Windows messenger new spammer tool ?

hello people

found this at the register this morning has any one else encounterd spam from windows messenger services well it seems that a company called DirectAdvertisment is spamming with alert messages

http://www.theregister.co.uk/content/4/27634.html

Quote:

---

Windows Messenger is new spam vector
By Thomas C Greene in Washington
Posted: 16/10/2002 at 08:44 GMT

The forces of evil have produced a devilish tool whereby spam can be sent to thousands of Windows users in minutes, in the guise of system alerts. This was brought to our attention by reader Mike MacNeill, who sent us a screenie of a Windows system alert offering him the university diploma of his dreams with "no required tests, classes, books or interviews," in the classic manner. Below is a smaller example:



The scam is the brainchild of an outfit called DirectAdvertiser , and leverages the Windows RPC (Remote Procedure Call) function. I downloaded the demo version and played around for a while. My results may not be entirely accurate because I didn't use the full, $700 version, and because I used it on my own network behind a firewall. However, running Ethereal on the box and trying it out revealed packets destined for ports 135 (DCE/RPC), 137 (NetBIOS name service) and 138 (NetBIOS UDP) on the target.

So we have here essentially a NetBIOS attack tool. It's capable of attacking entire IP ranges, but will not (the company says) get past a firewall or provide a hyperlink in the alert to the attacker's commercial Web site. The latter shortcoming is currently being addressed, the company says.

The quickest way to defeat it is simply to shut off Windows Messenger (not the MSN Messenger IM client), so long as it's not needed by other applications. Otherwise port 135 UDP and TCP can be filtered. If neither of these solutions is suitable, the company invites you to share with them "any questions, comments, or suggestions that you may have" at this e-mail address. ®

---

follow the link to see the pop up picture it sends
i think windows alert messages was enough for me now they are spamming with them geez whats next

all thought and views on this subject are highly welcome

I think this happened to me yesterday. I'm using Trillian though ...

hmmmm...don't confuse this with MSN (or windows) messenger. What they are talking about is actually the messenger built into windows that Administrators use to send messages to users across the network, not the popular IM service.

Quote:

---

The quickest way to defeat it is simply to shut off Windows Messenger (not the MSN Messenger IM client)

---

So is it the Messenger service which runs under 2k (and XP I assume) that you have to disable? Do you have to disable the XP Windows Messenger client? Are these possibly the same thing? If they are only talking about the service then they haven't really made it clear enough.

powertoad more info here in it how to disable it and more detail on it

http://www.techtv.com/screensavers/a...374542,00.html

On the link to the original page at The Register it said the full version was $700. But if it uses the Messenger service in NT/2K/XP, it would be as simple as scanning those specific ports and then doing a 'net send' for the message on a mass scale (not totally sure about this). $700 for something that simple? :rofl: I hope they don't get any customers - bastard spammers.

Indeed powertoad..

net send is a sometimes usefull tool that has gotten me fired once, for mass spamming the company I worked with with a simple message.

Quote:

---

Allways remember: if the world would not suck, we'd all fall off . . .

---

They didn't like it.

They have been doing that with AIM and AOL IM for the longest time... Anyone remember 'progz' , lol...

Yeah, I've been getting those damned messages. When I was in class for NT 4.0, the more "savvy" users used to send messages to unsuspecting people using net send. It was pretty funny to watch them try to figure out where it was coming from. ROFL! I think you can just disable the messenger service (at least, it was that way in NT), and you will no longer get those messages. The format does indeed suggest that it's some sort of mass net send, and they could possibly be getting paid for that??? UGH!

It is my understanding that since the messenger uses the net utilities, it transports over tcp/139 (maybe tcp/135), and udp/137-138. We currently block all inbound netbios connections from the internet (very scary things can happen if you don't), so wouldn't that cover it?

I guess what I am getting at, does the messenger use the standard netbios ports or is it off in a world of its own (M$ has been known to do that before :) )

/nebulus

windows messanger is the same as MSN Messanger but it dont have all the features as msn messanger. u mite aswell download msn messanger

Neb, I just tested it by running a windump while I sent a net send message to someones machine, and it picked it up as traffic with a destination port of 139 just as you may have been thinking.

Thanks for looking into that, always nice to have some time saved :)

So I guess the lessen is, if you are getting these messages, you should be looking into maybe filtering out all netbios traffic (udp/137, udp/138, tcp/139). Aside from fixing the messenger thing, you would also be protecting yourself from user enumeration via null sessions, improper securing of administrative shares, and several other popular windows hacking methods.

/nebulus

Hi All;

I do not have Messenger service active on a
Windows 2000 Pro box I use as a DNS/HTTP and
Game Server. Everytime I remote in I have
a Pop Up add from some sort of non-accreded
group.... very annoyining!!!

So far no attempted hack attacks on it....
I do not use IIS on that box. (Do you think I am NUTS!!!)
What port do I have to block ??
or how do I stop it ???

Now If I learn to read the other posts
on Antionline... I would not have to ask
so many DUMB Questions!!!

Highlander: Put a personal firewall on the machine. I have ZoneAlarm loaded on my machine and it blocked all pop-ups.

We got hit by this on six of our machines last Friday. The only thing they had in common is that they were all upgraded from NT4.0 to 2000. It uses the Windows Messenger Service not MSN Messenger. We stopped it by opening the Services Manager and shutting down and disabling the messenger service. I am also asking the firewall guy to block all netbios/netbui ports.

I also would think that this would be illegal. The company that makes the software http://www.directadvertising.com claims it to be perfectly legal. Not in my eyes!

Stuart

what's funny is there is an online game that I play where someone reported this very thing happening to him over the weekend. He said it's been going on for him for about a week until he figured out how to turn it off.

I had never thought of this as an avenue for advertising... spammers have sunk to a whole new level.



El Diablo

the real shame about what their doing is that it falls under the IM catagory which is pretty much unregulated.if we wanted to stop this legally it would require even more government regulation. like we need that. i really wish scum bags like this would just dry up and blow away like the scabs they are.

I forgot to mention something in the previous post I made regarding which ports to block to block the messenger/netbios. I neglected to mention that Win2k has its own netbios like port 445/tcp, so need to block that as well.

/nebulus

Quote:

---

windows messanger is the same as MSN Messanger but it dont have all the features as msn messanger. u mite aswell download msn messanger

---

MSN messanger is a complete IM service allowing real time chat with multiple people as well as p2p file transfers - windows messanger is built in to the operating system and allows other people to send msgs to your pc using the net send command

eg:

net send xxx.xxx.xxx.xxx then your msg here

or on a local network

net send computername then your msg here

see there is quite a dif between the 2 ;)

v_Ln

I think that companies spam too they just do it in a legal way. They will spam and tell you that they found your email in a email list. So they give other people an idea for spamming and making it look legal. that is what i think i dont know if everybody agree with me, but these companies are giving people an idea to fake the message that they found your email in an email list.

I think that companies spam too they just do it in a legal way. They will spam and tell you that they found your email in a email list. So they give other people an idea for spamming and making it look legal. that is what i think i dont know if everybody agree with me, but these companies are giving people an idea to fake the message that they found your email in an email list.

There's a nice little tool, if you're running xp, that will take care of the problem and quite a few other problems, too. I found it mentioned in a thread at wilders.org

http://www.xpantispy.de/index.html?/news-e.htm

There's a nice little tool, if you're running xp, that will take care of the problem and quite a few other problems, too. I found it mentioned in a thread at wilders.org

http://www.xpantispy.de/index.html?/news-e.htm