Chapel Hill Technology Advisory Committee

["Steve Irving" <wsirving AT morgancreek.net>]

To all concerned,

 

I believe that the TOC-WIRELESS-L listserv has been compromised and used to proliferate a phishing-type scam message to its members. The message was sent this morning, is titled “PayPal – Check your account” and appears in the listserv archive for October 2005. This immediately drew my attention because I do not have a PayPal account.

 

Upon examining the message header there is evidence that the originating email address has been ‘spoofed’ and that the message originated in Hong Kong. (BTW, the header indicates that TOCWireless is using an evaluation copy of the listserv software – is this correct??) The full message header appears below for your reference.

 

I joined the listserv last week in order to conduct some research on TOCWireless and this is the first message I have received from the list. My quick review of the listserv archive shows other suspect messages on September 14, 2005 - “Online Banking” and February 8, 2005 – “Use this in the House of God”.

 

If you agree that this message is malicious, bogus or, at the very least, inappropriate for a municipal listserv, you may want to consider sending a warning to the list membership. In the meantime, please remove my name from the listserv until this issue is resolved.

 

Thank you,

 

Steve Irving

 

 

Return-Path: <owner-toc-wireless-l AT LISTSERV.CI.CARRBORO.NC.US>

Delivery-Date: Thu, 20 Oct 2005 09:47:49 -0400

Received: from [207.59.145.193] (helo=listserv.ci.carrboro.nc.us)

            by mx.perfora.net with ESMTP (Nemesis),

            id 0MKuxu-1ESalp0Iug-0004U5 for wsirving AT MORGANCREEK.NET; Thu, 20 Oct 2005 09:47:49 -0400

Received: from listserv (192.168.128.40:1785) by listserv.ci.carrboro.nc.us (LSMTP for Windows NT v1.1b) with SMTP id <0.000016BB AT listserv.ci.carrboro.nc.us>; Thu, 20 Oct 2005 9:47:43 -0400

Received: by LISTSERV.CI.CARRBORO.NC.US (LISTSERV-TCP/IP release 14.4) with

          spool id 0520 for TOC-WIRELESS-L AT LISTSERV.CI.CARRBORO.NC.US; Thu, 20

          Oct 2005 09:47:43 -0400

Received: from jive.isk.com.hk (210.177.229.13:54865) by

          listserv.ci.carrboro.nc.us (LSMTP for Windows NT v1.1b) with SMTP id

          <0.000016BA AT listserv.ci.carrboro.nc.us>; Thu, 20 Oct 2005 9:37:42

          -0400

Received: by jive.isk.com.hk (Postfix, from userid 1034) id 3570D1AEA52; Thu,

          20 Oct 2005 21:37:39 +0800 (HKT)

Content-Type: text/html

Message-ID:  <20051020133739.3570D1AEA52 AT jive.isk.com.hk>

Date:         Thu, 20 Oct 2005 21:37:39 +0800

Reply-To:     "Town of Carrboro,              NC - Forum for Free Public Access Wireless Infrastructure"              <TOC-WIRELESS-L AT LISTSERV.CI.CARRBORO.NC.US>

Sender:       "Town of Carrboro, NC - Forum for Free Public Access Wireless Infrastructure" <TOC-WIRELESS-L AT LISTSERV.CI.CARRBORO.NC.US>

Comments:     This message was delivered by an evaluation copy of LSMTP(TM)

Comments:     running on listserv.ci.carrboro.nc.us. L-Soft did not author,

              review

Comments:     nor edit the present message and therefore assumes no

Comments:     responsibility for its content. LSMTP evaluation kits are made

Comments:     available for testing purposes, on the assumption that they will

Comments:     only be used to deliver information requested by its recipients.

From:         "paypal.com" <support AT PAYPAL.COM>

Subject: PayPal - Check your account[via LSMTP - see www.lsoft.com]

To:           TOC-WIRELESS-L AT LISTSERV.CI.CARRBORO.NC.US

Precedence: list

Envelope-To: wsirving AT MORGANCREEK.NET