Subject: Re: FW: Virus alert

From: Dean Anderson <[email-masked]>
Date: Sun, 31 Aug 2003 18:34:10 -0400 (EDT)

On Sun, 31 Aug 2003, Tim Chown wrote:

> On Sat, Aug 30, 2003 at 05:25:19PM -0400, Dean Anderson wrote:
> >
> > The Virus writer obviously went to some trouble to pick valid addresses.
> > It stands to reason that they expect that someone is getting mail to these
> > addresses.  It also stands to reason that the abuser expects those persons
> > to get Virus notifications.
>
> I don't think so; isn't it more likely the writer wants the infection to
> spread, and the best chance for that is that the recipient sees a From:
> address that they recognise and "trust", rather than [email-masked],
> so they look at the content where they otherwise would be wary?

Your comments are true in general, but I don't think they take into
consideration the differences between this virus and the ones that go
through the address book. One can (more) easily get such valid, trusted,
familiar addresses from the address book. Many virues do just that,
probably with just the purpose you mentioned. However, this virus is
different. It is using 'valid' addresses that aren't found in address
books--addresses that wouldn't be familiar to anyone, but are still valid.
There must be a reason why they would go to such trouble...

		--Dean

---

From: Jonathan Hogg <[email-masked]>
Date: Tue, 02 Sep 2003 10:34:10 +0100

> There must be a reason why they would go to such trouble...

I think this virus wasn't just designed to spread, I think it was designed
to remain alive on each machine it infected. If you send out emails to a
user's address book from that user, they will quickly get emails from their
friends saying "I think you've got a virus Bob, I just got this weird email
from you." Or they will receive bounces/vacation-messages for emails they
know they didn't send.

Faking the From address means that replies will go to someone completely
random. Since that means the sender will be a stranger, you might as well
grab as many To addresses as possible rather than just restricting yourself
to the user's address book.

Faking the From address also adds another vector for infection in that
people start getting bounces saying "Sorry I was unable to deliver your
message." They open these to figure out what the original message was and
get infected. Now the virus can use a vast network of unwitting relays to
further spread and mask its location.

I have received dozens of emails from helpful systems and people notifying
me that I have the virus - and I have a Mac. I could crawl through the
headers on the bounces to determine the machine that has actually been
infected and has my email address, but once I've got an IP number I have no
easy way to turn that into an email address for the user.

The disinformation strategy clearly worked, so I expect to see more of this
style of virus in the future. Many have suggested that the purpose of the
virus may have been to setup a large zombie spamming network - I'm not sure
if it was this time, but I'm pretty sure it will be next time.

Jonathan

---

From: Einar Stefferud <[email-masked]>
Date: Sat, 2 Jan 1904 00:03:05 -0700

So far I have not seen one case of someone I know informing me that I 
have sent a message to them with a virus included.  They have all been from strangers, which is one reason they get trapped by my filters.

As best I can tell, all the to and from addresses are randomly selected.

Cheers...\Stef

At 0:52 +0100 8/31/03, Tim Chown wrote:
>I don't see a problem with notifications where the virus is known not to
>forge the sender.
>
>Tim

---

From: Einar Stefferud <[email-masked]>
Date: Fri, 1 Jan 1904 23:52:22 -0700

See below;-)...\Stef

>I don't see a problem with notifications where the virus is known not to
+++++++++++++++++++++

I get lots of bounces of spam bearing Joe-Jobs that were sent to what 
I expect are nonexistent addresses (at AOL, and others), with the initial 
sender's apparent intent to get the bounce to me with my address obtained 
from a spamming list, or just privately harvesting it from the web.

Just put my address in GOOGLE and stand back to see why they find it.  
It has been harvested for every spam list CD in captivity since day one.  
Just one of the little rewards given to us pioneers;-)...

I have elected to avoid running from them by often changing my address, 
perhaps with throw-away MSN or Yahoo or Juno and whatever.  Frequent 
changes don't mix with wanting to be reachable over time;-)...

So, I have a filtering scheme that for now catches all of them and deposits 
them in the trash;-)...  Nothing too sophisticated!  

Cheers...\Stef

---

From: Dean Anderson <[email-masked]>
Date: Tue, 2 Sep 2003 17:49:10 -0400 (EDT)

> to remain alive on each machine it infected.

Hmm. Good points supporting this... Could be.

> easy way to turn that into an email address for the user.

Once you have an IP number, you can look up the responsible party in one
of the registries (whois.arin.net, whois.ripe.net, whois.apnic.net,
etc--there are sub registries for Latin America and such, but they aren't
too hard to find.) Then you send an email with your logs or headers to the
abuse contact and/or the administrative contact.  They will know how to
deal with the problem.

> if it was this time, but I'm pretty sure it will be next time.

Interesting, but we already have large zombie Type 3 spamming networks...

---

From: Jonathan Hogg <[email-masked]>
Date: Wed, 03 Sep 2003 00:05:00 +0100

On 2/9/03 22:49, Dean Anderson wrote:

>> [...] but once I've got an IP number I have no

Yes, I know how to do this, but the point is that it's not *easy*. And even
if I can be bothered doing all this, it will end up in a queue for the
postmaster at the ISP who may or may not end up actually trawling the logs
to figure out which user it was and notify them.

More likely than not, the user will never realise they are harbouring the
virus.

Jonathan