Internetworkers: http://www.ibiblio.org/internetworkers/

["Josep L. Guallar-Esteve" <jlguallar AT maduixa.net>]

Steve,

Sorry for getting back to you so late, but I've been busy with other viruses.

El dia Divendres 21 Juny 2002 10:43, no tenies res mes que fer i vas i 
m'envies aquest e-mail:
> Can you explain that triangulation thingy you did to determine the
> Klez infected sender?

I checked the source of the e-mail (raw text), checked the IP address, 
discovered the email's sender ISP (that is, the infected person) and did a 
search of my mailboxes for similar IPs / same ISPs (you gotta love grep and 
the mailbox format of Kmail).

I send an email to a friend with a different ISP that also happens to know 
quite a bit about computers). He had also been getting those Klez e-mails. He 
lives in Barcelona, so the finding the right schedule was ... challenging.

We got together through instant messaging. Then, we traced the IPs addresses, 
and tried to find which common friends we had who use Windows (too many), 
which ones used that ISP (lesser number), and then, checking 
Klez-infected-messages' IP address with messages received the same days from 
pour friends. We were able to distincly identify a single friend, using 
Windows, that ISP and using those IP addresses when we got his emails and 
Klez emails.

> I'm thinking that one of the reasons these entities can keep doing what
> they're doing is because most of us lack the time, know how and expertise
> to track and nail the perpetrator. When I read articles on how to stop
> Spam they are frequently great descriptions of how the Spam works but
> the methods for stopping Spam are usually a simple blocking method,
> that doens't provide as robust a solution as I would like.

Hope this can give you a clue about it.


Hope this helps you understand how I did the "IP triangulation" thing :)



Salut,
Josep
-- 
Josep L. Guallar-Esteve, QA-Test Engineer, Red Hat, Inc.
http://www.ibiblio.org/sinner/