Carolyn P. Meinel Hall of Shame
Hacking Guide Errata
GUIDE TO (mostly) HARMLESS HACKING
Vol. 3 Number 1
How to protect yourself from email bombs!
______________________________________________________________
Email bombs! People like angry johnny [xchaotic], AKA the "Unamailer," have
made the news lately by arranging for 20 MB or more of email -- tens of
thousands of messages -- to flood into his victims' email accounts.
Email bombing can be bad news for two reasons. One, the victim can't easily
find any of their legitimate email in that giant garbage heap of spam. Two,
the flood of messages ties up mail servers and chews up communications
bandwidth.
Of course, those are the two main reasons that email bombers make their
attacks: to mess up people's email and/or harm the ISPs they target. The
email bomb is a common weapon of war against Internet hosts controlled by
spammers and con artists.
News stories make it sound like email bombing victims are, ahem, s*** out of
luck. But we aren't. We know, because johnny xchaotic (who prefers to be
called "angry johnny," by the way) -- the Christmas email bomber -- told the
press that he had targeted both the Happy Hacker list's Supreme
Commanderess, Carolyn Meinel. (Someone simultaneously attacked the Happy
Hacker list itself but no one has stepped forward to take credit for the
attempt).
But as you know from the fact that we got the Happy Hacker Digest out after
the attack, and by the fact that Meinel kept answering her email, there are
ways to beat the email bombers.
Now most of these are techniques for use by experts only. But if you are,
like most of us on this list, a newbie, you may be able to win points with
your ISP by emailing its technical help people with some of the information
within this guide. Maybe then they'll forgive you if your shell log file
gets to looking a little too exciting!
My first line of defense is to use several on-line services. That way,
whenever one account is getting hacked, bombed, etc., I can just email all
my correspondents and tell them where to reach me. Now I've never gotten
bombed into submission, but I have gotten hacked badly and often enough that
I once had to dump an ISP in disgust. Or, an ISP may get a little too
anxious over your hacking experiments. So it's a good idea to be prepared to
jump accounts.
But that's a pretty chicken way to handle email bombing. Besides, a member
of the Happy Hacker list says that the reason angry johnny didn't email bomb
all the accounts I most commonly use is because he persuaded johnny to just
bomb one for publicity purposes. But even if johnny had bombed all my
favorite accounts, I could have been back on my feet in a hurry.
There are several ways that either your ISP or you can defeat these attacks.
The simplest defense is for your ISP to block mail bombs at the router. This
only works, however, if the attack is coming from one or a few hosts. It
also only works if your ISP agree to help you out. Your ISP may just chicken
out and close your account.
***************************
Newbie note: routers are specialized computers that direct traffic. A host
is a computer on the Internet.
***************************
But what if the attack comes from many places on the Internet? That happened
to me on Christmas day when angry johnny took credit for an email bombing
attack that also hit a number of well-known US figures such as evangelist
Billy Graham, President Bill Clinton and House Majority Leader Newt
Gingrich. (I blush to find myself in such company).
The way angry johnny worked this attack was to set up a program that would
go to one computer that runs a program to handle email lists and
automatically subscribe his targets to all lists handled by that computer.
Then his program went to another computer that handles email lists and
subscribed his targets to all the lists it handled, and so on.
I was able to fix my problem within a few minutes of discovery. Xchaotic had
subscribed all these lists to my address cmeinel@swcp.com. But I use my
private domain, techbroker.com, to receive email. Then I pipe all this from
my nameserver at Highway Technologies to whatever account I find useful at
the time. So all I had to do was go to the Highway Technologies Web site and
configure my mail server to pipe email to another account.
**************************
Newbie note: a mail server is a computer that handles email. It is the
computer that sends you email when you hook your personal computer up to the
Internet and give it a command to upload or download your email.
**************************
***********************
Evil genius tip: You can do something like this by creating a file in your
shell account (you do have a shell account, don't you? SHELL ACCOUNT! All
good hackers should have a SHELL ACCOUNT!) named .forward. This file directs
your email to another email account of your choice.
