Forum Archive Index - September 2003

[crt jakhel <crt@dergan.net>]

In reply to Allan Potts (03.09.03 23:02):

> I received a bounce back message today THAT I DIDN'T SEND.  It was addressed 
>to Liz@bossleyarchitects.co.nz.  The heading was  Re: Your application and 
>contained a pif. attachement which, I'm told is a WORM.  Specifically a 
>W32.Sobig.F@mm worm.  The trouble is that some other worm sent it, not me.  
>I've not sent any such messages, and since it was a NZ message, I have to 
>assume that someone is useing the Sharechat site names to trick people into 
>opening this fradulent mail.  Please do not open any such messages from me or 
>anyone else.  Some people really should get a life.

In the last year or so it has become customary for email worms to use fake
senders. The worm inspects the addressbook at the infected machine and
harvests email addresses it finds, using them as "senders" for its own
spreading.

This can be very irritating if you are a company who relies heavily on
good realtions with its customers, only to be swamped with reports to the
effect of "WHY are you sending us infected emails?? What do you think you
are doing?".

There is no really simple and easily implementable protection from this
sender-address-hijacking. Yes, email headers can be inspected to see
whether the email in question has actually been sent from an appropriate
machine (inside the company's domain, for example) or not. But one can't
realistically expect the recipients to do that instead of having the
reflex reaction of "you bastard(s)". Sad but natural.

regards,
crt

----------------------------------------------------------------------------
To remove yourself from this list, please use the form at
http://www.sharechat.co.nz/chat/forum/