spammers?

Randy Sigman said:

I'm not sure where all of this came from, but your attributions are not quite right. I never
challenged your comment about a controlled study, as I recognized it to be a joke. 🙂

Sorry. I often have troubles with attributions when I am trying to figure out where to snip in these
ridiculously long threads.

Randy Sigman said:

Pete <[email hidden]> wrote:

Quoted message said:

Quoted message said:

Well I'd agree with that except there are viri about which do not need to be executed. They
function on arrival.

Hi Pete,

Quoted message said:

Are you able to cite an example of such a virus? Randy

Off the top of my head - no but I will root out the details of a decent one for you. - Later

Pete Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

On Sat, 07 Feb 2004 00:34:58 GMT, [email hidden]

Quoted message said:

Alan Mackenzie wrote:

Quoted message said:

Quoted message said:

Quoted message said:

These are some of the items you should be looking at to ensure your security and privacy. There
are more but I consider this the minimum.

Quoted message said:

Not a bad idea. We just lost the use of 29 computers here in the office. The people working the
lines want to open everything but their job descriptions. Anyone want 29...at last count...used
hard drives complete with worms.

Sounds like a case of thouroughly bad training and discipline to me. Sack the lot of
them........................for incompetence.

Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

Wes Groleau said:

Pete said:

Ok but to do that you have to identify that there is a virus. I prefer to attempt to identify
obvious potential rather than wait for a definate identification.

Quoted message said:

A virus is an attachment.

That is the favourite method of dispatch and self replication/respond but there are others such as
attached to messaging frames.

Quoted message said:

If an e-mail has an executable

Viri are not always attachments though the majority are.

Quoted message said:

attachment, I never see it. If it does not, tests for "spam-like features" are made. None of those
tests have anything to do with the presence of "Re" or "Fwd"

Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

Randy Sigman said:

Pete said:

Well I'd agree with that except there are viri about which do not need to be executed. They
function on arrival.

Hi Pete, Are you able to cite an example of such a virus? Randy

Viruses are categorized by how they infect. These categorizations often overlap the categories
above and may even be included in the description (e.g., polymorphic file virus). These
categories include:

Polymorphic Viruses Stealth Viruses Fast and Slow Infectors Sparse Infectors Armored Viruses
Multipartite Viruses Cavity (Spacefiller) Viruses Tunneling Viruses Camouflage Viruses NTFS
ADS Viruses

Virus Droppers - programs that place viruses onto your system but themselves may not be viruses (a
special form of Trojan).

Nimda is one of the more complex virus/worm constructs released. It infects files, spreads itself
via E-mail, spreads via *Web sites*, and spreads via local area network exploits. It infects all
versions of Windows from Win95 through Win2000 as well as Microsoft's IIS.

Nimda is credited with several "firsts" in its infection techniques. It is the first beast to infect
.EXE files by embedding them into itself as a resource. It also infects Web pages so unsecured
browsers will infect upon viewing the Web page. Finally, Nimda is the first worm to use any user's
computer to scan a network for vulnerable machines behind a firewall to attack (in the past only
infected servers did that).

Nimda uses several known weaknesses in Microsoft IIS servers. It would not have spread as far as it
did had administrators applied the known patches.

Level of Threat

High
- Blended threats (i.e. spreads via email, P2P, IM, network shares)
- Mass mailers
- Spreads via network shares

Medium
- Mailers
- has spread via third-party or media
- spreads in IRC, IM, or P2P <<<<<<<<<<<<<<<<note
- requires user intervention to spread
- URL/Web site download <<<<<<<<<<<<<<<<<Note

Low
- no network spreading
- requires manual distribution to spread

ActiveX malicious code <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<Note ActiveX controls allow Web developers to
create interactive, dynamic Web pages with broader functionality such as HouseCall, Trend Micro's
free on-line scanner. An ActiveX control is a component object embedded in a Web page which runs
automatically when the page is viewed. In many cases, the Web browser can be configured so that
these ActiveX controls do not execute by changing the browser's security settings to "high."
However, hackers, virus writers, and others who wish to cause mischief or worse may use ActiveX
malicious code as a vehicle to attack the system. To remove malicious ActiveX controls, you just
need to delete them.

