Techsurvivors

Archives => 2008 => Topic started by: MamaMoose on March 22, 2008, 02:10:40 AM

Title: New Nasty Spam Trick!
Post by: MamaMoose on March 22, 2008, 02:10:40 AM: I have discovered a new and very nasty spam approach thatis impossible to filter out. I get a message from me addressed to me and of course my spam filter passes it through to my In box. An exampl is:

To: mamamoose@moosedomain.com

From: mamamoose@moosedomain.com

Please send money as I am in prison unfairly in bazzokastan

What I don't understand is how anyone can send me an e-mail by usingmy addy without knowing my password. However, they can! My only thought is that my e-mail password has been hacked. Should I change my e-mail password?

Anyone have any ideas?

Thanks,

MamaMoose
Title: New Nasty Spam Trick!
Post by: kbeartx on March 22, 2008, 03:58:23 AM: SMTP is a 'trusting' protocol [perhaps its biggest flaw, IMO], so anyone can type whatever username and domain they feel like. I seriously doubt that anything has been hacked or stolen.
Title: New Nasty Spam Trick!
Post by: gunug on March 22, 2008, 06:11:02 AM: I've gotten email from myself occasionally at work and a lot from "garbagename@ourdomain.name" (with ourdomain.name being correct for our domain) as this is a favored routine of the bots that are trying to get response to penny stock pleas and other nonsense. At work we use GWAVA to filter at the firewall but this stuff will get through because GWAVA won't filter against an actual email list (probably 40,000 people with students and all staff included) as it would take to long.
Title: New Nasty Spam Trick!
Post by: Paddy on March 22, 2008, 08:29:09 AM: Anyone can send email using any address in the from line. I can send you email using "donaldduck@disney.com" if I want to. But have you checked the long headers? In there you may see the actual, real sending address, or at least some indication of where it's really from. Better yet - put it through spamcop.com and you'll find out where it's from. The spammers usually use open relays and the *real* sending address often isn't readily apparent in the headers.

More info: http://sparksspace.blogspot.com/2008/01/email-spoofing.html

Interestingly, Rogers has sent us emails in the last couple of days asking us to enter every email address that we send from on every account - and unless we do this, outgoing mail won't go out. I guess this is one way they're trying to prevent users from spamming, but it won't prevent those with any real evil intent; this will make sure they're not using Rogers (Yahoo's) servers. Good discussion of the ins and outs of this move: http://www.dslreports.com/forum/r20163255-...is-this-genuine
Title: New Nasty Spam Trick!
Post by: Gregg on March 22, 2008, 10:32:21 AM: I also have received e-mail that was "from my address", one just the other day. I hesitated after clicking the "block" button, because it asks if I want to block e-mail from me. Well, I don't, because sometimes I use my e-mail to send a message to my wife when she's at work, to the very same address of course.

Would allowing the "spoofed" e-mail to be blocked really block messages from the actual sender? Frankly, I have my doubts that blocking works very well. I think tackling would be much more effective.
Title: New Nasty Spam Trick!
Post by: Xairbusdriver on March 22, 2008, 03:49:07 PM: And this demonstrates that "To:" and "From:" addresses are not a good method to prevent SPAM. Get a good SPAM filter (SPAMsieve comes to mind, and I think Mail has something built-in) that can "learn" what you consider SPAM, even if the filter app doesn't. It only gets smarter and better with time! If you really want to send yourself mail, see if your ISP has free aliases available. Then create one of those for use when you need/want to send something to yourself, that's much less likely to be a SPAM (until that alias becomes known, but then you can just change it to something else!). When I send something to several people, I always use "BCC:" for their names/addresses. But I have to have something in the "To:" field and that's when I use one of my aliases or just one of my several addresses. I severely detest people sending stuff to me that has my name/address in the "To:" section with dozens of other people who I have never ever known. Some of them probably just copy the whole list into their (insecure) address book which is then harvested by one of the hundreds of PC worms/malware! Stop me from wandering so far off rack! Whoa!
Title: New Nasty Spam Trick!
Post by: Paddy on March 22, 2008, 05:37:35 PM: Here's an example of spam and how the "from" line can forged to show your address - I found this today from my semi-throwaway gmail addy (it never made it to my actual inbox - GMail stuck it in the spam folder:

Delivered-To: (me)@gmail.com
Received: by 10.142.141.1 with SMTP id o1cs175975wfd;
Fri, 21 Mar 2008 17:15:40 -0700 (PDT)
Received: by 10.65.20.18 with SMTP id x18mr7760746qbi.48.1206144939999;
Fri, 21 Mar 2008 17:15:39 -0700 (PDT)
Return-Path: <duncanschofield@iprimus.com.au>
Received: from d610geo (206-248-131-220.dsl.teksavvy.com [206.248.131.220])
by mx.google.com with SMTP id c5si3523917qbc.19.2008.03.21.17.15.38;
Fri, 21 Mar 2008 17:15:39 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning duncanschofield@iprimus.com.au does not designate 206.248.131.220 as permitted sender) client-ip=206.248.131.220;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning duncanschofield@iprimus.com.au does not designate 206.248.131.220 as permitted sender) smtp.mail=duncanschofield@iprimus.com.au
Date: Fri, 21 Mar 2008 17:15:39 -0700 (PDT)
X-Originating-IP: [206.248.131.220]
X-Originating-Email: [(me)@gmail.com]
X-Sender: (me)@gmail.com
Received: (qmail 2180 by uid 510); Fri, 21 Mar 2008 08:15:37 -0500
Message-Id: <20080321031537.2182.qmail@d610geo>
To: <(me)@gmail.com>
Subject: RE: MedHelp 73816
From: <(me)@gmail.com>
MIME-Version: 1.0
Importance: High
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit

Either that or I'm going crazy and sending myself spam!!

(Interesting that the supposed originating sender is "duncanschofield@iprimus.com.au" - the user ID is somewhat similar to my Google ID; not sure what THAT means, if anything!)

I did try looking up the IP address that GMail's servers complain about - at first I couldn't find it. Tried again on another site and it's actually a Teksavvy.com IP - they're a provider here in Toronto. Unusual, in that they're usually offshore. When I did a Google search, I got one result:

http://en.wikipedia.org/wiki/User_talk:24.118.187.54

Apparently this IP has been used for various nefarious purposes!!

Even though SpamCop would report this to TekSavvy.com's abuse, I'm not going to send it on since it says it comes from ME at my gmail addy, and I'm darned if I want any confusion!! I don't generally bother reporting the Gmail spam via SpamCop, since I don't really completely trust the abuse departments at some of the less-than-stellar offshore ISPs. Not that I think TekSavvy is scuzzy - they actually have a pretty good local reputation from what I can tell. I do occasionally have a go at SpamCop with my Yahoo spam, because that REALLY is a throwaway account and I don't care what happens to it.
Title: New Nasty Spam Trick!
Post by: Gregg on March 23, 2008, 02:47:34 PM: QUOTE(Xairbusdriver @ Mar 22 2008, 03:49 PM) <{POST_SNAPBACK}>
Get a good SPAM filter (SPAMsieve comes to mind, and I think Mail has something built-in) that can "learn" what you consider SPAM, even if the filter app doesn't.

Does such software work with web-based e-mail?

I'm told that Mail can be configured to download we-based accounts to your hard drive, but I haven't looked into it and it's not on my "to do" list.