full-disclosure - Swen Really Sucks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0309241229260.25794-100000@kepler.acns.bethel.edu>
From: b-nordquist at bethel.edu (Brent J. Nordquist)
Subject: Swen Really Sucks

On Wed, 24 Sep 2003, Peter Busser <peter@...steddebian.org> wrote:

> I use several procmail rules to filter out domains (microsoft.com,
> msdn.com, etc.) in From: and From, To: (e.g. microsoft.com) and certain
> words in the subject (e.g. Microsoft). Since the virus depends on
> looking like an authentic message, it can't do too much randomisation of
> the domains and subject lines. Of course the filtering is not perfect,
> but it still reduces the number of virus messages hitting the inbox.

Someone pointed out yesterday that Swen has the header "SUBJECT: " in all
upper-case, as opposed to the usual mixed-case "Subject: ".  I looked at
all the ones I've received, and sure enough, they're all upper-case.  
That might be another telltale you can use if you're taking the procmail
approach.

-- 
Brent J. Nordquist <b-nordquist@...hel.edu> N0BJN
Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html
* Fast pipe * Always on * Get out of the way - Tim Bray http://tinyurl.com/7sti