You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cocoon.apache.org by su...@apache.org on 2004/03/03 10:19:36 UTC
E-mail account disabling warning.
Dear user of Apache.org gateway e-mail server,
Your e-mail account has been temporary disabled because of unauthorized access.
Please, read the attach for further details.
Cheers,
The Apache.org team http://www.apache.org
Suspicious Attachment
Posted by an...@triplemind.com.
----------------------------------------------------------------------
Warning: Message delivery wasn't performed.
Reason: Our virus scanner detected very suspicious code in
the attachment of a mail addressed to a user of our system.
The following message will not be delivered:
From: support@apache.org
To: cocoon-dev@apache.org
Subj: E-mail account disabling warning.
Date: Wed, 03 Mar 2004 14:49:36 +0530
Feel free to contact webmaster@triplemind.com if you can't cope with it.
----------------------------------------------------------------------
This mail was automatically generated by TrashScan v0.08
Watch out for viruses originating from the fake support@apache.org address!
Posted by Steven Noels <st...@outerthought.org>.
On 03 Mar 2004, at 10:19, support@apache.org wrote:
> Dear user of Apache.org gateway e-mail server,
>
> Your e-mail account has been temporary disabled because of
> unauthorized access.
I have been chatting with apmail about this clever social engineering
spam which now unfortunately has been moderated through on the list:
even though it looks legitimate, especially since the ASF is cleaning
out committer accounts with no valid CLA on file as-we-speak, this mail
*is* infected with a virus. I guess it was clear to most of you
already, but please delete this mail immediately.
</Steven>
--
Steven Noels http://outerthought.org/
Outerthought - Open Source Java & XML An Orixo Member
Read my weblog at http://blogs.cocoondev.org/stevenn/
stevenn at outerthought.org stevenn at apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@cocoon.apache.org
For additional commands, e-mail: users-help@cocoon.apache.org
Re: E-mail account disabling warning.
Posted by Roger I Martin PhD <hy...@hypernexinc.com>.
Is there any digital signer anyone recommends? What is the procedure? Can
it be set automatic or is it something to remember and do
everytime? -Thanks.
----- Original Message -----
From: "Stefano Mazzocchi" <st...@apache.org>
To: <de...@cocoon.apache.org>
Cc: <ap...@apache.org>
Sent: Wednesday, March 03, 2004 4:24 PM
Subject: Re: E-mail account disabling warning.
> Steven Noels wrote:
>
> > On 03 Mar 2004, at 17:23, Brian Behlendorf wrote:
> >
> >> On Wed, 3 Mar 2004, Sam Ruby wrote:
> >>
> >>> Neither. This email contained:
> >>>
> >>> Return-Path: <an...@luminas.co.uk>
> >>> From: support@apache.org
> >>>
> >>> ... neither of which is subscribed to dev@cocoon.apache.org.
> >>>
> >>> From what I have read, ezmlm uses a separate SMTP 'SENDER' field,
which
> >>> isn't retained in the archive. My bets are that this field contained
> >>> the value savs@luminas.co.uk.
> >>
> >>
> >> No. Return-Path does capture the email address used by ezmlm to figure
> >> out if and when to send. As it turns out, "andrew@luminas.co.uk" is
able
> >> to post as he's in the "allow" database for that list.
> >
> >
> > That's what I was afraid of, since I happened to know Andrew uses *both*
> > addresses (or has been using them), at the very least in private mails
> > sent to me.
> >
> > How can we defend ourselves from bots spamming the lists using
> > subscribed or allowed addresses...?
>
> the only way is to require everybody to sign their email. But enforcing
> this would be a serious PITA.
>
> > Or do we need to actively
> > monitor/clean up stale entries in the allow list?
>
> this doesn't really reduce the problem.
>
> --
> Stefano.
>
>
Re: E-mail account disabling warning.
Posted by Stefano Mazzocchi <st...@apache.org>.
Steven Noels wrote:
> On 03 Mar 2004, at 17:23, Brian Behlendorf wrote:
>
>> On Wed, 3 Mar 2004, Sam Ruby wrote:
>>
>>> Neither. This email contained:
>>>
>>> Return-Path: <an...@luminas.co.uk>
>>> From: support@apache.org
>>>
>>> ... neither of which is subscribed to dev@cocoon.apache.org.
>>>
>>> From what I have read, ezmlm uses a separate SMTP 'SENDER' field, which
>>> isn't retained in the archive. My bets are that this field contained
>>> the value savs@luminas.co.uk.
