Subject: Denial of Service by Spamware?

From: Daniel Senie <[email-masked]>
Date: Tue, 26 Dec 2000 16:36:58 -0500

So we're getting to see the latest non-feature from the Virus scanning
legions. Earlier today someone spammed the IETF list with a message
containing a virus. This may or may not have been on purpose (virus may
have sent itself to the ietf list). That accounted for 3 messages seen
here.

Since then, many additional messages have been posted to the list
pointing out the virus and how it's been addressed by various sites. I
guess we will see several hundred more of these as people return to work
next week. What a wonderful feature... it's permitted the spammers to be
MUCH more annoying. I expect to see spammers appending viruses to their
messages as a way to keep them in front of our faces long after the
original spam is gone.

Just another case of a "feature" which doesn't scale.

-- 
-----------------------------------------------------------------
Daniel Senie                                        [email-masked]
Amaranth Networks Inc.                    http://www.amaranth.com

---

From: Randy Bush <[email-masked]>
Date: Tue, 26 Dec 2000 16:39:24 -0800

actually, if it is a delivery failure notification, 1123 5.3.3 would seem
to apply.  mail bounces are to be sent to the MAIL FROM: not the original
sender.  or even if they were sent to the from: we would not see them.

this <bleep> has been designed to be max annoying.  get the word out.  tell
folk NOT TO BUY ANTIGEN.

randy

---

From: "Perry E. Metzger" <[email-masked]>
Date: 28 Dec 2000 14:49:55 -0500

> this <bleep> has been designed to be max annoying.  get the word out.  tell

It is even worse than that.

Anyone who has posted to the IETF list in the last week or two has
gotten literally dozens of "out of office notification" messages from
Microsoft Exchange clients. You would think the largest application
software provider in the world would understand the difference between
envelope and message headers, but apparently not. (You would also
think that, as with many Unix based mailers, they'd understand notions
like not sending automated replies if the person isn't in the header
To: or CC: lines, but apparently that behavior is also too complicated
for them to understand.)

This problem has been around for years now, and there is no sign of
enough clue showing up to fix it.

.pm

---

From: Randy Bush <[email-masked]>
Date: Thu, 28 Dec 2000 11:57:53 -0800

> To: or CC: lines, but apparently that behavior is also too complicated

i'll see ya' and raise ya' o ne better.  mailing list owners get the
appended from microsft corporate.  note the lack of information on which
addressee's mail is bouncing, but it tells me to "Verify that the recipient
address is correct."

    From: "Automated Virus Gateway (do not reply)" <[email-masked]>
    To: [email-masked]
    Subject: Mail could not be delivered
    Date: Tue, 26 Dec 2000 23:05:35 -0800

    ****** Message from InterScan E-Mail VirusWall NT ******

    The following mail could not be delivered.
    Reason:  Exceeded Maximum Delivery Attempts.  Verify that the recipient
    address is correct.

    *****************     End of message     ***************

    -----
    Message-ID: <4.3.2.7.2.20001225220830.00d07630@csi-admin1>
    From: Ron Cohen <[email-masked]>
    Sender: [email-masked]
    To: [email-masked]
    Subject: RE: draft-santitoro-rap-policy-errorcodes-01.txt
    Date: Mon, 25 Dec 2000 22:09:13 -0800
    X-Mailer: Internet Mail Service (5.5.2651.58)
    x-sender: ronc@csi-admin1

    ....

nya nya nya :-)

randy