Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Security

Windows/NetBIOS pop-up Spam: 411

bofus writes "This article from Wired News presents a new way to deliver unsolicited advertising content - the MS Windows Messenger service. It appears that the client software hasn't been widely distributed yet, but it's probably only a matter of time before a free clone is circulating. This method could become the delivery method of choice for all kinds of unsolicited junk, given the number of unsecured PCs out there. On the flip side, if you run a relatively secured machine and have some sort of firewall, this probably shouldn't concern you."
This discussion has been archived. No new comments can be posted.

Windows/NetBIOS pop-up Spam:

Comments Filter:
  • ahh nuts! (Score:5, Funny)

    by Quasar1999 ( 520073 ) on Thursday October 17, 2002 @03:26PM (#4472903) Journal
    I wasn't sure how to take this message...

    Hello, would you like to get laid? Call me at xxx-xxx-xxxx

    alas, now that I know it's spam.. my hopes have been crushed... :(
    • by blonde rser ( 253047 ) on Thursday October 17, 2002 @04:24PM (#4473491) Homepage
      I wasn't sure how to take this message...

      Hello, would you like to get laid? Call me at xxx-xxx-xxxx

      alas, now that I know it's spam.. my hopes have been crushed... :(


      Of course I meant it. But you never called :(
    • There is someone, somewhere, who is sitting in front of their computer thinking...
      Their mind has wandered...
      SEX...
      Sex with the (wo)man of their dreams...

      oh, how wonderful life could be... but alas no, not for this poor soul. For they only have a tiny small penis.
      And right then, at that very moment just as their dream is being crushed by their own insecurities, up pops Windows Messaging Service:

      ++ INCREASE THE SIZE OF YOUR PENIS!!!! ++

      ++ New pill adds 3 inches to your cock! ++

      How right it would be for them at that moment, to give this poor poor person some hope in life?

      So my question is "Who are we to judge the rights and wrongs of this 'Mass advertising/marketing/spamming' product; a product that might give hope to just one or two of the thousands of millions spammed?"

      That said, personally I couldn't give a rats-arse about some spotty virgin geeks' lack of sex - but hey, SOMEBODY SOMEWHERE must actually buy these products. Find that person, kill them, and the whole spamming problem is solved! Surely?!!
      ---
      Lots of love, Zaiffy baby!
  • by jon787 ( 512497 ) on Thursday October 17, 2002 @03:26PM (#4472910) Homepage Journal
    echo echo echo [slashdot.org]
  • what client ?!?1 (Score:5, Informative)

    by Archfeld ( 6757 ) <treboreel@live.com> on Thursday October 17, 2002 @03:27PM (#4472913) Journal
    try "net send IPADDR"

    it is a cli and batchable, this can be supremely irritating as the only info given with the popup is wins name which is useless unless you are in the same domain/ou.
    • The client that will probe a network for port 135, then create the batchable list and do it itself.
      Any tool with minimal user thought is valuable to spammers. It beats the hell out of the other options (like thinking or learning how the internet works)
    • NET STOP MESSENGER

      That's all we did here in the lab and it took care of things quite nicely.

      It's not very Newtonian to be running services that you just simply do not need! Newton was a very smart man who took advantage of several areas that he was able to, but I doubt he would ever have wastefully ran services that he didn't ever use.

      Please be smart and think/act like a physicist. Just don't stop brushing your teeth/hair or start wearing Spandex(TM) pants and bicycle helmets to work -- that's just plain weird!

      Ah well, back to the lab...
      • see the problem is who knows what other services the messenger provides? I mean, every time I turn around I find something that I'd love to shut off but something in our outside our network depends on it. Messenger service, for all I know, is also involved in SQL authentication or will fark up the queue messenger because it relies on Messenger to initialize.

        OK I know check the dependencies but it's still a dice roll. I decided it's easier to just install Tiny firewall on all the boxes, let 'em talk to eachother all they want but not allow 'lsa services' to chat w/ the internet.
        • Nothing (Score:3, Informative)

          It doesn't provide -any- service or do anything besides displaying a message on your screen that your network admin wanted to broadcast.

          Frankly, the only time I've seen it used is when I annoy the hell out of my co-workers by sending them anonymous popus using this lovely piece of Windows software [webattack.com].

        • by cscx ( 541332 ) on Thursday October 17, 2002 @04:46PM (#4473699) Homepage
          What I did when I first became aware of the problem (yes I'm on a college LAN but we have a class A) is configured Tiny Personal Firewall to only allow UDP/TCP traffic on 137-139 and UDP on 135 (messenger service) to the samba servers and campus netblocks that I might use to access my computer (e.g., resnet, labs, etc), then add a filter rule to deny all other traffic on those ports - works like a charm =)
          • by Permission Denied ( 551645 ) on Thursday October 17, 2002 @06:54PM (#4474584) Journal
            Correct me if I'm wrong:

            Port 135 is not messenger. Messenger is an RPC service and port 135 is the RPC port locator on Windows (like portmap on unix). Messenger can use any port at all - blocking port 135 works because client machines connect to port 135 to locate the port that the messenger rpc service is running on. Blocking port 135 may stop a bunch of other things from working, but net stop messenger stops just messenger.

