Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Spammers Leak 1.4 Billion User Records

A company run by a couple of known spammers has unknowingly leaked a series of files containing sensitive information about its operations, including nearly 1.4 billion user records.

A company run by a couple of known spammers has unknowingly leaked a series of files containing sensitive information about its operations, including nearly 1.4 billion user records.

River City Media (RCM), which claims to be a legitimate marketing firm, is run by Matt Ferris and Alvin Slocombe, both listed in Spamhaus’ Register of Known Spam Operations (ROKSO).

Slocombe is said to be involved with the bulletproof spam host Cyber World Internet Services, which is believed to have launched spam campaigns using aliases such as Ad Media Plus, RCM Delivery, eBox, Brand 4 Marketing and Site Traffic Network.

MacKeeper researcher Chris Vickery, who has made a name for himself after finding misconfigured databases exposing large amounts of potentially sensitive data, discovered a freely accessible Rsync backup belonging to River City Media.

The leaked data has been analyzed by Vickery, Spamhaus, and IDG’s CSO Online. Law enforcement has also been alerted as some of the exposed files appear to contain evidence of illegal activities. Tech giants such as Microsoft and Apple have also been notified.

According to Vickery, the leaked data includes documents (e.g. financial data), backups and chat logs. One of the most interesting files is a database containing 1.37 billion user records, including names, email addresses, physical addresses and IPs.

The expert, whose investigation showed that much of the data appears to be valid, believes the vast amount of information was collected by the spammers through credit checks, sweepstakes, education opportunities and other similar activities.

“Well-informed individuals did not choose to sign up for bulk advertisements over a billion times. The most likely scenario is a combination of techniques,” Vickery said in a blog post. “One is called co-registration. That’s when you click on the ‘Submit’ or ‘I agree’ box next to all the small text on a website. Without knowing it, you have potentially agreed your personal details can be shared with affiliates of the site.”

Advertisement. Scroll to continue reading.

The exposed data, which Vickery believes will lead to the downfall of this “spam empire,” also includes information on the illegal tools and techniques used by RCM. For example, one of the leaked files describes a technique leveraged by the spammers to target Gmail servers by opening as many connections as possible between them and the targeted server.

“This is done by purposefully configuring your own machine to send response packets extremely slowly, and in a fragmented manner, while constantly requesting more connections,” the researcher explained. “Then, when the Gmail server is almost ready to give up and drop all connections, the spammer suddenly sends as many emails as possible through the pile of connection tunnels. The receiving side is then overwhelmed with data and will quickly block the sender, but not before processing a large load of emails.”

Related: Government Subcontractor Leaks Military Healthcare Worker Data

Related: Spam “Hailstorms” Deliver Variety of Threats

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.