Here are the details on the inner workings of a massive, illegal spam operation. The situation presents a tangible threat to online privacy and security as it involves a database of 1.4 billion email accounts combined with real names, user IP addresses, and often physical address. Chances are that you, or at least someone you know, is affected.
A cooperative team of investigators from the MacKeeper Security Research Center, CSOOnline, and Spamhaus came together in January after I stumbled upon a suspicious, yet publicly exposed, collection of files. Someone had forgotten to put a password on this repository and, as a result, one of the biggest spam empires is now falling.
Additional coverage can be seen over at CSOOnline.
The leaky files, it turns out, represent the backbone operations of a group calling themselves River City Media (RCM). Led by known spammers Alvin Slocombe and Matt Ferris, RCM masquerades as a legitimate marketing firm while, per their own documentation, being responsible for up to a billion daily email sends.
Think about that for a second. How can a group of about a dozen people be responsible for one billion emails sent in one day? The answer is a lot of automation, years of research, and fair bit of illegal hacking techniques.
I say illegal hacking due to the presence of scripts and logs enumerating the groups’ many missions to probe and exploit vulnerable mail servers. The following chat log, found among the backups, is just one example of River City Media crew members admitting to exploitive behavior.
In that screenshot, a RCM co-conspirator describes a technique in which the spammer seeks to open as many connections as possible between themselves and a Gmail server. This is done by purposefully configuring your own machine to send response packets extremely slowly, and in a fragmented manner, while constantly requesting more connections.
Then, when the Gmail server is almost ready to give up and drop all connections, the spammer suddenly sends as many emails as possible through the pile of connection tunnels. The receiving side is then overwhelmed with data and will quickly block the sender, but not before processing a large load of emails.
Purposely throttling your own machinery to amass open connections on someone else’s server is a type of Slowloris attack [https://en.wikipedia.org/wiki/Slowloris_(computer_security)]. The twist here is that the spammer is not trying to completely disable the receiving server, he is only temporarily stressing the resources in order to overwhelm and force the processing of bulk email.
Details of the even more abusive scripts and techniques have been forwarded on to Microsoft, Apple, and others. Law enforcement have also been notified and, while we are prohibited from saying too much, they are indeed interested in the matter.
1.4 Billion
Through offers such as credit checks, education opportunities, and sweepstakes, this spam operation has gathered and conglomerated a database of 1.4 billion peoples’ email accounts, full names, IP addresses, and often physical address. There is evidence that similar organizations have contributed to this collection. An active market exists for trafficking in these types of lists for illegitimate purposes.
Imagine the privacy and legal implications here. Law enforcement agents normally have to go through a subpoena process before a service provider will hand over the name behind an IP address or account. This list maps out 1.4 billion.
The natural response is to question whether the data set is real. That was my initial reaction. I’m still struggling with the best software solution to handle such a voluminous collection, but I have looked up several people that I know and the entries are accurate. The only saving grace is that some are outdated by a few years and the subject no longer lives at the same location.
Random selections also consistently appear to reflect real people. Investigating names from the list, through social media and work websites, usually shows that the additional details in the entry are most likely accurate. However, it’s not so verifiable that a common web scraper could have easily gathered all the data.
Well-informed individuals did not choose to sign up for bulk advertisements over a billion times. The most likely scenario is a combination of techniques. One is called co-registration. That’s when you click on the “Submit” or “I agree” box next to all the small text on a website. Without knowing it, you have potentially agreed your personal details can be shared with affiliates of the site.
You are never told who the affiliates are and groups like River City Media capitalize on that aspect. One line of the leaked chat logs explains it all very succinctly:
“The key is sincerity. Once you can fake that…”
Keep that line in mind if there is an official response from Alvin Slocombe, Matt Ferris, or one of the other River City Media crew members.
As of this morning, Spamhaus will be blacklisting RCM’s entire infrastructure.
Alvin: https://www.spamhaus.org/rokso/spammer/SPM1247/alvin-slocombe-cyber-world-internet-services
Matt: https://www.spamhaus.org/rokso/spammer/SPM1011/matt-ferris-river-city-media-acetech-usa
Watch this blog for updates to the story as well as further details about the RCM operation. There are enough spreadsheets, hard drive backups, and chat logs here to fill a book.
***
This article is reprinted from an article published by MacKeeper Security Researcher, Chris Vickery.
Do you have security tips or suggestions? Contact: cvickery@kromtech.com or security@kromtech.com
Stay tuned to the latest security news by visiting MacKeeper Security Watch blog with Chris Vickery.