{"id":80907,"date":"2020-05-09T13:42:35","date_gmt":"2020-05-09T11:42:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/spam-kak-instrument-zashhity"},"modified":"2020-05-09T13:42:35","modified_gmt":"2020-05-09T11:42:35","slug":"spam-kak-instrument-zashhity","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/spam-kak-instrument-zashhity","title":{"rendered":"Spam as a protection tool","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

There is an opinion<\/a><\/noindex>, that 80% of emails in the world are spam. This means emails that are completely unnecessary for the recipient (which is unfortunate). But as if that weren't enough, among spam, there are often messages sent with malicious intent: for example, to steal or delete data, or to extort money.<\/p>\n

KDPV:<\/p>\n

\"Spam
\n
\nAs we know, for an email to actually harm computer systems, merely delivering the email to the recipient is usually not enough. A 'cooperative opponent' is required, i.e., the user must take actions that will lead to the malicious intent being executed.
\n<\/a><\/noindex>
\nUsually, this action is 'opening' the attachment in the email, meaning manually launching the file with the appropriate processing program within the user's operating system.<\/p>\n

What is even more unfortunate is that the cooperative opponent is not a rare bird, and our spammer-criminal can certainly count on them. <\/p>\n

And this leads to<\/b>
\n \"Spam<\/p>\n

\nIn short, our accountant opens an account, and instead of an account, there is a virus.<\/p>\n

Malicious emails, of course, have important differences. But hoping for the attentiveness and awareness of users is a bad idea. Even extravagant concerts on the theme of 'don't open this' with fireworks and a solo vocal performance from the CEO (the composition 'Polymers') eventually fade from the memory of an office worker.<\/p>\n

Of course, well-configured systems will protect us from most of these attacks. But the key word is still 'most.' No one can provide a 100% guarantee; and when it comes to the user, reinforcing them, as one of the weakest points in systems, is a good deed.<\/p>\n

In the realm of computer crime, technology and social engineering go hand in hand. The attacker realizes that it's difficult to pretend to be someone the user trusts unconditionally, and is therefore forced to use other tactics: intimidation, coercion, imitating recognized authorities, and\/or using corresponding false titles \u2013 for example, sending emails on behalf of government agencies and large companies.<\/p>\n

And as the ancients teach us: if we cannot defeat them, we must lead them. Indeed, how are we worse than spammers? We are much better! We even have more opportunities. And the task itself will require only minimal programming skills and will hardly affect existing systems.<\/p>\n

Disclaimer: the author is not a spammer, and a spammer is not the author. The author is solely on the side of good.<\/p><\/blockquote>\n

The task is very simple: <\/p>\n

we will send emails to our users that resemble malicious ones. In the attachments to these emails, we will include documents that say in large letters, \u201cDO NOT OPEN DOCUMENTS FROM SUCH EMAILS. Be more careful and cautious.\u201d<\/p>\n

Thus, the following conditions<\/b>:<\/p>\n

Condition 1<\/b>. Emails must be different<\/b>. If we send the same email to everyone each time, it will be no different from regular meeting reminders, to which users have a strong immunity. We must stimulate the user's learning system. This leads to the following conditions:<\/p>\n

Condition 2<\/b>. Emails must look like real ones<\/b>. Sending emails from the company \"Meat Company\" or Barack Obama is possible, but ineffective. It makes sense to use real (and different!) names of organizations and authorities;<\/p>\n

Condition 3<\/b>. There are also it is important that the emails appear slightly strange<\/b>. They should be somewhat suspicious to trigger the user's suspicions and activate the learning system in the brain;<\/p>\n

Condition 4<\/b>. And with all this, the emails must attract attention and provoke<\/b>. Well, this is simple; we don't even need to come up with anything: spammers have already done everything for us. \"Fines\", \"Court Decisions\", and even just \"Documents\" in attachments, \"Penalties\", \"Recalculation\", \"Charges\" in the subject, and many words like \"Urgent\", \"Immediately\", \"Must\", \"Pay\" in the text \u2013 and the matter is settled.<\/p>\n

To implement this magical set, minimal programming skills and a boring evening will be required. The author used Python 3 (because it was necessary to practice) and JS (for data collection, right from the browser console). However, most of the code can be easily implemented with native OS tools (bash, cmd), but you might struggle with encodings.<\/p>\n

