{"id":6866,"date":"2017-03-06T08:30:54","date_gmt":"2017-03-06T16:30:54","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/03\/06\/news-657\/"},"modified":"2017-03-06T08:30:54","modified_gmt":"2017-03-06T16:30:54","slug":"news-657","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/03\/06\/news-657\/","title":{"rendered":"1.37 billion records leak after spammers forgot to password-protect backups"},"content":{"rendered":"

<\/p>\n

Credit to Author: Darlene Storm| Date: Mon, 06 Mar 2017 06:19:00 -0800<\/strong><\/p>\n

Nearly 1.4 billion people are affected by a database records leak caused by spamming group River City Media (RCM) forgetting to password-protect their backups.<\/p>\n

Last week, MacKeeper security researcher Chris Vickery promised a \u201c1.4 billion identity leak story<\/a>\u201d would be made public on Monday. The actual number of people affected \u2013 1,374,159,612 \u2013 is slightly lower than that, but is nothing to scoff at.<\/p>\n

Teaser screenshot of that DB’s summary data: pic.twitter.com\/PEnpJbDZRt<\/a><\/p>\n

Today, Vickery described<\/a> the leak from RCM as a \u201ctangible threat to online privacy and security\u201d because the database included nearly 1.4 billion email accounts tied to real names, IP addresses and \u201coften\u201d physical addresses. RCM accumulated that list via offers for things such as \u201cfree\u201d gifts, credit checks, sweepstakes, education opportunities and techniques like co-registration in which a person\u2019s info is shared with unnamed affiliates after clicking \u201csubmit\u201d or \u201cI agree\u201d on a website.<\/p>\n

Vickery has a knack for finding unsecured databases; this time, the repository of RCM backup files was publicly exposed after the spammers slipped up. \u201cSomeone had forgotten to put a password on this repository and, as a result, one of the biggest spam empires is now falling<\/em>,\u201d wrote Vickery.<\/p>\n

RCM, led by known spammers Alvin Slocombe<\/a> and Matt Ferris<\/a>, \u201cmasquerades as a legitimate marketing firm,\u201d but Vickery published a snippet of RCM\u2019s documentation which claims it can send over a billion<\/em> spam emails every day. The highlighted line in the documentation states, \u201cIn 2013 an IPv6 version of \u2018IPQ\u2019 was used across 4 servers to send over a billion bulk messages to Gmail per day.\u201d<\/p>\n

Vickery added:<\/p>\n

How can a group of about a dozen people be responsible for one billion emails sent in one day? The answer is a lot of automation, years of research, and fair bit of illegal hacking techniques.<\/p>\n

I say illegal hacking due to the presence of scripts and logs enumerating the groups\u2019 many missions to probe and exploit vulnerable mail servers.<\/p>\n

Vickery worked with CSO and Spamhaus to investigate the leak. As a result, Spamhaus is now blacklisting RCM\u2019s entire infrastructure. Salted Hash\u2019s Steve Ragan has a fantastic writeup<\/a> about RCM and its operations. In Ragan\u2019s words, the spammers \u201caccidentally exposed their entire operation to the public after failing to properly configure their Rsync backups.\u201d<\/p>\n

The researchers found chat logs which revealed that the spammers used a type of Slowloris attack to send their spam. They would \u201copen as many connections as possible between themselves and a Gmail server. This is done by purposefully configuring your own machine to send response packets extremely slowly, and in a fragmented manner, while constantly requesting more connections.\u201d<\/p>\n

Vickery added:<\/p>\n

Then, when the Gmail server is almost ready to give up and drop all connections, the spammer suddenly sends as many emails as possible through the pile of connection tunnels. The receiving side is then overwhelmed with data and will quickly block the sender, but not before processing a large load of emails.<\/p>\n

It’s a twist on a Slowloris attack, since \u201cthe spammer is not trying to completely disable the receiving server, he is only temporarily stressing the resources in order to overwhelm and force the processing of bulk email.\u201d<\/p>\n

The data appears to be real, but some may be outdated such as a person no longer living at the physical address attached to his or her name in the spammer\u2019s database. The researchers notified law enforcement and sent Microsoft, Apple and others details about abusive scripts and techniques.<\/p>\n

Vickery and Ragan intend to reveal more about the RCM operation. As Vickery put it, \u201cThere are enough spreadsheets, hard drive backups, and chat logs here to fill a book.\u201d<\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: Darlene Storm| Date: Mon, 06 Mar 2017 06:19:00 -0800<\/strong><\/p>\n

\n
\n

Nearly 1.4 billion people are affected by a database records leak caused by spamming group River City Media (RCM) forgetting to password-protect their backups.<\/p>\n

Last week, MacKeeper security researcher Chris Vickery promised a \u201c1.4 billion identity leak story<\/a>\u201d would be made public on Monday. The actual number of people affected \u2013 1,374,159,612 \u2013 is slightly lower than that, but is nothing to scoff at.<\/p>\n

\n

Teaser screenshot of that DB’s summary data: pic.twitter.com\/PEnpJbDZRt<\/a><\/p>\n

To read this article in full or to leave a comment, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[11072,714],"class_list":["post-6866","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-cybercrime-hacking","tag-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=6866"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6866\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=6866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=6866"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=6866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}