lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 7 Feb 2004 14:15:57 -0500
From: "Richard M. Smith" <rms@...puterbytesman.com>
To: "BUGTRAQ@...URITYFOCUS. COM" <BUGTRAQ@...URITYFOCUS.COM>
Subject: Why are postmasters distributing the MyDoom virus?


Hi,

I was looking over the MyDoom email messages that I received today and found
about 15 copies of the worm which came from postmasters in bounce messages.
Some postmasters, when sending out a bounce message, include the original
email message as an attachment.  If a bounce message is for a
MyDoom-infected message, the bounce message will sometimes include an intact
copy of the MyDoom executable which can be run by mistake with a few mouse
clicks.

It looks like some postmasters are in the virus distribution business pretty
much like the MyDoom virus itself.  Perhaps these postmasters need to review
their bounce message policies and remove all attached files from messages
being bounced.

Attached is a list of postmasters that appear to have sent me intact copies
of the MyDoom virus today.

Richard M. Smith
http://www.ComputerBytesMan.com

==============================================================

System Administrator [postmaster@...CODESOURCE.com]
Mail Delivery Subsystem [MAILER-DAEMON@...lgw2.tiscali.dk]
postmaster@....ORG
Mail Delivery System [MAILER-DAEMON@...01.nyc02.dsl.net]
Mail Delivery Subsystem [MAILER-DAEMON@....adorigin.com]
MAILER-DAEMON [MAILER-DAEMON@...p.net]
postmaster@...de.dk
postmaster@....net
postmaster@...erealty.com
postmaster@...ccd.org
postmaster@...gunnet.co.jp
Mail Delivery Subsystem [MAILER-DAEMON@...T.Net]
Mail Delivery Subsystem [MAILER-DAEMON@...it.com]



Powered by blists - more mailing lists