            Not that I really care - I would just cut off the port and then worry about only if someone complains.

      • by afidel ( 530433 ) on Thursday October 17, 2002 @03:51PM (#4473198)
        not everyone needs it but it sure can be usefull. Our netapps have the ability to send a message before they are taken offline for maintenance (like we did recently when moving from a couple single filers to a f880 cluster). We also use it with our Samba server to notify the users when their print jobs have cleared the queue (great for plotters or very high traffic lasers).
      • if you have no messenger then you don't see printer messages, or disk full messages. The alerter service would fail but I think thats about it.
      • by billstewart ( 78916 ) on Thursday October 17, 2002 @04:23PM (#4473478) Journal
        Here in San Francisco, messengers not only do the Spandex pants and bicycle helmets, but also usually have tattoos and metal rings on their faces. I hadn't heard of anybody using nets to stop them, though....

        The only time it's really a problem is Critical Mass [critical-mass.org].

      • by blakestah ( 91866 ) <blakestah@gmail.com> on Thursday October 17, 2002 @05:21PM (#4473947) Homepage
        I think this may be more useful for most users (verified for 2000 and XP).

        Right Click the icon for This Computer on the desktop. Click on manage.

        Doubleclick Sessions and Services.

        Doubleclick Services.

        Scroll down to Messenger, doubleclick it.

        Click on Stop. Change pull-down menu from Automatic to Manual.

        Click on Apply.

        You are done.
    • Re:what client ?!?1 (Score:4, Informative)

      by zdzichu ( 100333 ) on Thursday October 17, 2002 @04:05PM (#4473303) Homepage Journal
      I'd prefer "nmblookup -A ip.of.vic.tim" and "smbclient -M" in some short shell script looping over some big DSL subnets :)
  • by PaddyM ( 45763 ) on Thursday October 17, 2002 @03:28PM (#4472937) Homepage
    When my friends and I would play Starcraft, the winpopup was my secret weapon ;)
  • by LittleBigScript ( 618162 ) on Thursday October 17, 2002 @03:29PM (#4472945) Homepage Journal
    "I have customers who call me back and tell me they love it and it generates hundreds of calls right away," said Kovacs, who noted blah...blah...blah..

    That sure is a funny way to say "death threats."

    "The girls of the internet. Ooh, I'd go online with them anyday!"
    -Homer Simpson
  • by Anonymous Coward
    Everyone should be running one. A good software for Windows one is Kerio Personal Firewall [kerio.com] (Formerly Tiny).

    It'll block everything you don't want if you set it up correctly.
  • Wonderful... (Score:2, Interesting)

    by Dark-One ( 24259 )
    I first saw this on my cable modem(before I started using IPTables to share my connection) Then I noticed it on my network on campus. And as I am the administrator I simply blocked the ports on our firewalls. However I can not imagine what students thought when they saw these messages. As a mater of course we disable NT messaging on our servers and all of our faculty/admin machines because its not needed. However I never tought I would need to block it from the internet. But apparently its become a big problem. I have heard from a number of students that they have received these messages, all in one day. I suppose that it just means I have to make our firewall all that more restrictive; which I hate to do.
  • The Solution (Score:3, Informative)

    by KingAdrock ( 115014 ) on Thursday October 17, 2002 @03:30PM (#4472956) Journal
    Is to go into the services panel, and turn off Windows Messenging Service.

    Or we could just bitch about it on /.
  • net send (Score:5, Funny)

    by mrgrey ( 319015 ) on Thursday October 17, 2002 @03:30PM (#4472963) Homepage Journal
    I get really bored in my NT4 Server class one day and wrote a small stupid batch file that utilized the net send command.

    :one
    net send %1 "crapflood of info"
    goto one


    It was kind of amusing to watch. People would click the OK button on the message and as soon as it went away another popped up. The best thing is the beep that accompanies the message. Oh the assinine joy....

  • The Register... (Score:2, Informative)

    by sczimme ( 603413 )
    ran a story on this yesterday morning:

    El Reg [theregister.co.uk]
  • How to do it (Score:3, Informative)

    by cr@ckwhore ( 165454 ) on Thursday October 17, 2002 @03:31PM (#4472978) Homepage
    Real easy to do this stuff... find a win2k or XP box connected directly to the 'net with port 139 open ...

    c:\> net send \\ip_address "message"

    • oops... no double backslashes before the IP address.. sorry
    • Re:How to do it (Score:3, Interesting)

      by ep32g79 ( 538056 )
      I discovered the joy's of "net send" back in the eighth grade. I thought it was fun to be able to message my friends at school while they were loged on, admins had disabled the novel send client.

