kpatz
MY HEAD A SPLODE
Premium
join:2003-06-13
Manchester, NH
| Re: Messenger Spam on 1026 - Bad News Kids Also, from what I've heard is the spammer doesn't have to "listen" for the response either, unless they want to confirm that the spam was received. By setting certain flags in the RPC data the spam will pop up with no handshake required, thus allowing mass "mailing" of messenger spam Slammer style, and the source IPs can even be spoofed.
I've been running a listener program, similar to your PortPuker (initially on 135, but now I run it on 1026-1028) on my Linux box and have captured over 2,300 messenger spams so far. The majority of them, ironically, are advertising ways to stop messenger spam.
Of course the good news is this garbage is easy to block, preferably with a firewall, or by turning off the Messenger service. Still, how much bandwidth is being wasted on this garbage.
I like that name PortPuker.  I've made utilities with cool names in the past, my favorite is when I write data import utilities and call them DataSuckers.
KJP
[text was edited by author 2003-09-16 08:32:47] |
·