This new MYDOOM variant [B] is a mass-mailing worm that selects from a list of email subjects,
message bodies, and attachment file names for its email messages. It spoofs the sender name of its
messages so that they appear to have been sent by different users instead of the actual users on
infected machines.

It also propagates using the Kazaa peer-to-peer file-sharing network and copies itself into machines
with random IP addresses.

***It scans IP addresses for accessible systems and sends a copy of itself into these systems via
port 3127. ***

So in short do not assume that these things are spread just as an attachment to an e-mail. That is
not the case at all.

There are many more examples and information. An easy Google will show you all you want to know.

HTH

Pete

Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

Wes Groleau said:

Pete said:

Ok but to do that you have to identify that there is a virus. I prefer to attempt to identify
obvious potential rather than wait for a definate identification.

A virus is an attachment.

No it is not. Incorrect definition. Some are spread and propogated as attached files and it is a
popular delivery method but they are also spread via IRC / Web / direct via vulnerable ports / as
macros within valid documents which may be embedded in a mail body.

If you have a vulnerable port and are running a protocol that is not needed and or not securred,
then you can be scanned and a payload delivered. However, behind a server [ISP] you are unlikely to
have too much risk. But if you run your own server, you are. It is a very simple matter to scan a
range of addresses at random to try and find someone somewhere with an open or vulnerable port.
There is free software available to automate this for you. There is also freely available software
to help you write basic virus files for info gathering such as mail addresses/passwords and
keystrokes.

I think it is a mistake to categorise virus's under one description and assume that that is it. Its
a bit like being an ostrich.

See my other response for more detail.

Quoted message said:

If an e-mail has an executable attachment, I never see it. If it does not, tests for "spam-like
features" are made. None of those tests have anything to do with the presence of "Re" or "Fwd"

Re: and Fwd; Are the most common first subject line content for the majority of auto spam. As well
as being used by virus's during propogation - but not always.

If you like I will give you the pop3 accound details of an account I hold specifically for storing
spam. Currently standing at an excess of 8Mb worth. You can check out all the headers and then tell
me out of the first 100 how many have Re: or Fwd in the subject line. And how many originate from
the USA. You will perhaps see why I say what I say.

HTH

Pete

Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

Pete <[email hidden]> wrote on Fri, 06 Feb 2004 16:31:13 +0000:

Quoted message said:

On Fri, 6 Feb 2004 12:02:32 +0000, Alan Mackenzie<[email hidden]> wrote:

Quoted message said:

Quoted message said:

Pete <[email hidden]> wrote on Wed, 04 Feb 2004 09:53:07 +0000:

Quoted message said:

Quoted message said:

[Actually, an anti-virus program is a good idea anyway, but is needless for mail.]

Quoted message said:

Odd......the only occasions I have had a virus - they arrived by e-mail and I have in the past
been guilty of sending a virused mail. So why you say it is needless I find a little curious.

Sorry: I was assuming adherence to my "rule 0" below.

Quoted message said:

Quoted message said:

And the single, better rule is ] Never use an email client which is capable of executing a program
arriving by email. An HTML formatted mail (probably) counts as a program for this purpose, unless
the client merely strips out the HTML garbage for display purposes.

Quoted message said:

Well I'd agree with that except there are viri about which do not need to be executed. They
function on arrival.

How? A computer virus is a program, and can only function if it can somehow run, a bit like a
biological virus can only function if it can get some cell to incorporate its DNA into the cell's
own. Any "virus" arriving at my email program simply remains a collection of unreadable hex, until I
delete it. There is no possible way it can function.

Quoted message said:

Pete

--
Alan Mackenzie (Munich, Germany) Email: [email hidden]; to decode, wherever there is a repeated
letter (like "aa"😉, remove half of them (leaving, say, "a"😉.

