The Register® — Biting the hand that feeds IT

Feeds

US Dems fill inboxes with 419 scams

democrats.org co-opted

Agentless Backup is Not a Myth

Scammers pumping out emails that try to trick recipients into parting with large sums of cash are getting a helping hand from the Democratic National Committee.

According to a researcher with anti-spam company Cloudmark, 419 fraudsters have been relaying a "significant" amount of messages through the democrats.org domain name. The abuse, which dates back at least to the beginning of this month, helps evade filters that internet service providers employ to block the messages.

"Unfortunately, because they're able to relay mail through the Democratic Party server, it does affect the Democratic Party's IP reputation, as well as their domain sending reputation," Jamie Tomasello, Cloudmark's abuse operations manager, told The Register. "I was surprised."

One such message purports to come from Mrs. Amina Adan and seeks help in recovering $25m in assets belonging to her late husband, said to be the former Somalia security minister who died of an explosives attack in Central Somalia in June.

A second email carries the subject Sign up to volunteer for the Democratic Party and claims to be sent on behalf of a "a wealthy white farmer who was murdered on the land dispute in Zimbabwe." Other messages try to con recipients with a Microsoft lottery scam.

A spokesman for the Democratic Party had no comment. It's unclear if he alerted the party's webmaster so the open mail relay can be closed.

The messages were sent courtesy of this page, which allows anyone with an internet connection to send emails. The PHP script employs no CAPTCHA, or other measure to help ensure there is a real human being behind each email that gets funneled through the service. The service allows messages to be sent to 10 addresses as a time and even provides a way for people to import contacts they have stored in their address book.

As the use of spam filters has grown over the past few years, fraudsters sending large amounts of email have struggled to find low-cost ways to get around those protections. Carelessness at democrats.org is providing some relief.

Steps to Take Before Choosing a Business Continuity Partner

Latest Comments

Their response?

They've added a CAPTCHA displaying a true ignorance of the problem at hand, FFS

0
0

@g_mannings

I was rather impressed with this post. I must admit that I thought the article was about bad design, not a criticism of PHP but clearly given the length of g's post I must have been wrong.

Can we have a bucket of water icon to douse the flames? The only alternative seems to be a waste of good beer.

0
0

@g_mannings

Sent myself a quick test mail from the page in question. From the headers:

Received: from web1.dnc.org (web1.dnc.org [192.168.10.71]) by mailservices.democrats.org (Postfix) with ESMTP id 6EAB912E47B for <me>; Mon, 31 Aug 2009 11:17:11 -0400 (EDT)

Received: by web1.dnc.org (Postfix, from userid 30) id 4F7C1482BD; Mon, 31 Aug

2009 11:17:11 -0400 (EDT)

Received: from phpmailer ([192.168.10.24]) by www.democrats.org with HTTP

(PHPMailer); Mon, 31 Aug 2009 11:17:11 -0400

Sorry, but it does indeed look like the venerable and frewuently-exploited PHPMailer is at work here. I know that the exploitable nature of the page itself isn't helping, but few (if any) security problems have been improved by the addition of PHP.

0
0

More from The Register

 breaking news
Number of cops abusing Police National Computer access on the rise
Only a telegram from the Queen can get you off it
 breaking news
NSA PRISM snoop-gate: Won't someone think of the children, wails Apple
10,000 things probed, mostly about missing kids, Alzheimer patients, we're told
Flash flaw potentially makes every webcam or laptop a PEEPHOLE
But it's a Google problem - Chrome only, insists Adobe
Internet fraud still stings suckers
Australians twice as gullible as Americans
 breaking news
NSA PRISM-gate: Relax, GCHQ spooks 'keep us safe', says Cameron
Whatever they are up to, it's all above board, we're told
 breaking news
Yahoo! joins! rivals! in! PRISM! data! request! admission!
Keep calm and carry on using American tech firms, folks
PRISM snitch claims NSA hacked Chinese targets since 2009
Snowden suddenly looks safer in Hong Kong after revelations
 breaking news
US chief spook: Look, we only want to spy on 6.66 BEELLLION of you
Americans assured they are not in the NSA's sights
Speech-to-text drives motorists to distraction
Will talking to you mean I crash into that car up ahead, Siri?
DHS warns of vulns in hospital medical equipment
Has your doctor's anasthesia machine been hacked?