Re: Curious "spam" (or broken viral payload)...

From: GertJan Hagenaars <incidents(at)hagenaars.com>
Date: Wed Jan 08 2003 - 22:04:14 EST

I've seen it too (today), I forwarded the (complete) message on to the email address mentioned in the error message and I received this reply back:

%% Thanx a lot, i have just found what is the error about!
%% 
%% I got 5 messages like yours and yours one is the only one which helped
%% me to find the reasons, thanx again!
%% 
%% Wednesday, January 8, 2003, 7:24:06 AM, you wrote:
%% 
%% GH> Hi there,
%% 
%% GH> not sure why I got this messsage, but someone might be trying to 
%% GH> use your machine to send spam through.  Thought you might like to 
%% GH> check it out.
%% 
%% GH> CHeers,

The original SPAM that I got had an empty Subject line.

No. No idea who, what or why. Would be interesting to find out exactly what the heck was going on. For now I'm willing to think that it was just a case of a spammer finding a potential box with standard misbehaving tools (formmail??) and getting bitten by a misconfiguration in the script / the server.

CHeers,
GertJan.

+++++++++++++ -------- +++++ --- ++ - +0+ + ++ +++ +++++ ++++++++ +++++++++++++

sed '/^[when][coders]/!d         G.J.W. Hagenaars -- gj at hagenaars dot com
    /^...[discover].$/d          Remembering Mike Carty 1968-1994
   /^..[real].[code]$/!d         UltrixIrixAIXHPUXSunOSLinuxBSD, nothing but nix
' /usr/dict/words                I'm Dutch, what's _your_ excuse?

Apparently, Jay D. Dyson wrote:
% -----BEGIN PGP SIGNED MESSAGE-----

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Fri Jan 10 02:43:08 2003