Subject: Re: [Asrg] Is this a new spam form?

From: Matt Sergeant <[email-masked]>
Date: Tue, 1 Apr 2003 11:52:49 +0100

On Tuesday, Apr 1, 2003, at 05:27 Europe/London, Kee Hinckley wrote:

> I have heard people talk of viruses/trojans which either sent spam 
> directly, or used the user's account to signup for free accounts on 
> webmail sites and sent spam using those.  But I've only heard those in 
> the friend-of-a-friend market.
>
> There was an e-greetings trojan (technically it wasn't a trojan, it 
> was a test of how closely you read a EULA) which sent greeting card 
> messages to everyone in your address book.  I've also heard that it 
> sent a copy of your address book to the company who set it up--but I 
> haven't seen that officially reported anywhere.  (The fact that the 
> software did what it said it was going to do kind of threw the 
> anti-virus companies in a quandry.  Some blocked it, some did not. The 
> company sending the stuff had to switch servers several times too, 
> since their ISP's weren't so friendly.  Last I heard they had a server 
> in Panama.)
>
> On the illegal fringes of spam I suspect that regular collaboration of 
> virus writers and spammers is only a matter of time.  It's good money 
> for the script kiddies.  Most likely I would expect the virus not to 
> carry the spam payload directly, but to pick it up from a newsgroup or 
> some such.

The virus in question is (was?) Trojan.Win32.Rewt. A spam sending 
trojan. But I don't expect we'll see many more of those - it's *very* 
illegal to write a trojan - the feds *will* lock you up for it. 
Especially in these times of heightened security everywhere. I'd be 
very surprised if spammers went to these lengths.

Matt.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 1 Apr 2003 15:04:42 +0200

> very surprised if spammers went to these lengths.

IANAL, but isn't the big problem to prove who the originator is?
Just that e.g. a site is spamvertised is not a evidence. Other than
that it would be really easy to get rid of competitors.
And with all the taken hosts esp. in South Asia and South America
it shouldn't be too hard a thing to get it spread without anyone being
able to prove the real source. And as soon as it's gone the mission is
accomplished.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matt Sergeant <[email-masked]>
Date: Tue, 1 Apr 2003 14:54:21 +0100

> IANAL, but isn't the big problem to prove who the originator is?

Sure. But it's easier than with a regular virus. Follow the money.

Matt.

---

From: wayne <[email-masked]>
Date: 01 Apr 2003 11:16:40 -0600

In <[email-masked]> Matt Sergeant <[email-masked]> writes:

>         But I don't expect we'll see many more of those - it's *very*
> illegal to write a trojan - the feds *will* lock you up for
> it. Especially in these times of heightened security everywhere. I'd
> be very surprised if spammers went to these lengths.

Uh, and all the stock pump-and-dump scams, 419 scams, pyramid schemes,
etc. aren't also *very* illegal?  Breaking the law doesn't seem to
bother many spammers and I don't see how using a spam-worm as a tool
would bother them any more than using stolen credit cards to sign up
for ISPs.

-wayne

---

From: [email-masked] (Justin Mason)
Date: Tue, 01 Apr 2003 10:51:41 -0800

> very surprised if spammers went to these lengths.

On the contrary -- I reckon there'll be *more* if open relays and
proxies decrease.   A lot of spammers do not care about the legality of
how the spam gets from them to their recipients.  In a good few
jurisdictions, it's already illegal anyway!

--j.