- NANOG - lists.nanog.org

Re: companies like microsoft and telia...
by Steven M. Bellovin 26 Jun '03

26 Jun '03

In message <g3u1ac23g8.fsf(a)sa.vix.com>, Paul Vixie writes: > >Kauto.Huopio(a)ficora.fi (Huopio Kauto) writes: > >> How about IODEF? Lots of CERT:s and company-internal abuse teams:s ticketing >> systems are going to eat it with ease - if not now, soon. > >please post a url so we can all take a look at the "IODEF" complaint format. >-- >Paul Vixie > See http://www.ietf.org/html.charters/inch-charter.html --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

RE: companies like microsoft and telia...
by Huopio Kauto 26 Jun '03

26 Jun '03

>> Perhaps someone could write a bcp for an email-form that lays out the same >> information so we can make the complaints use this format and all abuse >> departments can accept using this form, to get some structure to it? >yow. i first asked that this be done in 1998, and for this very reason >among others. can anybody beat that date (with an earlier one?) this is >a hard problem but with outlook forms and sri-style ascii templates it's >quite achievable. note though that many abusebots will reject MIME >since it might contain a virus. and, there will be huge controversies >about header munging, list cleaning, complaint forwarding, and >definitions of >"abuse", "consent", "implied consent", "recourse", and "standing". >so if ``someone'' writes this up, count me as a grateful&willing >reviewer. >-- >Paul Vixie How about IODEF? Lots of CERT:s and company-internal abuse teams:s ticketing systems are going to eat it with ease - if not now, soon. --Kauto FICORA / CERT-FI

2 1

RE: Weird email messages with "re:movie" and "re:application" in the subject line..
by McBurnett, Jim 26 Jun '03

26 Jun '03

got it here too.. And on 30+ publicly annouced mail accounts.... Hitting big.. sobig virus once again... Jim -----Original Message----- From: Anne P. Mitchell, Esq. [mailto:amitchell@habeas.com] Sent: Wednesday, June 25, 2003 11:05 PM To: 'nanog(a)merit.edu' Subject: Re: Weird email messages with "re:movie" and "re:application" in the subject line.. > New spam technique or some new virus, similar to a Melissa? Any body > else seeing this? We're seeing it here too, coming to role accounts. Our folks are saying virus, but haven't identified which one yet. Anne

3 2

Major E-mail Delivery for FTC DNCR Launch
by Callahan, Richard M, SOLGV 26 Jun '03

26 Jun '03

Good Afternoon and forgive the new guy if I break any rules or conventions. I work for AT&T Government Solutions and we are about to launch the Do Not Call Registry for the Federal Trade Commission. At a high level this allows consumers to register their phone numbers to keep most telemarketers from calling their homes. Penalties for calling a consumer on the list can be $11K per call and enforcement begins in October. We are launching consumer registrations on Friday. My concern: - every registration using the web generates an email which must be opened to complete the registration process We are looking at the potential of MILLIONS OF EMAILS PER DAY beginning Friday. These will be from the same address and have the same subject line. I am worried about denial of service or blocking by spam filters if providers are not aware this is coming. I am hoping this group is a good medium to get the word out to inform the community of this impending event. At this time I am unable to provide the link or email address, but will do so on Thursday evening if it is of value. Any thoughts? Richard M. Callahan Client Business Manager AT&T Government Solutions Office: (703)506-5780 Mobile: (703)608-0665 Fax: (703)245-3749

10 9

Re: companies like microsoft and telia...
by Paul Vixie 26 Jun '03

26 Jun '03

> > grrrrrrrrrrrrr. > > telia has been on my list for 2.5 years now for this stuff. let the public shaming begin, then. four isp abusebots have rejected my complaints tonight because (gasp!) i included a copy of the virus i was complaining about. cluestick please!

2 1

RE: Weird email messages with "re:movie" and "re:application" in the subject line..
by Mark Segal 26 Jun '03