      I soon began to use a batch file to repetedly spam them with messages, a little while later I build a Visual C++ program to allow a user to input the user they wished to spam along with their message and how many times to spam them. It was amazing to watch how fast the program I made spread through the junior high.

      After about a week and a half I was called into the office and suspended for 3 days because roughly 56 people in my class used my program to harass their classmates.
  • by Ian Wolf ( 171633 ) on Thursday October 17, 2002 @03:33PM (#4472989) Homepage
    While you're at it disable Remote Registry while you are at it. It truly amazes what services Microsoft deems the average user needs running. I find the whole concept of Remote Registry particularly disturbing.

    "Cool this service allows people to modify my registry remotely, sweet!"

    While I know there are some legitimate and possibly useful reasons to have these services enabled, why on earth are they enabled by default?
    • by afidel ( 530433 ) on Thursday October 17, 2002 @03:49PM (#4473174)
      Sorry but I use remote registry service daily. If you want to do performance monitoring on a remote pc you need remote registry right because the perfdata is a section of the registry. It's also nice when you have a busted uninstaller and need to cleanup the registry before a reboot for a remote client, it's saved me a couple days worth of travel time this year alone! Whether it should have the default permissions that MS sets is another matter, but that is true for just about any MS default.
    • While you're at it disable Remote Registry while you are at it. It truly amazes what services Microsoft deems the average user needs running. I find the whole concept of Remote Registry particularly disturbing.

      "Cool this service allows people to modify my registry remotely, sweet!"


      You do realize that you have to provide authentication (ie. username/pwd) for this to work, don't you? You can't just wander around networks checking out others' systems.

      Simon
  • I'm an admin for one of the larger university's in the south, XXXXXXXXXX.edu (name changed to protect the clueless) that doesn't have a firewall. This is due to the fact it's part of a teaching hospital, and has a historical policy of openness. Last week we recieved a windows popup message across most of the campus containing preformatted SPAM text. I don't know how the formatting was done...but some one else has already started this crap.
  • its almost as if... (Score:5, Informative)

    by diesel_jackass ( 534880 ) <travis DOT hardiman AT gmail DOT com> on Thursday October 17, 2002 @03:33PM (#4472993) Homepage Journal
    ...we just talked about this [slashdot.org] :-)

    There were many helpful suggestions in those posts.
  • Simple fix... (Score:4, Informative)

    by _bug_ ( 112702 ) on Thursday October 17, 2002 @03:33PM (#4472998) Journal
    C:\> net stop messenger
    The Messenger service is stopping.
    The Messenger service was stopped successfully.


    Then when you're up for it, just disable the service entirely from the services administration tool. It won't break any workstation functionality.

    So what's next? Spam on my HP Printer [digitaltrust.it]?
    • Re:Simple fix... (Score:3, Informative)

      by Nintendork ( 411169 )
      If it's not set to manual or disabled, it'll start on the next reboot. On my workstations, I just set it to manual in case I decide to start it momentarily for the purpose of spamming...err, sending cute messages to co-workers.
    • Even better fix.. (Score:3, Insightful)

      by gatekeep ( 122108 )
      Firewall your damned machine! Allow in only what you need to allow in, or responses to requests sent outbound. Not only will it protect against this, but all the other crap people will figure out in the future as well.
      • In a business intranet, there may be uses for this service. But for a machine connected to the public internet (i.e. a spam target), there's simply no excuse for letting packets in unless they're running on a protocol you know you want to support across the net. For most couch potatoes at home, that means responses to outgoing queries, plus incoming packets on any Instant Messenger, Games, and P2P File Sharing type application you are running. If you're also running a web server, then there's that too. For couch potatoes at work, there may be all sorts of stuff, but there's no reason the business firewall should be letting them in from unknown sources.
    • by TheTomcat ( 53158 ) on Thursday October 17, 2002 @04:20PM (#4473448) Homepage
      So what's next? Spam on my HP Printer [digitaltrust.it]?

      I've sent messages to random printers before. Back in the days before Napster, there was a P2Pish search engine that scoured the net for open SMB shares. People would often share their whole C drive (retardedly), but the most fun was to send messages like "I'm running out of ink. I'm running out of ink. I'm running out of ink. I'm running out of ink. (etc)" or "You should reall secure your machine.." to remote printers shared to the world over SMB.

      S
  • What kind of person would read and post on /. without having a secure computer with a firewall. it pretty much comes with the title of nerd to have a secure computer.
  • by Nintendork ( 411169 ) on Thursday October 17, 2002 @03:34PM (#4473014) Homepage
    Don't tell the spammers that there's already a utility that can abuse the messenger service. There is no such thing as the net.exe command line utility.
  • by XorNand ( 517466 ) on Thursday October 17, 2002 @03:34PM (#4473016)

    If your NETBIOS ports are open, getting spam should be the least of your worries. You'll be too busy dodging winnuke attacks and fileshare scans/cracking. Close off ports 137 and 138 on any WAN connections. Of course, any competent windows network admin already knows this.
    • by brunes69 ( 86786 ) <slashdot AT keirstead DOT org> on Thursday October 17, 2002 @03:39PM (#4473078)

      ... youll see that the messager service uses port 135, not 137 or 139.

