US Dems fill inboxes with 419 scams
Scammers pumping out emails that try to trick recipients into parting with large sums of cash are getting a helping hand from the Democratic National Committee.
According to a researcher with anti-spam company Cloudmark, 419 fraudsters have been relaying a "significant" amount of messages through the democrats.org domain name. The abuse, which dates back at least to the beginning of this month, helps evade filters that internet service providers employ to block the messages.
"Unfortunately, because they're able to relay mail through the Democratic Party server, it does affect the Democratic Party's IP reputation, as well as their domain sending reputation," Jamie Tomasello, Cloudmark's abuse operations manager, told The Register. "I was surprised."
One such message purports to come from Mrs. Amina Adan and seeks help in recovering $25m in assets belonging to her late husband, said to be the former Somalia security minister who died of an explosives attack in Central Somalia in June.
A second email carries the subject Sign up to volunteer for the Democratic Party and claims to be sent on behalf of a "a wealthy white farmer who was murdered on the land dispute in Zimbabwe." Other messages try to con recipients with a Microsoft lottery scam.
A spokesman for the Democratic Party had no comment. It's unclear if he alerted the party's webmaster so the open mail relay can be closed.
The messages were sent courtesy of this page, which allows anyone with an internet connection to send emails. The PHP script employs no CAPTCHA, or other measure to help ensure there is a real human being behind each email that gets funneled through the service. The service allows messages to be sent to 10 addresses as a time and even provides a way for people to import contacts they have stored in their address book.
As the use of spam filters has grown over the past few years, fraudsters sending large amounts of email have struggled to find low-cost ways to get around those protections. Carelessness at democrats.org is providing some relief.
They've added a CAPTCHA displaying a true ignorance of the problem at hand, FFS
I was rather impressed with this post. I must admit that I thought the article was about bad design, not a criticism of PHP but clearly given the length of g's post I must have been wrong.
Can we have a bucket of water icon to douse the flames? The only alternative seems to be a waste of good beer.
Sent myself a quick test mail from the page in question. From the headers:
Received: from web1.dnc.org (web1.dnc.org [192.168.10.71]) by mailservices.democrats.org (Postfix) with ESMTP id 6EAB912E47B for <me>; Mon, 31 Aug 2009 11:17:11 -0400 (EDT)
Received: by web1.dnc.org (Postfix, from userid 30) id 4F7C1482BD; Mon, 31 Aug
2009 11:17:11 -0400 (EDT)
Received: from phpmailer ([192.168.10.24]) by www.democrats.org with HTTP
(PHPMailer); Mon, 31 Aug 2009 11:17:11 -0400
Sorry, but it does indeed look like the venerable and frewuently-exploited PHPMailer is at work here. I know that the exploitable nature of the page itself isn't helping, but few (if any) security problems have been improved by the addition of PHP.