Skip to Content.
Sympa Menu

internetworkers - Re: Help! I've been abused!

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Jason Laughlin <jason AT jasonlaughlin.com>
  • To: "InterNetWorkers" <internetworkers AT franklin.metalab.unc.edu>
  • Subject: Re: Help! I've been abused!
  • Date: Thu, 20 Jun 2002 10:41:28 -0400


This actually happened to me on a yahoogroup that I'm the admin for. The list was set so that only I, as owner, could send messages to the list. However, a subscriber's computer was infected with Klez. The virus sent out an email with a forged "From:" field to the list. Unfortunately, the Yahoogroups software only looked at the From: field to determine whether it was from me, and allowed the message to go through to my entire group. Since no other fields were forged, it was a simple matter to identify the originating email account, but the email had been sent, and an hour later I had multiple messages from friends and servers mistakenly telling me that I had the Klez.

(To prevent problems in the future, I've changed the group settings to strip all attachments.)

Jason



At 10:04 AM 6/20/2002, you wrote:

Are you sure is someone taking over your identity for spam pouropses?

The Klez virus has a behavious that, first, made me think that someone hasd
taken over my email address. Then, I learnt some more about Klez. Now I know
that it was the Klez virus.

How the Klez virus work?

First, infects someone

Then, checks for e-mail addresses in the addressbooks, cached-webpages, sent
messages, received messages, newsgroup messages (if you are into usenet)...

Now, the virus decides to use one of those collected email addresses as the
forged "From" field, to make more difficult to detect the infected machine.

The last step is the "reproduction": the virus sends itself to all the
collected e-mail addresse, using the "From" (and, I think, "Retrun-To")
field(s) forged so they point to someoneelses's adress.

So, when an infected email bounces, it bounces to an uninfected, unsuspecting
email address (the one used in the "From" field).

Of course, using the "Sender-IP" field you can verify that it was not you who
sent the email.

With some triangulation, SamSpade and a few friends, I was able to get to one
of my "Windows-friends" infected with the Klez viirus that was using my
e-mail address in the "From:" field.

Hope that this is your case.



Salut,
Josep
--
Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.
http://www.ibiblio.org/sinner/

---
Come and play at the InterNetWorkers Web site! http://www.ibiblio.org/internetworkers/
You are currently subscribed to internetworkers as: jason AT jasonlaughlin.com
To unsubscribe send a blank email to $subst('Email.Unsub')





Archive powered by MHonArc 2.6.24.

Top of Page