Scammers Fighting With Anti-Scam Services

On February 23, 2007, the US SANS Internet Storm Center got a sample of malware code containing not a very pleasant message for the Center.

The Center received a malevolent code known as "sans.exe" written to update thousands of infected systems that has been under surveillance by SANS. The text of the code suggests a strike on the Center if its two crime fighters do not stop interfering with the moneymaking operations of the attacker.

According to a post on the blog of the Center, a part of the message threatened Johannes Ullrich and Kevin Hong, two of the spam fighters of the Center. The message further said that he (the attacker) doesn't have anything against the Center and he wants to pass his malicious code.

Johannes Ullrich, chief research officer, SANS Institute, reported to SCMagazine.com that the style of the message shows the writer isn't a professional. Ullrich thinks that the offender behind the whole zombie spam attack is someone SANS reported to a Domain Name Server (DNS) provider recently, telling the vendor the spam writer was exploiting its server to direct botnets.

Ullrich thinks that the message was sent as revenge - but he was not upset. He said that the message is a proof that they are on the right track of stopping spammers.

Recently, several anti-spam sites came under a continued DDoS (distributed denial of service) attack. It's an e-attack during which the spammers exploit thousands of infected PCs to overfill the target with so much of fake traffic that it can't accommodate the legitimate visitors.

Millions of systems compromised by the recent e-mail virus called "Storm worm" made the attacks possible. The e-mail virus connects compromised systems into a peer-to-peer data network employing the same technology used by eDonkey file-sharing network.

CastleCops website (CastleCops is an all-volunteer, cyber scam fighting community) was also under a sustained denial of service (DoS) attack recently. Robin Laudanski, Co-founder, CastleCops, said that the intermittent website shutdowns have been problematic, but he added that they boosted the support for the community from within the security circle.

Related article: Scammers Exploit Tax System Resulting in ID Theft

» SPAMfighter News - 3/6/2007