Re: Realisticness of header rearrangement

On Apr 05 2004, Mark E. Mallett wrote:

> I see "Received" as an overlapping set of information not necessarily
> tied to the filter-produced headers.  There should be enough
> information in the filter-generated headers to uniquely identify the
> locus of operation of the filter.

Bear in mind that the spammer can easily obtain email samples
containing information such as: all the names of spam filters passed
through, all the names and IP addresses of the machines used during
delivery.

For example, suppose the spammer wants to spam yahoo users. He gets an
couple of yahoo accounts himself, sends some messages to himself, and
looks at the message headers after delivery. Now he knows exactly which spam
filters yahoo is currently using, what the names and IP addresses of
the relaying MTAs are, etc. 

All of this information can now potentially be used, when he starts sending
messages to other yahoo users. Moreover, he can use his own account to 
debug his spam message structure.


-- 
Laird Breyer.