You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Arthur Dent <ml...@blueyonder.co.uk> on 2008/04/04 12:52:12 UTC
Spam from the list?
Hello all,
This one slipped through almost entirely unscathed...
http://pastebin.com/m642c5e5
The worrying thing for me is that this is an email address I have only
recently created and have ONLY ever used for subscribing to this list (I
have not even used it for posting yet - errr... well until now...) having
unsubscribed my last address because my other ISP was bouncing too many
messages...
So is it just coincidence? - A spammer got lucky with a name generation
tool?
Can anyone shed any light?
Thanks
Mark
Re: Spam from the list?
Posted by Arthur Dent <ml...@blueyonder.co.uk>.
On Fri, Apr 04, 2008 at 07:34:43AM -0400, Matt Kettler wrote:
> Michael Scheidell wrote:
>>> From: Arthur Dent <ml...@blueyonder.co.uk>
>>> Date: Fri, 4 Apr 2008 11:52:12 +0100
>>> To: <us...@spamassassin.apache.org>
>>> Subject: Spam from the list?
>>>
>>> Hello all,
>>>
>>>
>>> The worrying thing for me is that this is an email address I have only
>>> recently created and have ONLY ever used for subscribing to this list (I
>>>
>>
>> You email address IS public now, SA list is mirrored on several web servers.
>> Email harvesters will find it.
>>
> Well, now, yes.. however, the OP did say he hadn't used it for posting.
> Doesn't matter how many mirrors there are.
>> Also, (not sure what list) but the 'backdoor' email address we use to send
>> copies of this list (and others) to our internal public folders was also
>> spammed. We never used that to post, so they must have gotten it from one
>> of the lists web pages.
>>
> Hmm, that's odd, as the subscriber list shouldn't ever appear on a web
> archive mirror. The only addresses there would be those actually appearing
> in posts via From, Cc or body text.
>
> I'm hoping this is just name generation coincidence.. Spammers extensively
> use dictionary attacks, and unless your email address is highly
> un-guessable (ie: aurthur's mlists is pretty guessable) it will eventually
> be found by spammers even if it's never used anywhere.
Yes. True...
I should also point out that the address I was subscribed with
previously (sa.lists@troodos.demon.com) was NEVER spammed and I used
that (and posted) for years. In fact I came to trust this (and other)
list(s) so much that I decided to create a generic one for all my
mailing lists instead of one for each...
>
> I intend to do some testing to see what's going on..
Thanks - I really hope it's just coincidence...
All the best...
Mark
>
Re: Spam from the list?
Posted by Arthur Dent <ml...@blueyonder.co.uk>.
On Fri, Apr 04, 2008 at 07:55:24AM -0400, Matt Kettler wrote:
> Michael Scheidell wrote:
>>> From: Matt Kettler <mk...@verizon.net>
>>> Date: Fri, 04 Apr 2008 07:34:43 -0400
>>> To: Michael Scheidell <sc...@secnap.net>
>>> Cc: Arthur Dent <ml...@blueyonder.co.uk>, <us...@spamassassin.apache.org>
>>> Subject: Re: Spam from the list?
>>>
>>> Michael Scheidell wrote:
>>>
>>>>> From: Arthur Dent <ml...@blueyonder.co.uk>
>>>>> Date: Fri, 4 Apr 2008 11:52:12 +0100
>>>>> To: <us...@spamassassin.apache.org>
>>>>> Subject: Spam from the list?
>>>>>
>>>>> Hello all,
>>>>>
>>>>>
>>>>> The worrying thing for me is that this is an email address I have only
>>>>> recently created and have ONLY ever used for subscribing to this list (I
>>>>>
>>
>> I don't even mung my personal email address: michael@scheidell.org.
>>
>
> Well, I'm less worried about it from a "who gets spam" perspective, but
> more worried by what it implies. These are the only ways for a spammer to
> detect an address that's subscribed to this list, but never used for
> posting anywhere:
>
> 0) That address really has been used for posting, possibly by a former
> owner of your domain.
No - I can assure you it hasn't..
> 1) Dictionary attack (ie: guessing, which they do a lot of, and if you
> don't have countermeasures, they guess quite rapidly)
Well - possibly a random guess...
> 2) malware on the PC you used to subscribe, or any of your local servers
> used to handle the subscription request.
