{"id":3908,"date":"2017-03-06T20:41:32","date_gmt":"2017-03-06T20:41:32","guid":{"rendered":"https:\/\/www.rsoftsolution.com\/blog\/spammers-expose-over-a-billion-email-addresses-after-failed-backup.html"},"modified":"2017-03-06T20:41:32","modified_gmt":"2017-03-06T20:41:32","slug":"spammers-expose-over-a-billion-email-addresses-after-failed-backup","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/spammers-expose-over-a-billion-email-addresses-after-failed-backup.html","title":{"rendered":"Spammers expose over a billion email addresses after failed backup"},"content":{"rendered":"


\n<\/p>\n

At its height, River City Media<\/a>, run by Alvin Slocombe and Matt Ferris, sent out a billion emails a day, slamming Gmail servers with fragmented traffic in order to ensure all of its email went out on time. After failing to password-protect a remote backup, however, the company has exposed its nearly 1.4 billion email records, some of which contain real names and addresses. The company, for all intents and purposes, is sunk but the privacy implications of this trove of data are staggering.<\/p>\n

Discovered by a security researcher for MacKeeper, Chris Vickery<\/a>, the leaked data appeared as a result of a failed rsync backup \u2013 essentially a remote backup gone wrong. The data sat on an exposed server for months, allowing Vickery \u2013 and anyone else \u2013 access to chat logs, emails, and, most important, the company\u2019s massive email list.<\/p>\n

Vickery feels, well, victorious.<\/p>\n

\u201cI found an rsync server on port 873 that they had not put any password or security of any sort on and it has led to he downfall of a criminal enterprise,\u201d he said. \u201cI\u2019m hoping that they\u2019ll be out of business soon but that would largely depend on actions by law enforcement. If you\u2019re sitting behind bars it\u2019s hard to spam.\u201d<\/p>\n

He also found the list to be quite unruly.<\/p>\n

\u201cI\u2019m still struggling with the best software solution to handle such a voluminous collection, but I have looked up several people that I know and the entries are accurate,\u201d Vickery told CSO Online<\/a>. \u201cThe only saving grace is that some are outdated by a few years and the subject no longer lives at the same location.\u201d<\/p>\n

Slow Loris<\/h2>\n

The multiple RCM spam techniques were extraordinary. The company would first send out tens of thousands of \u201cwarm-up emails\u201d to their own email addresses on Gmail and other servers. Because these emails would never bounce or send complaints \u2013 they were owned by RCM after all \u2013 the security systems wouldn\u2019t notice the rest of the emails exploding out of the servers.<\/p>\n

Further, the spammers would send fragmented data slowly \u2013 technically a \u201cslowloris\u201d attack \u2013 while requesting multiple connections under the guise of error correction. Then, when all the servers were accepting data, they would \u201cstuff as much packet data\u201d into the servers as they could before disconnection.<\/p>\n

\"9179614ac47a3f6accce56a0277ccc2d58b99f0fa0ddd\"<\/p>\n

Vickery has spent the last few days going through the massive data dump and has found the weapons spammers use to attack mail servers.<\/p>\n

\u201cThere are scripts in here for all sorts of nefarious things that may or may not be patched already. I will go into more detail after I talk to Gmail, Microsoft, and Yahoo,\u201d he said. He estimates that the company had only twenty actual hardware servers and instead used \u201cbackroom dealings\u201d with friends and affiliates to send out the bulk of their spam, partners who are now refusing to work with RCM. Ad partner Amobee<\/a>, for example, has disowned the company.<\/p>\n

\u201cThey have tons of developed software for hiding their own mail servers, making themselves look like other people, and spoofing email address,\u201d said Vickery. They called these \u201cProjects\u201d and there were hundreds of them.<\/p>\n

Flatline<\/h2>\n

RCM has always been on The Register of Known Spam Operations (ROKSO) and has used over 2,199 IP addresses to send out email making it wildly difficult to block. It has done campaigns for Nike, Gillette, Victoria\u2019s Secret, Covergirl, and ATT, among others although these big names didn\u2019t use RCM directly but were shunted onto the spammers by other, presumably legitimate, marketing firms.<\/p>\n

Vickery believes this leak and the associated data will put RCM out of business indefinitely.<\/p>\n

\u201cAs far as the RCM email spam empire goes it\u2019s going to be very hard for them to operate in the near future,\u201d he said. But this won\u2019t stop all spam forever. This, in the end, is a major victory in an ongoing war.<\/p>\n

\u201cI\u2019m sure somebody else will step into the void they left,\u201d Vickery said.<\/p>\n

<\/p>\n

Featured Image: Christof Schmitt<\/a>\/Flickr<\/a> UNDER A CC BY-SA 2.0<\/a> LICENSE<\/small><\/p>\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunchIt\/~3\/CwfqvXOEIH8\/<\/p>","protected":false},"excerpt":{"rendered":"

At its height, River City Media, run by Alvin Slocombe and Matt Ferris, sent out a billion emails a day, slamming Gmail servers with fragmented traffic in order to ensure <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[19],"tags":[25],"class_list":["post-3908","post","type-post","status-publish","format-standard","hentry","category-enterprise-software","tag-enterprise"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t