Subject: [Ipsec] !!! PLEASE STOP SPAMMING VIRUSES !!!

From: "Nicolas Saurbier" <[email-masked]>
Date: Thu, 27 May 2004 10:49:21 +0200

Thanx,

NIC

--------------------------------------------
Any e-mail message from Biodata Systems GmbH is sent in good faith but shall neither be binding nor construed as constituting a commitment by Biodata Systems GmbH except where provided for in a written agreement. This e-mail is intended only for the use of the recipient(s) named above. Any unauthorised disclosure, use or dissemination, either in whole or in part, is prohibited. If you have received this e-mail in error, please notify the sender immediately via e-mail and delete this e-mail from your system.
--------------------------------------------
 
Biodata Systems GmbH is a specialist manufacturer of Information Security products -This message has been scanned for all known viruses by 'Biodata BIGApplication®'.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Thu, 27 May 2004 14:01:58 +0300

I've seen such mails with viruses coming from people who use 'pine' on 
Solaris for their email.  It's not their fault.  I suppose the mail 
worm fakes the from address to an SMTP server to hide where the mail is 
sent from.

Take for example the latest "Incoming Message" from uri at lucent.com.  
Looking at full headers, I see this:

	from unknown(203.199.214.66) by nutshell.tislabs.com via csmap (V6.0) 
id srcAAAGRaaJA; Wed, 26 May 04 23:45:16 -0400

I can't dig up where 203.199.214.66 is, but that is more likely to be 
the compromised computer then any computer at Lucent.

On May 27, 2004, at 11:49 AM, Nicolas Saurbier wrote:

> Any e-mail message from Biodata Systems GmbH is sent in good faith but 
> shall neither be binding nor construed as constituting a commitment by 
> Biodata Systems GmbH except where provided for in a written agreement. 
> This e-mail is intended only for the use of the recipient(s) named 
> above. Any unauthorised disclosure, use or dissemination, either in 
> whole or in part, is prohibited. If you have received this e-mail in 
> error, please notify the sender immediately via e-mail and delete this 
> e-mail from your system.
> Biodata Systems GmbH is a specialist manufacturer of Information 
> Security products -This message has been scanned for all known viruses 
> by 'Biodata BIGApplication®'.
>

---

From: Henry Spencer <[email-masked]>
Date: Thu, 27 May 2004 09:21:12 -0400 (EDT)

> Thanx,

There is no point in screaming about it here.  None of the people actually
on this list is sending the stuff.  The garbage is coming from infected
Windows machines whose users' address books happen to include this list. 
(The source addresses are forged, typically selected randomly from the
address books.)

                                                          Henry Spencer
                                                       [email-masked]

---

From: "Theodore Ts'o" <[email-masked]>
Date: Thu, 27 May 2004 12:04:31 -0400

> (The source addresses are forged, typically selected randomly from the

Indeed, the only thing which the apparent senders have at fault is
being associated with people who have the bad taste to use a Microsoft
Outlook or Outlook Express.

We are filtering something like 400-500 Spam and virus messages A DAY
being sent to the ipsec mailing list.  It's only the ones which match
valid recipients of the ipsec mailing list (and e-mail address on the
white list) that are getting through.

						- Ted