Subject: FW: Virus alert

From: "Fam. van den Berg" <[email-masked]>
Date: Fri, 29 Aug 2003 23:53:30 +0200

All,
 
Today I recieved 2 mails with the following subjects:
 
Wicked screensaver
Thank you!
 
The sender was [email-masked], according to the header.
 
This may indicate that this ietf mailinglist is infected with the sobig
f virus.
I recommend that all the participiants on this list update their
virusscanner and scan their computer for viruses.
 
With kind regards,
 
A. van den Berg, Netherlands

---

From: "A. Kremer" <[email-masked]>
Date: Sat, 30 Aug 2003 00:10:50 +0200

Perhaps you are right, but I don't see any harm in warning people about
possible viruses on their computer, even if it seems to be unnecessary.
:)

-----Oorspronkelijk bericht-----
Van: [email-masked] [mailto:[email-masked]] Namens Fam. van
den Berg
Verzonden: vrijdag 29 augustus 2003 23:54
Aan: [email-masked]
Onderwerp: FW: Virus alert
Urgentie: Hoog

All,

Wicked screensaver
Thank you!
 
The sender was HYPERLINK "mailto:[email-masked]"[email-masked],
according to the header.

With kind regards,

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.512 / Virus Database: 309 - Release Date: 19-8-2003

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.512 / Virus Database: 309 - Release Date: 19-8-2003

---

From: Dean Anderson <[email-masked]>
Date: Fri, 29 Aug 2003 18:21:24 -0400 (EDT)

The from address is typically forged, but seems to be frequently be real
addresses.

I've been getting quite a large number of virus disinfection replies to
various addresses that come to me.  (Quite odd, too, since some of the
addresses being used haven't been used for 10 years, but are still
forwarding mail to my real addresses...)

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Fri, 29 Aug 2003 18:41:10 -0400 (EDT)

Caution is always a good thing. :-)

		--Dean

---

From: [email-masked]
Date: Fri, 29 Aug 2003 19:23:29 -0400

> Version: 6.0.512 / Virus Database: 309 - Release Date: 19-8-2003

And every single copy of Sobig-F goes out with the header:

X-MailScanner: Found to be clean

What's wrong with this picture?

---

From: David Frascone <[email-masked]>
Date: Fri, 29 Aug 2003 19:30:44 -0500

With the current virii usually forging the from field with random
addresses from its victim's address book, I turned off my virus
scanner's warning to the senders . . I only send a polite note to the
intended recipient.

Responding to virii, or warning users that they are infected is a waste
of time.

'course, I probably get 25 e-mails a day telling me that I sent someone
Sobig, which would be pretty impressive, since I run Suse :)

-Dave

-- 
David Frascone

    Why do they tell us to watch "The Today Show" tomorrow?

---

From: [email-masked]
Date: Fri, 29 Aug 2003 21:12:15 -0400

> Sobig, which would be pretty impressive, since I run Suse :)

I should be so lucky.  I'm averaging almost that many AV-scanner alerts bouncing
to me an *hour*.  And inbound Sobig-F are above 1 per minute.

I still say we should have put this in the "security considerations" in RFC1341:

"If you think you know how to secure active objects in e-mail, you are
probably very mistaken.  There be serious and nasty dragons here."

(with apologies to the authors of 'xterm').

On the other hand, maybe we didn't do THAT badly - I can only think of one
vendor that really didn't pay attention....

---

From: shogunx <[email-masked]>
Date: Thu, 28 Aug 2003 22:14:26 -0400 (EDT)

Can't we just hack the mailman configs to dump mails with X-sender value
of outlook or outlook express?  That would solve the problem, no;)

Scott

> vendor that really didn't pay attention....

sleekfreak pirate broadcast
world tour 2002-3
live from the pirate hideout
http://sleekfreak.ath.cx:81/

---

From: [email-masked]
Date: Fri, 29 Aug 2003 22:26:45 -0400

> of outlook or outlook express?  That would solve the problem, no;)

Well, the only problem with that idea is that we explicitly do *NOT* have a
"Your clue must be ->THIS<- tall to ride the IETF list" policy... ;)

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 Aug 2003 22:54:22 -0400

> I still say we should have put this in the "security considerations" in RFC1341:

It's pretty difficult to miss the ones that are already there - which certainly
would have been sufficient to stop Sobig had they been heeded.

---

From: Tim Chown <[email-masked]>
Date: Sat, 30 Aug 2003 10:35:08 +0100

> What's wrong with this picture?

Well, as the group that made MailScanner, we take the presence of that line 
as a great compliment by the virus writer :)

Aside:  MailScanner (which is open source and free) is one of few gateway
spam/virus detectors that can cater for those virii that forge email From:
headers so that warnings do not erroneously go back to the forged sender.   

See www.mailscanner.info if you're interested.

Tim

---

From: Dean Anderson <[email-masked]>
Date: Sat, 30 Aug 2003 17:25:19 -0400 (EDT)

> scanner's warning to the senders . . I only send a polite note to the

Don't do that. That is quite likely what the Virus writer wants you to do:
Stop notifying people about infections.  The worst that happens is that
people get notifications, and update their anti-virus, which finds
nothing.  The best that happens is that the headers included in such a
notification reveal the IP address of an infected zombie.

Also, in the current cases, I don't think the addresses aren't taken from
address books.  I'm getting responses to addresses that haven't been used
for email and addresses that haven't been used in years. Certainly, these
aren't in anyone's address book.  In one case, the address is on a little
used web site (but even spammers rarely spam it, and in another, its in a
reasonably public area, but not used)

The Virus writer obviously went to some trouble to pick valid addresses.
It stands to reason that they expect that someone is getting mail to these
addresses.  It also stands to reason that the abuser expects those persons
to get Virus notifications.

Most probably, virus notifications tend to frustrate the purposes of
the Virus operator, since the infected will not stay infected. It seems
possible that the virus operators are trying to manipulate people to stop
sending or responding to virus notifications.

In past cases, the forged from address was the target of the abuse: the
abuser hoped to have people block mail with the common from address, thus
getting some measure of revenge on that person.  Most people have
filtering on From: addresses for this reason.

The best thing to do in response to such an attack is to do things that
frustrate purposes the abuser, catch the abuser, or nothing at all.
Never succumb to what might be a desired manipulation--That only
encourages more abuse.

		--Dean

---

From: shogunx <[email-masked]>
Date: Fri, 29 Aug 2003 18:12:50 -0400 (EDT)

On Sat, 30 Aug 2003, Dean Anderson wrote:

How beautiful to be immune behind an open-source kernel;)  The rest of the
world worries.  I eat a sandwich.

Scott

---

From: Dean Anderson <[email-masked]>
Date: Sat, 30 Aug 2003 18:11:23 -0400 (EDT)

Open source kernels aren't immune. They just aren't at focus this time.

Have fun with the sandwich. ;-)

		--Dean

---

From: Tim Chown <[email-masked]>
Date: Sun, 31 Aug 2003 00:52:06 +0100

> to get Virus notifications.

I don't think so; isn't it more likely the writer wants the infection to
spread, and the best chance for that is that the recipient sees a From:
address that they recognise and "trust", rather than [email-masked],
so they look at the content where they otherwise would be wary?

I don't see a problem with notifications where the virus is known not to
forge the sender.

Tim

---

From: shogunx <[email-masked]>
Date: Sat, 30 Aug 2003 00:00:45 -0400 (EDT)

> Open source kernels aren't immune. They just aren't at focus this time.

If a worm is executing visual basic code, then i think i am pretty darn
immune.

> Have fun with the sandwich. ;-)

It was wonderful.