🚀 go-pugleaf

quoting Winfield Hill <whill@picovolt.com> :
> I've now received over 3000 of these, each with a 106k bytes-long worm.

	you must have received an (increasing) number of bounces also,
	without the worm (ISPs are installing filters and dropping the
	attachments), plus bounces of "Can't be delivered, no such address.


> That's 320MB of downloads from my mail server in Pittsburgh in 24 hours.
> hard to see how folks with ordinary POTS modems could survive such an attack. 

	simple: one uses a decent mail-agent and ISP (the latter is hard to
	figure out beforehand); one doesn't download but the headers (IMAP)
	or only complete messages shorter than X k (Eudora) with X set to
	between 10k and 70k (would work for most)


> They're coming in at the rate of about four a minute right now.
> I spent some time trying to set filters, but the quasi-random nature of
> the Swen email headings makes that impractical with my The Bat! email client.
> I'm ready to change programs again.

	sweN --> News		if you stop posting to USEnet the rate should
	go down within a day or two...
						:-)

	sometimes I can't help but wonder is such worms are written by
	people who are disgusted with deficiencies in current computing
	platforms: talking to MicroSloth (and sendmail, for that matter)
	authors for several decades about lurking problems didn't get
	anything addressed, telling ISP's about DOS-attack problems,
	mail-floods (both message size and number of messages), forging,
	snooping, etc... didn't get any of them to take any steps.

	I just checked, and it's somewhere between funny and pathetic to
	see how many users here have hundreds of megabytes waiting for
	them in the mail-queue...  I wonder how many ISPs are learning
	the hard way about this problem (waiting to happen again) and
	how many lusers will get their courage up to bitch at their ISP
	to get their shit together and PREPARE for this kind of event
	to happen again and again and again... and to be ready to react
	quickly and effectively, without poor lusers getting overwhelmed
	and losing the email that they actually want to receive.

	this particular attack is targetting the USEnet community as
	a whole (those who don't post there should see little... and
	may wonder what the hoopla is all about) and the theory is that
	its some spammer(s) who are trying to retaliate and inconvenience
	(keep otherwise busy) those netizens who are trying to fight the
	email spam problem... could be, but maybe not.

	...next time it will be another subset of the online community
	(users of some software, website, or communication protocol) who
	will be victimized, thrown for a loop, and more and more people
	will get turned off to the whole online experience and technology.

	Vandals and Anarchists clearly have a new playground, as do all the
	snakeoil salesmen and con artists of the world... (not mentioning
	criminal and political organizations, and business mainsleaze...
	it's going to be a long next couple of years, I fear)

-- 
  /"\      ASCII...       ._.    ||   Stop Verisign DNS Abuse Petition 
  \ /     on Usenet       /v\    ||       www.whois.sc/verisign-dns
   X    ANYTHING ELSE   /(   )\  ||      "Don't Mess With Penguins!!"
  / \    IS BLOAT !!     ^^ ^^   ||       OPT-OUT is *UNACCEPTABLE*