You could be seeing a great picture here
_

Charles on… anything that comes along

Thursday 23 September 2004

Filed under: — Charles @ 11:38 am

If your IP address is 208.252.68.66, your machine has a Trojan that’s annoying me

(The following is the text of an email sent to MCI’s abuse department… more in hope than expectation.

Hi, abuse people at MCI.com.

My blog keeps details of people who try to post crap.
This is one of dozens of attempts - very annoying to me - using one of your customers whose computer is clearly compromised. (There are many similar attempted posts from other networks. Therefore this one is being used as part of a bot network.)

Please trace this machine (should be obvious from the IP and time of posting) and GET IT FIXED.

Your customer is contributing to online fraud, theft, possibly IP theft and for all we know the murder of kittens by not having a secure system. As I’ve now warned you, it’s your responsibility too. I would email the infected customer but there’s no way to work out their email from their IP. The email here is of course a spoof.

Your urgent response most appreciated. And this and your response will be blogged - we all live in the public eye, after all.

—begin forwarded text—

>X-VirusChecked: Checked
>Subject: [Charles on… anything that comes along] Please approve: “”A full house of dysfunctionality”: why we all hate automated answering systems”
>Date: Thu, 23 Sep 2004 08:32:42 +0100
>
>A new comment on the post #102 “”A full house of dysfunctionality”: why we all hate automated answering systems” is waiting for your approval
Author : カジノ米国オンラインカジノ (IP: 208.252.68.66 , 208.252.68.66)

[I hope this isn’t something very rude in Katakana; if it is, please tell me and I’ll remove it - Charles]

>E-mail : bartlett_john@bloginc.com [faked - Charles]
>URL : http://www. asdfhost. com/ members/ megafungames/ casino_us_online_casino.htm [Spaces put in to break the URL, but just so you can see where this junk points to - Charles]
>Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=208.252.68.66
>Comment:
>Hello, I just wanted to say you have a very informative site which really made me think, thanks very much! Have a nice Day!!
– end forwarded text –

One of 27 spam posts, all with roughly the same content, posted from a number of different machines in the US and Europe in the course of 3 minutes 6 seconds at 8.33am today.
Bot nets are depressing for a number of reasons. First, they’re so widespread, which means getting rid of them will be hard. Second, the ones I’m seeing are in Europe and the US; it’s not Far Eastern machines being compromised. Third, it’s so damn unnecessary, if only Bill Gates and the bunch at Microsoft had grown up with the same inbred suspicion of users as the people who wrote Unix.

Maybe it’s like convenience food; this is convenience computing. And now we get the SuperSizeMe result: a sort of computing obesity where we can’t lose the weight of the old rubbish, which stops us running after the people nicking our possessions. Something like that.

4 Responses to “If your IP address is 208.252.68.66, your machine has a Trojan that’s annoying me”

  1. Andrew Brown Says:

    “the same inbred suspicion of users as the people who wrote Unix.” — and its user interfaces.

  2. Nick Miners Says:

    Your katakana translates as: Casino American online casino (according to altavista), for what it’s worth…

  3. Martin Says:

    The one thing that annoys me about technology writers is they seem to think that everybody else understands what their terminology means. Please print a list of computer words with their English translations and what they do.

    M

  4. Charles Says:

    Which “computer words” in particular were you thinking of? “Spam” = unwanted commercial email or other content sent or posted to property owned by others, usually piggybacking on the others’ better name to gain visibility.

    “Trojan” = short for Trojan horse program: a program that takes over someone’s machine, usually without their knowing. Historically derived.

    “Blog” = thing you’re reading now.
    “IP address” = numerical address that uniquely identifies a computer on the Net at any particular time.
    “Spoof” = English word whose meaning is already in the dictionary.
    “IP theft” = intellectual property theft. Compromised machines can be used to store software without the owner of that machine realising it.

    Still, if that’s the only thing that annoys you about technology writers, some might see that as not bad.

    BTW MCI haven’t written back.

Leave a Reply

Powered by WordPress