    • by zulux ( 112259 ) on Thursday October 17, 2002 @03:43PM (#4473127) Homepage Journal
      Close off ports 137 and 138 on any WAN connections. Of course, any competent windows network admin already knows this.

      I can't find a port setting on my NT Lan Manager - what are you talking about?

      Are you useing that TCP/IP thing? That's for hackers on the internet.

      You should be useing NetBEUI - now that's a stable protocall, made by the fine folks at Microsoft. Not one of those "Internet" (read: hacker) protocalls made by one of those unwashed UNIX people.

      I've heard the MSN is going to move to NetBEUI - so I know it's the network protocall of the future!

      If you can't use NetBEUI - at least give Banyan Vines a try. Works great with our Windows for Workgroups!

      Stay away from OS/2 - thats bad Mojo. Amiga people like OS/2 so I know it's bad.

      • by nuxx ( 10153 ) on Thursday October 17, 2002 @04:01PM (#4473273) Homepage
        Actually, if you really want to keep people out of your file & printer sharing stuff on a home network, using NetBEUI is a good idea. It's lightweight, fast, and it works just fine. Use IP for your internet stuff, NetBEUI for file & printer sharing.

        Works like a charm and doesn't require any extra software. Hell, you could have the cable modem company's favorate version of multiple machines on a cable modem (modem with multiple IP service plus the client machines all plugged into one hub) using this and you'll still be safe.
    • by Nintendork ( 411169 ) on Thursday October 17, 2002 @04:26PM (#4473520) Homepage
      You can't just close off a port. You have to close off the correct port number for the correct protocol.

      A lot of "Paper MCSEs" understand this because the networking exam covers the OSI model. The same thing goes for those "Paper CCNAs".

      Here's how it works. When I do a net send "Message", the following occurs. Once the data portion of the net send information is formatted by the appropriate layers, it's handed down to the protocol layer and wrapped in a UDP header with a port number. UDP is the protocol responsible for maintaining a communication session between hosts. The port number is like an apartment number in a street address. A lot of services have to talk using the UDP protocol, so it's divided into port numbers (As an FYI, the same is done for TCP). This in turn is handed down to the network layer where it will get a source and destination address stamp (The IP addresses). That in turn is handed down to the data link layer which stamps on the source and destination MAC addresses (Your computer and the default gateway). From there, it hits the physical layer and is on the wire. Along the way, the data link layer changes every hop that is made because the MAC addresses involved change at each router hop. Once it gets to the destination IP address, the recipient strips off the layers to reveal the data. It knows to hand that data up to the NetBIOS services because they're the ones listening on UDP port 138. Finally, you get a little window trying to sell pr0n. Here's a picture [uic.edu] that shows the different layers of a TCP packet and their function.

      Here's a rundown on NetBIOS port usage.

      UDP port 137 is used for NetBIOS name resolution.

      UDP port 138 is used for browsing, domain authentication, and datagrams (This is what the messenger service uses).

      TCP port 139 is used for the actual session. This is what you transfer files through.

      TCP port 135 is the RPC service. Some people often confuse it with the NetBIOS ports. I don't know why.

      So, technically, you'll want to block UDP ports 137 and 138 and TCP port 139. Unfortunately, a lot of home equipment is geared towards the novice and they don't separate the UDP and TCP protocols. You are forced to block both TCP and UDP for any given port number. Because of this, you end up blocking more than is required.

      For those interested in this brief tutorial, I highly encourage you to get a CCNA study guide even if you're not going to get the certification. Lots of valuable networking info.

      Lucas
      MCSE, CCNA, Ex-Microsoft NT Networking and Security Support Rep

      • by AKnightCowboy ( 608632 ) on Thursday October 17, 2002 @04:41PM (#4473655)
        You are forced to block both TCP and UDP for any given port number. Because of this, you end up blocking more than is required.

        And the problem with this is what exactly? Your firewall should block everything unless you specifically exempt it. Only people living in 1994 are still trying to play the "I'll just block dangerous ports" whack-a-mole game with their firewalls. Any el-cheapo home Linksys box will block all inbound connections by default. There isn't any reason to be using NetBIOS across the Internet period. It's a horribly insecure protocol that was never designed to be used across a WAN. Keep it on the intranet where it is meant to be used.

        • You are talking of a related, but different technology. Dynamic Access Filtering or Stateful Packet Inspection (SPI) can be used to block all ports while opening up tiny holes to allow sessions you initiate to go through. This way, you can get out, but nobody can try and establish a session to you. If you're running a service like http, ftp, gnutella, IRC, AIM file transfer, etc., you have to create permanent holes in the service ports to allow incoming connections. Some devices allow you to specify the protocol, others do not.