>>
>>
>> No. Return-Path does capture the email address used by ezmlm to figure
>> out if and when to send. As it turns out, "andrew@luminas.co.uk" is able
>> to post as he's in the "allow" database for that list.
>
>
> That's what I was afraid of, since I happened to know Andrew uses *both*
> addresses (or has been using them), at the very least in private mails
> sent to me.
>
> How can we defend ourselves from bots spamming the lists using
> subscribed or allowed addresses...?
the only way is to require everybody to sign their email. But enforcing
this would be a serious PITA.
> Or do we need to actively
> monitor/clean up stale entries in the allow list?
this doesn't really reduce the problem.
--
Stefano.
Re: E-mail account disabling warning.
Posted by Andrew Savory <an...@luminas.co.uk>.
Hi,
On 3 Mar 2004, at 19:12, Steven Noels wrote:
> That's what I was afraid of, since I happened to know Andrew uses
> *both* addresses (or has been using them), at the very least in
> private mails sent to me.
Yup, I was. Now I'm happily living in mac-land, just andrew@. Do I need
to unsub savs@ and resub as andrew@? If so, where's the 'allow' list,
as I should remove myself ...
Just an unfortunate coincidence that the virus spoofed a moderator :-(
Andrew.
--
Andrew Savory, Managing Director, Luminas Limited
Tel: +44 (0)870 741 6658 Fax: +44 (0)700 598 1135
Web: http://www.luminas.co.uk/
Orixo alliance: http://www.orixo.com/
Re: E-mail account disabling warning.
Posted by Steven Noels <st...@outerthought.org>.
On 03 Mar 2004, at 17:23, Brian Behlendorf wrote:
> On Wed, 3 Mar 2004, Sam Ruby wrote:
>> Neither. This email contained:
>>
>> Return-Path: <an...@luminas.co.uk>
>> From: support@apache.org
>>
>> ... neither of which is subscribed to dev@cocoon.apache.org.
>>
>> From what I have read, ezmlm uses a separate SMTP 'SENDER' field,
>> which
>> isn't retained in the archive. My bets are that this field contained
>> the value savs@luminas.co.uk.
>
> No. Return-Path does capture the email address used by ezmlm to figure
> out if and when to send. As it turns out, "andrew@luminas.co.uk" is
> able
> to post as he's in the "allow" database for that list.
That's what I was afraid of, since I happened to know Andrew uses
*both* addresses (or has been using them), at the very least in private
mails sent to me.
How can we defend ourselves from bots spamming the lists using
subscribed or allowed addresses...? Or do we need to actively
monitor/clean up stale entries in the allow list?
</Steven>
--
Steven Noels http://outerthought.org/
Outerthought - Open Source Java & XML An Orixo Member
Read my weblog at http://blogs.cocoondev.org/stevenn/
stevenn at outerthought.org stevenn at apache.org
Re: E-mail account disabling warning.
Posted by Brian Behlendorf <br...@collab.net>.
On Wed, 3 Mar 2004, Sam Ruby wrote:
> Neither. This email contained:
>
> Return-Path: <an...@luminas.co.uk>
> From: support@apache.org
>
> ... neither of which is subscribed to dev@cocoon.apache.org.
>
> From what I have read, ezmlm uses a separate SMTP 'SENDER' field, which
> isn't retained in the archive. My bets are that this field contained
> the value savs@luminas.co.uk.
No. Return-Path does capture the email address used by ezmlm to figure
out if and when to send. As it turns out, "andrew@luminas.co.uk" is able
to post as he's in the "allow" database for that list.
Brian
Re: E-mail account disabling warning.
Posted by Sam Ruby <ru...@apache.org>.
Steven Noels wrote:
> On 03 Mar 2004, at 15:19, Sam Ruby wrote:
>
>> Agreed. It looks to me like this was NOT moderated in. The dates
>> don't match the files in
>> /home/apmail/lists/cocoon.apache.org/dev/mod/accepted
>>
>> The message contains the following header:
>>
>> Return-Path: <an...@luminas.co.uk>
>>
>> ... which, may very well have been spoofed. In any case, Andrew
>> Savory (savs@luminas.co.uk) subscribed to the dev@cocoon.apache.org
>> mailing list almost exactly two years ago (Sat Mar 2 09:54:49 PST 2002).
>
> ... and Andrew is coincidentally also one of the two moderators on this
> list. :-/
I'm not sure that that mattered.
> Are we saying ezmlm checks the Return-Path header rather than the From?
Neither. This email contained:
Return-Path: <an...@luminas.co.uk>
From: support@apache.org
... neither of which is subscribed to dev@cocoon.apache.org.
