Skip to Content.
Sympa Menu

nafex - [NAFEX] ADMIN: virus process

nafex@lists.ibiblio.org

Subject: North American Fruit Explorers mailing list at ibiblio

List archive

Chronological Thread  
  • From: "Greg Miller" <gsmiller@cet.com>
  • To: Tom Olenio <tolenio@sentex.net>, North American Fruit Explorers <nafex@lists.ibiblio.org>
  • Cc:
  • Subject: [NAFEX] ADMIN: virus process
  • Date: Sun, 03 Aug 2003 15:44:14 -0800

> So if you cannot verify the sender of an virus laden email, how can a
> person be banned,or even accumulate strikes against them?

Tom:

I'm pretty sure that "xyz", who has been unsubscribed, was the right
person, and my reasons are listed below. Note that "xyz" can
resubscribe at any time on their own initiative without my
involvement. They can also subscribe under a different email address
if they wish. The main effect is that messages cannot be POSTED from
that address. There is no total defense against having someone who
wants to subscribe and has no interest in having viruses sent to the
list.

Here's why I think it was "xyz"

1. I'm familiar with the KLEZ virus, including its spoofing ability.
I get KLEZ attachments all the time. I've also helped 3 friends get
their computers cleaned up, which made finding the links for tools
pretty easy. Although the virus has the ability to spoof email
addresses, it does sometimes send an email with the infected user in
the from field.

2. In the past, I have read the headers of the offending email to
try to figure out who the REAL sender is--this has been helpful in
breaking the bad news to people who thought they had things solved.
In doing so with the forwarded message, the only headers that matched
subscribers to the list was the name in the FROM header.
Unfortunately IBIBLIO strips many of the headers from the original
email when it forwards messages, but it's the best I can go on.

3. To have messages forwarded from the IBIBLIO server, it has to be
sent from a user who is subscribed to the list. Either "xyz" sent
the message (and was recognized as a subscriber by IBIBLIO) or
someone else who is subscribed to the list and has "xyz" in their
addressbook sent the message. Unless that other theoretical person
cleans up their computer, I will get other posts to IBIBLIO. I don't
know whether IBIBLIO validates the FROM field, but there is clearly
something more than how people configure their FROM headers in how it
decides who belongs. We may all know the answer to that one if we
get other infected messages.

If the suspended user "xyz" simply scans his or her system (or for
that matter says to heck with it and takes no steps), he or she can
resubscribe AT ANY TIME. I am not blocking any one from using the
list. But if someone takes no steps to cleanse their system, and
repeatedly floods the list with computer viruses, there needs to be
some point at which it is said "ENOUGH!" I think it's most fair to
let people know ahead of time that this is a serious matter that
should be addressed seriously.

Worst case scenario: "xyz" is innocent. Hopefully along with
resubscribing they will send a message to me as the list admin, so
that I can take it into account for tallying future "dings." At most
they miss a few messages, which can be viewed on line at a later
time.

If "xyz" is infected and doesn't take any steps, I should know about
it soon, as my email address (in the message I sent to that user)
will probably be a target for KLEZ. Luckily, the list shouldn't be
getting any of those infected messages.

GREG MILLER
list administrator





Archive powered by MHonArc 2.6.24.

Top of Page