full-disclosure - bouncing SoBig.F mail (was: RE: SoBig.F strange problem)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <382BC0C28F397F4785E7414B8279F527028C2381@n2-atl-exch.it.n2bb.com>
From: ARouse at n2bb.com (Alan Rouse)
Subject: bouncing SoBig.F mail (was: RE: SoBig.F strange problem)

Doesn't this just result in sending spam to innocent parties?  Remember,
the addresses are spoofed.  Seems to me it just doubles the amount of
bogus mail flying around as a result of SoBig.F.  I've been seeing this
kind of messages, and I don't need the additional spam!  

IMO it is much better just to drop the message and forget it.

-----Original Message-----
From: Stephen Clowater [mailto:steve@...vesworld.hopto.org] 
Sent: Wednesday, August 20, 2003 10:26 AM
To: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] SoBig.F strange problem

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I started getting 1000-2000 an hour yesterday, I just went to all the
border routers and put a filter on 25 to drop those connections and send
a notice to the From feild of the smtp query, and a QUIT to the
mailserver it was connecting to.

I'd recomend doing this, its easy to do in freeBSD, all my borders are
freeBSD so I havent tried it on anything else yet :)