Archive for July, 2009

29
Jul

Canadian Health Care

What on Earth does Canadian health care have to do with proxies?

Well kidz, in the last few days a number of proxies located in Surrey, British Columbia (Canada, eh?) have popped up in The List.

Normally I avoid Canadian proxies.  They’re just too close to home (Mexico is fine, an exception I’d rather not get into).  But these were all fast and they all came from the same netblocks.  I did a few quick spot checks using telnet, got a connection each time, but failed to get a proper proxy response.

I did a whois on the IPs and discovered the netblocks are owned by Surrey Memorial Hospital.

I determined immediately that this was Not A Good Thing.  The last thing a health care facility needs is to have its bandwidth eaten up by SEO spammers, Cameroonian 419 puppy  pushers, and your run-of-the-mil skriddies.

I was going to put my white hat on and notify… somebody, but I discovered to my dismay that I don’t have a white hat and since I definitely don’t like making trouble for myself I decided the best course of action was to lay low and see how it played out (perhaps this could be the result of Black Hat shenanigans, since that conference is on-going as we speak).

And besides, the testing I did indicated the proxies weren’t working.  The List was pushing a thousand this AM so I ran the recheck on the database, just to clear these – apparently dead – hospital proxies out.

But they stuck.  After the recheck there were just short of one hundred Surrey proxies listed as active.

Like I said, I avoid Canadian proxies like the AIDS, so I’m definitely not using them.  I would urge you to do the same, considering interfering with these particular proxies might jeopardize someone’s health or life.

Play nice.

27
Jul

WANTED: Proxy Expert REWARD: $100

I just ran across this on the Web.

We need a small application that does the following:

- Scrapes and Tests socks5 resources online to bring/check consistantly new proxies.

- App should allow use of IP:PORT:U:P for Private proxies

- App should be able to scrape large list of Socks in site & forums on multiple levels etc..

- On user Interface, app should only show a list of all the working US Socks proxies

All other proxies from other countries, non-working proxies, non-Socks5, BlackListed, RBL, honeypots etc.; should be Filtered out so I have a clean list to use at any given time. Short and Simple result.

This should get done in 3-6 days, and the budget for this is around $100.

Bid only if you are a pro on proxy.

Hilarious. Hell. I’d pay $149.95 for a program like that! Plus shipping & handling!
This is a joke on so many levels it’s nothing short of pathetic. Good luck with those “SOCKS5″ proxies, fella. They are the rarest birds on the ‘Net.

27
Jul

AT&T Promotes The Proxy Business

It seems AT&T decided that 4chan is evil and has begun blocking certain 4chan servers through AT&T’s residential broadband systems.

Needless to say, the butthurt factor is high at 4chan.

Check this article from cnet

Reports began to surface on Sunday that AT&T had blocked broadband access to parts of the notorious (and powerful) Internet forum site 4chan. Late that night, a fake story surfaced on CNN’s iReport citizen journalism site that AT&T CEO Randall Stephenson had been “found dead in his multimillion dollar beachfront mansion” after a cocaine overdose.

lulz

Anyway, this is GREAT NEWS for the proxy business, as AT&T 4channers start looking for ways around this blockage.

26
Jul

Get Ready For East African Proxies!

Last Thursday, the SEACOM link went live, bringing high speed Internet access to the East Coast of Africa.

What does this mean for proxy hunters?  It means that people who have never done it before will be setting up e-commerce servers with mod_proxy listening on the outside link, green technicians setting up home cable or DSL modems with default passwords, and clueless noobie sysadmins on shoestring budgets will be putting up servers without firewalls.

It also means East African cybercrooks, hackers, and puppy scammers will be competing for the proxies already out there.

Anyway you look at it the opportunities are there.  And this is only the beginning

While SEACOM will be the first cable connected to eastern Africa, it will soon be joined by two further cables. The East African Marine System (TEAMS), scheduled for completion later in 2009, will link Kenya and the United Arab Emirates, and the Eastern African Submarine Cable System (EASSy), which lands in many of the same countries as SEACOM, is expected to commence service in mid-2010.

It’s also an absolute boon for globe-hopping security companies and educators.

Gentlemen, start your scanners!

25
Jul

Refining The Process

Since I’ve been keeping track of where I’ve been going with the Google Hack, I’ve managed to harvest over 14,000 unique proxy list URLs.  There seems to be very few new lists and now I’m down to running The Hack once a week at most.

However, the top-level URLs are a different story.  I can hit these once a day and get a handful of new proxies.  So, that’s exactly what I have been doing for the last week.

There is a good enough influx of new proxies that I’ve dropped back on resurrecting the old ones.  And, now that I have a database of 14,000 URLs, I have leveraged them to get more precise results.

I have begun using a random URL from this database as a fake Referer in my requests through the proxy judges.  The presence of the Referer in the page returned from the judge (almost) guarantees I haven’t hit a vanilla Web server.  It is always present if the page was from a judge.  It’s absense means I have hit useless junk.

After I added that, things got interesting.

I have found that there are proxies out there that toggle between being a Web server and being a proxy!  That’s actually a nice cover when you think about it.  For what?  Who knows, but there it is.

