Re: Possible spam from Tesltra user.

Geoffrey Hyde wrote:
www.spamcop.net/sc?id=z931966737zcbe8497f877d987e944951d04bbc846dz
>
> It would appear that this is coming from a telstra user, probably one
> of their bigpond customers.  It also seems there is a rather large
> attachment, does that look like a virus or some kind of infectious
> trojan program?

Pharm spam
source 144.136.148.123  CPE-144-136-148-123.qld.bigpond.net.au
not listed in open proxy db/s, just dynamics
spamvertiser fzd.4qatada3909zxmmx9m4x94m4.therterhk.com 58.19.254.157
spamhaused as the /32 rokso Leo Kuvayev / BadCow  CNCGROUP HuBei
b64 gif attachment promoting Cialis, Viagra, Levitra

You don't have to open the spam to examine the gif.  You can access the
message properties, isolate the attachment and save it as the b64, then
b64 decode that into the gif, I use Iceows for various functions of
arc/unarc, code/decode convert, and look at the gif with a normal viewer
like IrfanView.

The disadvantage of opening the spam to inspect it is the traditional
insecurity of something like Outlook Express using Internet Explorer's
rendering engine under Windows.  If you are going to use Win, you don't
have to deal with the inherent insecurities of OE/IE.

In this case, you can inspect the interior and see that the b64 is a
.gif, then all you have to worrry about is what the rendering engine of
IE/OE can do insecurely with a malformed .gif.

// Double-free vulnerability in mshtml.dll for certain versions of
Internet Explorer 6.x allows remote attackers to cause a denial of
service (application crash) via a malformed GIF image. //   named here
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1048

patched here
http://www.microsoft.com/technet/security/bulletin/MS04-025.mspx
Microsoft Security Bulletin MS04-025

More from me in alt.spam about malformed gifs

http://groups.google.com/group/alt.spam/msg/5bf26a618d243915?hl=en&  or
http://snipurl.com/pvyx

From: "Mike Easter"
Newsgroups: alt.spam
Subject: Re: Nonsense Spam
Message-ID: <[email protected]>


-- 
Mike Easter
kibitzer, not SC admin