          From a security standpoint, you're right. At home, I use SPI. Sometimes though, I turn it off and just block the commonly attacked NetBIOS ports since most scanning activity is for NetBIOS and SQL(I don't run SQL at home). From a control freak standpoint, it's just plain rediculous to specify a port without specifying a protocol. I guess it's just a pet peeve of mine.

  • Legality? (Score:2, Interesting)

    by DesScorp ( 410532 )
    Couldn't law enforcement nail them for using this kind of method? Assuming the spammers in question could be found, of course? This isn't a case where you visit a website, and an affiliate's popup ad appears. The argument could be made that if you visit a site voluntarily, you can't hold them accountable for popups. And while mail spam is annoying, it's legal if certain procedures are followed (but that's another rant entirely). It seems to me that THIS method is so intrusive as to warrant prosecution. Unfortunately, even if I'm right, it's pissing in the wind to hope for any legal redress. If the internet ever dies, it won't be because of government tyranny or the RIAA. It'll die because people will become so fed up with the spam and porn shoveled at them, they'll just turn it off.
  • by gpinzone ( 531794 ) on Thursday October 17, 2002 @03:35PM (#4473032) Homepage Journal
    "I have customers who call me back and tell me they love it and it generates hundreds of calls right away," said Kovacs.

    What about the thousands of calls that go something like, "YOU MOTHER F*CKER!!! STOP MAKING THESE F*CKING POPUPS COME UP WHEN I'M PLAYING COUNTERSTRIKE OR I'LL F*CKING RIP OFF YOUR F*CKING HEAD AND F*CKING SH*T DOWN YOUR F*CKING NECK!!!!!"

    Sorry, I don't have anything else to say. The stupid lameness filter is censoring my post for yelling.
  • by M-2 ( 41459 ) on Thursday October 17, 2002 @03:40PM (#4473087) Homepage
    Start -> Administrative Tools -> Computer Management

    When that comes up, expand 'Services and Applications', and click on Services.

    Scroll down to find "Messenger". Right-click and go to Properties. Set 'Startup Type' to 'Disabled'. Hit 'STop' to stop the service. Click OK. Close Computer Management.

    Done. You're now clear.

    (Many people won't need this. But I'm sure at least one person will.)
  • by techwolf ( 26278 )
    Windows Messaging is...

    ( ) An Instant Message client
    ( ) A method of sending popups
    ( ) An Email Client
    ( ) My own worst enemy
    ( ) Cowboy Neal's Little Secret
  • It doesn't solve the problem for large organisations, or for a university campus, where various people may have access to different computers with little logging done, and anyone from the inside could do the job.

    A local university ehre is having some serious issues with that. Of course, people using Macs or Linux are once again quite exuberant about the fact that they aren't affected.

    And closing the port or disabling the service on individual systems may not be possible, because different applications need to use the service for other uses. Printer servers for example use it for notification of print job status.

  • already out there (Score:5, Interesting)

    by htmlboy ( 31265 ) on Thursday October 17, 2002 @03:42PM (#4473112)
    two weeks ago, we had a big hulabaloo here at uiuc.edu because of this. all the win2k/xp machines on all of campus still running the messenger service got a popup describing how great our lives would be if only we had a diploma from a non-accredited university. most of the "administrative" users assumed it was a virus and panicked. then three more of the same came in this morning.

    i just wish windows would log things like the origin of said messages so the abuse could be addressed at its source.
  • This is old hat... (Score:5, Interesting)

    by Mysticalfruit ( 533341 ) on Thursday October 17, 2002 @03:43PM (#4473124) Homepage Journal
    If you've got a machine out on the internet and you've windows networking turned on, you've probably got bigger problems.

    A couple years ago, a co-worker of mine were at his house when he turned on windows networking and set his domain to "WORKGROUP" did the obligatory reboot suffle and started surfing all the shares in the area. It was hilarious, people had their entire C:\ drives shared, etc. Needless to say, after we got him setup with a firewall (linux/maq box) sure enough the logs just rolled with people trying to connect to ports 137/138/139. In one regard may ISP's block the netbios ports on their ingress and egress gateways.
  • by stratjakt ( 596332 ) on Thursday October 17, 2002 @03:46PM (#4473151) Journal
    One of our gateway boxes is terribly insecure, and gets these pretty much every day now.

    It's usually selling "diplomas from prestigious non-accredited Universities, based on work experience. No testing or coursework required"

    I guess not locking down the box, they just assume we'd be stupid enough to fall for it.