From what I have read, ezmlm uses a separate SMTP 'SENDER' field, which
isn't retained in the archive. My bets are that this field contained
the value savs@luminas.co.uk.
- Sam Ruby
Re: E-mail account disabling warning.
Posted by Steven Noels <st...@outerthought.org>.
On 03 Mar 2004, at 15:19, Sam Ruby wrote:
> Agreed. It looks to me like this was NOT moderated in. The dates
> don't match the files in
> /home/apmail/lists/cocoon.apache.org/dev/mod/accepted
>
> The message contains the following header:
>
> Return-Path: <an...@luminas.co.uk>
>
> ... which, may very well have been spoofed. In any case, Andrew
> Savory (savs@luminas.co.uk) subscribed to the dev@cocoon.apache.org
> mailing list almost exactly two years ago (Sat Mar 2 09:54:49 PST
> 2002).
... and Andrew is coincidentally also one of the two moderators on this
list. :-/
Are we saying ezmlm checks the Return-Path header rather than the From?
</Steven>
--
Steven Noels http://outerthought.org/
Outerthought - Open Source Java & XML An Orixo Member
Read my weblog at http://blogs.cocoondev.org/stevenn/
stevenn at outerthought.org stevenn at apache.org
Re: E-mail account disabling warning.
Posted by Sam Ruby <ru...@apache.org>.
Steven Noels wrote:
> On 03 Mar 2004, at 14:30, Stefano Mazzocchi wrote:
>
>> support@apache.org wrote:
>>
>>> Dear user of Apache.org gateway e-mail server,
>>> Your e-mail account has been temporary disabled because of
>>> unauthorized access.
>>> Please, read the attach for further details.
>>> Cheers,
>>> The Apache.org team
>>> http://www.apache.org
>>
>> AGGGGGH! Who let this in?
>
> Not me - Andrew?
>
> I'm starting to suspect they properly subscribed to the list prior to
> posting..... :-|
Agreed. It looks to me like this was NOT moderated in. The dates don't
match the files in /home/apmail/lists/cocoon.apache.org/dev/mod/accepted
The message contains the following header:
Return-Path: <an...@luminas.co.uk>
... which, may very well have been spoofed. In any case, Andrew Savory
(savs@luminas.co.uk) subscribed to the dev@cocoon.apache.org mailing
list almost exactly two years ago (Sat Mar 2 09:54:49 PST 2002).
> </Steven>
- Sam Ruby
Re: E-mail account disabling warning.
Posted by Steven Noels <st...@outerthought.org>.
On 03 Mar 2004, at 14:30, Stefano Mazzocchi wrote:
> support@apache.org wrote:
>
>> Dear user of Apache.org gateway e-mail server,
>> Your e-mail account has been temporary disabled because of
>> unauthorized access.
>> Please, read the attach for further details.
>> Cheers,
>> The Apache.org team
>> http://www.apache.org
>
> AGGGGGH! Who let this in?
Not me - Andrew?
I'm starting to suspect they properly subscribed to the list prior to
posting..... :-|
</Steven>
--
Steven Noels http://outerthought.org/
Outerthought - Open Source Java & XML An Orixo Member
Read my weblog at http://blogs.cocoondev.org/stevenn/
stevenn at outerthought.org stevenn at apache.org
Re: E-mail account disabling warning.
Posted by Stefano Mazzocchi <st...@apache.org>.
support@apache.org wrote:
> Dear user of Apache.org gateway e-mail server,
>
> Your e-mail account has been temporary disabled because of unauthorized access.
>
> Please, read the attach for further details.
>
> Cheers,
> The Apache.org team http://www.apache.org
AGGGGGH! Who let this in?
--
Stefano.
Watch out for viruses originating from the fake support@apache.org address!
Posted by Steven Noels <st...@outerthought.org>.
On 03 Mar 2004, at 10:19, support@apache.org wrote:
> Dear user of Apache.org gateway e-mail server,
>
> Your e-mail account has been temporary disabled because of
> unauthorized access.
I have been chatting with apmail about this clever social engineering
spam which now unfortunately has been moderated through on the list:
even though it looks legitimate, especially since the ASF is cleaning
out committer accounts with no valid CLA on file as-we-speak, this mail
*is* infected with a virus. I guess it was clear to most of you
already, but please delete this mail immediately.
</Steven>
--
Steven Noels http://outerthought.org/
Outerthought - Open Source Java & XML An Orixo Member
Read my weblog at http://blogs.cocoondev.org/stevenn/
stevenn at outerthought.org stevenn at apache.org