[meteorite-list] OT: Virus early warning system

Mail actions: [ respond to this message ] [ mail a new topic ]
Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ]

From: Troy <Troy_at_meteoritecentral.com>
Date: Thu Apr 22 10:04:49 2004
Message-ID: <000d01c1fcca$e674eb60$30a9afce_at_default>

This is a multi-part message in MIME format.

------=_NextPart_000_000A_01C1FCA0.FC9B7D20
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi List, I have one better than that. Take all your addresses from your =
address book and put them into a simple text file which you can name =
address book. Now remove all the addresses from the address book and =
leave it empty. Then when you need an address just copy it from the text =
file and paste it into the e-mail header. Sort of like having a real =
address book.
Just a thought
Troy Bell
  ----- Original Message -----=20
  From: Matson, Robert=20
  To: meteorite-list=20
  Sent: Wednesday, May 15, 2002 12:51 PM
  Subject: [meteorite-list] OT: Virus early warning system

  Hi All,
  =20
  Sorry for the off-topic post, but I wanted to pass along this
  little trick. Add some diagnostic, fake addresses to your
  address books -- e.g. "%trap" or "JJJfilter", and give them
  a non-working email address like "mailto:Virus_at_Warn.Me. Using a
  % or ! to begin at least one of your fake address names is
  good because it will alphabetize to the top of your address
  book, and many of the simpler worms will start by sending
  themselves to the first address in your address book.
  =20
  Since this address is fake, it will bomb, and in many cases
  terminate an unsophisticated worm. Better yet, you'll get
  an error in your Inbox indicating that a message was sent
  out and it was undeliverable, thus tipping you off.
  =20
  Some worms are smart enough to ignore the first address
  in your book (for exactly this reason), and taking this a step
  further -- a truly sophisticated worm would select addresses
  at random. To help defeat these, you can scatter fake
  addresses periodically through the alphabet as traps:
  "DDD", "HHH", "LLL", etc., all with bad email addresses.
  =20
  Obviously this won't prevent you from getting the worm in
  the first place, but it stands a good chance of warning you
  that you are propagating it yourself.
  =20
  Cheers,
  Rob

------=_NextPart_000_000A_01C1FCA0.FC9B7D20
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Diso-8859-1" =
http-equiv=3DContent-Type>
<META content=3D"MSHTML 5.00.3314.2100" =
name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY background=3D"" bgColor=3D#ffffff scroll=3Dyes=20
style=3D"BACKGROUND-POSITION: 0px 0px; FONT-FAMILY: Arial; FONT-SIZE: =
10pt; MARGIN: 1px"=20
X-FVER=3D"2.0" ORGYPOS=3D"0">
<DIV>Hi List, I have one better than that. Take all your addresses from =
your=20
address book and put them into a simple text file which you can name =
address=20
book. Now remove all the addresses from the address book and leave it =
empty.=20
Then when you need an address just copy it from the text file and paste =
it into=20
the e-mail header. Sort of like having a real address book.</DIV>
<DIV>Just a thought</DIV>
<DIV>Troy Bell</DIV>
<BLOCKQUOTE=20
style=3D"BORDER-LEFT: #000000 2px solid; MARGIN-LEFT: 5px; MARGIN-RIGHT: =
0px; PADDING-LEFT: 5px; PADDING-RIGHT: 0px">
  <DIV style=3D"FONT: 10pt arial">----- Original Message ----- </DIV>
  <DIV=20
  style=3D"BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: =
black"><B>From:</B>=20
  <A href=3D"mailto:ROBERT.D.MATSON_at_saic.com"=20
  title=3DROBERT.D.MATSON_at_saic.com>Matson, Robert</A> </DIV>
  <DIV style=3D"FONT: 10pt arial"><B>To:</B> <A=20
  href=3D"mailto:meteorite-list_at_meteoritecentral.com"=20
  title=3Dmeteorite-list_at_meteoritecentral.com>meteorite-list</A> </DIV>
  <DIV style=3D"FONT: 10pt arial"><B>Sent:</B> Wednesday, May 15, 2002 =
12:51=20
  PM</DIV>
  <DIV style=3D"FONT: 10pt arial"><B>Subject:</B> [meteorite-list] OT: =
Virus early=20
  warning system</DIV>
  <DIV><BR></DIV>
  <DIV><SPAN class=3D668344217-15052002>Hi All,</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002></SPAN> </DIV>
  <DIV><SPAN class=3D668344217-15052002>Sorry for the off-topic post, =
but I wanted=20
  to pass along this</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>little trick.  Add some =
diagnostic,=20
  fake addresses to your</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>address books -- e.g. "%trap" or =

  "JJJfilter", and give them</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>a non-working email address like =
"<A=20
  href=3D"mailto:Virus_at_Warn.Me">mailto:Virus@Warn.Me</A>.  Using=20
  a</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>% or ! to begin at least one of =
your fake=20
  address names is</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>good because it will alphabetize =
to the=20
  top of your address</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>book, and many of the simpler =
worms will=20
  start by sending</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>themselves to the first address =
in your=20
  address book.</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002></SPAN> </DIV>
  <DIV><SPAN class=3D668344217-15052002>Since this address is fake, it =
will bomb,=20
  and in many cases</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>terminate an unsophisticated =
worm. =20
  Better yet, you'll get</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>an error in your Inbox =
indicating that a=20
  message was sent</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>out and it was undeliverable, =
thus tipping=20
  you off.</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002></SPAN> </DIV>
  <DIV><SPAN class=3D668344217-15052002>Some worms are smart enough to =
ignore the=20
  first </SPAN><SPAN =
class=3D668344217-15052002>address</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>in your book (for exactly this =
reason),=20
  and taking this </SPAN><SPAN class=3D668344217-15052002>a =
step</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>further -- a truly sophisticated =
worm=20
  would select addresses</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>at random.  To help defeat =
these, you=20
  can scatter fake</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>addresses periodically through =
the=20
  alphabet as traps:</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>"DDD", "HHH", "LLL", etc., all =
with bad=20
  email addresses.</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002></SPAN> </DIV>
  <DIV><SPAN class=3D668344217-15052002>Obviously this won't prevent you =
from=20
  getting the worm in</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>the first place, but it stands a =
good=20
  chance of warning you</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002>that you are propagating it=20
  yourself.</SPAN></DIV>
  <DIV><SPAN class=3D668344217-15052002></SPAN> </DIV>
  <DIV><SPAN class=3D668344217-15052002>Cheers,</SPAN></DIV>
  <DIV><SPAN =
class=3D668344217-15052002>Rob</SPAN></DIV></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_000A_01C1FCA0.FC9B7D20--
Received on Thu 16 May 2002 07:14:50 AM PDT

This message: [ Message body ]
Next message: Norbert Classen: "[meteorite-list] AD - Real Bargain, HaH173 MM, Fresh L6 - L_at_@k!"
Previous message: Jim: "[meteorite-list] Incredible Ebay Bargains"
In reply to: Matson, Robert: "[meteorite-list] OT: Virus early warning system"

Mail actions: [ respond to this message ] [ mail a new topic ]
Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ]

StumbleUpon

del.icio.us

Yahoo MyWeb