Hmmm... I use Linux and am pretty paranoid about security (rkhunter +
chkrootkit run every night - selinux in enforcing mode, etc.)
> 3) hacking the list servers and mining the address (ie: malware on the list
> server)
Dunno...
> 4) malware on the routers of one of the ISPs involved is sniffing the lines.
Ditto...
>
> As you go down the list, they get more and more improbable. 0 is
> essentially the "your assertions are wrong, possibly due to lack of
> adequate information" case, hence I didn't really consider it a proper part
> of the list. However, it does merit mentioning.
>
> However, the possibility of 3 is disturbing, and the fact that this has
> happened to two different "blind" addresses does make it twice as likely..
> of course, 2 times near zero is still near zero... I'll post any findings
> I come up with later..
I would say that, unless others on this list have received this same spam
to their subscription address, then it is just a chance hit on my (as
you say "pretty guessable") new address.
Thanks for looking into it...
Mark
Re: Spam from the list?
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Fri, 2008-04-04 at 07:55 -0400, Matt Kettler wrote:
> Well, I'm less worried about it from a "who gets spam" perspective, but
> more worried by what it implies. These are the only ways for a spammer
> to detect an address that's subscribed to this list, but never used for
> posting anywhere:
^^^^^^^
Probably doesn't apply to the OP, since the address seems to be used
exclusively for mailing lists -- however, your list of address
harvesting sources lacks a possibility:
> 0) That address really has been used for posting, possibly by a former
> owner of your domain.
> 1) Dictionary attack (ie: guessing, which they do a lot of, and if you
> don't have countermeasures, they guess quite rapidly)
> 2) malware on the PC you used to subscribe, or any of your local servers
> used to handle the subscription request.
Malware on the machine of anyone, who ever received a (personal) mail
from that address, sent a mail to it or otherwise added it to some local
address book.
(Since bots spread themself by harvesting address books on infected
machines, spammers would be dumb if they don't use these addresses as
targets, too.)
> 3) hacking the list servers and mining the address (ie: malware on the
> list server)
> 4) malware on the routers of one of the ISPs involved is sniffing the lines.
guenther
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Spam from the list?
Posted by Matt Kettler <mk...@verizon.net>.
Michael Scheidell wrote:
>> From: Matt Kettler <mk...@verizon.net>
>> Date: Fri, 04 Apr 2008 07:34:43 -0400
>> To: Michael Scheidell <sc...@secnap.net>
>> Cc: Arthur Dent <ml...@blueyonder.co.uk>, <us...@spamassassin.apache.org>
>> Subject: Re: Spam from the list?
>>
>> Michael Scheidell wrote:
>>
>>>> From: Arthur Dent <ml...@blueyonder.co.uk>
>>>> Date: Fri, 4 Apr 2008 11:52:12 +0100
>>>> To: <us...@spamassassin.apache.org>
>>>> Subject: Spam from the list?
>>>>
>>>> Hello all,
>>>>
>>>>
>>>> The worrying thing for me is that this is an email address I have only
>>>> recently created and have ONLY ever used for subscribing to this list (I
>>>>
>
> I don't even mung my personal email address: michael@scheidell.org.
>
Well, I'm less worried about it from a "who gets spam" perspective, but
more worried by what it implies. These are the only ways for a spammer
to detect an address that's subscribed to this list, but never used for
posting anywhere:
0) That address really has been used for posting, possibly by a former
owner of your domain.
1) Dictionary attack (ie: guessing, which they do a lot of, and if you
don't have countermeasures, they guess quite rapidly)
2) malware on the PC you used to subscribe, or any of your local servers
used to handle the subscription request.
3) hacking the list servers and mining the address (ie: malware on the
list server)
4) malware on the routers of one of the ISPs involved is sniffing the lines.
As you go down the list, they get more and more improbable. 0 is
essentially the "your assertions are wrong, possibly due to lack of
adequate information" case, hence I didn't really consider it a proper
part of the list. However, it does merit mentioning.
However, the possibility of 3 is disturbing, and the fact that this has
happened to two different "blind" addresses does make it twice as
likely.. of course, 2 times near zero is still near zero... I'll post
any findings I come up with later..
Re: Spam from the list?
Posted by Michael Scheidell <sc...@secnap.net>.
