindbenderstudios.com
To unsubscribe send a blank email to
$subst('Email.Unsub')