2010-01-31 04:13:37

by Gene Heskett

Subject: A spammer, wanting to poison our bayes seems to have found a hole at vger.kernel.org

Greeting;

I just noticed that I have a poison bayes spam in my inbox cuz kmails filters
haven't a clue what to do with a message addressed like this:

to:[email protected]

Is this a leak in the mailing list server, or a total forgery?

--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)

Congratulations are in order for Tom Reid.

He says he just found out he is the winner of the 2021 Psychic of the
Year award.

2010-01-31 15:42:05

by Matti Aarnio

Subject: Re: A spammer, wanting to poison our bayes seems to have found a hole at vger.kernel.org

On Sat, Jan 30, 2010 at 11:13:19PM -0500, Gene Heskett wrote:
> Greeting;
>
> I just noticed that I have a poison bayes spam in my inbox cuz kmails filters
> haven't a clue what to do with a message addressed like this:
>
> to:[email protected]
>
> Is this a leak in the mailing list server, or a total forgery?

It was real, and bypassed Majordomo processing entirely.
Now I have added some extra "secret sauce" on all outgoing aliases.

> --
> Cheers, Gene

/Matti

2010-01-31 23:30:07

by Matti Aarnio

Subject: Re: A spammer, wanting to poison our bayes seems to have found a hole at vger.kernel.org

On Sat, Jan 30, 2010 at 11:13:19PM -0500, Gene Heskett wrote:
> Received: from vger.kernel.org ...
> Received: ([email protected]) by vger.kernel.org via listexpand ...
> Received: ([email protected]) by vger.kernel.org id S1752309Ab0AaENg
> (ORCPT <rfc822;linux-kernel-outgoing>);
> Sat, 30 Jan 2010 23:13:36 -0500
> Received: from vms173007pub.verizon.net ([206.46.173.7]:39289 "EHLO
...
> Greeting;
>
> I just noticed that I have a poison bayes spam in my inbox cuz kmails filters
> haven't a clue what to do with a message addressed like this:
>
> to:[email protected]
>
> Is this a leak in the mailing list server, or a total forgery?

Sharp eyes, thanks.

I quoted above Gene's emails Received headers as it travelled thru
vger.kernel.org. You can have a look at headers of this reply to see,
how many hops it did inside VGER.

There were explicit aliases mapping majordomo output to actual list
expansion. A smart spammer realized that by adding vger's domain on
them was possible to post directly to list system backend.

Now there is no separate backend, and such aliases no longer exist.

> --
> Cheers, Gene

Best Regards, Matti Aarnio, one of <postmaster at vger.kernel.org>