> From: Matt Kettler <mk...@verizon.net>
> Date: Fri, 04 Apr 2008 07:34:43 -0400
> To: Michael Scheidell <sc...@secnap.net>
> Cc: Arthur Dent <ml...@blueyonder.co.uk>, <us...@spamassassin.apache.org>
> Subject: Re: Spam from the list?
>
> Michael Scheidell wrote:
>>> From: Arthur Dent <ml...@blueyonder.co.uk>
>>> Date: Fri, 4 Apr 2008 11:52:12 +0100
>>> To: <us...@spamassassin.apache.org>
>>> Subject: Spam from the list?
>>>
>>> Hello all,
>>>
>>>
>>> The worrying thing for me is that this is an email address I have only
>>> recently created and have ONLY ever used for subscribing to this list (I
I don't even mung my personal email address: michael@scheidell.org.
Just in case spammers need more, its michael@scheidell.org.
And, my personal email address (mailto:michael@scheidell.org) should be easy
for DHA attackers to try.
I guess mailto:scheidell@secnap.net should be easy to guess also, but not
needed. Its posted to thousands of posts in blogs, old usenet posts and
SA/snort/bugtraq/amavis and other mailing list mirrors.
Funny thing, even though michael@scheidell.org is easy to guess, no spam
gets through my SA/ amavisd/postfix/razor/dcc setup.!
--
Michael Scheidell, CTO
>|SECNAP Network Security
Winner 2008 Network Products Guide Hot Companies
FreeBSD SpamAssassin Ports maintainer
Charter member, ICSA labs anti-spam consortium
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(tm).
For Information please see http://www.spammertrap.com
_________________________________________________________________________
Re: Spam from the list?
Posted by Matt Kettler <mk...@verizon.net>.
Michael Scheidell wrote:
>> From: Arthur Dent <ml...@blueyonder.co.uk>
>> Date: Fri, 4 Apr 2008 11:52:12 +0100
>> To: <us...@spamassassin.apache.org>
>> Subject: Spam from the list?
>>
>> Hello all,
>>
>>
>> The worrying thing for me is that this is an email address I have only
>> recently created and have ONLY ever used for subscribing to this list (I
>>
>
> You email address IS public now, SA list is mirrored on several web servers.
> Email harvesters will find it.
>
Well, now, yes.. however, the OP did say he hadn't used it for posting.
Doesn't matter how many mirrors there are.
> Also, (not sure what list) but the 'backdoor' email address we use to send
> copies of this list (and others) to our internal public folders was also
> spammed. We never used that to post, so they must have gotten it from one
> of the lists web pages.
>
Hmm, that's odd, as the subscriber list shouldn't ever appear on a web
archive mirror. The only addresses there would be those actually
appearing in posts via From, Cc or body text.
I'm hoping this is just name generation coincidence.. Spammers
extensively use dictionary attacks, and unless your email address is
highly un-guessable (ie: aurthur's mlists is pretty guessable) it will
eventually be found by spammers even if it's never used anywhere.
I intend to do some testing to see what's going on..
Re: Spam from the list?
Posted by Michael Scheidell <sc...@secnap.net>.
> From: Arthur Dent <ml...@blueyonder.co.uk>
> Date: Fri, 4 Apr 2008 11:52:12 +0100
> To: <us...@spamassassin.apache.org>
> Subject: Spam from the list?
>
> Hello all,
>
>
> The worrying thing for me is that this is an email address I have only
> recently created and have ONLY ever used for subscribing to this list (I
You email address IS public now, SA list is mirrored on several web servers.
Email harvesters will find it.
Also, (not sure what list) but the 'backdoor' email address we use to send
copies of this list (and others) to our internal public folders was also
spammed. We never used that to post, so they must have gotten it from one
of the lists web pages.
Ps, I trust SpamAssassin so much, that long ago I stopped munging my email
address. Have had same email address since 2001. SA has helped block
sometimes 2000 spams a day just to me. (seriously, remember, I don't munge
my email address).
(thanks Theo and the whole SA team. You probably saved me jail time if out
of frustration I would have tracked down and killed some spammer. I am in
Boca Raton, spam capitol of the world ;-)
--
Michael Scheidell, CTO
>|SECNAP Network Security
Winner 2008 Network Products Guide Hot Companies
FreeBSD SpamAssassin Ports maintainer
Charter member, ICSA labs anti-spam consortium
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(tm).
For Information please see http://www.spammertrap.com
_________________________________________________________________________