***********************
If angry johnny had email bombed cmeinel@techbroker.com, I would have piped
all that crud to dev/null and requested that my correspondents email to
carolyn@techbroker.com, etc. It's a pretty flexible way of handling things.
And my swcp.com accounts work the same way. That ISP, Southwest Cyberport,
offers each user several accounts all for the same price, which is based on
total usage. So I can create new email addresses as needed.
Warning -- this technique -- every technique we cover here -- will still
cause you to lose some email. But I figure, why get obsessive over it?
According to a study by a major paging company, a significant percentage of
email simply disappears. No mail daemon warning that the message failed,
nothing. It just goes into a black hole. So if you are counting on getting
every piece of email that people send you, dream on.
But this doesn't solve my ISP's problem. They still have to deal with the
bandwidth problem of all that crud flooding in. And it's a lot of crud. One
of the sysadmins at Southwest Cyberport told me that almost every day some
luser email bombs one of their customers. In fact, it's amazing that angry
johnny got as much publicity as he did, considering how commonplace email
bombing is. So essentially every ISP somehow has to handle the email bomb
problem.
How was angry johnny was able to get as much publicity as he did? You can
get an idea from this letter from Lewis Koch, the journalist who broke the
story (printed with his permission):
*******************
From: Lewis Z Koch
Subject: Question
Carolyn:
First, and perhaps most important, when I called you to check if you had
indeed been email bombed, you were courteous enough to respond with
information. I think it is a tad presumptuous for you to state that "as a
professional courtesy I am _letting_ Lewis Koch get the full scoop." This
was a story that was, in fact, exclusive.
(Carolyn's note: as a victim I knew technical details about the attack that
Koch didn't know. But since Koch tells me he was in contact with angry
johnny in the weeks leading up to the mass email bombings of Christmas 1996,
he clearly knew a great deal more than I about the list of johnny's targets.
I also am a journalist, but deferred to Koch by not trying to beat him to
the scoop.)
Second, yes I am a subscriber and I am interested in the ideas you advance.
But that interest does not extend to feeding you -- or single individual
or group -- :"lots of juicy details." The details of any story lay in the
writing and commentary I offer the public. "Juicy" is another word for
sensationalism, a tabloid approach -- and something I carefully avoid.
(Carolyn's note: If you wish to see what Koch wrote on angry johnny, you may
see it in the Happy Hacker Digest of Dec. 28, 1996, posted at the Hackers
forum at http://www.infowar.com/cgi-shl/login.exe.)
The fact is I am extraordinarily surprised by some of the reactions I have
received from individuals, some of whom were targets, others who are
bystanders.
The whole point is that there are extraordinary vulnerabilities to and on
the Net -- vulnerabilities which are being ignored...at the peril of us all.
Continuing: "However, bottom line is that the email bomber used a technique
that is ridiculously lame -- so lame that even Carolyn Meinel could turn
off the attack in mere minutes. Fry in dev/null, email bomber!"
johnny made the point several times that the attack was "simple." It was
deliberately designed to be simple. I imagine -- I know -- that if he, or
other hackers had chosen to do damage, serious, real damage, they could
easily do so. They chose not to.
One person who was attacked and was angry with my report. He used
language such as" his campaign of terror," "the twisted mind of 'johnny',"
"psychos like 'johnny'," "some microencephalic moron,""a petty gangster" to
describe johnny.
This kind of thinking ignores history and reality. If one wants to use a
term such as "campaign of terror" they should check into the history of the
Unabomber, or the group that bombed the Trade Center, or the Federal
Building in Oklahoma City...or look to what has happened in Ireland or
Israel. There one finds "terrorism."
What happened was an inconvenience --equivalent, in my estimation, to the
same kind of inconvenience people experienced when young people blocked the
streets of major cities in protest against the war in Vietnam. People were
inconvenienced --- but the protesters were making a point about an illegal
and unnecessary war that even the prosecutors of the war, like Robert
McNamara knew from the beginning was a lost venture. Hundreds of thousands
of people lost their lives in that war -- and if some people found
themselves inconvenienced by people protesting against it -- I say, too
d*** bad.
