That was fast

[solarbird]

Got mail back from the tech contact alias at the domain where the "this is interesting" LJ virus going around is hosted. To quote the reply:

Date: Sat, 12 Jun 2004 13:34:53 -0400
From: "Rev. Jeffrey Paul" <sneak@datavibe.net>
Subject: Re: Probable proof-of-concept for a simple spam robot

On Sat, Jun 12, 2004 at 10:31:17AM -0700, Dara's Commercial Account wrote:
> It looks like one of your users is hosting a proof-of-concept
> Livejournal virus. When activated, it posts itself to the livejournal
> of the user who clicks on it. Users who click on it there (it's a
> social engineering virus) find it posted to their own journals. The
> user is collecting hit data via a webbug as well. It is clear to me
> that this is an attempt to build a spam robot targeting livejournal.
> Please delete this user's spam data before they can use it.

Yeah, that's mine.

If it's clear to you that it's an attempt at a spambot, then please go and
drink bleach.

Thank you, drive through.

-j

--
--------------------------------------------------------
Rev. Jeffrey Paul -datavibe- sneak@datavibe.net
aim:x736e65616b pgp:0x15FA257E phone:8777483467
70E0 B896 D5F3 8BF4 4BEE 2CCF EF2F BA28 15FA 257E
--------------------------------------------------------

Comments

[avram]

So he’s at least two kinds of asshole.

[starfallz.livejournal.com]

Which one is it? The russian one or the "this is interesting" one?

[solarbird]

The "this is interesting" one - I posted the sourcecode in my previous friends-only post.

[marzipan-pig.livejournal.com]

I posted a link to this in a friend's journal who had it; I hope that is ok?

[solarbird]

Sure, that's okay.

[starsongky.livejournal.com]

I hope this asshat gets reported to the LJ staff - a lot. Maybe they can fix whatever hole he's exploiting.

[firni.livejournal.com]

So, do you think Ray clicked it on purpose or not? He's the only one on my friends list to have that up there.

[banner.livejournal.com]

I hope you forwarded that complaint to the rest of the staff, and his response as well. That guy is an ass and shouldn't be working for LJ.

[gazerwolf.livejournal.com]

This guy is getting his jollies off of it...

http://sneak.datavibe.net/blog/

Has several entries about it...including people congratulating the twit.

[solarbird]

He went down to the thread on lj_dev and went around taunting people. (In my case, he asked whether I had taken his advice yet.) Ha ha, fuck you.

[backrubbear.livejournal.com]

What I can't figure out is why you came to the conclusion that this was for building a spam robot.

[solarbird]

Really? Potential spam uses seem obvious to me. First, most people don't have popup blockers, so take this exact one and add one extra line to pop up an ad window, preferably in back so they don't know where it came from later. A second option would be to add several more lines of code to troll through the victim's community memberships and post ads to each of them under the victim's name, using the same technique. Sure, they'd get deleted quickly, but so does 99.99999% of all spam.

[backrubbear.livejournal.com]

You don't even need a popup - you need only to create a frame of zero or one pixel size and do everything inside that. You can even put a "legitimate" meme in there. You can even code around the LJ cookies not being present to prevent warnings about not having the password on submisssion.

The problem with doing the community spam is that you'd need to do at least two HTTP operations - the "fetch friends list", a parser and then a form.submit. I don't think you can actually do both simultaneously but I wouldn't bet on it.

[solarbird]

I haven't researched it, but I get the idea from some of the talk going around about how older clients worked that you could. But I'm not sure either.

Regardless, in the lamest case, you have something that's one line of code away from being a lame but effective-the-first-time spambot that propogates itself pretty effectively, or did this time. So that's why I came to the conclusion that I did; whether he meant it to be such or not, it is a proof-of-concept for a distributed spam engine. La.