Full Disclosure mailing list archives
Re: viruses being sent to this list
From: Paul Schmehl <pauls () utdallas edu>
Date: Wed, 24 Mar 2004 09:59:05 -0600
--On Tuesday, March 23, 2004 08:22:55 PM -0800 John Sage <jsage () finchhaven com> wrote:
Every post to the list will have this.in it, so that's not an indication of anything.Without exception, these are all virii-laden. Whether they got here by malice or by chance, they all contain the following: Received: from NETSYS.COM (localhost [127.0.0.1]) by netsys.com (8.11.6p2-2003-09-16/8.11.6) with ESMTP id i2H1kI327175; Tue, 16 Mar 2004 20:46:18 -0500 (EST)
Last night I reviewed the archive file, and I see a way to split on each message, so I can put the messages in an array and then parse them for useful info. I just have to find the time to whip up the script.
If I find anything useful to the list, I'll post it, but what I've seen so far appears to be normal viral activity. You have to keep in mind that viruses forge the sender field routinely. If the sender is a member of this list, and the virus sends an email to the list "from" that sender, it's going to go to the list because the list isn't moderated.
At this point I don't see anything to indicate deliberate seeding, but that's very preliminary.
Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: viruses being sent to this list, (continued)
- Re: viruses being sent to this list John Sage (Mar 23)
- Re: viruses being sent to this list Byron Copeland (Mar 23)
- Re: viruses being sent to this list Gadi Evron (Mar 24)
- Re: viruses being sent to this list John Sage (Mar 24)
- Re: viruses being sent to this list Adam (Mar 24)
- Re: viruses being sent to this list Gadi Evron (Mar 24)
- Re: viruses being sent to this list Maarten (Mar 24)
- One more Wack at the dead equine WAS: viruses being sent to this list Marc Rassbach (Mar 25)
- Re: One more Wack at the dead equine WAS: viruses being sent to this list Gadi Evron (Mar 25)
- Re: One more *plonk* John Sage (Mar 25)
- Re: viruses being sent to this list Paul Schmehl (Mar 24)
- Re: viruses being sent to this list Valdis . Kletnieks (Mar 24)
- Re: viruses being sent to this list Gadi Evron (Mar 22)
- Re: viruses being sent to this list Gadi Evron (Mar 22)
- Cael's Corollary (was: viruses being sent to this list) Cael Abal (Mar 24)