Bill Moran wrote: > Just curious if anyone knows the origin of all these auto-responses, etc. > > I'm seeing a lot of these on every list I'm subscribed to (not all of them > FreeBSD related) so I was wondering if some Windows trojan is running rampant > and using these list addresses as return addys? > > Anyone know?
Yes. There are a number of machines in the texas.gov domain that are infected with the SoBIG worm because the morons running them are too dumb to install Windows patches from 6 months ago, and to split their inbound and outbound mail servers and filter out outbound mail from forged "from" addresses with an IP address that happens to be in their netblock, but with a source domain that is not one of the domains under their immediate control. One of these machines is 204.65.42.107, which is in the netblock subdelegated to access.texas.gov. There are about 4 others. but that one in particular has someone who is subscribed to the FreeBSD mailing lists. Be warned that if you post to these mailing lists at all, the user on that machine subscribed to the list will end up using *your* email address will be used to forge outbound email to other people by the worm. Most people who build out email infrastructure have no idea of what they are doing. On the plus side, whoever is running that frigging machine is liable under California law for a fine of $10,000 and up to 3 years in jail, since forging a "from" address belonging to someone else is now a felony in California. -- Terry _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "[EMAIL PROTECTED]"