    Every once in awhile I'll do a
    "NET SEND * ALL YOUR BASE ARE BELONG TO US"

    Noone here has a clue what it means or where it came from.
  • Dammit! (Score:4, Funny)

    by futuresheep ( 531366 ) on Thursday October 17, 2002 @03:48PM (#4473165) Journal
    Now that this is out, my NET SEND pranks in IRC won't be as much fun anymore!
  • by ncc74656 ( 45571 ) <scott@alfter.us> on Thursday October 17, 2002 @03:50PM (#4473185) Homepage Journal
    I configured Apache to pop up a window on an infected machine every time my server received an attempt at compromising it. It exploited the hole created by Code Red to pop up a message on the infected server. /default.ida used a server-side include to call Lynx with a URL that caused this command to execute on the infected server:

    net send localhost "Your webserver has been infected with the CodeRed2 worm. You have a security hole so big that you can drive a Mack truck through it. You should fix it before some script kiddie comes along and takes advantage of it. Remove root.exe and shell.exe from c:\inetpub\scripts (or wherever your CGI scripts live, though c:\inetpub\scripts is the default location)."

    Damn...if I had thought of it (and if I didn't think Internet advertising is evil), I could've made a mint off all of the lusers who let their servers get infected with Code Red! If I had figured out how to do something similar with Nimda, I could've made an even bigger killing!

    (Details of my adventures with Code Red are up here [alfter.us]. The live counter is gone now because my rusty SQL skillz resulted in MySQL thrashing away for more than a minute to generate four numbers.)

  • Slap em! :P (Score:3, Interesting)

    by Palos ( 527071 ) on Thursday October 17, 2002 @03:51PM (#4473189)
    Saw this a while ago, looks like it could be fun:
    Slap [securitysoftware.cc]:If your like me you run firewall software that tells you when someone tries to access your system. Sometimes I respond with a few packets of my own just to let them know that I am paying attention. I wrote Slap to make responding to these access attempts easier and more entertaining. Just enter the IP address of the person you wish to slap and click on the Slap button. The program will attempt to access all the ports in the list and send them a packet with a personal message. (The default message is 'Leave Me Alone!') Slap integrates with Black Ice and Zone Alarm and can use information received from these software firewalls to "Auto Slap" intruders and add their attacks to your list of responses. --Here is a cool Wav file to use with this.
    • by zrodney ( 253699 ) on Thursday October 17, 2002 @04:00PM (#4473265)
      that's cute, but often the ip you have is not the origin, but a hapless victim
      which is being used to launch the attack and/or hide the tracks of the real blackhat

      by sending data back to that ip, you may be unwittingly being used to help the intruder hide
      and you may appear to be the intruder in the logs of the machine which the blackhat is using as a stepping stone

      that's probably not what you are trying to do
      and that's why I just add those ips to a droplist instead of sending data back
      • by billstewart ( 78916 ) on Thursday October 17, 2002 @04:45PM (#4473687) Journal
        In this case, it doesn't sound like the spamware lets the spammer relay their traffic through another machine - it's probably coming directly from them. Slapping them may actually be fun - here you are, some poor slob who bought a package telling you how you can M8ke Munny Fast! by promoting your 1-900-sex-spam line, you start this thing up on your PC, and now you've got 500 popup windows on your screen telling you to stop bothering people, plus one more saying that all your base are belong to them.
  • by daveman_1 ( 62809 ) on Thursday October 17, 2002 @03:51PM (#4473195) Homepage
    $700? You've got to be kidding me. I'm not going to waste the time, but it wouldn't be to difficult to make a perl script that increments an IP address range and calls smbclient -M... In fact, it would be really easy for someone to do this one time and send a link to the tone of "Tired of annoying messages like this? Go to www.xxx.net to find out how to eliminate messages like this forever." And that would be the end of this problem. Unfortunately, if you did this as a regular citizen, you'd have the FBI crashing through your window in no time for "hacking"...

    Sad really.
  • Good. (Score:4, Insightful)

    by forged ( 206127 ) on Thursday October 17, 2002 @03:54PM (#4473212) Homepage Journal
    Every exploit eventually produces a patch (or make people aware) to make the default OS settings a bit less brain-dead stupid open. People actually connect to the Internet these days.
  • by Jouster ( 144775 ) <slashdot AT angelfaq DOT com> on Thursday October 17, 2002 @04:06PM (#4473306) Homepage Journal
    I tried quite a few nbtstat tricks before I gave up reverse-mapping by NetBIOS name and determined they were external and not from a zombie host inside the firewall.

    The tricky part is that they use UDP, since many firewalls "forget" to filter it unless you remind them with a CLI, sledgehammer, and repeated threats to use an etherkiller.

    There's no reason to let UDP ports below 1024 in from outside your network, except for the specific services you're running, to the specific servers you're running them on.

    Jouster
  • I just saw this for the first time the other day. A coworker got hit with a message, and sent me a screen capture. At first I thought it was a browser pop-up made to look like NetBIOS message...

    Anyway, another reason to be glad I run a Mac OSX box at home.

    --ST
  • A few points (Score:2, Interesting)

    by yar ( 170650 )
    Yes, this was talked about earlier [slashdot.org]. Some of the comments provided then were helpful, others less than so. There was a lot of FUD about how using any form of share or NetBIOS at all meant that you were "already hacked." If an administrator knows what they're doing, that's not true.