It is worth noting that the idea itself does not belong to the author; it was borrowed from a large international company. Nevertheless, the idea is so obvious that, upon hearing it, the author rushed to implement it exclaiming, 'Why didn't I think of this earlier?'<\/p>\n

So, first and foremost, we need the components to compose the letter. Let's start with the From field \u2014 who will threaten our timid users? Well, who: undoubtedly banks, tax authorities, courts, and various strange LLCs. We might as well add templates for future auto-completion, like JSC. CmpNmF<\/code>. See from.txt<\/p>\n

Now we need, essentially, names. LLC Chamomile and Vector, as well as the endlessly repeating 'Moscow Court', are unlikely to resonate with anyone.<\/p>\n

Fortunately, the internet offers us amazing opportunities for gathering information. For example, a list of active courts in the Russian Federation<\/a><\/noindex> can be easily obtained using a simple JavaScript command right in the browser console, like:<\/p>\n

for (let el of document.getElementById(\"mw-content-text\").querySelectorAll(\"li\")) {console.log(el.innerText;)}<\/code><\/pre>\n
\nThis way, we can quickly gather a great database for our tasks (especially since the author has already done this for you \ud83d\ude42). We'll save it as Plain text; a database for this task is overkill. The project uses UTF-8 encoding with BOM, in case of the usage of the most specific characters. See the txt files with corresponding names.<\/p>\n
Next, we need to generate a valid sender email address (considering standards, but not necessarily existing) so that our email is displayed correctly and forwarded properly. For some names, the author used fixed domains, while for others, he used auto-generation from the name with a transliteration library, something like LLC \"Vector\" -> warning@ooovektor.ru. The mailbox name is taken from a list in the code and is also intended to instill a sense of dread: \"vzyskanie\", \"shtraf\", \"dolg\", 'alarm' and other \"zapros\".<\/p>\n
Now \u2014 the subject of the letter.<\/p>\n
The subject must definitely grab attention; otherwise, the letter will go unnoticed. Let your inner accountant scarecrow have free rein, and it will work: 'Closure of account(s) (CmpNm<\/code>)', 'To the Chief Accountant (CmpNm<\/code>)', 'Demand (for CmpNm<\/code>)', 'Pay immediately (!!!)' and other mischief. 
\nSee subj.txt. Add to taste, mix, do not shake.<\/p>\n
The text of the email should be somewhat strange. We have already captured the user's attention; now our task is to raise suspicions. Therefore, there's no need to be careful in this respect. Let\u2019s borrow threatening phrases from spammers and combine them at random; absolute accuracy will only hinder us. It will result in nonsense like:<\/p>\n
(important) Information (LLC "TEST") Regarding the invoice in the course of litigation 
\nplease open the attached documents 
\nruling attached<\/code><\/p><\/blockquote>\n
\nSee msg.txt. Contributions are welcome.<\/p>\n
And finally, the attachment. The project currently provides for 3 types of attachments: pdf, doc, docx. Files are copied from samples without changing their content, and the attachment file is assigned a name from the list (e.g., \"Resolution,\" \"Court Decision,\" etc., see flnms.txt). For the first two types, the size is generated randomly by adding zeros at the end of the file. This does not work for docx (although after the recovery procedure, Word opens the file; LibreOffice, for example, opens docx files with added external files via archiving interface without any complaints).<\/p>\n
And we will get this kind of miracle:<\/p>\n
\"Spam
\n
\nYou can send:<\/p>\n
gen_msg.py buh@oootest.ru<\/code><\/pre>\n
\nThe code is, of course, on GitHub<\/a><\/noindex><\/p>\n
So, that\u2019s all. An hour\u2019s work, and the benefits\u2026 And there will be benefits. Because theory is dry, but the tree of life is lushly green \u2013 explanations are overlooked, reminders are forgotten, and people acquire skills only through practice. It\u2019s better for us to be teachers than to restore everything from backups later, right?<\/p>\n
Only registered users can participate in the survey. Please log in<\/a><\/noindex>, please.<\/p>\n
Have you tried it on your users? What were the results?<\/h2>\n