full-disclosure - viruses being sent to this list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <076701c41098$87eac540$7702a8c0@officeeagle>
From: pauls at utdallas.edu (Paul Schmehl)
Subject: viruses being sent to this list

----- Original Message ----- 
From: "MICHAEL coles" <lppcolemi@...njsp.org>
To: <full-disclosure@...ts.netsys.com>
Sent: Monday, March 22, 2004 8:38 PM
Subject: Re: [Full-Disclosure] viruses being sent to this list


> Dookie,
>
>     There is a very fine line between uber-troll and not understanding
> the topic. What makes you think that your email wasn't found on one of
> the resting places for this mailing list? You name appears over three
> hundred times according to google.com when searching for "full
> disclosure".
>
Not picking on you, your post is just a convenient point to jump in to this
"conversation", but I really wonder if anyone thinks before they post any
more.  I read Gadi's post, and I happen to know him, so I didn't instantly
think he was an idiot or uninformed or naive.  Instead, I downloaded the
entire raw archives of the list and started grepping for patterns.  What
I've found so far is suspicious.  I won't post any results yet, because
they're incomplete, but suffice it to say that it is at least *possible*
that this list is deliberately being used to spread viruses.  It's equally
possible that it's just the random seeding that viruses do these days.  I
just don't know for sure yet, one way or the other.

>
http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=ge%40egotistical.reprehensible.net%3E+%22full+disclosure%22&btnG=Google+Search
>
> You weren't targetted, just unlucky.
>
I don't believe he's complaining about his address being targeted.  You
might consider for a moment that the people who use this list come from all
over the world, and sometimes non-native English speakers word things in a
way that could be misinterpreted if you don't pay attention to what they're
saying.  Gadi is saying that the list is deliverately being used to spread
viruses, *not* that he is personally being targeted.  He's an Israeli, so
perhaps his way of wording things is throwing you (and others) off.

This is a small sample of what I have found in the archives:
message.pif - 5 copies
your_details.pif - 2 copies
attachment.htm.pif - 1 copies
file.pif - 1 copies
test.pif - 1 copies
readme.scr - 1 copies

I say "appears" because this is very preliminary, from some 'grep "some
string" file | grep -c "filename" ' stuff, so it's not completely error
free.  In addition, the archive is one, 96+ MB file for the entire list, so
it's a bit hard to sort things out quickly, eliminate dupes, etc.

In any case, before anyone goes assuming Gadi is an idiot (which he is most
definitely not), you might take the time to consider what he's saying and,
if you don't have something useful to say, refrain from posting.  There's
far too many Monday morning quarterbacks on this list and double far too
many uninformed critics.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/