Subject: Anyone else seeing lots of virus mails originating from [email-masked] (or similar addresses)

From: [email-masked]
Date: Wed, 6 Jul 2005 15:11:33 +0300

In one day mailman has caught:

	27 mails from [email-masked];
	24 mails from [email-masked];

Usually they have some blacklisted file attachment. The past few days, I have had simlary numbers from [email-masked].  
Is this a new worm attack?

John

---

From: Lars Eggert <[email-masked]>
Date: Wed, 6 Jul 2005 15:29:34 +0300

On 2005-7-6, at 15:11 , [email-masked] wrote:
> Usually they have some blacklisted file attachment. The past few  
> days, I have had simlary numbers from [email-masked].

FWIW, dccp sees it, too.

> Is this a new worm attack?

No clue.

Lars
-- 
Lars Eggert                                     NEC Network Laboratories

---

From: David R Oran <[email-masked]>
Date: Wed, 6 Jul 2005 09:04:37 -0400

Speechsc is seeing tis as well. Spam volume has about doubled in the  
last few days, much of it with these two (quite likely spoofed)  
addresses

The speechsc list also got a virus attack I hadn't seen before last  
night. It was an email purporting to come from [email-masked],  
saying that the [email-masked] email account had been zombied and  
was generating tons of SPAM. The attack email contained what I  
suspect was a virus vector and asked the owner to execute the  
attachment to de-zombie the machine.

I wonder if all the publicity about identity theft is actually  
increasing the ratio of successful attacks by preying on the fear of  
being attacked!

Dave.

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 6 Jul 2005 08:17:03 -0700

In the past few days, there has been a great increase in both viruses 
and phishing where the return address has a left-hand side of an 
official sounding name and the right-hand side is the user's domain 
name. I suspect they are targeting with that because it works. I have 
had some of my friends who use my vanity domain name ask if that was 
really a message from me....

--Paul Hoffman, Director
--VPN Consortium

---

From: Fred Baker <[email-masked]>
Date: Wed, 6 Jul 2005 09:16:06 -0700

They come from every other address (spoofed); why not that?

I would strongly suggest that we have emails that are legitimately from 
us use one of the smtp-signing technologies as proof of authenticity. 
You will note that mine is using that, in the SMTP envelope, signed by 
imail.cisco.com...

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 6 Jul 2005 10:36:47 -0700

Hi -

> From: <[email-masked]>
> To: <[email-masked]>
> Sent: Wednesday, July 06, 2005 5:11 AM
> Subject: Anyone else seeing lots of virus mails originating [email-masked] (or similar addresses)
>
> Usually they have some blacklisted file attachment. The past few days,
> I have had simlary numbers from [email-masked].

Don't know.  I manage three lists @ietf.org.  Only one of them (disman)
has been getting this stuff.  The other two are agentx (closed), and ltru
(started this spring).

Randy

---

From: Tom Taylor <[email-masked]>
Date: Wed, 06 Jul 2005 16:57:13 -0400

I've been getting lots on Megaco for a few days.  A number fit the 
profile of W32.Bobax.

---

From: Rob Austein <[email-masked]>
Date: Wed, 06 Jul 2005 17:22:06 -0400

> Is this a new worm attack?

Probably, or at least a new varient.

I run Ronan Waide's mailman.pl script on a couple of ietf mailing
lists.  The number of pieces of crud deleted by that script has been
climbing recently.  Last night one of these lists hit an all-time
record for number of pieces of crud held by mailman and deleted by
Ronan's script.  (153 pieces of crud deleted in one 24 hour period --
keep in mind that this is crud that already got past ietf.org's own
spam filtering system).

My servers are also seeing a lot more backscatter to addresses like
postmaster.  So from my corner of the pond, the answer is yes, there
appears to be an increase in the amount of crud being sent with
addresess like postmaster@example as forged source addresses.

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 07 Jul 2005 12:00:57 +0200

There was a new attack around, and it took a few hours for
Scott Blomquist to get the defenses updated. In theory, the walls
have now been rebuilt...

    Brian

---

From: Rob Austein <[email-masked]>
Date: Thu, 07 Jul 2005 21:59:43 -0400

> Scott Blomquist to get the defenses updated. In theory, the walls

That would explain why the list in question was down to only 100
pieces of crud last night. :)