Sean-Ward.com

At work I’m on a lot of e-mail lists, many of which are public and have been public for quite some time, and as a result, I get a decent amount of spam. Then there’s the fact that we send out a lot of e-mails to students, and if they get infected, our e-mail addresses can (and do) get harvested. Earlier last week, we got an e-mail asking us to do something about the stock e-mails that were getting sent to students at BGSU, but there’s not much we can do, being the wrong department. I responded with an e-mail listing some things they could do to mitigate the amount of spam they get, such as using the spam filter with their school e-mail (BGSU students: go to http://webmail.bgsu.edu/filters) or use an e-mail client, such as Thunderbird, that has either a built-in spam filter that can adapt to spam over time, or a plugin that can reference somewhere else. This, however, got me thinking on the spam that has been coming in the most: stock e-mails.

However, I really don’t care how this effects businesses, stock prices, or anything like that. Well, I should say that it isn’t the main focus of this post. If you want to read more about those particulars, such as more about scam itself, variations of it, and advice for users, investors, and companies, check out this article over at spamnation dot info.

We’ve all seen these stock spam e-mails. Typically, there’s a randomly generated image that lists some text to try and grab your attention and information about when the stock is going to be traded and how much it’ll cost. Aside from that though, are the stories that follow the stock image. Below the image are sentences regarding numerous topics, typically about a half dozen or so. This is done to allow the spam to bypass the popular Bayesian spam filters companies and organizations use.

Where do these e-mails come from? Now, these could be sent out from spammers who have machines set aside just for this purpose. However, due to the randomness of the e-mails, I would personally say that the e-mails are being sent from computers that have been compromised with malware, and are now being used as zombies to send out the spam. Chances are, the compromised computers connect to an IRC room or are otherwise sent commands from the Internet. Then, the infected computer either uses a list of e-mail addresses it was installed with, gathers an updated list from the web, or simply harvests e-mails from the computer it is on. After getting the list of recipients, it creates the image after getting commands saying what stocks they are to promote or where they are supposed to get this information from, etc. Once the image is created, the malware looks at the browser history of the infected computer, or the current webpage(s) that have been viewed by the users, and then place this text in the e-mail following the image. After all this is done, out the backdoor it goes, and into your mail box.

I only mention this due to the content that is being used by these e-mails. As of late, the subjects of these e-mails have gone from odd word combinations, such as “corkscrew sympathy” or “meticulous staple”, to more readable phrases like “is pleased to announce RSS2SQL, a new php script that allows users to converts RSS feeds to databases.” and “There are two main obstacles preventing the formation of a coalition government.”. Subjects like this caught my eye. I started to start Googling parts of the spam messages, and lo-and-behold, I was getting nearly exact matches for most fo the text. Here are some samples:

Subject:
Let’s be serious here, at best, this is a case of “porting” OpenBSD to another platform, UltraSparc III.

Body:
Theo explained, “Sun released CPU docs, but that’s useless.
11 adapters as found in Centrino Duo laptops. What will change are the middlemen who broker these ads. Today, data mining uses well-established statistical and machine learning techniques to build models that predict customer behavior. I’ve pre-ordered as well, and I hope many of the individuals using OpenBSD will buy CDs and swag.
However, I don’t think that’s the gist of the message. For instance, why not invite key customers to HR team meetings?
We canonly win, and then the device works. “It’s going to stay that way as far as I’m concerned,” Jason says, “I don’t need it. They fed those answers into their program as well.
They’re getting a big
As for getting involved as a developer I wanted to add an option to ls, saw how clean and elegant the code in the source tree was and became addicted soon after. They’re getting a big benefit from OpenBSD and have a vested interest in seeing in continue.

Almost every sentence from the above can be found somewhere on KernelTrap.
Here’s another, but it does not cover just one site in particular.

Subject:
I feel almost like a fully-dressed clown at church.

Body:
Please DO NOT do that. I’m not exactly sure howmany, but they would have certainly been enough to house that third pig and histwo retarded brothers.
Hogg and Uncle Jessie. I sometimes usebad language, and totally rip my loser co-workers.
I’ve been watching several episodes the past few days. Take advantage of our Platinum Membership offer in a very reasonable price, click here. Hooray for Ubi Soft and the PoP team! I suppose the rumors were true.
He’s now abouthalfway to collecting them all!
Although I didn’t get to shakehermetically-sealed hands with Steve Jobs, or even grace my eyeballs with hisrugged good looks, it was as close as a guy like me can hope to come to the MacPope. Free Articles Distribution and Search Engine for Free Ezine or Website Content - iSnare. I got lucky and there’s noone sitting in my entire row.
comAbout Us : My Account : Submit Articles : It’s been a bit odd trying to work out of a pristinely cleanenvironment. Michael Tatelman, a vp with Motorola’s Mobile Devices Business in North Asia, said, “We knew people were waiting for MotoRazr, and we knew the Christmas season would be big.
Should Ibe embarrassed to say that many of them brought me to tears?
This proves it will be as big a hit in Japan as it is everywhere else. But don’t just take our word for it. Please DO NOT do that.
This past weekendI decided it was time for a little outdoors work. I rarely make it from one end of the house to theother without stepping on at least one of them.
India has overtaken China as the fastest growing cellular market.
It’s becoming more and more obvious why such a fierce fight has emerged for a controlling an operator which is a mere fourth largest player in its market.
comAbout Us : My Account : Submit Articles : >From lighting to character models to new gameplay features, Splinter Cell 3 was astounding.
Javier Perez Dolset, Zed’s CEO, said his company possessed leading personalised mobile products which it would make available to MonsterMob.
Recently I attended traffic court inresponse to receiving the ticket.
It was an intense couple of days of meetingafter meeting and penning job-related emails in-between.
Website: upmarketcontent.
In the meantime, check out these DailyGame-exclusive videos of the game’s single-player components.
or should I say more OFFthe bicycleThe whole”teaching-your-son-how-to-ride-a-bicycle” thing is a HUGE deal for most people.
” anytime he detects any increase inspeed while riding in the car, or even the shopping cart at the grocery store.
Given its Steam distribution method, Valve is familiar with distributing its own games, albeit in a manner far different from the retail method in which Half-Life 2 will ship for Xbox. He was the first astronauton the moon after-all.
Where they evenrelated?
But of course we are busymotoring, and our price for flight comes due again in only a couple of days whenI fly back out to Anaheim, CA for the NAMM convention. I’m actually writing this on theairplane as I fly back home to Tennessee.
comSEO And Magnet Content By: Chris AngusMaintaining Your Dog’s Training Skills By: Veronica Sanchez M.
According to an Associated Press report, a man arrested by Iraqi authorities in conjunction with the filming was an official who supervised the execution and he’s now under investigation. html I’ve also posted pictures from theNAMM show.

Some websites that came up with that last one were some old pages from CJ Sorg idiotblog, the Inquirer, and Daily Game.

So, from this I would say that the infected machines are either snagging cached files on the machines they are on, or they are running their own spiders for the sake of generating random content (if they are on spam-specific servers). In either case, I’ve been mulling this over for the last couple days, and while I doubt I’m the first to look at what is going on, it is what I came up with on my own, without someone telling me “this is what is happening, see?” and so that makes me feel better about myself.

Now I’m leaving work and going home to celebrate Seanmas!