Subject: [TAG] Nasty virus

From: Mike Orr <[email-masked]>
Date: Fri, 5 Mar 2004 09:06:47 -0800

There's been a particularly clever virus going around the past day.
It somehow chooses the From: address to be familiar, and the body
message to match the nature of the list.  I'm not sure if it picks
a From: address with the same name as the To: address or what.  The
two that hit tag today have pretty generic messages:

Date: Fri, 20 Feb 2004 17:52:39 +0530
From: [email-masked]
To: [email-masked]
Subject: [TAG] warning

stuff about you?

---
Date: Fri, 20 Feb 2004 16:40:59 +0530
From: [email-masked]
To: [email-masked]
Subject: [TAG] fake

something is going wrong!

---
But one that showed up on a work list yesterday had an amazingly
customized messages that could have fooled a customer:

---
Date: Thu, 04 Mar 2004 14:48:53 -0800
From: [email-masked]
To: [email-masked]
Subject: Important notify about your e-mail account.

Dear user of Patientwire.com, Our main mailing server will be temporary
unavaible for next two days, to continue receiving mail in these days you
have to configure our free auto-forwarding service. For details see the
attach. Cheers, The Patientwire.com team http://www.patientwire.com

Attachments:
application/octet-stream; name="Document.pif"
---

-- 
-Mike Orr (aka. Sluggo), [email-masked]  ([email-masked])
   http://sluggo.kicks-ass.org/                  Cxu vi parolas Esperante?
_______________________________________________
TAG mailing list
[email-masked]
http://linuxgazette.net/mailman/listinfo/tag

---

From: Ben Okopnik <[email-masked]>
Date: Sat, 6 Mar 2004 14:39:57 -0500

> something is going wrong!

I've actually seen a bit of how this thing works due to having private
and other list-relevant addresses for several lists. What it looks like
is that it gets hold of an addressbook and then does some sort of
permutations on the address list - perhaps matching domains as you
mention (which is a fairly clever trick, if you think about it - it
"works" in both directions.)

> attach. Cheers, The Patientwire.com team http://www.patientwire.com

Yup. Nothing technically difficult about it once you have the domain
name, but it is a jump in spammer sophistication - just another
indication of the "arms race" engendered by Bayesian filters and such.
I'm not sure of what the next step in fighting spam is going to be, but
that one is rapidly heading toward a dead end.

* Ben Okopnik * okopnik.freeshell.org * Technical Editor, Linux Gazette *
-=-=-=-=-=o0o=-=-=-=-= <http://linuxgazette.net/> =-=-=-=-=o0o=-=-=-=-=-
_______________________________________________
TAG mailing list
[email-masked]
http://linuxgazette.net/mailman/listinfo/tag

---

From: "Ashwin N." <[email-masked]>
Date: Mon, 8 Mar 2004 14:10:59 -0800

Mike Orr <[email-masked]> wrote:
> message to match the nature of the list.

Looks like the W32.Beagle virus. This particular massmailing worm is very
clever in it's social engineering aspects (the From: address, the Subject
and the body). Also, I liked (!) the way it traps the trust of the user by
asking him to enter a password to free itself.

More details on the virus here -
http://www.sarc.com/avcenter/venc/data/[email-masked]

~ash
-- 
Ashwin N.
http://ash.webhop.net/