On Fri, 6 Feb 2004 17:38:23 +0000, Alan

Mackenzie said:

Pete <[email hidden]> wrote on Fri, 06 Feb 2004 16:31:13 +0000:

Quoted message said:

Alan Mackenzie said:

Pete <[email hidden]> wrote on Wed, 04 Feb 2004 09:53:07 +0000:

Quoted message said:

Quoted message said:

Quoted message said:

[Actually, an anti-virus program is a good idea anyway, but is needless for mail.]

Quoted message said:

Quoted message said:

Odd......the only occasions I have had a virus - they arrived by e-mail and I have in the past
been guilty of sending a virused mail. So why you say it is needless I find a little curious.

Quoted message said:

Sorry: I was assuming adherence to my "rule 0" below.

Oh........I see..........ok

Quoted message said:

Quoted message said:

Quoted message said:

And the single, better rule is ] Never use an email client which is capable of executing a
program arriving by email. An HTML formatted mail (probably) counts as a program for this
purpose, unless the client merely strips out the HTML garbage for display purposes.

Quoted message said:

Quoted message said:

Well I'd agree with that except there are viri about which do not need to be executed. They
function on arrival.

Quoted message said:

How? A computer virus is a program, and can only function if it can somehow run, a bit like a
biological virus can only function if it can get some cell to incorporate its DNA into the cell's
own. Any "virus" arriving at my email program simply remains a collection of unreadable hex, until
I delete it. There is no possible way it can function.

Well see my responses earlier. Not all viruses are delivered by e-mail. There are other delivery
methods. For one - direct to your OS via an open port - if you are vulnerable. Via a web page and
other communication programs that you may run on your system. Agreed some systems are less
vulnerable to certain entry methods but so long as you have an input / output device operable
[hardware] then there is an entry point. Whether it is viable or attractive is another question.

In the old days before the internet became as it is now, viruses were commonly spread via floppy
drives, then CD's then the internet and so on. So long as you are connected then there is an
opportunity.

Pete

BTW - some attachments do not need opening or initialising. Some have been constructed to 'operate'
on arrival.

Check out any AV site on Google to discover that.

HTH

Pete

Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

Quoted message said:

Quoted message said:

Quoted message said:

Well I'd agree with that except there are viri about which do not need to be executed. They
function on arrival.

Quoted message said:

Are you able to cite an example of such a virus?

Off the top of my head - no but I will root out the details of a decent one for you. - Later

AFAIK, the ONLY thing that remotely resembles "functioning on arrival" is malicious Javascript in an
e-mail client whose owner did not turn off "execute Javascript in e-mail"

Quoted message said:

Quoted message said:

Quoted message said:

Well I'd agree with that except there are viri about which do not need to be executed. They
function on arrival.

Are you able to cite an example of such a virus?

[snip all the examples] OK, but I thought the discussion was about protection from e-mail
deliveries.

Pete said:

Wes Groleau said:

Pete said:

Ok but to do that you have to identify that there is a virus. I prefer to attempt to identify
obvious potential rather than wait for a definate identification.

A virus is an attachment.

No it is not. Incorrect definition. Some are spread and propogated as attached files and it is a
popular delivery method but they are also spread via IRC / Web / direct via vulnerable ports / as
macros within valid documents which may be embedded in a mail body.

OK, an e-mail virus is an attachment (or Javascript). Since the above was preceded by the claim that
one should avoid viruses by discarded subject lines starting with "Re: " or "Fwd: " it almost sounds
like you're changing the subject to argue with me (or preach at me--the choir).

I do not use IRC or Chat software. I remove all supporting software for such things every time I
upgrade (because Apple has yet to figure out that customers don't want to upgrade something they
deleted from the previous time around!). My firewall lets out only requests for services I actually
use (DNS, HTTP, NNTP, etc.) and lets in only answers to my requests. Consequently, AFAIK, I have
never received a virus, except by e-mail, and discarding executable attachments (rather than
discarding forwards and replies) at the e-mail forwarding site has eliminated that threat. Having
an O.S. incapable of executing most of the current crop helps. And then I scan regularly for the
fun of it.

