🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: sci.electronics.design
Article #2576

Re: Worm and Virus attack

#2576
From: Active8
Date: Sat, 20 Sep 2003 13:22
66 lines
4007 bytes
In article <bkhf2202hoc@drn.newsguy.com>, whill@picovolt.com says...
> Active8 wrote...
> >
> > wow. i'm only at 83. that's around 30 more since the last time i posted, 
> > which was the post you replied to. if you really mean that you deleted 
> > them rather than bounced them, ouch. you may or may not have confirmed
> > a valid e-mail addy.
> 
>  I've now received over 3000 of these, each of which has a 106k
>  bytes-long worm.  That's 320MB of downloads from my mail server
>  in Pittsburgh in the last 24 hours.  My Comcast cable modem has
>  a slow upload speed of about 150k bits/sec, so if I were to have
>  bounced these messages, that would have taken about 5 hours of
>  full upload traffic.  It's hard to see how folks with ordinary
>  POTS modems could survive such an attack. 

good point, but i wasn't aware that bouncing did that. figure that with 
mailwasher, you're viewing the message on the server which requires a 
download, but it's still on the server. a bounce message should be just 
that, a bounce message, no?

i just bounced 15 as a test. that would be 1.59MB or 12.72Mb at 14.4kbps 
dial-up upload speed or 883 sec.

it took 30 sec. :-)

from the help:

Clicking the Bounce box on a message or selecting E-mail/Mark for 
Bouncing from the menu sends a faked �address not found� message to the 
address that the message originated from. This reduces the possibility 
of more spam e-mail coming from this address. Checking the Bounce box 
will automatically check the Delete checkbox. 

Some messages may meet the virus or spam-like material selection 
criteria that is configured into MailWasher and these will automatically 
be set to Bounce and Delete. However you may unset these checkboxes if 
you wish to receive the mail. 

end of topic

so the mail is viewed but not downloaded and the only thing sent is a 
bounce message.
> 
>  They're coming in at the rate of about four a minute right now.
>  I spent some time trying to set filters, but the quasi-random
>  nature of the Swen email headings makes that impractical with
>  my The Bat! email client.  I'm ready to change programs again.

i know of no filter rule ( i'm using pegasus mail, but checked out the 
bat. i think bat would be a good client and pegasus a good list server) 
that would handle this random crap.

i'm up to 90 now. about 4 per hour.

BTW, mailwasher can blacklist mail from certain users, so any repeat 
from the same random sender will be blaclisted. it has filters. the 2 
filters that come with it (unchecked by default) are for mail sent to 
"undisclosed recipient" and mail not specifically to you (me).

mike
> 
>  Thanks,
>     - Win
> 
> 
Technical Details
Message-ID: <MPG.19d61eb5500badb298987a@news.east.earthlink.net>
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!logbridge.uoregon.edu!newshub.sdsu.edu!elnk-nf2-pas!newsfeed.earthlink.net!stamper.news.pas.earthlink.net!stamper.news.atl.earthlink.net!newsread2.news.atl.earthlink.net.POSTED!not-for-mail
References: <3f4939c.0309190951.5ee61d08@posting.google.com> <MPG.19d5451b792bd6a698986c@news.east.earthlink.net> <3F6BB55E.7E2D4EFD@earthlink.net> <MPG.19d603bed5e27573989875@news.east.earthlink.net> <bkhf2202hoc@drn.newsguy.com>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII
X-Google-Thread: 112d1e,4a531e8bd9cad7b2
X-Google-Attributes: gid112d1e,public
X-Google-Thread: 113866,4a531e8bd9cad7b2
X-Google-Attributes: gid113866,public
X-Google-ArrivalTime: 2003-09-20 06:22:48 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!logbridge.uoregon.edu!newshub.sdsu.edu!elnk-nf2-pas!newsfeed.earthlink.net!stamper.news.pas.earthlink.net!stamper.news.atl.earthlink.net!newsread2.news.atl.earthlink.net.POSTED!not-for-mail
From: Active8 <mREMOVEcolasono@earthlink.net.invalid>
Newsgroups: sci.electronics.design,austin.internet
Subject: Re: Worm and Virus attack
Message-ID: <MPG.19d61eb5500badb298987a@news.east.earthlink.net>
References: <3f4939c.0309190951.5ee61d08@posting.google.com> <MPG.19d5451b792bd6a698986c@news.east.earthlink.net> <3F6BB55E.7E2D4EFD@earthlink.net> <MPG.19d603bed5e27573989875@news.east.earthlink.net> <bkhf2202hoc@drn.newsguy.com>
Organization: S
X-Newsreader: MicroPlanet Gravity v2.60
Lines: 66
Date: Sat, 20 Sep 2003 13:22:48 GMT
NNTP-Posting-Host: 209.173.120.170
X-Complaints-To: abuse@earthlink.net
X-Trace: newsread2.news.atl.earthlink.net 1064064168 209.173.120.170 (Sat, 20 Sep 2003 09:22:48 EDT)
NNTP-Posting-Date: Sat, 20 Sep 2003 09:22:48 EDT