Thank you for forwarding my remarks to your list
***********************
Ahem. I'm flattered, I guess. Are you suggesting the Happy Hacker list --
with its habit of ***ing out naughty words -- and evangelist Billy Graham --
whose faith I share -- are of an Earth-shaking level of political bad
newsness comparable to the Vietnam War? I'm sure you don't really think
this. But let's get some perspective on this, OK?
So what are some more ways to fight email bombs?
For bombings using email lists, one approach is to run a program that sorts
through the initial flood of the email bomb for those "Welcome to the Tomato
Twaddler List!" messages which tell how to unsubscribe. These programs then
automatically compose unsubscribe messages and send them out.
Damien Sorder (jericho@dimensional.com) has set up an ftp site to
distribute one of these programs. To get it, ftp to:
ftp.nova.dimensional.com
/pub/security/security.utils/unix/unsubscribe.mailist.perl
Another way your ISP can help you is to provide a program called Procmail
(which runs on the Unix operating system. For details, Zach Babayco
(zachb@netcom.com) has provided the following article. Thank you, Zach!
*******************************
Defending Against Email-Bombing and Unwanted Mail
Copyright (C) Zach Babayco, 1996
[Before I start this article, I would like to thank Nancy McGough for letting
me quote liberally from her Filtering Mail FAQ, available at http://www.cis.
ohio-state.edu/hypertext/faq/usenet/mail/filtering-faq/faq.html. This is
one of the best filtering-mail FAQs out there, and if you have any
problems with my directions or want to learn more about filtering mail,
this is where you should look.]
Lately, there are more and more people out there sending you email that
you just don't want, like "Make Money Fast!" garbage or lame ezines that
you never requested or wanted in the first place. Worse, there is the
email bomb.
There are two types of email bombs, the Massmail and the Mailing List bomb:
1) Massmail-bombing. This is when an attacker sends you hundreds, or
perhaps even thousands of pieces of email, usually by means of a script
and fakemail. Of the two types, this is the easier to defend against,
since the messages will be coming from just a few addresses at the most.
2) Mailing List bombs. In this case, the attacker will subscribe you to
as many mailing lists as he or she can. This is much worse than a massmail
because you will be getting email from many different mailing lists, and
will have to save some of it so that you can figure out how to unsubscribe
from each list.
This is where Procmail comes in. Procmail (pronounced prok-mail) is a
email filtering program that can do some very neat things with your mail,
like for example, if you subscribe to several high-volume mailing lists,
it can be set up to sort the mail into different folders so that all the
messages aren't all mixed up in your Inbox. Procmail can also be
configured to delete email from certain people and addresses.
Setting up Procmail
-------------------
First, you need to see if your system has Procmail installed. From the
prompt, type:
> which procmail
If your system has Procmail installed, this command will tell you where
Procmail is located. Write this down - you will need it later.
*NOTE* If your system gives you a response like "Unknown command: which"
then try substituting 'which' with 'type', 'where', or 'whereis'.
If you still cannot find Procmail, then it is probably a good bet that
your system does not have it installed. However, you're not completely
out of luck - look at the FAQ I mentioned at the beginning of this file
and see if your system has any of the programs that it talks about.
Next, you have to set up a resource file for Procmail. For the rest of this
document, I will use the editor Pico. You may use whichever editor you feel
comfortable with.
Make sure that you are in your home directory, and then start up your editor.
> cd
> pico .procmailrc
Enter the following in the .procmailrc file:
# This line tells Procmail what to put in its log file. Set it to on when
# you are debugging.
VERBOSE=off
# Replace 'mail' with your mail directory.
MAILDIR=$HOME/mail
# This is where the logfile and rc files will be kept
PMDIR=$HOME/.procmail
LOGFILE=$PMDIR/log
# INCLUDERC=$PMDIR/rc.ebomb
(yes, type the INCLUDERC line WITH the #)
Now that you've typed this in, save it and go back up to your home directory.
> cd
> mkdir .procmail
Now go into the directory that you just made, and start your editor up with
a new file: rc.ebomb:
IMPORTANT: Be sure that you turn off your editor's word wrapping during
this part. You will need to have the second, third, and fourth lines of
this next example all on one line. With Pico, use the -w flag. Consult
your editor's manual page for instructions on turning off its word wrapping.
