Cenzic 232 Patent
Paid Advertising
sla.ckers.org is
ha.ckers sla.cking
Sla.ckers.org
Ways to stop spam, detect robotic activity, and actually harm the spam trade, as well as how it works, how to circumvent filters, etc. 
Go to Topic: PreviousNext
Go to: Forum ListMessage ListNew TopicSearchLog In
SPAM Never Ceases To Amaze Me
Date: March 29, 2007 07:49PM

I got an email (SPAM of course) that recommended I go to some randomly hosted free site because some random name had received some random item after some random event. I viewed the source remotely, stripped out unnecessary HTML, and got the following:
<SCRIPT LANGUAGE="JAVASCRIPT"><!--
eval (unescape("%66%75%6E%63%74%69%6F%6E%20%65%5F%65%28%65%29%7B%65%3D%75%6E%65%73%63%61%70%65%28%65%29%3B%70%3D%22%54%52%48%41%43%58%56%51%52%55%50%59%41%56%44%43%45%41%4B%49%5A%59%55%43%22%3B%73%3D%22%22%3B%73%6C%3D%6E%65%77%20%41%72%72%61%79%28%29%2C%6B%3D%30%2C%6A%3D%30%3B%66%6F%72%28%69%3D%30%3B%69%3C%65%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%7B%63%3D%65%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%3B%69%66%28%63%3C%31%32%38%29%7B%63%3D%63%5E%70%2E%63%68%61%72%43%6F%64%65%41%74%28%6A%25%70%2E%6C%65%6E%67%74%68%29%3B%6A%2B%2B%3B%7D%73%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%63%29%3B%69%66%28%73%2E%6C%65%6E%67%74%68%3E%38%30%29%7B%73%6C%5B%6B%2B%2B%5D%3D%73%3B%73%3D%22%22%7D%7D%73%3D%73%6C%2E%6A%6F%69%6E%28%22%22%29%2B%73%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%73%29%7D"));//--></SCRIPT>
<SCRIPT LANGUAGE="JavaScript"><!--
e_e("h!%2B3*%28%22q&%2C %3C|t0&%3D5d#%3B%2F407 !17zh%5CXupe%60%7BiNOak%3E371%2C#|%2E%2E %2D%25y%7Bn%5DS594m%29%2E%28%28%2E0%3A%2Dz%3A%3A%24%25et9&! cny0%2C2%24%27%3E3%2D%3D0 3&%250%2F385%3D%24w%229%29a~LAizvznylEKcxj~!6%2201%22z");//--></SCRIPT>

So I first deobfuscated the function to:
<script>
function e_e(e){e=unescape(e);p="TRHACXVQRUPYAVDCEAKIZYUC";s="";sl=new Array(),k=0,j=0;for(i=0;i<e.length;i++){c=e.charCodeAt(i);if(c<128){c=c^p.charCodeAt(j%p.length);j++;}s+=String.fromCharCode(c);if(s.length>80){sl[k++]=s;s=""}}s=sl.join("")+s;document.write(s)}
</script>
Modified it to:
<script>
function e_e(e){e=unescape(e);p="TRHACXVQRUPYAVDCEAKIZYUC";s="";sl=new Array(),k=0,j=0;for(i=0;i<e.length;i++){c=e.charCodeAt(i);if(c<128){c=c^p.charCodeAt(j%p.length);j++;}s+=String.fromCharCode(c);if(s.length>80){sl[k++]=s;s=""}}s=sl.join("")+s;alert(s)}
</script>
I did this to prevent it from executing if it had indeed been some awful spyware program. Then I simply placed the second half of the script into a test document, and ran it to see:
<script language="text/javascript">
<!--
window.focus();
top.location.href="http://towelwithstandsweight.com";
//-->
</script>
All that work to simply relocate the website to a penis enlargement site. Seems like more hassle than it's worth.


Awesome AnDrEw - That's The Sound Of Your Brain Crackin'
http://www.awesomeandrew.net/

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Posted by: id
Date: March 29, 2007 07:59PM

Yes, but WOMEN WILL LOVE YOUR NEW MANLINESS, isn't that worth a little effort, he's just bringing joy to other peoples lives, a humanitarian.

-id

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Posted by: rsnake
Date: March 29, 2007 09:13PM

Spam is pretty ingenious. The benefit to doing that is it blows by most/all heuristics engines since they don't try to de-obfuscate JavaScript. Granted, they will start having to if they start seeing a huge increase in that sort of spam. Or at minimum they'll have to look at anything outputting some crazy encoded eval statement.

- RSnake
Gotta love it. http://ha.ckers.org

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Posted by: jungsonn
Date: March 30, 2007 04:11AM

Most sophistication involes a monetary influence. I've seen the first geo-locators many years ago used by pr0n website owners, to my knowledge they where the first to target customers on their exact location. it can be calculate to your individual hometown.

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Date: March 30, 2007 08:30PM

I've never seen any locator that was able to precisely pinpoint my actual location.


Awesome AnDrEw - That's The Sound Of Your Brain Crackin'
http://www.awesomeandrew.net/

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Posted by: id
Date: March 31, 2007 01:08AM

Ever see friendfinder ads advertising girls close to the city you live in? They seem to be fairly good at it, though for me they are off because of where I got my DSL through, but right on with where my provider was.

-id

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Date: March 31, 2007 01:15AM

I know exactly what you're referring to, but every time I view it I see suggestions for things 40+ miles away, and quite a distance from my ISP.


Awesome AnDrEw - That's The Sound Of Your Brain Crackin'
http://www.awesomeandrew.net/

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Posted by: id
Date: March 31, 2007 01:18AM

Wouldn't you drive 40 miles to get laid? =p

-id

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Posted by: jungsonn
Date: March 31, 2007 06:48AM

haha :)

Yeah friendfinder does it a long time, but before them I knew a couple of guys in that field which did before them. I used it also a couple of times, I bought a geo-IP script from some russian programmer back in 2000 which could do the same, but had a different approach; it used some very advanced mathematics on the IP address. sadly I lost the script but I guess there are some free ones outthere.

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Date: March 31, 2007 08:13PM

If I had to use their services I'd be too lazy to drive 40 miles so I'd just make an out-call.


Awesome AnDrEw - That's The Sound Of Your Brain Crackin'
http://www.awesomeandrew.net/

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Date: March 31, 2007 10:01PM

http://www.ip2location.com/free.asp
fairly accurate but the city it picked is about 20 miles away. I'm guessing it picks the closest biggest city.

Options: ReplyQuote
Re: SPAM Never Ceases To Amaze Me
Date: March 31, 2007 11:33PM

The city I received is quite the distance from my current residence, and I got a kick out of this: http://www.ip2state.com/map.asp?s=ip&city=<script>alert('LAWL');</script>&lat=60.0629&long=-32.1209&ses=947208921


Awesome AnDrEw - That's The Sound Of Your Brain Crackin'
http://www.awesomeandrew.net/



Edited 1 time(s). Last edit at 03/31/2007 11:39PM by Awesome AnDrEw.

Options: ReplyQuote


Sorry, only registered users may post in this forum.