26 Jun '03

Here the best link I have seen so far... Thanks to kevin day.. http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.e@mm.html My guess is they might need to upgrade it to more than 55-999 infections :). mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Eric Brunner-Williams in Portland Maine [mailto:brunner@nic-naa.net] Sent: June 25, 2003 11:25 PM To: Larry Rosenman Cc: Mark Segal; 'nanog(a)merit.edu'; brunner(a)nic-naa.net Subject: Re: Weird email messages with "re:movie" and "re:application" in the subject line.. > W32/sobig.e@MM per McAffee..... I seem to have done one better ... according to a M$ host in Level3-land, the Unix box right in front of me sent the mail in question. Someone at L3 needs to call home. The only L3 turd in my mail log is their inbound... Jun 25 18:21:11 nic-naa sm-mta[24589]: h5PMLB5U024589: from=<administrator(a)Level3.com>, size=1711, class=0, nrcpts=1, msgid=<012d01c33b68$2bd14b40$d706010a(a)corp.global.level3.com>, proto=ESMTP, daemon=MTA, relay=machine77.Level3.com [209.244.4.106] Cheers, Eric ------- Forwarded Message Return-Path: administrator(a)Level3.com Delivery-Date: Wed Jun 25 18:21:11 2003 Return-Path: <administrator(a)Level3.com> Received: from f1ee40-19.idc1.level3.com (machine77.Level3.com [209.244.4.106]) by nic-naa.net (8.12.9/8.12.9) with ESMTP id h5PMLB5U024589 for <brunner(a)nic-naa.net>; Wed, 25 Jun 2003 18:21:11 -0400 (EDT) Received: from idc1exc0001.corp.global.level3.com (localhost [127.0.0.1]) by f1ee40-19.idc1.level3.com (8.8.8p2+Sun/8.8.8) with SMTP id WAA02577 for <brunner(a)nic-naa.net>; Wed, 25 Jun 2003 22:21:50 GMT Received: from idc1exc0005.corp.global.level3.com ([10.1.6.215]) by idc1exc0001.corp.global.level3.com with Microsoft SMTPSVC(5.0.2195.4905); Wed, 25 Jun 2003 16:21:49 -0600 Received: from mail pickup service by idc1exc0005.corp.global.level3.com with Microsoft SMTPSVC; Wed, 25 Jun 2003 16:21:49 -0600 thread-index: AcM7aCvRcfOY+VcOT2aAnuNoWHZmCQ== Thread-Topic: [MailServer Notification]Alert to Sender: File Attachment Blocked From: <Administrator(a)machine77.level3.com> Sender: <Administrator(a)machine77.level3.com> To: <brunner(a)nic-naa.net> Subject: [MailServer Notification]Alert to Sender: File Attachment Blocked Date: Wed, 25 Jun 2003 16:21:49 -0600 Message-ID: <012d01c33b68$2bd14b40$d706010a(a)corp.global.level3.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft CDO for Exchange 2000 Content-Class: urn:content-classes:message Importance: normal Priority: normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4920.2300 X-OriginalArrivalTime: 25 Jun 2003 22:21:49.0631 (UTC) FILETIME=[2BF044F0:01C33B68] ScanMail for Microsoft Exchange has blocked an attachment. Sender = brunner(a)nic-naa.net Recipient(s) = ops(a)genuity.com Subject = Re: Movie Scanning time = 06/25/2003 16:21:49 Action on file blocking: The attachment your_details.zi matches the file blocking settings. ScanMail has Deleted it. Attachment blocked due to extension match of .bat, .eml, .nws, .pif, .scr, .src, .shs, .vbe, .vbs, .com, or .exe. ------- End of Forwarded Message

1 0

Weird email messages with "re:movie" and "re:application" in the subject line..
by Mark Segal 26 Jun '03

26 Jun '03

My email box has started receiving a bunch of emails recently (earlier this evening) with a 80k zip attachment called "your_details.zip" and either "re:movie" and "re:application" from a whole bunch of other address I have never heard of.. New spam technique or some new virus, similar to a Melissa? Any body else seeing this? mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband

5 4

autoresponders, spam verifiers.
by Mark Segal 26 Jun '03

26 Jun '03

Isn't it against nanog's BCP to have auto responders reply to people who post to the list... This is very annoying ever time I post.. and being the zealot that I am (I know 50,000 heads just nodded their agreement) I do not want to be on his "safe" list. mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com <http://www.fcibroadband.com/> Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: AntiSpam UOL [mailto:armenio.lobato.sspam@uol.com.br] Sent: June 25, 2003 11:11 PM To: msegal(a)corporate.fcibroadband.com Subject: RE:RE: Weird email messages with "re:movie" and "re:application" in <http://antispam.uol.com.br> <http://mail.i.uol.com.br/tirateima_txt.gif> <http://www.uol.com.br> Olá, Você enviou uma mensagem para armenio.lobato(a)uol.com.br Para que sua mensagem seja encaminhada, por favor, clique aqui Esta confirmação é necessária porque armenio.lobato(a)uol.com.br usa o Antispam UOL, um programa que elimina mensagens enviadas por robôs, como pornografia, propaganda e correntes. _____ Hi, You´ve just sent a message to armenio.lobato(a)uol.com.br In order to confirm the sent message, please click here This confirmation is necessary because armenio.lobato(a)uol.com.br uses Antispam UOL, a service that avoids unwanted messages like advertising, pornography, viruses, and spams. Use o <http://antispam.uol.com.br> AntiSpam UOL e proteja sua caixa postal

1 0

RE: Weird email messages with "re:movie" and "re:application" in the subject line..
by Williamson, Todd 26 Jun '03

26 Jun '03

At least the "Re: Application" message is referenced here: http://vil.nai.com/vil/content/v_100429.htm I received several of these today. Don't know about "Re: movie". todd > My email box has started receiving a bunch of emails recently > (earlier this > evening) with a 80k zip attachment called "your_details.zip" > and either > "re:movie" and "re:application" from a whole bunch of other > address I have > never heard of.. > > New spam technique or some new virus, similar to a Melissa? > Any body else > seeing this? > > mark > > > -- > Mark Segal > Director, Network Planning > FCI Broadband > Tel: 905-284-4070 > Fax: 416-987-4701 > http://www.fcibroadband.com > > Futureway Communications Inc. is now FCI Broadband >

1 0

RE: Weird email messages with "re:movie" and "re:application" in the subject line..
by Mark Segal 26 Jun '03

26 Jun '03

That body should read ... "either "re:movie" and "re:application" in the subject line" Sorry, mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Mark Segal [mailto:MSegal@Corporate.FCIBroadband.com] Sent: June 25, 2003 10:57 PM To: 'nanog(a)merit.edu' Subject: Weird email messages with "re:movie" and "re:application" in the subject line.. My email box has started receiving a bunch of emails recently (earlier this evening) with a 80k zip attachment called "your_details.zip" and either "re:movie" and "re:application" from a whole bunch of other address I have never heard of.. New spam technique or some new virus, similar to a Melissa? Any body else seeing this? mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband

1 0