full-disclosure - MS Security Bulletin doing email harvesting?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Law14-F461DMD1F5fk000008e08@hotmail.com>
From: kdurron at hotmail.com (Kyp Durron)
Subject: MS Security Bulletin doing email harvesting?

I get this email today that says it’s from 
windowssecurity@...il.microsoft.com.  It looks legit so I go to forward it 
to someone I know and Outlook 2003 pops an error message that I attached.  I 
look at the HTML and it’s trying to pull the following URL.

http://www.m0.net/m/logopen02.asp?vid=1102&catid=9707637645&ecid=0

I go to www.m0.net and it’s a mass marketing site.

Here is the message header.

Microsoft Mail Internet Headers Version 2.0

Received: from mh.microsoft.m0.net ([xxx.xxx.xxx.xxx]) by mail.xxxxxxx.com 
with Microsoft SMTPSVC(5.0.2195.5329);

             Mon, 4 Aug 2003 12:12:42 -0500

Received: from [xxx.xxx.xxx.xxx]

            by 10.203.1.116 (mh.microsoft.m0.net) with SMTP; 04 Aug 2003 
10:36:29 +0000

Message-ID: <9707637645.1060016945712@...net>

Date: Mon, 4 Aug 2003 10:09:05 -0700 (PDT)

From: Microsoft <windowssecurity@...il.microsoft.com>

Reply-to: windowssecurity@...il.microsoft.com

To: xxxxxx@...xxxx.com

Subject: Security Update for Microsoft Windows

Errors-to: windowssecurity@...il.microsoft.com

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="---=_NEXT_f6cdeefa1d"

X-cid: 9707637645

X-pid: 228387

Return-Path: windowssecurity@...il.microsoft.com

X-OriginalArrivalTime: 04 Aug 2003 17:12:42.0446 (UTC) 
FILETIME=[9D7A6EE0:01C35AAB]

Do you all think it’s a spammer trying to harvest emails by impersonating a 
MS security bulletin?  If it is, how funny is THAT?!?!?

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OutlookWarning.JPG
Type: image/pjpeg
Size: 15849 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030804/5f120e80/OutlookWarning.bin