full-disclosure - weird worm ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3FF23C4F.15695.4B2A0A4C@localhost>
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: weird worm ?

vogt@...senet.com wrote:

> For days now, I've been receiving weird messages, with a few lines of
> apparently random, garbage text, like this:
> 
> highest bailiff nomad father advise heir 
> oxygen honorarium allegro reveal wronskian indentation coachmen 
> deficient tribute arcturus mitigate bypath 

Yep...

> Anyone got a clue what this is? There are no attachments to these mails, but
> they keep coming in at a rate of about 1-2 per day, from different sources,
> nobody I know really.

Are you "behind" an HTML-stripping filter??

No matter -- some of them have a text/html part as well as a text/plain 
part; some just have text/plain.

It is widely agreed that these are spam messages designed to cloud the 
judgement of Bayesian filters by including little or no "typically 
spammy" content and many (mostly) "normal" words.  The messgaes like 
this I have seen that do have a text/html component invariably have a 
single link to a graphic which is presumably the actual "spam".

> Anyone else receiving this stuff?

Yep...

> Makes neither sense as spam nor as a virus - no attachment, no product being
> advertised. The only explanation I can come up with is hoping for people to
> reply ("what?") and thus verifying addresses, but that doesn't fit to the
> pattern of different senders.

Think further outside the box...

Regards,

Nick FitzGerald