Subject: [Asrg] Is this a new spam form?

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 31 Mar 2003 12:30:00 -0800

someone on list-managers just posted a note that has me a bit freaked.

she got spam addressed from a user of her mail list. That user seems to 
have gotten "something" that caused her machine to send a spam message 
to everyone in her address book.

which sounds suspiciously like a spammer who's gotten into the 
macro-virus game to propogate spam mail.

anyone else seen this before? Is this a new toy we have to worry about?

(and I'll say upfront that complaining about what microsoft HAS done 
isn't productive, if this is going to happen, how are we going to 
contain it?)

I hadn't thought about it before now, but this seems like a great way 
to propogate a spam message, because it works through whitelists and 
around subscription blocks on lists nicely, and doesn't require open 
relays or open proxies.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 31 Mar 2003 15:51:13 -0500

> to everyone in her address book.

  Which indicates a useful definition for spam:

  "spam is email which the user of the MUA did not intend to send"

> around subscription blocks on lists nicely, and doesn't require open 

  I agree.  There are many, many machines out there which are
"owned".  Many are being used to send spam *without* a MUA.

  Alan DeKok.

---

From: Chuq Von Rospach <[email-masked]>
Date: Mon, 31 Mar 2003 12:56:47 -0800

> "owned".  Many are being used to send spam *without* a MUA.
except in this case, the machine isn't "owned", but "borrowed for a 
minute". And you only need one "owned" machine or open relay to start a 
chain reaction of redistributions, all of which look like legitimate 
e-mails from someone you know, because it is. Except it's just that 
person's machine, not the person itself.

My guess is this isn't a case of a machine being taken over by a virus 
as a zombie, but an e-mail coming in that's triggering itself to be 
resent out to the members in the address book. No need for any resident 
code.

got an advil?

---

From: Jason Hihn <[email-masked]>
Date: Mon, 31 Mar 2003 15:56:59 -0500

I have seen this too.

I don't know if this is the same thing, but my users were tricked into
installing something that did this. In the click though EULA, (which no one
ever reads) it said exactly what it was going to do too! And they still call
it a 'virus' around here...!

In this case, a an unsolicited message was sent with an attached program (in
zip form) it only took 1 fool to install it. Once in, it was sent to people
in the address book. Then it was coming from a 'credible' person, nullifying
the first rule of email: "Don't open email from those you don't know"

I think in the future, this propagate via white-lists is going to be the way
to go for spammers. User education is the only solution here.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Alan
> DeKok
> Sent: Monday, March 31, 2003 3:51 PM
> To: [email-masked]
> Subject: Re: [Asrg] Is this a new spam form?
>
>

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 31 Mar 2003 23:27:37 -0500

At 12:30 PM -0800 3/31/03, Chuq Von Rospach wrote:
>she got spam addressed from a user of her mail list. That user seems 
>to have gotten "something" that caused her machine to send a spam 
>message to everyone in her address book.

I have heard people talk of viruses/trojans which either sent spam 
directly, or used the user's account to signup for free accounts on 
webmail sites and sent spam using those.  But I've only heard those 
in the friend-of-a-friend market.

There was an e-greetings trojan (technically it wasn't a trojan, it 
was a test of how closely you read a EULA) which sent greeting card 
messages to everyone in your address book.  I've also heard that it 
sent a copy of your address book to the company who set it up--but I 
haven't seen that officially reported anywhere.  (The fact that the 
software did what it said it was going to do kind of threw the 
anti-virus companies in a quandry.  Some blocked it, some did not. 
The company sending the stuff had to switch servers several times 
too, since their ISP's weren't so friendly.  Last I heard they had a 
server in Panama.)

On the illegal fringes of spam I suspect that regular collaboration 
of virus writers and spammers is only a matter of time.  It's good 
money for the script kiddies.  Most likely I would expect the virus 
not to carry the spam payload directly, but to pick it up from a 
newsgroup or some such.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg