Re: Weird emails from blfs-support mailing list...

Rainer Fiebig ([email protected] via blfs-support Mailing List) wrote:
> Am 16.09.25 um 04:26 schrieb Eric Clothier ([email protected] via
> blfs-support Mailing List):
>> On Mon, Sep 15, 2025, 22:21 Bruce Dubbs <
>> [email protected]> wrote:
>>
>>> On 9/15/25 6:15 PM, Eric Clothier ([email protected] via
>>> blfs-support Mailing
>>> List) wrote:
>>>> Is anyone else getting weird emails from the blfs-support mailing list?
>>> I got an
>>>> email from rubarbpieguy via the blfs-support list that had a pdf of
>>> coupons attached.
>>>> And I also received an email from David Daugherty via blfs-support that
>>> has a
>>>> "special invitation" from Punchbowl. Both emails show mailed from
>>> blfs-support <at>
>>>> lists <dot> linuxfromscratch <dot> org, with the reply-to having the
>>> "original"
>>>> source address (Rubarbpieguy / David Daugherty). I just wanted to bring
>>> it to
>>>> everyone's attention, in case someone's email account has been
>>> compromised.
>>>
>>> I really do not know how to stop that.  Anyone can register and send a
>>> message to all.
>>>
>>> I looked at the headers and the "coupons" message says
>>>
>>>     Reply-To: [email protected]
>>>
>>> which is a valid subscriber.  We do have both anti-spam and anti-virus
>>> software in
>>> the server, but sometimes things get through.  It looks like rhubarbpieguy
>>> has a
>>> compromised system.
>>>
>>> Bottom line, never click on an attachment or link unless you really know
>>> what it is
>>> in advance.
>>>
>>>     -- Bruce
>>>
>>> --
>>> http://lists.linuxfromscratch.org/sympa/info/blfs-support
>>> Unsubscribe: See the above information page
>>>
>> Yeah, I just wanted to bring it to light, in case Rubarbpieguy or David
>> Daugherty had potentially compromised systems that they were not aware of.
>> Honestly, the message from David Daugherty was flagged as a promotion by
>> Gmail, and that was precisely why I saw it - I didn't expect to see a
>> blfs-support message in promotions, lol.
> Right, but next time it may not be so clumsy but disguised as an
> attachement in connection with a support-request.  So I wouldn't "lol"
> too loudly.
>
>> And yeah, unless I absolutely know what I'm clicking on, I don't. It's far
>> too easy for something malicious to slip through the cracks!
> Which brings up the question of how to deal with unrequested
> attachements on this and the other lists in general.  Doesn't happen too
> rarely.  To be frank, I don't open them at all.  But maybe I've become a
> bit (too) paranoid. ;)
>
> Apart from that and as a question to the list: any advice for the poor
> guy's with the compromised systems on how to get them clean again?
>
> Rainer
>
>
>
I think I should respond to this.  I also received the David Daugherty 
message which I thought odd.  However, my coupons.pdf message was pure 
operator error on my part.  It was a listing of coupons to be sent to my 
aunt.  How I sent it to the list I don't know.  My guess is I simply 
clicked the wrong recipient although I think that's a first for me.  So 
nothing nefarious, just simple stupidity.  Sorry.

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-support
Unsubscribe: See the above information page