Keeping Track of the Bad Guys
Keeping Track of the Bad Guys
When I took some Russian classes at Purdue, I was one of the few non-ROTC students in the room. In that same spirit of "know your adversary"....
Criminal Markets
There are sites where "carding" or selling stolen credit card information goes on openly. Also counterfeit currency, stolen smart phones, etc. They tend to appear, change names, and disappear frequently.
Exploit Code
Start looking at:
Stack smashing refers to a specific form of attack on poorly coded memory management code. There was a great paper on how to exploit poor coding via buffer overflow and related attacks in Phrack volume 49, "Smashing The Stack For Fun And Profit". Get the original paper at insecure.org Packet Storm.
There's a nice follow-up paper on writing advanced buffer overflow exploits.
Hackers in the Classic Sense of the Term
Magazines and web sites catering to the community of bad guys, or at least security researchers plus some wannabe bad guys and posers, include 2600.
Phrack seems to have ended in mid 2016.
Spamming and Stolen Accounts
Criminal organizations openly sell access to hacked systems and spamming software. I received the following email. "WebMails" will mean stolen webmail accounts, "Shells" means access to hacked Linux/UNIX systems, "RDP" means access to hacked Windows systems.
From: TOOLX.SX <info@bmw-avtoport.ru>
Subject: FRESH SPAM TOOLS ON SHOP (SMTP UNLIMITED + RDP FRESH IP)
Reply to: TOOXSHOP@YAHOO.COM
TOOLX.SX - Support 24/7 - WELCOME
* WebMails : with only _10$_ .
* Inbox Mailers : Starting from _7$_ .
* Shells _5$_ .
* Gold Unlimited Smtp's : _6$_ .
* Big & Fresh Leads : Starting with _10$_ .
* RDP's ( WIN 2008 & 2003 & 7 & XP ) : Starting with Only _10$_ .(Administrators)
* Private Scam Pages , Tutorials , Tools , Exploits , Scripts in Sections :
Files & Hack & More Tools Just Register on toolx.sx <http://www.toolx.sx> .
* Go to toolx.sx <http://www.toolx.sx> , Register , ADD Funds To Your Account
: http://toolx.sx/balance.php <http://www.toolx.sx/balance.php>
***
NEW BIGG UPDATE: - RDP = USA & Worldwide [2003-2008] / Shells /
SMTPs / Mailers / Leads / cPanel. - Support 24/7 - WELCOME
We Currently Accept as Method of Add Funds :
*Bitcoin* & *PerfectMoney*& *Coupon Code System*
If you not have account , Free Register at *http://toolx.sx* <http://www.toolx.sx>
Sincerely,
toolx.sx SHOP Team ©
Web: *http://toolx.sx* <http://www.toolx.sx> ******************
**********Login at our shop now: *Go to store now <http://www.toolx.sx>***********
© Toolx.sx - The Best Store 2012-2015
toolx.sx
Let's look at the headers to see where this came from:
Return-Path: info@bmw-avtoport.ru
Received: from resimta-po-12v.sys.comcast.net (LHLO
resimta-po-12v.sys.comcast.net) (96.114.154.140) by
resmail-ch2-291v.sys.comcast.net with LMTP; Thu, 16 Jun 2016 04:50:34 +0000
(UTC)
Received: from mail.visko-td.ru ([92.39.142.238])
by resimta-po-12v.sys.comcast.net with comcast
id 7GqW1t00g58p8DG01GqXy2; Thu, 16 Jun 2016 04:50:33 +0000
X-CAA-SPAM: N00001
X-Authority-Analysis: v=2.2 cv=Z6cDJDZA c=1 sm=1 tr=0 p=CuUU-2S5AAAA:8
p=FQcSCCfIWczPZYWNgecA:9 p=IC0bq68s7SMhLFC5:21 a=A0n+dx4VeM4CxFeTCCKc1A==:117
a=A0n+dx4VeM4CxFeTCCKc1A==:17 a=9cW_t1CCXrUA:10 a=Dyoqhi_TatcA:10
a=47kyEjea234A:10 a=Cfj4BQAnxiAA:10 a=QHxmGfcNzOwA:10 a=pD_ry4oyNxEA:10
a=8AvH1LBivTgA:10 a=XH8yafb-v7IA:10 a=pnnV3C4PK3yGex1eHNS2:22
X-Xfinity-Message-Heuristics: IPv6:N
Received: from localhost ([127.0.0.1])
by mail.visko-td.ru (Kerio Connect 8.0.0);
Thu, 16 Jun 2016 07:50:28 +0300
Reply-To: <TOOLXSHOP@YAHOO.COM>
From: "TOOLX.SX"<info@bmw-avtoport.ru>
Subject: FRESH SPAM TOOLS ON SHOP (SMTP UNLIMITED + RDP FRESH IP)
Date: Thu, 16 Jun 2016 05:50:28 +0100
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
They're not trying to hide! This seems to have come right out of mail.visko-td.ru, and the IP block 92.39.136.0/21 is allocated to InterTelecom ISP in Ryazan, Russia.