Re: Spam with "non-forged" sender

Peter
   In the past, I have sent mail like this to the postmaster of the source
mail operator and asked them to fix this.  They probably could identify the
source by account, so I don't know what having a antispam signing key for
message authentication would buy.  I think I agree with you that if signed
email were used it would only further confirm the obvious - Bernie's
machine has come down with a virus.

thanks, Mark
At 07:25 AM 2/23/2004, Peter J. Holzer wrote:
>I got an interesting piece of spam today:
>
>
>| Return-Path: <[email protected]>
>| Delivered-To: [email protected]
>| Received: (qmail 4369 invoked by uid 519); 23 Feb 2004 12:06:30 -0000
>| X-Spam-Status: No, hits=2.6 required=5.0
>|       tests=YAHOO_REDIR
>| X-Spam-Check-By: teal.hjp.at
>
>The spam came through a mailing-list with an "only subscribers can post"
>policy:
>
>| Received: from arachne.luga.at (HELO arachne.luga.at) (143.130.20.2) by
>teal.hjp.at (qpsmtpd/0.26) with SMTP; Mon, 23 Feb 2004 13:06:30 +0100
>| Received: from arachne.luga.at (localhost [127.0.0.1])        by
>arachne.luga.at
>(8.12.9/8.12.9) with ESMTP id i1NC6FKl005281;   Mon, 23 Feb 2004 13:06:15
>+0100
>| Received: from localhost (mail@localhost)     by arachne.luga.at
>(8.12.9/8.12.9/Submit) with SMTP id i1NC6ECu005280;     Mon, 23 Feb 2004
>13:06:14
>+0100
>| Received: by arachne.luga.at (bulk_mailer v1.9); Mon, 23 Feb 2004 13:06:10
>+0100
>| Received: from arachne.luga.at (localhost [127.0.0.1])        by
>arachne.luga.at
>(8.12.9/8.12.9) with ESMTP id i1NC6AKl005251;   Mon, 23 Feb 2004 13:06:10
>+0100
>| Received: (from majordomo@localhost)  by arachne.luga.at
>(8.12.9/8.12.9/Submit) id i1NC69Mm005250;       Mon, 23 Feb 2004 13:06:09
>+0100
>| Received: from localhost.localdomain (localhost [127.0.0.1])  by
>arachne.luga.at (8.12.9/8.12.9) with ESMTP id i1NC69Kl005246    for
><[email protected]>; Mon, 23 Feb 2004 13:06:09 +0100
>| X-Spam-Status: No, hits=2.6 required=5.0      tests=YAHOO_REDIR
>| X-Spam-Check-By: arachne.luga.at
>
>It came from hotmail:
>
>| Received: from bay7-f97.bay7.hotmail.com (HELO hotmail.com) (64.4.11.97)
by
>arachne.luga.at (qpsmtpd/0.26) with SMTP; Mon, 23 Feb 2004 13:06:07 +0100
>| Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
>Mon, 23 Feb 2004 03:48:45 -0800
>
>Via their web interface:
>
>| Received: from 195.34.133.69 by by7fd.bay7.hotmail.msn.com with HTTP; Mon,
>23 Feb 2004 11:48:44 GMT
>
>Via 195.34.133.69, which is an HTTP proxy of a major Austrian ISP:
>
>| X-Originating-IP: [195.34.133.69]
>
>Ostensibly from a person subscribed to the above mailing-list and
>probably authenticated by hotmail:
>
>| X-Originating-Email: [[email protected]]
>| X-Sender: [email protected]
>| From: "bernhard langer" <[email protected]>
>
>The adresses in the To: line might be from the alleged sender's address
>book (they look all plausible enough):
>
>| To: [email protected], [email protected], [email protected],
>[email protected], [email protected], [email protected],
>[email protected], [email protected], [email protected], [email protected],
>[email protected], [email protected], [email protected],
>[email protected], [email protected], [email protected],
>[email protected]
>
>The rest of the headers isn't particularly interesting:
>
>| Subject: [luga] Was geht ...
>| Date: Mon, 23 Feb 2004 11:48:44 +0000
>| Mime-Version: 1.0
>| Content-Type: text/plain; charset=iso-8859-1; format=flowed
>| Message-ID: <[email protected]>
>| X-OriginalArrivalTime: 23 Feb 2004 11:48:45.0114 (UTC)
>FILETIME=[FDC831A0:01C3FA02]
>| X-SMTPD: qpsmtpd/0.26, http://develooper.com/code/qpsmtpd/
>| Sender: [email protected]
>| X-Mailing-List: [email protected]
>| List-Id: <luga.lists.luga.at>
>| X-SMTPD: qpsmtpd/0.26, http://develooper.com/code/qpsmtpd/
>| Content-Length: 377
>| Lines: 14
>
>Nor is the body. Just a pointer to a viagra site:
>
>| Yeah wollt eigentlich nur fragen wie's geht? :-))
>| Und dir ne Fläshige Site die dir helfen könnt dabei díeses eine problem zu
>| lösen .
>| Cya
>|
>| http://rd.yahoo.com/dir/?http://www.er4xds.com/cu/
>|
>| yeah peace
>|
>
>And a standard MSN footer:
>
>| _________________________________________________________________
>| So wird man Teil einer gigantischen Chattergemeinde, die ihrer Zeit voraus
>| ist. http://messenger.msn.at/
>
>I am not familiar with the headers inserted by hotmail (few of my
>aquaintances use hotmail), but the headers look plausible to me. So my
>analysis of the spam is that the PC of bernhard langer was infected with
>a trojan, which uses his hotmail account to send spam - with his real
>address as the sender - thereby circumventing any sender verification
>scheme, both on the SMTP level (a mail with a hotmail address coming
>from hotmail is ok) and on the message level (if hotmail implemented any
>message signing, the message would probably have been signed).
>
>People have been speculating that this would happen if any sender
>verification scheme was in wide spread use. I find it interesting that
>it is already happening today.
>
>         hp
>
>--
>    _  | Peter J. Holzer    | I think we need two definitions:
>|_|_) | Sysadmin WSR       | 1) The problem the *users* want us to solve
>| |   | [email protected]         | 2) The problem our solution addresses.
>__/   | http://www.hjp.at/ |    -- Phillip Hallam-Baker on spam
>
>[demime 0.99d.1 removed an attachment of type application/pgp-signature]