Make sure that when you edit it, you leave NO SPACES in that line.
> cd .procmail
> pico -w rc.noebomb
# noebomb - email bomb blocker
:0
* ! ^((((Resent-)?(From|Sender)|X-Envelope-From):|From )(.*[^.%@a-z0-9])?
(Post(ma?(st(e?r)?|n)|office)|Mail(er)?|daemon|mmdf|root|uucp|LISTSERV|owner
|request|bounce|serv(ices?|er))([^.!:a-z0-9]|$)))
* ! ^From:.*(postmaster|Mailer|listproc|majordomo|listserv|cmeinel|johnb)
* ! ^TO(netstuff|computing|pcgames)
/dev/null
Lets see what these do. The first line tells Procmail that this is the
beginning of a "recipe" file. A recipe it basically what it sounds like
- it tells the program what it should look for in each email message, and
if it finds what it is looking for, it performs an action on the message
- forwarding it to someone; putting it in a certain folder; or in this
case, deleting it.
The second, third, and fourth lines (the ones beginning with a *)are called
CONDITIONS. The asterisk (*) tells Procmail that this is the beginning of a
condition. The ! tells it to do the OPPOSITE of what it would normally do.
Condition 1:
* ! ^((((Resent-)?(From|Sender)|X-Envelope-From):|From )(.*[^.%@a-z0-9])?
(Post(ma?(st(e?r)?|n)|office)|Mail(er)?|daemon|mmdf|root|uucp|LISTSERV|owner
|request|bounce|serv(ices?|er))([^.!:a-z0-9]|$)))
Don't freak out over this, it is simpler than it seems at first glance.
This condition tells Procmail to look at the header of a message, and see
if it is from one of the administrative addresses like root or
postmaster, and also check to see if it is from a mailer-daemon (the
thing that sends you mail when you bounce a message). If a message IS
from one of those addresses, the recipe will put the message into your
inbox and not delete it.
Advanced User Note: Those of you who are familiar with Procmail are
probably wondering why I require the user to type in that whole long line
of commands, instead of using the FROM_MAILER command. Well, it looked
like a good idea at first, but I just found out a few days ago that
FROM_MAILER also checks the Precedence: header for the words junk, bulk,
and list. Many (if not all) mailing-list servers have either Precedence:
bulk or Precedence: list, so if someone subscribes you to several hundred
lists, FROM_MAILER would let most of the messages through, which is NOT
what we want.
Condition 2:
* ! ^From:.*(listproc|majordomo|cmeinel|johnb)
This condition does some more checking of the From: line in the header.
In this example, it checks for the words listproc, majordomo, cmeinel,
and johnb. If it is from any of those people, it gets passed on to your
Inbox. If not, it's a goner. This is where you would put the usernames
of people who normally email you, and also the usernames of mailing-list
servers, such as listproc and majordomo. When editing this line,
remember to: only put the username in the condition, not a persons full
email address, and remember to put a | between each name.
Condition 3:
* ! ^TO(netnews|crypto-stuff|pcgames)
This final condition is where you would put the usernames of the mailing
lists that you are subscribed to (if any). For example, I am subscribed
to the netnews, crypto-stuff, and pcgames lists. When you get a message
from most mailing lists, most of the time the list address will be in the
To: or Cc: part of the header, rather than the From: part. This line
will check for those usernames and pass them through to your Inbox if
they match. Editing instructions are the same as the ones for Condition 2.
The final line, /dev/null, is essentially the trash can of your system.
If a piece of email does not match any of the conditions, (i.e. it isn't
from a mail administrator, it isn't from a listserver or someone you
write to, and it's not a message from one of your usual mailing lists)
Procmail dumps the message into /dev/null, never to be seen again.
Ok. Now you should have created two files: .procmailrc and rc.noebomb.
We need one more before everything will work properly. Save rc.noebomb
and exit your editor, and go to your home directory. Once there, start
your editor up with the no word wrapping command.
