full-disclosure - AV "feature" does more DDoS than Sobig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <007201c36d70$b309bb30$550ffea9@rms>
From: rms at computerbytesman.com (Richard M. Smith)
Subject: AV "feature" does more DDoS than Sobig

   >>> Any sort of automated response based on perceived 
   >>> sender IP address is not only brain-dead, but irresponsible.

In the case of Sobig, it's the return email address which is false.  The
bogus warning messages are being sent to these forged email addresses. 

The originating IP address in the email headers of a Sobig message
should be accurate in most cases.  Sobig talks directly to the SMTP
server for the email address that Sobig is sending a copy of itself to.

Richard

#################################################################
#################################################################
#################################################################
#####
#####
#####
#################################################################
#################################################################
#################################################################