Re: Your response is requested

Re: Your response is requested

[Dave Zarzycki]

On Tue, 17 Apr 2001 J.I.@thor.sbay.org wrote:
                    ^^^^^^^^^^^^^^^^^^

Arrggg!!! Mumble... grumble... F*cking spammer using my hostname as the
from address for sending spam...

Dave Zarzycki

Re: Your response is requested

[Matti Aarnio]

On Tue, Apr 17, 2001 at 12:18:48PM -0700, Dave Zarzycki wrote:
> On Tue, 17 Apr 2001 J.I.@thor.sbay.org wrote:
>                     ^^^^^^^^^^^^^^^^^^
> Arrggg!!! Mumble... grumble... F*cking spammer using my hostname as the
> from address for sending spam...

  Actually not.  Either your MTA, or your MUA did that.
  I got:

	From:   J. I.

  This particular detail -- when to add canonical domain to e.g. From:
  address, and when not -- is implemented rather fuzzily usually..

> Dave Zarzycki

/Matti Aarnio

Re: Your response is requested

[Nathan Dabney]

Nope, it was spoofed.

It just looks to you like it came from you, like mine looks like it came from 
my domain...

-Nathan

On Tue, Apr 17, 2001 at 12:18:48PM -0700, Dave Zarzycki wrote:
> On Tue, 17 Apr 2001 J.I.@thor.sbay.org wrote:
>                     ^^^^^^^^^^^^^^^^^^
> 
> Arrggg!!! Mumble... grumble... F*cking spammer using my hostname as the
> from address for sending spam...
> 
> Dave Zarzycki
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

Re: Your response is requested

[Rik van Riel]

On Tue, 17 Apr 2001, Dave Zarzycki wrote:
> On Tue, 17 Apr 2001 J.I.@thor.sbay.org wrote:
>                     ^^^^^^^^^^^^^^^^^^
> 
> Arrggg!!! Mumble... grumble... F*cking spammer using my hostname as the
> from address for sending spam...

Funny, I saw a  "From: J.I.@conectiva.com.br" ...

regards,

Rik
--
Virtual memory is like a game you can't win;
However, without VM there's truly nothing to lose...

		http://www.surriel.com/
http://www.conectiva.com/	http://distro.conectiva.com.br/

Re: Your response is requested

[Disconnect]

(Sending to LKML just so nobody else flips out)

OK it wasn't just us.  Lemme reassure the admins I just forwarded it to ;)

It seems to list the hostname of whoever receives it (neat trick).

On Tue, 17 Apr 2001, Dave Zarzycki did have cause to say:

> On Tue, 17 Apr 2001 J.I.@thor.sbay.org wrote:
>                     ^^^^^^^^^^^^^^^^^^
> 
> Arrggg!!! Mumble... grumble... F*cking spammer using my hostname as the
> from address for sending spam...
> 
---
-----BEGIN GEEK CODE BLOCK-----
Version: 3.1 [www.ebb.org/ungeek]
GIT/CC/CM/AT d--(-)@ s+:-- a-->? C++++$ ULBS*++++$ P+>+++ L++++>+++++ 
E--- W+++ N+@ o+>$ K? w--->+++++ O- M V-- PS+() PE Y+@ PGP++() t 5--- 
X-- R tv+@ b++++>$ DI++++ D++(+++) G++ e* h(-)* r++ y++
------END GEEK CODE BLOCK------

Re: Your response is requested

[John Jasen]

On Tue, 17 Apr 2001, Disconnect wrote:

> (Sending to LKML just so nobody else flips out)
>
> OK it wasn't just us.  Lemme reassure the admins I just forwarded it to ;)
>
> It seems to list the hostname of whoever receives it (neat trick).

sendmail, by default, appends its domainname to incoming email that
doesn't have one.

--
-- John E. Jasen (jjasen1@umbc.edu)
-- In theory, theory and practise are the same. In practise, they aren't.

[OT] Re: Your response is requested

[J Sloan]

John Jasen wrote:

> On Tue, 17 Apr 2001, Disconnect wrote:
>
> > (Sending to LKML just so nobody else flips out)
> >
> > OK it wasn't just us.  Lemme reassure the admins I just forwarded it to ;)
> >
> > It seems to list the hostname of whoever receives it (neat trick).
>
> sendmail, by default, appends its domainname to incoming email that
> doesn't have one.

We reject domainless messages, so that's not it.

jjs

Re: Your response is requested

[Doug McNaught]

Dave Zarzycki <dave@zarzycki.org> writes:

> On Tue, 17 Apr 2001 J.I.@thor.sbay.org wrote:
>                     ^^^^^^^^^^^^^^^^^^
> 
> Arrggg!!! Mumble... grumble... F*cking spammer using my hostname as the
> from address for sending spam...

Not true.  The From: address was simply "J.I."; your mailhost tacked
on your local domain since it was unqualified.

