Every time in a while, when some spam message hits one of my inboxes and it's one of those tracking messages (images or links meant to confirm your e-mail address appears to be valid) I take the time to draft some (usually oneliner) script that would send them back some garbage to fullfill their databases with junk so their spamming boxes spend some time figuring out why those "confirmed" email addies ain't working (a somewhat time exhausting task).
Usually I'd have some dictionary text files at hand to iterate over them and get some words to use, but here I'll depict just the basic concept with randomly generated gibberish, the wise SOFH in you will figure out ways to make it better in no time:
#!/bin/bash
url='http://cawaseswokofmum.com/support.php?name='
opts=-U "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)"
for i in $(seq 1 1000)
do
ad=$(makepasswd --chars=10)
dom='@hotmail.com'
wget $url$ad$dom -O /dev/null $opts >&/dev/null
done
Simple sample just to not make it look overly complex, major aspects I tried to spot are:
1) Some good source of random crap to feed the spam bot with. Here I used some simple source, I could have dd'ed
/dev/urandom or something else, yet results would be debatable unless my target script were blindfully accepting new addresses. For confirmation gathering scripts it's better to get some names or words dictionary and salt it with random numbers, for example mary1999, mary2000, mary2001, etc. Something similar can be used for domains too, here I left all of the shitload on the Hotmail shoulders.
2) wget is a really powerful toy, you can command him to get cookies and authentication stuff from anywhere, or as I did here you may need to use a different User Agent string. (these guys were aware of the wget playing already, so I pretend to be IE8)
3) wget URL arguments: in this case it was pretty straightforward. But in general all you need to do is some quoting here and there, so "special" symbols such as question and ampersand marks don't get incorrectly interpreted by the command line shell. Some other times verification arguments are tokens obtained by base64 or slt. You'll need to think a bit 'til you find out the way it works. Here some python snippet I used some time ago for base64 encoding:
#!/usr/bin/python
import binascii
import sys
print binascii.b2a_base64(sys.argv[1]),
When this is fed with
666,666,diefuckingspambot@gmail.comyou get
NjY2LDY2NixkaWVmdWNraW5nc3BhbWJvdEBnbWFpbC5jb20=Ready to deceive some spam making mother fucker that likes verification in such a format.
The more places you can bomb these hosts from, the more annoying it can be, only your imagination will find a limit: use proxies, anonymize your request, introduce random waits, random user agents, if you don't manage a big bunch of servers you can convince some friends to join your journey against spammers =)
Also including anti-gathering tools such as
this one in your web content can help to delude these mofos.
For second time in the history, two Mersenne prime numbers were discovered out of order. With 12kk and 11kk digits, the discovery qualify for a U$S 100K EFF award.
Then I keep reading, to I find out that the hacking event had the dear mad-doctors totally desperate, AND the script kidz were just a step away from the real computing/controlling beasts! I can imagine some Transformers movie alike scene with yelling-and-running peeps waving their arms in their white suites . Gee, now THAT was pathetic. Honestly, if we had such an expensive and powerful facility built and handled by a band of not-so professional 'Homer Simpsons', and -which is probably worse- such operators were relying on end-user level tailored software, with bunchs of seamlessly complex (read bug-prone) abstraction layers and wizards and web 2.0 candy bars then yes, we DO deserve a doomsday. One that hurts a lot, preferably.
On may 21, MS announced they won't widely implement their own OOXML thing 'til Office 14 (whatever they plan to call it), while the ODF support would be added by Office 12 SP2, upon their own words.