    I work at a large university. The obvious solutions don't quite work for us. We'd like to be able to block 135-139. However, some of us are required to use Outlook. *pause* On an Exchange server. *pause* And, we've been told that some of the Outlook functionality depends on the Messenger service being available.

    I block it. But not everyone (particularly some administrative staff and some professors) has the technical knowledge to do so, and some people actually use it.
  • by larien ( 5608 ) on Thursday October 17, 2002 @04:14PM (#4473389) Homepage Journal
    I was thinking about this earlier, and it's nothing I couldn't do with Samba (smbclient) and a short perl script (heck, even ksh could do it).

    As for people saying "turn off the messenger service", there are actually valid uses for winpopups. At my last work, I set up a few perl scripts that would use smbclient to warn Samba users when they were over quota. Before that, users would go over quota and wouldn't know about it until things broke after the grace period.

    Obviously, you should be filter Netbios ports at the firewall unless you have a damn good reason to have internet access to them. If someone in your network is using this program to spam, the LART them appropriately.

  • by stratjakt ( 596332 ) on Thursday October 17, 2002 @04:15PM (#4473398) Journal
    "... and then my computer was like beep beep beep and I was waist deep in a Nigerian money-laundering scheme!"

    (Ellen Feiss parodies are destined to replace underpants gnome business plans.. Do not resist)
  • I had 2 or 3 of these things popup before...so I ran Ad-aware and it came up empty handed. Perhaps this would be a good thing to include in ad-aware...just a little reminder that windows messaging is enabled, explain why it can lead to spam, and that disabling it is harmless.

    I'll say one thing tho...I must have disabled about 10 or 12 things in the Services menu including a LOT of "remote" stuff to remotely control the PC and the windows update feature that I specifically told windows NOT to do.
  • Here it is again... (Score:5, Informative)

    by Da VinMan ( 7669 ) on Thursday October 17, 2002 @04:22PM (#4473476)
    This is from my previous post at http://slashdot.org/comments.pl?sid=42016&cid=4432 394

    Note, I'm not karma whoring, I could care less.

    --

    (You will have to graduate from newbie status in order to take advantage of my advice. This means that you will have to climb the learning curve and actually go read some stuff. You can spend a chunk of cash on products to avoid doing just that, but that's much less fun.)

    If you're doing things like turning on file sharing or sharing printers, it's (supposedly) very easy to hack you. I say supposedly only because I haven't actually tried this. It's such an infamous hole though that I do believe it. To turn this off, unbind the NetBIOS protocol from the modem/network card that connects you to the Internet. In Windows 2000, that you means you go to the Properties for your network connection (in the Control Panel) and uncheck the 'File and Printer Sharing for Microsoft Networks' option. (It's very easy to fix this in Win9x too using roughly the same technique.) You may have to reboot, I don't recall. That problem will then be solved.

    Now to protect yourself from other intrusions and threats.

    If you're just running a dial-up connection and don't leave your machine on the network for extended periods of time, then a product like ZoneAlarm (www.zonelabs.com - look for the free version) will serve you well. Actually, it serves you well in two ways: 1) it protects your machine from the outside world coming into your machine in an unauthorized fashion and 2) it protects adware on your machine from phoning home without your permission (actually it prevents everything from using the Internet until you grant permission, not just adware). This is sufficient for dialup.

    For broadband users and users who want to leave their machine on the Internet for extended periods of time (more than a couple hours at a time), I recommend using an honest to goodness separate firewall. There is a lot that can be said about this, far more than I know really, but I well give you a couple pointers.

    First of all, one of your options is to use a second PC as the firewall. It will need to have 2 network cards, you will need a router or hub for your home LAN, and you will have to get the cable modem (or DSL for that matter; with which I have no experience - shouldn't be too hard) working with that extra PC (via Windows would be easiest to start with). Once that's setup, go grab a Linux distribution like IPCop (or SmoothWall - they're very similar, in fact they were the same product at one time), and install it on that PC. It will require that you reformat the hard drive, so don't plan on storing any files on it. A small hard drive is sufficient. There are FAQs and forums on the IPCop and SmoothWall sites that will help get you setup.

    Your second option in the category of 'real protection' (for home users anyway) is to just go buy a hardware firewall. So instead of a second PC, you just go buy a device that does essentially the same thing. I won't go into detail on these as I have no experience with them. I just thought you should know about them.

    Two last points:
    -PLEASE keep a current anti-virus product actively running on your machine and keep it up to date. If you need a free one, go to http://www.grisoft.com to get the free personal version of the AVG anti-virus product. This one has saved my butt several times from several infections. It may or may not be the best product out there, but it works for me.

    -To protect yourself from browser window popups and other shenanigans, go grab WebWasher at http://www.webwasher.com/en/products/wwash/downloa d_license.htm. You will occasionally find that it interferese with pages that make heavy use of Javascript, but you can turn it off when needed. The added protection from annoying web sites is worth the small inconvenience it may sometimes cause.

