Skip to Content.
Sympa Menu

internetworkers - RE: internetworkers digest: June 20, 2002

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: "Josep L. Guallar-Esteve" <jlguallar AT maduixa.net>
  • To: "InterNetWorkers" <internetworkers AT franklin.metalab.unc.edu>
  • Subject: RE: internetworkers digest: June 20, 2002
  • Date: Fri, 28 Jun 2002 11:41:42 +0000


Steve,

Sorry for getting back to you so late, but I've been busy with other viruses.

El dia Divendres 21 Juny 2002 10:43, no tenies res mes que fer i vas i
m'envies aquest e-mail:
> Can you explain that triangulation thingy you did to determine the
> Klez infected sender?

I checked the source of the e-mail (raw text), checked the IP address,
discovered the email's sender ISP (that is, the infected person) and did a
search of my mailboxes for similar IPs / same ISPs (you gotta love grep and
the mailbox format of Kmail).

I send an email to a friend with a different ISP that also happens to know
quite a bit about computers). He had also been getting those Klez e-mails. He
lives in Barcelona, so the finding the right schedule was ... challenging.

We got together through instant messaging. Then, we traced the IPs addresses,
and tried to find which common friends we had who use Windows (too many),
which ones used that ISP (lesser number), and then, checking
Klez-infected-messages' IP address with messages received the same days from
pour friends. We were able to distincly identify a single friend, using
Windows, that ISP and using those IP addresses when we got his emails and
Klez emails.

> I'm thinking that one of the reasons these entities can keep doing what
> they're doing is because most of us lack the time, know how and expertise
> to track and nail the perpetrator. When I read articles on how to stop
> Spam they are frequently great descriptions of how the Spam works but
> the methods for stopping Spam are usually a simple blocking method,
> that doens't provide as robust a solution as I would like.

Hope this can give you a clue about it.


Hope this helps you understand how I did the "IP triangulation" thing :)



Salut,
Josep
--
Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.
http://www.ibiblio.org/sinner/




Archive powered by MHonArc 2.6.24.

Top of Page