Re: Re: Barracuda: WinMain lpCmdLine

On Tuesday 05 August 2003 16:29, Diez B. Roggisch wrote:
> Richard Kunze wrote:
> >>I just got one of these from Richard Kunze.
> >
> >You got one of these from someone claiming to be me, to be precise. I'd be
> >very surprised if a Windows virus a) made it through or scanner and b)
> >m
> >
> >
> >anaged to infect my Linux box.
>
> I didn't want to say that you were the actual sender. I also use Linux,
> and mozilla on windows - still Jacob got a virus claiming to be from me.
> Thats why I think  that they might harvest our mailing list archives,
> sending mails to people from the list, faking other list-members
> addresses as sender to make them look less suspicious.

You've got the scond point dead accurate - newer viruses indeed fake the 
sender address to make it look less suspicious. 

As far as I know, however, they get their pool of fake addresses from the most 
obvious place: The address book and inbox of their victim. A typical windows 
mail worm has full access to both, and it's the most likely place to find 
both new potential victims to infect and fake sender addresses that look 
"harmless" to these victims.

-- 
Richard Kunze 

[ t]ivano Software, Bahnhofstr. 18, 63263 Neu-Isenburg
Tel.: +49 6102 80 99 07 - 0, Fax.: +49 6102 80 99 07 - 1
http://www.tivano.de, [email protected]

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQA/L8Tb86Aqb3OZfF4RArWlAJ9ZV+M4tsds9yzTjstiWhSmDnjefwCfTFVO
bfYBri6Ql6wLqaTINSdZKkE=
=em1U
-----END PGP SIGNATURE-----