full-disclosure - From field spoofing and AV responses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <40174007.4080104@dylanic.de>
From: security at dylanic.de (Michael Renzmann)
Subject: From field spoofing and AV responses

Hi.

Another OT threat, so I'll keep it short.

Erik van Straten wrote:
>>How hard would it be to have the AV software actually check the source
>>email smtp host, and send an email to abuse@....com for the *actual*
>>offending smtp server?
> Incredibly hard.

Yep. Mostly because of the fact that these type of worms use their own 
local SMTP engine. So, what you'll likely see is that the originating 
SMTP server IP is within the Dial-Up-Pool of your favorite ISP.

Autoresponding AV software is a bad idea in times of 
from-address-spoofing. Personally, I'd vote for throwing every false 
"Watch, I catched a virus that YOU sent to me" auto-response towards the 
company that thought auto-responding would be a great idea. Maybe that 
would make them start thinking it over again...

Bye, Mike