There are still issues with what I like to call “false proxy judges”.  Some jokers like to run Web pages that look like the output of a proxy judge.  They always display exactly what you want to see when you’re testing proxies.  For some reason this was popular in Japan last year.

For now, this is all development code.  It only runs when the proxies are rechecked or resurrected, not when the proxy is originally discovered.  Until I move it into production there will be still be some crap in the list.

25
Jul

Blessed By Pappa Dollars

My original post about Cameroon on my UT99 blog has attracted a bit of converstion, ostensibly from Cameroonian scammers/hackers themsleves.

Here is one of the most recent:

This is papa Dollars. I do enjoy your proxies and indeed they are very helpful. I pray God keeps you alive and that you have many more days on earth like President Biya, so as to continue providing proxies for us.  Stay Blessed and continue with your hard work.

Awwww… isn’t that sweet?

I could be the Patron Saint of Puppy Scammers if I could pull off a miracle or two.

18
Jul

Twitter + SSL + proxies + curl = #@!&%

As it turns out, Twitter can do SSL and it could care less about proxies.

I Twitterized one of my other UT99 servers (known as “Experimental IV”) and the results can be seen here.  Originally I used an old (May 2009) Indonesian proxy from the List, but I have since changed to a more recent (like “today”) Mexican proxy.  I works well and the SSL overhead doesn’t seem to be an issue.  It is a dedicated dual-core AMD64 UT99 server (not the AMD64 dualie that MythTV and the Google Hack runs on), so it really shouldn’t be a problem at all.

It took way too long to write because I had to generalize the code (it lives on an NFS share that all servers have access to) and deal with a number of infuriating little peculiarities of curl I had evidently forgotten.

I think during my testing I went over the 150 tweet/hour/IP limit because curl was ignoring the –proxy directive.  The original UT99 Tweeter stopped updating even though it was sending junk to Twitter.  Then, out of the blue it started working again.

If they’re using the X-Forwarded-For header to check the real IP, I could be fucked.  I tend to use transparent proxies a lot, since High Anonymous are so difficult to come by.

Time will tell.

18
Jul

TWO MILLION FUCKING PROXIES!!!

2,021,305 to be exact.

But who’s counting?

The count rolled over before the 8PM run on July 10th.  And then, the fucking 8PM run – the run that should have marked the two millionth proxy –  didn’t run.

I have no idea what the FUCK happened but the List was entirely blank.  Months and months of  flawless operation and the system decided to barf all over itself during this important milestone.  And it’s been running flawlessly ever since.

I tried to identify the 2,000,000th proxy but apparently it’s beyond my abilities as a database monkey.  Rest assured it’s in there somewhere, safe and sound.  In fact as soon as I gave up trying to find it I was on to Other Projects.

One of those projects was the Twitterfication of one of my Unreal Tournament servers.  That, my little proxy pals, was a lot of fun.  The result can be seen here.  Twitter’s API was made for scriddies like me.  I want to do the same thing for my other UT servers, but Twitter has a 150 tweet per hour per IP address maximum.  Of course, this is beatable with proxies, but it entails tossing your account credentials out in cleartext (if you go the low tech scriddie route).  It’s just a matter of time until someone steals your account.

I have considered the possibility of using SSL (I’m not even sure that works – I haven’t tested it yet), but the script would have to build up and tear down an SSL connection several times a minute.  Plus, if  Twitter’s smart (and there’s plenty of evidence to the contrary) they have probably already banned most of the IP addresses in The List since there’s an ungodly amount of advertising bot activity going on in there.  In the week since my script has been running, it has tweeted nearly 4,000 times and attracted over 300 “followers” with names like “fistinggirl”, “Russian SEO”, “Dr_Marketing”, and “onlineMoviesForYou”.

That  ”foryou” suffix always screams “SCAM” to me.  I hate it.  I’ve hated it since the 90s.

Those “people” are obviously not my UT players (in fact I doubt if any of them have even bothered with it yet), but some of these bots are very subtle.  You’d think they were real people musing about Life In General until you get the sales pitch and the bit.ly link.  I was actively blocking them for a while but there’s just too damned many to bother with.

And perhaps since I called the Twitter account “BOT House” (the unfortunate name I chose for my first UT server back in 2003 when botnets were in their infancy), advertising bots are somehow attracted to it.  Maybe bots just like to hang out with each other.

Anyway, I’m thinking of integrating The List with Twitter, since I have my own account.  It could be used to pre-announce proxies on the odd hours before the page is published, for instance.  Since the bruhaha in Iran there’s been a lot of activity in that area.  See this account for an example.

But, I think I’d rather have the traffic hit the Web page.  I’m Old School like that.

10
Jul

1.9999 Million Proxies!

It should happen before midnight tonight!

w00t!

10
Jul

1.999 Million Proxies!

Should roll over this weekend, if not today!

I seem to be getting a steady stream using the usual feeds.  Knock on wood.  I am discontinuing the resurrection for a while.  I was doing it about twice a week, which is way too often.  I’m still wondering why two thirds of the active proxies are on again off again like that.  I had always suspected the proxy judges but whenever I checked them they were always fine.

But, I haven’t done that in quite some time.  And considering it’s always the same ratio no matter what, that’s probably not it.

Anyway, that’ll be my weekend project.