bugtraq - Re: Why are postmasters distributing the MyDoom virus?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0402101308100.4320@shishi.roaringpenguin.com>
Date: Tue, 10 Feb 2004 13:29:51 -0500 (EST)
From: "David F. Skoll" <dfs@...ringpenguin.com>
To: "Richard M. Smith" <rms@...puterbytesman.com>
Cc: "BUGTRAQ@...URITYFOCUS. COM" <BUGTRAQ@...urityfocus.com>
Subject: Re: Why are postmasters distributing the MyDoom virus?

On Sat, 7 Feb 2004, Richard M. Smith wrote:

> I was looking over the MyDoom email messages that I received today and found
> about 15 copies of the worm which came from postmasters in bounce messages.
> Some postmasters, when sending out a bounce message, include the original
> email message as an attachment.  If a bounce message is for a
> MyDoom-infected message, the bounce message will sometimes include an intact
> copy of the MyDoom executable which can be run by mistake with a few mouse
> clicks.

This is sometimes unavoidable.  A lot of MyDoom's go to nonexistent
recipients, and when they are failed with a 5xx failure code, the sending
relay (quite reasonably) includes the original message in the bounce.

Regards,

David.