onHacks

I disappeared again after my last post talking about spam collections and DNS misconfigurations. Today, I read log0’s post which he is calling for bots/ tools for his security research. Did you see anything familiar to you? How log0 is showing his contact to us, “log0 [ at ] gmail [ dot ] com”. We were using this format for quite some time, after we realized that showing full form of our address (eg. spam@onhacks.org) increases the chance that our email get exposed to spammers.

However, these kinds of representation already appeared on the Internet for last few years. Did you ever think of one fact is that: A clever spammers just need to modify few lines of code in their bots, changing the target strings they are looking for, then everything is just working as the same as in the past.

The most interesting thing is that RSnake has blogged his finding on this form of email representation last Tuesday. In short, he has googled with “at gmail dot com”, and surprisingly there are at least 6 email addresses in the first result page. There are many variations, but they all have the same pattern, here are some examples:

spam  at  onhacks  dot  com
spam [at] onhacks [dot] com
spam (at) onhacks (dot) com
spam <at> onhacks <dot> com
spam “at” onhacks “dot” com

(Obviously, I am trying my best to let spammers know my address)

I spent an hour to write a very simple PoC parser to retrieve email addresses from the result page mentioned above. Obviously there are at least 4 valid email addresses, it is not too hard to get those email addresses by bots. The parser is just looking for 1 ‘at’ and 1 ‘dot’ keyword appears sequentially in the pattern: [any word] “at” [any word] “dot” [any word]. The code is poorly written, I will improve it later this week.

It is not so difficult to discover the pattern between these email addresses, just a piece of cake even for primary students. Then, what kind of representation we should use to show our email address on the Internet? Display the jpeg of the email? Without adding noises to the image, it is as easy as just performing text recognition. With noises on the image, it is more like CAPTCHA. Since most of the CAPTCHA solver aims on specific type of CAPTCHA, it may takes more time to decrypt an “encrypted” email using CAPTCHA. However, it is not unsolvable.

What is the takeaway then? Better not showing your address on web! Or encrypt it into CAPTCHA, at least your email address has less chance being captured by spammers.

Email Email, Gmail, Spam

我知道 Gmail 防毒是用 Sophos 的，這也是2005年 有人測試過的。

現在是2009年了，早陣子我在寫 “誰在入侵我的系統 ~’誰會理我’ 是錯的~“的時候，我本地用 ClamAV 掃一下看看中毒情況，再把那 53 個執行檔用 Gmail 送去 VirusTotal。若果 Gmail 是用 Sophos 的話，不應該會出現 Gmail 掃不到，VirusTotal 能掃到的情況。

我把 53 個執行檔送去 Gmail ，亦在本地 ClamAV 掃一下。

再把那 12 個執行檔送去 VirusTotal。

ClamAV 仍然是沒有掃到，而且 Sophos 竟能掃到其中 10 個！似乎 Gmail 換了防毒呀！

Malware, Testing Gmail