Subject: Spam that appears to be from me but isn't

From: Stephen Casner <[email-masked]>
Date: Mon, 4 Nov 2002 18:03:00 -0800 (PST)

I've received several spam/virus messages on the pine-info mailing
list over the past few days that claim to be from "[email-masked]".
This is a forged address.  I doubt that these messages are coming from
any of my hosts because I follow safe computing practices and I use
Pine rather than virus-spreading agents.  However, some of the people
with whom I communicate use systems that could have been compromised.

The messages that come through the list only show the Received lines
starting from UW, so I don't have any hints as to where these messages
may have originated.  Can anyone there provide some info?

Presuming that everyone on the list is seeing these messages, all I
can say is I'm sorry this is happening, but I'm not sure if there is
anything I can do about it.

                                                        -- Steve

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Steve Hubert <[email-masked]>
Date: Wed, 6 Nov 2002 11:51:39 -0800 (Pacific Standard Time)

> may have originated.  Can anyone there provide some info?

I tried to track a couple of them. They were similar. One arrived at
mailhost2.u.washington.edu from [65.217.26.231] with an apparently forged
HELO parameter of mailhost.u.washington.edu. The other was similar
arriving at mailhost1.u.washington.edu from [65.217.26.12] with a forged
HELO of mailhost.u.washington.edu. Both had the header From: [email-masked],
also apparently forged. 65.217.26.xx appears to be in uu.net address
space, at least according to DNS.

Mailhost.u.washington.edu could probably be picked up by looking at past
posts to pine-info, as could [email-masked].

Something about the mail caused the washington.edu infrastructure to split
those real headers off into the body of the message. I expect there was a
virus in the mail and our virus scanners tried to clean the virus and
forward the mail. So there was probably initially an evil attachment that
was no longer there by the time it made it to pine-info.

I think the conclusion is that it is spam and it is from you because the
list only allows posting by list members and you got lucky!

> anything I can do about it.

I agree. Nothing you can do about it and probably nothing we can do about
it for now. We're working on advancing the state of our virus scanning
stuff so that we wouldn't pass this stuff on to the list.

-- 
Steve Hubert <[email-masked]>
Networks and Distributed Computing, Univ. of Washington, Seattle