Gave me a turn, too, until I figured it out.

-Doug

Re: Your response is requested

[Alan Cox]

> On Tue, 17 Apr 2001 J.I.@thor.sbay.org wrote:
>                     ^^^^^^^^^^^^^^^^^^
> 
> Arrggg!!! Mumble... grumble... F*cking spammer using my hostname as the
> from address for sending spam...

Its variously called 'fraud' and 'obtaining services by deception' in most
jurisdictions and as a criminal matter can be reported to interested parties.

Generally the mailing list isnt an interested party 8)

Re: Your response is requested

[David Woodhouse]

matti.aarnio@zmailer.org said:
>   Actually not.  Either your MTA, or your MUA did that.
>   I got:
> 	From:   J. I.
>   This particular detail -- when to add canonical domain to e.g. From:
>   address, and when not -- is implemented rather fuzzily usually.. 

I'm in the "if it arrives unqualified by SMTP from !localhost, reject it"
camp. I certainly can't think of a single case where it's appropriate to
accept it _and_ qualify it with the local domain in that case.

--
dwmw2

Re: Your response is requested

[Matti Aarnio]

On Wed, Apr 18, 2001 at 12:03:41AM +0100, David Woodhouse wrote:
> matti.aarnio@zmailer.org said:
> >   Actually not.  Either your MTA, or your MUA did that.
> >   I got:
> > 	From:   J. I.
> >   This particular detail -- when to add canonical domain to e.g. From:
> >   address, and when not -- is implemented rather fuzzily usually.. 
> 
> I'm in the "if it arrives unqualified by SMTP from !localhost, reject it"
> camp. I certainly can't think of a single case where it's appropriate to
> accept it _and_ qualify it with the local domain in that case.

	I didn't look for what it was at the SMTP level while
	incoming, but RFC 821 (SMTP) is the transport method, and
	VGER won't accept unqualified ( + a few more rules )

	What you are saying is that RFC 822 level (visible headers)
	should be controlled for something ?

	I have a surprise for you, RFC 822 data carries only incidental
	resemblance with the message content and destination.

	Like now, you (dwmw2) get this message twice: once from me
	which means the "From:" might even carry some resemblance
	to the sender (yes, resemblance, it isn't my login-id, just
	my email address), the second one comes via the list, and
	the Majordomo won't change the From: to be
		linux-kernel-owner@vger.kernel.org
	which is the real sender in that case...

	... and this is completely off topic ...
> --
> dwmw2

/Matti Aarnio

[OT] Re: Your response is requested

[J Sloan]

J.I.@toyota.com wrote:

> Dear Friend:
>
> YOU CAN make over a half million dollars every 4 to 5 months from
> your home for a one time investment of only twenty five U.S.
> Dollars.

This did not originate from toyota.com - The spammer simply
used that domain as the "from" hostname. We are careful
about mail server security here, there is no open relay.

jjs

Re: [OT] Re: Your response is requested

[Dale Amon]

On Tue, Apr 17, 2001 at 12:34:36PM -0700, J Sloan wrote:
> J.I.@toyota.com wrote:
> 
> > Dear Friend:
> >
> > YOU CAN make over a half million dollars every 4 to 5 months from
> > your home for a one time investment of only twenty five U.S.
> > Dollars.
> 
> This did not originate from toyota.com - The spammer simply
> used that domain as the "from" hostname. We are careful
> about mail server security here, there is no open relay.
> 

Yeah, I saw it to with *MY* domain on it and near had a fit!

\x18-- 
------------------------------------------------------
Use Linux: A computer        Dale Amon, CEO/MD
is a terrible thing          Village Networking Ltd
to waste.                    Belfast, Northern Ireland
------------------------------------------------------

Re: [OT] Re: Your response is requested

[Andreas Eibach]

----- Original Message -----
From: "Dale Amon" <amon@vnl.com>
To: "J Sloan" <jjs@toyota.com>
Cc: <linux-kernel@vger.kernel.org>
Sent: Monday, April 23, 2001 9:12 PM
Subject: Re: [OT] Re: Your response is requested


> On Tue, Apr 17, 2001 at 12:34:36PM -0700, J Sloan wrote:
> > J.I.@toyota.com wrote:
> >
> > > Dear Friend:
> > >
> > > YOU CAN make over a half million dollars every 4 to 5 months from
> > > your home for a one time investment of only twenty five U.S.
> > > Dollars.
> >
> > This did not originate from toyota.com - The spammer simply
> > used that domain as the "from" hostname. We are careful
> > about mail server security here, there is no open relay.
> >
>
> Yeah, I saw it to with *MY* domain on it and near had a fit!

Well it's kinda easy to protect yourself against this crap...
Just look through your mailer for 'dollar' || 'dollars' in the *body* of the
message, or more than two exclamation marks in the subject - and you shall
find the bastards ;-)

0.02 e
andreas