> cd
> pico -w .forward
We now go to an excerpt from Nancy M.'s Mail Filtering FAQ:
Enter a modified version of the following in your ~/.forward:
"|IFS=' ' && exec /usr/local/bin/procmail -f- || exit 75 #nancym"
== IMPORTANT NOTES ==
* Make sure you include all the quotes, both double (") and single (').
* The vertical bar (|) is a pipe.
* Replace /usr/local/bin with the correct path for procmail (see step 1).
* Replace `nancym' with your userid. You need to put your userid in
your .forward so that it will be different than any other .forward
file on your system.
* Do NOT use ~ or environment variables, like $HOME, in your .forward
file. If procmail resides below your home directory write out the
*full* path.
On many systems you need to make your .forward world
readable and your home directory world searchable in order for the
mail transport agent to "see" it. To do this type:
cd
chmod 644 .forward
chmod a+x .
If the .forward template above doesn't work the following alternatives
might be helpful:
In a perfect world:
"|exec /usr/local/bin/procmail #nancym"
In an almost perfect world:
"|exec /usr/local/bin/procmail USER=nancym"
In another world:
"|IFS=' ';exec /usr/local/bin/procmail #nancym"
In a different world:
"|IFS=' ';exec /usr/local/bin/procmail USER=nancym"
In a smrsh world:
"|/usr/local/bin/procmail #nancym"
Now that you have all the necessary files made, it's time to test this
filter. Go into your mailreader and create a new folder called
Ebombtest. This procedure differs from program to program, so you may
have to experiment a little. Then open up the rc.noebomb file and change
/dev/null to Ebombtest. (You should have already changed Conditions 2
and 3 to what you want; if not, go do it now!) Finally, open up
.procmailrc and remove the # from the last line.
You will need to leave this on for a bit to test it. Ask some of the
people in Condition 2 to send you some test messages. If the messages
make it through to your Inbox, then that condition is working fine. Send
yourself some fake email under a different name and check to see if it
ends up in the Ebombtest folder. Also, send yourself some fakemail from
root@wherever.com to make sure that Condition 1 works. If you're on any
mailing lists, those messages should be ending up in your Inbox as well.
If all of these test out fine, then congratulations! You now have a
working defense against email bombs. For the moment, change the
Ebombtest line in the rc.noebomb file back to /dev/null, and put the #
in front of the INCLUDERC line in the .procmailrc file. If someone ever
decides to emailbomb you, you only need to remove the #, and you will
have greatly cut down on the amount of messages coming into your Inbox,
giving you a little bit of breathing room to start unsubscribing to all
those lists, or start tracking down those idiots who did it and get their
asses kicked off their ISP's.
If you have any comments or questions about this, email me at
zachb@netcom.com. Emailbombs WILL go to /dev/null, so don't bother!
Disclaimer: When you activate this program, it is inevitable that a
small amount of wanted mail MAY get put into /dev/null, due to the fact
that it is nearly impossible to know the names of all the people that may
write to you. Therefore, I assume no responsibility for any email which
may get lost, and any damages which may come from those lost messages.
********************
A note of thanks goes to Damien Sorder (jericho@dimensional.com) for his
assistance in reviewing this guide.
_________________________________________________________
Want to see back issues of Guide to (mostly) Harmless Hacking? See either
http://www.tacd.com/zines/gtmhh/ or
http://ra.nilenet.com/~mjl/hacks/codez.htm.
Subscribe to our email list by emailing to hacker@techbroker.com with
message "subscribe" or join our Hacker forum at
http://www.infowar.com/cgi-shl/login.exe.
Want to share some kewl stuph with the Happy Hacker list? Correct mistakes?
Send your messages to hacker@techbroker.com. To send me confidential email
(please, no discussions of illegal activities) use cmeinel@techbroker.com
and be sure to state in your message that you want me to keep this
confidential. If you wish your message posted anonymously, please say so!
Please direct flames to dev/null@techbroker.com. Happy hacking!
Copyright 1997 Carolyn P. Meinel. You may forward or post on your Web site
this GUIDE TO (mostly) HARMLESS HACKING as long as you leave this notice at
the end..
________________________________________________________
