Article View: sci.electronics.design
Article #2578Re: Worm and Virus attack
From: Winfield Hill
Date: Sat, 20 Sep 2003 13:31
Date: Sat, 20 Sep 2003 13:31
66 lines
3816 bytes
3816 bytes
Active8 wrote...
>
> Win says...
>> Active8 wrote...
>>>
>>> wow. i'm only at 83. that's around 30 more since the last time i posted,
>>> which was the post you replied to. if you really mean that you deleted
>>> them rather than bounced them, ouch. you may or may not have confirmed
>>> a valid e-mail addy.
>>
>> I've now received over 3000 of these, each of which has a 106k
>> bytes-long worm. That's 320MB of downloads from my mail server
>> in Pittsburgh in the last 24 hours. My Comcast cable modem has
>> a slow upload speed of about 150k bits/sec, so if I were to have
>> bounced these messages, that would have taken about 5 hours of
>> full upload traffic. It's hard to see how folks with ordinary
>> POTS modems could survive such an attack.
>
> good point, but i wasn't aware that bouncing did that. figure that with
> mailwasher, you're viewing the message on the server which requires a
> download, but it's still on the server. a bounce message should be just
> that, a bounce message, no?
>
> i just bounced 15 as a test. that would be 1.59MB or 12.72Mb at 14.4kbps
> dial-up upload speed or 883 sec.
>
> it took 30 sec. :-)
>
> from the help:
>
> Clicking the Bounce box on a message or selecting E-mail/Mark for
> Bouncing from the menu sends a faked �address not found� message to the
> address that the message originated from. This reduces the possibility
> of more spam e-mail coming from this address. Checking the Bounce box
> will automatically check the Delete checkbox.
>
> Some messages may meet the virus or spam-like material selection
> criteria that is configured into MailWasher and these will automatically
> be set to Bounce and Delete. However you may unset these checkboxes if
> you wish to receive the mail.
>
> end of topic
>
> so the mail is viewed but not downloaded and the only thing sent is a
> bounce message.
>>
>> They're coming in at the rate of about four a minute right now.
>> I spent some time trying to set filters, but the quasi-random
>> nature of the Swen email headings makes that impractical with
>> my The Bat! email client. I'm ready to change programs again.
>
> i know of no filter rule ( i'm using pegasus mail, but checked out the
> bat. i think bat would be a good client and pegasus a good list server)
> that would handle this random crap.
>
> i'm up to 90 now. about 4 per hour.
>
> BTW, mailwasher can blacklist mail from certain users, so any repeat
> from the same random sender will be blaclisted. it has filters. the 2
> filters that come with it (unchecked by default) are for mail sent to
> "undisclosed recipient" and mail not specifically to you (me).
MailWasher, ok, thanks for the tip. I'll check it out.
Thanks,
- Win
Technical Details
Message-ID:
<bkhkrj038@drn.newsguy.com>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!logbridge.uoregon.edu!pln-w!spln!dex!extra.newsguy.com!newsp.newsguy.com!drnReferences:
<3f4939c.0309190951.5ee61d08@posting.google.com> <MPG.19d5451b792bd6a698986c@news.east.earthlink.net> <3F6BB55E.7E2D4EFD@earthlink.net> <MPG.19d603bed5e27573989875@news.east.earthlink.net> <bkhf2202hoc@drn.newsguy.com> <MPG.19d61eb5500badb298987a@news.east.earthlink.net>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII X-Google-Thread: 112d1e,4a531e8bd9cad7b2 X-Google-Attributes: gid112d1e,public X-Google-Thread: 113866,4a531e8bd9cad7b2 X-Google-Attributes: gid113866,public X-Google-ArrivalTime: 2003-09-20 06:50:56 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!logbridge.uoregon.edu!pln-w!spln!dex!extra.newsguy.com!newsp.newsguy.com!drn From: Winfield Hill <whill@picovolt.com> Newsgroups: sci.electronics.design,austin.internet Subject: Re: Worm and Virus attack Date: 20 Sep 2003 06:31:31 -0700 Organization: Rowland Institute Lines: 67 Message-ID: <bkhkrj038@drn.newsguy.com> References: <3f4939c.0309190951.5ee61d08@posting.google.com> <MPG.19d5451b792bd6a698986c@news.east.earthlink.net> <3F6BB55E.7E2D4EFD@earthlink.net> <MPG.19d603bed5e27573989875@news.east.earthlink.net> <bkhf2202hoc@drn.newsguy.com> <MPG.19d61eb5500badb298987a@news.east.earthlink.net> NNTP-Posting-Host: p-920.newsdawg.com X-Newsreader: Direct Read News 4.20