Pete said:

Well see my responses earlier. Not all viruses are delivered by e-mail. There are other delivery
methods. For one - direct to your OS via an open port - if you are vulnerable.

Just want to say that when I'm on the road with 56k modem (not behind Linksys router/firewall at
home), my linux laptop goes into stealth mode by logging incoming pings then dropping them with no
response. I send back "Rejects" for TCP and UDP requests for all file sharing requests (ports 135-
139) and log them as well.

This is an example of linux kernel rules I wrote called iptables:

[:0] -A INPUT -s ! 192.168.1.0/24 -p icmp -m icmp --icmp-type 8 -j LOG --log-prefix "-PINGdrop "
[:0] -A INPUT -s ! 192.168.1.0/24 -p icmp -m icmp --icmp-type 8 -j DROP

These two rules say:

If some [censored] outside my subnetwork tries to ping me, log it so I get his network address, then
drop it on the floor to keep him guessing. Ping is a tool to check for a connection. By default,
most OSs ping back: "I'm here!" But this makes you a target. I was on the 56k modem about a month
ago and most of the log entries were pings. Then the second most were windows shares requests where
I logged them and sent a reject so they would stop without wasting more bandwidth.

Other important rules are:

[:0] -A INPUT -s ! 192.168.1.0/24 -p tcp -m tcp --dport 0:1023 --syn -j LOG --log-prefix "-TCPsynREJ
" [:0] -A INPUT -s ! 192.168.1.0/24 -p tcp -m tcp --dport 0:1023 --syn -j REJECT

These say if somebody outside my subnet tries to start a conversation with me, log his address then
tell him "No." I do the same with UDP as well:

[:0] -A INPUT -s ! 192.168.1.0/24 -p udp -m udp --dport 0:1023 -j REJECT

In effect, all addresses outside my subnet are rejected for services requested. So my linux network
would have to be compromised from within.

All this filtering is done within the OS near the hardware level. So it is quite fast and extremely
flexible. The 192.168.x.y are non-internet addresses as well. So this provides more security. The
rules above say any request from an address on the internet is logged and dropped/rejected.

So this is the linux firewall mechanism called iptables,
--
Jim Dumas T1 4/86, background retinopathy, rarely hypoglycemic: <1/mo. lispro+R+U+NPH daily,
moderate exercise, typically <6% HbA1c

On Sat, 07 Feb 2004 16:24:46 GMT, Jim Dumas

[email protected]!mindspring.com said:

Pete said:

Well see my responses earlier. Not all viruses are delivered by e-mail. There are other delivery
methods. For one - direct to your OS via an open port - if you are vulnerable.

Quoted message said:

Just want to say that when I'm on the road with 56k modem (not behind Linksys router/firewall at
home), my linux laptop goes into stealth mode by logging incoming pings then dropping them with no
response. I send back "Rejects" for TCP and UDP requests for all file sharing requests (ports 135-
139) and log them as well.

Quoted message said:

This is an example of linux kernel rules I wrote called iptables: [:0] -A INPUT -s ! 192.168.1.0/24
-p icmp -m icmp --icmp-type 8 -j LOG --log-prefix "-PINGdrop " [:0] -A INPUT -s ! 192.168.1.0/24 -p
icmp -m icmp --icmp-type 8 -j DROP

Quoted message said:

These two rules say: If some [censored] outside my subnetwork tries to ping me, log it so I get his
network address, then drop it on the floor to keep him guessing. Ping is a tool to check for a
connection. By default, most OSs ping back: "I'm here!" But this makes you a target. I was on the
56k modem about a month ago and most of the log entries were pings. Then the second most were
windows shares requests where I logged them and sent a reject so they would stop without wasting
more bandwidth. Other important rules are:

Quoted message said:

[:0] -A INPUT -s ! 192.168.1.0/24 -p tcp -m tcp --dport 0:1023 --syn -j LOG --log-prefix "-
TCPsynREJ " [:0] -A INPUT -s ! 192.168.1.0/24 -p tcp -m tcp --dport 0:1023 --syn -j REJECT

Quoted message said:

These say if somebody outside my subnet tries to start a conversation with me, log his address then
tell him "No." I do the same with UDP as well:

Quoted message said:

[:0] -A INPUT -s ! 192.168.1.0/24 -p udp -m udp --dport 0:1023 -j REJECT

Quoted message said:

In effect, all addresses outside my subnet are rejected for services requested. So my linux network
would have to be compromised from within.

Quoted message said:

All this filtering is done within the OS near the hardware level. So it is quite fast and extremely
flexible. The 192.168.x.y are non-internet addresses as well. So this provides more security. The
rules above say any request from an address on the internet is logged and dropped/rejected.

Quoted message said:

So this is the linux firewall mechanism called iptables,

Nice

Pete

Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

Wes Groleau said:

Quoted message said:

Quoted message said:

>Well I'd agree with that except there are viri about which do not need to be executed. They
>function on arrival.

Are you able to cite an example of such a virus?

[snip all the examples] OK, but I thought the discussion was about protection from e-mail
deliveries.

Ok........I went off on a tangent.......:-))

Pete

Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

We will have the computers replaced by Monday. We can't afford to have the luxury of lost business.
Thus far it looks as though we have lost around 9-10000 per four hour period.

Pete said:

Quoted message said:

Alan Mackenzie wrote:

Quoted message said:

Quoted message said:

>These are some of the items you should be looking at to ensure your security and privacy. There
>are more but I consider this the minimum.

Quoted message said:

Not a bad idea. We just lost the use of 29 computers here in the office. The people working the
lines want to open everything but their job descriptions. Anyone want 29...at last count...used
hard drives complete with worms.

Sounds like a case of thouroughly bad training and discipline to me. Sack the lot of
them........................for incompetence.

Diagnosed 20/03/03 Type II D&E + Metformin + Gliclazide
+ Asprin 210lbs at Dx to BMI 166lbs achieved. To mail: aspen at freeuk.com

Quoted message said:

Alan Mackenzie said:

Quoted message said:

These are some of the items you should be looking at to ensure your security and privacy. There
are more but I consider this the minimum.

Not a bad idea. We just lost the use of 29 computers here in the office. The people working the
lines want to open everything but their job descriptions. Anyone want 29...at last count...used
hard drives complete with worms.

it couldn't have happened to a nicer company.

hehehehe

Mack Type 1 since 1975 alt-support-diabetes.orgalt-support-diabetes.orgOpen ↗ insulin-pumpers.orginsulin-pumpers.orgOpen ↗

In tribute to the United States of America and the State of Israel, two bastions of strength in a
world filled with strife and terrorism.

In the past there was a mad rush for an open and uncontrolled internet. We are reaping the results
today. I won't touch the "back door" area. Privacy???. Intrusions are common but most are nuts
playing. Several leaders have made public statements showing concern. Could the terrorists stay
organized so well with without the modern toys? Question the validity of the open system and you got
a rash of criticism until recently. Guy.

Mack said:

Quoted message said:

Alan Mackenzie said:

>These are some of the items you should be looking at to ensure your security and privacy. There
>are more but I consider this the minimum.

Not a bad idea. We just lost the use of 29 computers here in the office. The people working the
lines want to open everything but their job descriptions. Anyone want 29...at last count...used
hard drives complete with worms.

it couldn't have happened to a nicer company.

hehehehe

Mack Type 1 since 1975 alt-support-diabetes.orgalt-support-diabetes.orgOpen ↗ insulin-pumpers.orginsulin-pumpers.orgOpen ↗

In tribute to the United States of America and the State of Israel, two bastions of strength in a
world filled with strife and terrorism.