    As always, this advice is just a starting point. Today's perfect security solution may be an open door tomorrow. It's up to you to keep yourself informed and to take action when problems arise.

    Good luck and have fun!
  • The way this article posting on the front pages reads it leads you to believe that the spammers haven't figured this out yet. I get at least 3 or 4 of these every few days.

  • by naarok ( 102579 ) on Thursday October 17, 2002 @04:45PM (#4473688) Homepage
    At the last place I worked, we had a number of IPs assigned. This made it painfully obvious in the logs when some script kiddie was port scanning us. On a couple occaisions we found that the machine scanning us had netsend active and availble, so we net sended them telling them to stop port scanning or we would take action. We could just picture the 13 year-old kid at the other end freakin out at this message popping up on their monitor.
  • by Jeriki ( 563090 ) <apfe5917@@@uidaho...edu> on Thursday October 17, 2002 @04:50PM (#4473728)
    open up the advanced tab of you TCP/IP settings and goto the WINS tab and click 'disable NetBIOS over TCP/IP' and then 'OK'.
  • by Mdog ( 25508 ) on Thursday October 17, 2002 @05:18PM (#4473907) Homepage
    If you read the wired article and follow the link to the "dispute," AOL sued this company over their icq spam engine. It's important to notice, however, that they sued them over the *trademark* icq (which they infringed upon,) not the underlying spam problem.
  • by mark-t ( 151149 ) <markt AT nerdflat DOT com> on Thursday October 17, 2002 @05:25PM (#4473977) Journal
    Presumably, the messenger service exists because it is perceived as useful. So simply stopping the service may not be seen as particularly constructive.

    What about altering the service so that instead of just popping up a window that you can do nothing with but close, there would exist an additional button [REPLY] on the pop up message window, which would then allow you to respond to the alert message as you see fit? (Sending a message back to the source via the same net send facility that they used to send data to you).

    Now I presume, of course, that an authorized administrator would have a large say in what services are going to be running on the computers in his domain, so if he wasn't interested in fielding replies to his authorized alert messages, he could simply have the requirement that the normal "one-way" messenger is the one that gets installed on the domain machines. Meanwhile, unauthorized sends would find themselves the target of maybe hundreds or thousands of replies, potentially causing a D.O.S. for them, even if they weren't actually running the messenger service themselves.

    Of course, the new messenger service would also log the time, date, and originating IP of the sender, so that it can be confirmed later -- even if the sender does not happen to be running the messenger service himself.

    Now I realize that this doesn't do a thing for handling people who fake their IP address, but I'd bet it go some distance to making this virtually unusable by most of the people who would just use such tools to spam.

  • by CZroe ( 618398 ) on Thursday October 17, 2002 @05:37PM (#4474076)
    The same spam I get in my Hotmail hit me last week through Windows messenger:
    "U N I V E R S I T Y D I P L O M A S"
    Notice the spacing designed to avoid word filtering? It looks like these guys are thinking ahead!
  • by MontyP ( 26575 ) on Thursday October 17, 2002 @05:52PM (#4474182)
    I come home one night to find one of these on my desktops... I thought it was funny and just happen to have taken a screen shot

    Messenger_Service_Spam.gif [geocities.com]
  • Misuse aside.... (Score:4, Interesting)

    by AtariDatacenter ( 31657 ) on Thursday October 17, 2002 @06:14PM (#4474333)
    I'm glad to see this feature. When I was managing a very large multiuser application, from time to time, I would have to close some sessions were causing problems. Or I would see a problem going on, and would like to know more about what they see on their end. But armed with only an IP address and a vauge hostname, I could only track them reliably as far as what building they were in. "If only I could hit their walld", I said.

    BTW, at the same time, UNIX users are in for a treat if their syslogd can accept outside messages. (Default behavior on many OSs, but has been changing.)

    Think "kernel.crit".
  • by michrech ( 468134 ) on Thursday October 17, 2002 @06:18PM (#4474379)
    I've seen several posts now where the following text is read wrong (either by reading to fast, or skimming, or something). Figgered I'd clear up the confusion...

    Zoltan Kovacs, founder of DirectAdvertiser.com, said the company has sold about 200 copies of the program since launching two months ago. According to Kovacs, the software is ideal for advertising 900-number and other telephone services.

    "I have customers who call me back and tell me they love it and it generates hundreds of calls right away," said Kovacs, who noted that Direct Advertiser is a good alternative to bulk e-mail because its messages are not regulated by spam laws.


    The above doesn't mean that Joe User, sitting at his desk receiving all the spam via this new method, is calling and saying how they love it -- as several posts have noted. It means that Joe Spammer, the lowest form of life on earth, is calling and saying how they love the 'product' that directadvertiser.com is selling. World of difference there.

I've noticed several design suggestions in your code.

Working...