OT: pirated email

[Ric]

--- BluPhoenyx <quazar at dcnet2000.com> wrote:
> There is a slew of this stuff going around all over the web. I was
> seeing a few hundred a day at first and at 150k a pop, it sure screwed
> up my little 56k connection. I think it's could be a new campaign to
> screw with the data transfer records of ISP's. With all the data
> moving around, it could be more difficult to pinpoint the pirates.

I agree.  These emails are being sent from one source to another and then sent
to the end recipient.  The last go around with this mess, there was only one
"From" source in the headers for the SoBig emails.  These folks are getting
sneakier... but not much smarter.  Sending me code that runs on *Windows is a
waste of BW.  Maybe that is what they really want - to completely bring the net
down by sucking up all the BW....?

That also makes me feel a little better since I was only getting ~ a dozen or 2
a day.  I'd be one MSOB if I had gotten slammed with "a few hundred".  I am
already PO'd enuf with the PING( Cyberkit ) that my FW keeps getting...


> For me, the fix is easy. I set Sylpheed-Claws to limit the size of the
> emails to download to a reasonable threshold. In my case 99 kb for
> now. Then set a filter to grab the rest and send them to the garbage.
> Not only are there ones with attachments but there are those which are
> supposed to be stripped but you still get the detritus. So far I have
> eliminated this problem now and with Sylpheed-Claws, get the ones I
> want and kill the wormy emails without even downloading them. So cool.
> 
> For those who need it, here is the filter entry. It should give useful
> info for anyone with this problem.
> 
> headers_part matchcase "skynet.be" | from matchcase "Microsoft" |
> subject matchcase "Microsoft" | from matchcase "ms corporation" | from
> matchcase "ms technical" | from matchcase "ms public" | from matchcase
> "ms net" | from matchcase "ms security" | from matchcase "ms internet"
> | from matchcase "ms message" | from matchcase "ms mail" | from
> matchcase "internet message" | from matchcase "internet security" |
> from matchcase "inet delivery" | from matchcase "inet messag" | from
> matchcase "inet email delivery" | from matchcase "inet service" | from
> matchcase "network system" | from matchcase "network email" | from
> matchcase "network delivery" | from matchcase "net upgrade" | from
> matchcase "net storage" | from matchcase "net email" | from matchcase
> "customer support" | subject matchcase "security support" | subject
> matchcase "security update" | subject matchcase "Returned Message" |
> subject matchcase "Returned Mail" | subject matchcase "critical patch"
> | subject matchcase "failure message" | subject matchcase "abort
> report" | subject matchcase "bug notice" | subject matchcase "critical
> update" | subject matchcase "undelivered mail: return" | subject
> matchcase "undeliverable message: user" | from matchcase
> "administrator" | from matchcase "admin" | from matchcase "network
> mail delivery" | from matchcase "postmaster" | from matchcase "email
> storage" | from matchcase "robot at america.com" | subject matchcase
> "mail user unknown" | subject matchcase "failure announcement" |
> subject matchcase "failure advice" | from matchcase "program security"
> 

Thanks Mike. 


> -- 
> Cheers,
> Mike T.
> 
> Linux user #169067



=====
Have A Great Day!

Ric
***
Thought for today:
After 10 years writing object-orientated enterprise code, one of the most 
important things I've learned is to code as if the next guy to come along and 
maintain your code is a short-tempered 30-stone gorilla who knows where you 
live.
-- Caspian Rychlik-Prince
-- http://www.puppygames.net/articles/alienflux_postmortem.php

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com