🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: sci.electronics.design
Article #2578

Re: Worm and Virus attack

#2578
From: Winfield Hill
Date: Sat, 20 Sep 2003 13:31
66 lines
3816 bytes
Active8 wrote...
>
> Win says...
>> Active8 wrote...
>>>
>>> wow. i'm only at 83. that's around 30 more since the last time i posted, 
>>> which was the post you replied to. if you really mean that you deleted 
>>> them rather than bounced them, ouch. you may or may not have confirmed
>>> a valid e-mail addy.
>> 
>>  I've now received over 3000 of these, each of which has a 106k
>>  bytes-long worm.  That's 320MB of downloads from my mail server
>>  in Pittsburgh in the last 24 hours.  My Comcast cable modem has
>>  a slow upload speed of about 150k bits/sec, so if I were to have
>>  bounced these messages, that would have taken about 5 hours of
>>  full upload traffic.  It's hard to see how folks with ordinary
>>  POTS modems could survive such an attack. 
>
> good point, but i wasn't aware that bouncing did that. figure that with 
> mailwasher, you're viewing the message on the server which requires a 
> download, but it's still on the server. a bounce message should be just 
> that, a bounce message, no?
>
> i just bounced 15 as a test. that would be 1.59MB or 12.72Mb at 14.4kbps 
> dial-up upload speed or 883 sec.
>
> it took 30 sec. :-)
>
> from the help:
>
> Clicking the Bounce box on a message or selecting E-mail/Mark for 
> Bouncing from the menu sends a faked �address not found� message to the 
> address that the message originated from. This reduces the possibility 
> of more spam e-mail coming from this address. Checking the Bounce box 
> will automatically check the Delete checkbox. 
>
> Some messages may meet the virus or spam-like material selection 
> criteria that is configured into MailWasher and these will automatically 
> be set to Bounce and Delete. However you may unset these checkboxes if 
> you wish to receive the mail. 
>
> end of topic
>
> so the mail is viewed but not downloaded and the only thing sent is a 
> bounce message.
>> 
>>  They're coming in at the rate of about four a minute right now.
>>  I spent some time trying to set filters, but the quasi-random
>>  nature of the Swen email headings makes that impractical with
>>  my The Bat! email client.  I'm ready to change programs again.
>
> i know of no filter rule ( i'm using pegasus mail, but checked out the 
> bat. i think bat would be a good client and pegasus a good list server) 
> that would handle this random crap.
>
> i'm up to 90 now. about 4 per hour.
>
> BTW, mailwasher can blacklist mail from certain users, so any repeat 
> from the same random sender will be blaclisted. it has filters. the 2 
> filters that come with it (unchecked by default) are for mail sent to 
> "undisclosed recipient" and mail not specifically to you (me).

 MailWasher, ok, thanks for the tip.  I'll check it out.

 Thanks,
    - Win
Technical Details
Message-ID: <bkhkrj038@drn.newsguy.com>
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!logbridge.uoregon.edu!pln-w!spln!dex!extra.newsguy.com!newsp.newsguy.com!drn
References: <3f4939c.0309190951.5ee61d08@posting.google.com> <MPG.19d5451b792bd6a698986c@news.east.earthlink.net> <3F6BB55E.7E2D4EFD@earthlink.net> <MPG.19d603bed5e27573989875@news.east.earthlink.net> <bkhf2202hoc@drn.newsguy.com> <MPG.19d61eb5500badb298987a@news.east.earthlink.net>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII
X-Google-Thread: 112d1e,4a531e8bd9cad7b2
X-Google-Attributes: gid112d1e,public
X-Google-Thread: 113866,4a531e8bd9cad7b2
X-Google-Attributes: gid113866,public
X-Google-ArrivalTime: 2003-09-20 06:50:56 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!logbridge.uoregon.edu!pln-w!spln!dex!extra.newsguy.com!newsp.newsguy.com!drn
From: Winfield Hill <whill@picovolt.com>
Newsgroups: sci.electronics.design,austin.internet
Subject: Re: Worm and Virus attack
Date: 20 Sep 2003 06:31:31 -0700
Organization: Rowland Institute
Lines: 67
Message-ID: <bkhkrj038@drn.newsguy.com>
References: <3f4939c.0309190951.5ee61d08@posting.google.com> <MPG.19d5451b792bd6a698986c@news.east.earthlink.net> <3F6BB55E.7E2D4EFD@earthlink.net> <MPG.19d603bed5e27573989875@news.east.earthlink.net> <bkhf2202hoc@drn.newsguy.com> <MPG.19d61eb5500badb298987a@news.east.earthlink.net>
NNTP-Posting-Host: p-920.newsdawg.com
X-Newsreader: Direct Read News 4.20