[Chtechcomm] Possible email scam via TOCWireless

Steve Irving wsirving at morgancreek.net
Thu Oct 20 13:08:05 EDT 2005



Thanks for your prompt response.


I'm accustomed to lists which allow posting only after some sort of
registration (and presumed verification/confirmation) of the sender's email
address, and assumed this was the case. My bad assumption, but I noticed no
information to the contrary when signing up for the listserv.


Seems to me you've got a tough choice: either institute better registration
and security mechanisms (added cost and effort), or add a notice during the
sign up process indicating "anything goes" (scaring off potential
subscribers). I don't think relying on end user's "common sense" will get it
done, especially as electronic communication becomes more important in
conducting business with an involved citizenry.


You may also want to consider removing the messages I mentioned earlier from
your archives, considering any possible liability the Town may incur if, for
instance, some innocent (read: low common sense quotient) citizen regards
the "House of God" message as a Town-endorsed investment opportunity. Just a


I've added the original recipients back to this reply so that they will all
know how responsive and helpful you've been.


Thanks again,





From: Andy Vogel [mailto:avogel at ci.carrboro.nc.us] 
Sent: Thursday, October 20, 2005 12:31 PM
To: wsirving at morgancreek.net
Subject: RE: Possible email scam via TOCWireless




We have removed you from the list.


The list has not been "compromised" - it is a completely open list. People
can come and go as they please and send any message (malicious or
legitimate) that they please. It was our hope that this would promote free
and open discussion.


Like any email you receive, you can get malicious emails. It is our hope
that end users will use common sense and immediately delete suspicious
emails. There has not been an abuse of this list historically. Maybe a
couple "bad" emails per month at most.


You do bring up a good point, maybe it is time to lock it down!? We may
likely take this approach in the future on this list. Yours is the first
complaint and we try our best to respond to end user requests.


Thank you,

Town of Carrboro

Andy Vogel



From: Steve Irving [mailto:wsirving at morgancreek.net] 
Sent: Thursday, October 20, 2005 11:32 AM
To: Andy Vogel; Steven Stewart; Bing Roenigk; tocwireless; zzDept. Mail -
Town Manager
Cc: 'Bob Avery'; Gregg Gerdau; Chapel Hill Technology Committee Ibiblio List
Subject: Possible email scam via TOCWireless


To all concerned,


I believe that the TOC-WIRELESS-L listserv has been compromised and used to
proliferate a phishing-type scam message to its members. The message was
sent this morning, is titled "PayPal - Check your account" and appears in
the listserv archive for October 2005. This immediately drew my attention
because I do not have a PayPal account.


Upon examining the message header there is evidence that the originating
email address has been 'spoofed' and that the message originated in Hong
Kong. (BTW, the header indicates that TOCWireless is using an evaluation
copy of the listserv software - is this correct??) The full message header
appears below for your reference.


I joined the listserv last week in order to conduct some research on
TOCWireless and this is the first message I have received from the list. My
quick review of the listserv archive shows other suspect messages on
September 14, 2005 - "Online Banking" and February 8, 2005 - "Use this in
the House of God".


If you agree that this message is malicious, bogus or, at the very least,
inappropriate for a municipal listserv, you may want to consider sending a
warning to the list membership. In the meantime, please remove my name from
the listserv until this issue is resolved.


Thank you,


Steve Irving



Return-Path: <owner-toc-wireless-l at LISTSERV.CI.CARRBORO.NC.US>

Delivery-Date: Thu, 20 Oct 2005 09:47:49 -0400

Received: from [] (helo=listserv.ci.carrboro.nc.us)

            by mx.perfora.net with ESMTP (Nemesis),

            id 0MKuxu-1ESalp0Iug-0004U5 for wsirving at MORGANCREEK.NET; Thu,
20 Oct 2005 09:47:49 -0400

Received: from listserv ( by listserv.ci.carrboro.nc.us
(LSMTP for Windows NT v1.1b) with SMTP id
<0.000016BB at listserv.ci.carrboro.nc.us>; Thu, 20 Oct 2005 9:47:43 -0400

Received: by LISTSERV.CI.CARRBORO.NC.US (LISTSERV-TCP/IP release 14.4) with

          spool id 0520 for TOC-WIRELESS-L at LISTSERV.CI.CARRBORO.NC.US; Thu,

          Oct 2005 09:47:43 -0400

Received: from jive.isk.com.hk ( by

          listserv.ci.carrboro.nc.us (LSMTP for Windows NT v1.1b) with SMTP

          <0.000016BA at listserv.ci.carrboro.nc.us>; Thu, 20 Oct 2005 9:37:42


Received: by jive.isk.com.hk (Postfix, from userid 1034) id 3570D1AEA52;

          20 Oct 2005 21:37:39 +0800 (HKT)

Content-Type: text/html

Message-ID:  <20051020133739.3570D1AEA52 at jive.isk.com.hk>

Date:         Thu, 20 Oct 2005 21:37:39 +0800

Reply-To:     "Town of Carrboro,              NC - Forum for Free Public
Access Wireless Infrastructure"

Sender:       "Town of Carrboro, NC - Forum for Free Public Access Wireless

Comments:     This message was delivered by an evaluation copy of LSMTP(TM)

Comments:     running on listserv.ci.carrboro.nc.us. L-Soft did not author,


Comments:     nor edit the present message and therefore assumes no

Comments:     responsibility for its content. LSMTP evaluation kits are made

Comments:     available for testing purposes, on the assumption that they

Comments:     only be used to deliver information requested by its

From:         "paypal.com" <support at PAYPAL.COM>

Subject: PayPal - Check your account[via LSMTP - see www.lsoft.com]


Precedence: list

Envelope-To: wsirving at MORGANCREEK.NET

Town Web Site: http://www.townofcarrboro.org

Pursuant to North Carolina General Statutes Chapter 132, Public Records,
this electronic
mail message and any attachments hereto, as well as any electronic mail
message(s) that
may be sent in response to it *may* be considered public record and as such
are subject
to request and review by anyone at any time.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.ibiblio.org/pipermail/chtechcomm/attachments/20051020/a8629518/attachment.html 

More information about the Chtechcomm mailing list