Tue said:

In the past there was a mad rush for an open and uncontrolled internet. We are reaping the results
today. I won't touch the "back door" area. Privacy???. Intrusions are common but most are nuts
playing. Several leaders have made public statements showing concern. Could the terrorists stay
organized so well with without the modern toys? Question the validity of the open system and you
got a rash of criticism until recently.

heh. 🙂

i started with the internet in an aerospace biz application in 1989

and CompuServe at roughly the same time (by modem from home)

i got my 1st ISP in 1994 (again by modem from home)

i used to think that the internet "attacks" were automated things

but my current firewall shows that i've had both a synflood attack and a port scan attack in the
last 4 months

using the internet has gotten to be a scary experience. 🙁

bill t1 since '57

Guy <[email hidden]> wrote on Tue, 10 Feb 2004 10:32:47 -0600:

Quoted message said:

In the past there was a mad rush for an open and uncontrolled internet. We are reaping the results
today. I won't touch the "back door" area. Privacy???. Intrusions are common but most are nuts
playing. Several leaders have made public statements showing concern.

Guy, you're conflating two very different usages of the word "open".

There is the positive meaning, that the internet protocols are publicly documented, free for
anybody's use. Without this, the internet could not have been. This "open" allows internet users to
write or chose their own software appropriate for their needs, and to get it cheaply. Compare
internet software with AOL's offerings.

There is also the more contentious meaning of "open", that anybody can access the internet, almost
anonymously, and that security is non-existent.

These two meanings are utterly distinct. Failing to distinguish them could lead to those with
ulterior motives lobbying for _secret_ protocols to replace the open ones, as though this would
increase security. (It won't, of course).

Quoted message said:

Could the terrorists stay organized so well without the modern toys?

Yes, they could. Didn't the terrorists who bombed the World Trade Center in 2001 use couriers rather
than telecommunications?

Quoted message said:

Question the validity of the open system and you got a rash of criticism until recently. Guy.

Who would you trust to run a "closed" internet?

--
Alan Mackenzie (Munich, Germany) Email: [email hidden]; to decode, wherever there is a repeated
letter (like "aa"😉, remove half of them (leaving, say, "a"😉.

On Wed, 11 Feb 2004 08:51:07 +0000, Alan

Mackenzie said:

Guy <[email hidden]> wrote on Tue, 10 Feb 2004 10:32:47 -0600:

Quoted message said:

In the past there was a mad rush for an open and uncontrolled internet. We are reaping the
results today. I won't touch the "back door" area. Privacy???. Intrusions are common but most are
nuts playing. Several leaders have made public statements showing concern.

Guy, you're conflating two very different usages of the word "open".

There is the positive meaning, that the internet protocols are publicly documented, free for
anybody's use. Without this, the internet could not have been. This "open" allows internet users to
write or chose their own software appropriate for their needs, and to get it cheaply. Compare
internet software with AOL's offerings.

There is also the more contentious meaning of "open", that anybody can access the internet, almost
anonymously, and that security is non-existent.

These two meanings are utterly distinct. Failing to distinguish them could lead to those with
ulterior motives lobbying for _secret_ protocols to replace the open ones, as though this would
increase security. (It won't, of course).

Quoted message said:

Could the terrorists stay organized so well without the modern toys?

Yes, they could. Didn't the terrorists who bombed the World Trade Center in 2001 use couriers
rather than telecommunications?

Quoted message said:

Question the validity of the open system and you got a rash of criticism until recently. Guy.

Who would you trust to run a "closed" internet?

We have little disagreement. A problem is that the current popular software is designed for
commercial use. A knowledgable programmer can access your system easily.

I have some extra equipment to monition things and I see probers all of the time. That is the reason
I never use this system for any critical data.

I think it will reach the point where steps will be taken to jail a few to scare the others.
Identity theft is a growing problem and interfering with commerce, so now something will be done.

I have seen upset people here and in a short time you get a rash of probes. That is the reason I do
not discuss my system here. Let them guess. Guy