Subject: RE: A humour game

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 20 Aug 2002 20:46:35 -0700

Before everyone piles onto Paul...
 
... a couple of months ago I guy sent me a message accusing me of having
sent him an email virus. Oddly enough the machine in question was turned
off at the time and certainly disconnected from the net. Also the same
guy had been sending me virus spam...
 
Basically the virus had been forging the from address on the @#$(*$
message to cover its tracks.
 
Of course if Paul bothered to use a digital signature on his emails we
would know for sure...

-----Original Message-----
From: phoffman [mailto:[email-masked]]
Sent: Monday, July 08, 2002 11:29 PM
To: [email-masked]
Subject: A humour game

This is a special humour game
This game is my first work.
You're the first player.
I hope you would enjoy it.

---

From: Eric Murray <[email-masked]>
Date: Wed, 21 Aug 2002 09:48:48 -0700

> message to cover its tracks.

This particular virus uses an old list of email addresses....
I have gotten a number of virus-generated emails "from" people
who long ago left the company they supposedly sent email from.
Some of them have been "from" Phil Karlton, who died in an accident
in 1996 or 1997.  

Since a lot of them are people I recognize from the security community who
were doing SSL stuff around 1996, I think that the virus writer snagged
addresses to forge from old archives of the ssl-talk or ietf-tls lists.

These days I look at the headers of any mail that looks suspicious
or wierd.

Eric