Spam with "non-forged" sender

I got an interesting piece of spam today:


| Return-Path: <[email protected]>
| Delivered-To: [email protected]
| Received: (qmail 4369 invoked by uid 519); 23 Feb 2004 12:06:30 -0000
| X-Spam-Status: No, hits=2.6 required=5.0
| 	tests=YAHOO_REDIR
| X-Spam-Check-By: teal.hjp.at

The spam came through a mailing-list with an "only subscribers can post"
policy:

| Received: from arachne.luga.at (HELO arachne.luga.at) (143.130.20.2) by
teal.hjp.at (qpsmtpd/0.26) with SMTP; Mon, 23 Feb 2004 13:06:30 +0100
| Received: from arachne.luga.at (localhost [127.0.0.1])	by arachne.luga.at
(8.12.9/8.12.9) with ESMTP id i1NC6FKl005281;	Mon, 23 Feb 2004 13:06:15 +0100
| Received: from localhost (mail@localhost)	by arachne.luga.at
(8.12.9/8.12.9/Submit) with SMTP id i1NC6ECu005280;	Mon, 23 Feb 2004 13:06:14
+0100
| Received: by arachne.luga.at (bulk_mailer v1.9); Mon, 23 Feb 2004 13:06:10
+0100
| Received: from arachne.luga.at (localhost [127.0.0.1])	by arachne.luga.at
(8.12.9/8.12.9) with ESMTP id i1NC6AKl005251;	Mon, 23 Feb 2004 13:06:10 +0100
| Received: (from majordomo@localhost)	by arachne.luga.at
(8.12.9/8.12.9/Submit) id i1NC69Mm005250;	Mon, 23 Feb 2004 13:06:09 +0100
| Received: from localhost.localdomain (localhost [127.0.0.1])	by
arachne.luga.at (8.12.9/8.12.9) with ESMTP id i1NC69Kl005246	for
<[email protected]>; Mon, 23 Feb 2004 13:06:09 +0100
| X-Spam-Status: No, hits=2.6 required=5.0	tests=YAHOO_REDIR
| X-Spam-Check-By: arachne.luga.at

It came from hotmail:

| Received: from bay7-f97.bay7.hotmail.com (HELO hotmail.com) (64.4.11.97) by
arachne.luga.at (qpsmtpd/0.26) with SMTP; Mon, 23 Feb 2004 13:06:07 +0100
| Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Mon, 23 Feb 2004 03:48:45 -0800

Via their web interface:

| Received: from 195.34.133.69 by by7fd.bay7.hotmail.msn.com with HTTP;	Mon,
23 Feb 2004 11:48:44 GMT

Via 195.34.133.69, which is an HTTP proxy of a major Austrian ISP:

| X-Originating-IP: [195.34.133.69]

Ostensibly from a person subscribed to the above mailing-list and
probably authenticated by hotmail:

| X-Originating-Email: [[email protected]]
| X-Sender: [email protected]
| From: "bernhard langer" <[email protected]>

The adresses in the To: line might be from the alleged sender's address
book (they look all plausible enough):

| To: [email protected], [email protected], [email protected],
[email protected], [email protected], [email protected],
[email protected], [email protected], [email protected], [email protected],
[email protected], [email protected], [email protected],
[email protected], [email protected], [email protected],
[email protected]

The rest of the headers isn't particularly interesting:

| Subject: [luga] Was geht ...
| Date: Mon, 23 Feb 2004 11:48:44 +0000
| Mime-Version: 1.0
| Content-Type: text/plain; charset=iso-8859-1; format=flowed
| Message-ID: <[email protected]>
| X-OriginalArrivalTime: 23 Feb 2004 11:48:45.0114 (UTC)
FILETIME=[FDC831A0:01C3FA02]
| X-SMTPD: qpsmtpd/0.26, http://develooper.com/code/qpsmtpd/
| Sender: [email protected]
| X-Mailing-List: [email protected]
| List-Id: <luga.lists.luga.at>
| X-SMTPD: qpsmtpd/0.26, http://develooper.com/code/qpsmtpd/
| Content-Length: 377
| Lines: 14

Nor is the body. Just a pointer to a viagra site:

| Yeah wollt eigentlich nur fragen wie's geht? :-))
| Und dir ne Fläshige Site die dir helfen könnt dabei díeses eine problem zu
| lösen .
| Cya
|
| http://rd.yahoo.com/dir/?http://www.er4xds.com/cu/
|
| yeah peace
|

And a standard MSN footer:

| _________________________________________________________________
| So wird man Teil einer gigantischen Chattergemeinde, die ihrer Zeit voraus
| ist. http://messenger.msn.at/

I am not familiar with the headers inserted by hotmail (few of my
aquaintances use hotmail), but the headers look plausible to me. So my
analysis of the spam is that the PC of bernhard langer was infected with
a trojan, which uses his hotmail account to send spam - with his real
address as the sender - thereby circumventing any sender verification
scheme, both on the SMTP level (a mail with a hotmail address coming
from hotmail is ok) and on the message level (if hotmail implemented any
message signing, the message would probably have been signed).

People have been speculating that this would happen if any sender
verification scheme was in wide spread use. I find it interesting that
it is already happening today.

	hp

--
   _  | Peter J. Holzer    | I think we need two definitions:
|_|_) | Sysadmin WSR       | 1) The problem the *users* want us to solve
| |   | [email protected]         | 2) The problem our solution addresses.
__/   | http://www.hjp.at/ |    -- Phillip Hallam-Baker on spam

[demime 0.99d.1 removed an attachment of type application/pgp-signature]