From gbt@acm.org Thu May 30 22:12:55 2002 Received: from mailscan6.cac.washington.edu (mailscan6.cac.washington.edu [140.142.33.14]) by lists.u.washington.edu (8.12.1+UW01.12/8.12.1+UW02.01) with SMTP id g4V5Crw3027538 for ; Thu, 30 May 2002 22:12:54 -0700 Received: FROM mxu3.u.washington.edu BY mailscan6.cac.washington.edu ; Thu May 30 22:12:53 2002 -0700 Received: from smtp1.libero.it (smtp1.libero.it [193.70.192.51]) by mxu3.u.washington.edu (8.12.1+UW01.12/8.12.1+UW02.01) with ESMTP id g4V5Cqg4014717 for ; Thu, 30 May 2002 22:12:53 -0700 Message-Id: <200205310512.g4V5Cqg4014717@mxu3.u.washington.edu> Received: from dialup (151.29.229.206) by smtp1.libero.it (6.5.015) id 3CED54DB00302C83 for classics@u.washington.edu; Fri, 31 May 2002 07:12:52 +0200 Date: Fri, 31 May 2002 06:58 +0200 From: Gianfranco Boggio-Togna To: Classics list Subject: Re: [TANgential] Viruses (was Klez) Alfred M Kriman wrote: > This spoofing is not too surprising, since Klez apparently speaks > SMTP (simple mail transfer protocol) directly rather than through > the local MTA (mail transfer agent). When I have tried speaking > SMTP ("HELO [followed by fake name for myself]" -- the greeting is > vaguely ergative) the other end has usually not been fooled by my > transparent disguise, but MTA behaviors vary, and I wasn't trying > very hard, and I'm not an expert. I send all mail directly through my provider's SMTP server (using a Telnet client, for which I have written a script that handles the dialogue with the server) and I can perhaps shed some light on the matter. Three days ago I sent this simple message to the list server (I keep a log of all Telnet sessions): 220 smtp2.libero.it ESMTP Service (6.5.015) ready HELO dialup 250 smtp2.libero.it MAIL FROM: 250 MAIL FROM: OK RCPT TO: 250 RCPT TO: OK DATA 354 Start mail input; end with . Date: Tue, 28 May 2002 18:39 +0200 From: Gianfranco Boggio-Togna To: Classics server Subject: query versification . 250 <3CED528D001E87F3> Mail accepted [ Lines that start with a number come from the server ] The operand of the HELO command can be any string: the string will show up on the last "Received:" header, together with the IP address. The MAIL FROM command gives the address to be notified if the message cannot be delivered (it becomes the value of the "Return-Path:" header). It need not be the same as the address in the "From:" header; I always use the address at despammed.com, which I got for this purpose. These are the only two commands that give any clue about the identity of the sender. The headers listed between DATA and the dot may contain anything, so long as the (very simple) syntax is right. If your mail program allows you to look at the full headers, the only reliable check you can make is on the last (from the top of the message) "Received:" header, which shows the IP of the sender. The "Return-Path:" header (and the corresponding Unix-style "From " header) is not necessarily significant, though in fact it *is* valid with the current version of the virus: apparently the author has not yet thought of faking the MAIL FROM address (that will go into the next release...) As it happens, I have just received a copy of the virus which provides a good illustration of all this. It also shows a rather nasty turn in its _modus operandi_, which is going to trap many naive users. The message includes these headers: > From: postmaster > To: gbt@acm.org > Subject: Returned mail--"317,113, 317,116, 658,116, 658,113" and this is part of the text: > --ZLI5xa66wd6K276r8023l > Content-Type: text/html; > Content-Transfer-Encoding: quoted-printable > > > > The following mail can't be sent to inet@microsoft.com:
>
> > From: gbt@acm.org
> To: inet@microsoft.com
> > Subject: 317,113, 317,116, 658,116, 658,113
> The attachment is the original mail > > --ZLI5xa66wd6K276r8023l > Content-Type: application/octet-stream; > name=Pkxwd.pif > Content-Transfer-Encoding: base64 > Content-ID: Of course I knew, just from the main headers, that this could not be a genuine message: as I never use the ACM address in the MAIL FROM command, I cannot possibly get a non-delivery message at that address. I had a look at the rest of the headers. The last "Received:" header (which shows the starting point of the message) is this: > Received: from Sipy (node229.phyed.duth.gr [193.92.225.229]) > by ermis.cc.duth.gr (8.12.3/8.12.3) with SMTP id g4UBK285086224 > for ; Thu, 30 May 2002 14:20:02 +0300 (EEST) > (envelope-from nagelous@phyed.duth.gr) and the other header confirms the origin: > Return-Path: [ A competent virus writer would have used something like ] I have already received about a dozen copies of the virus from this address, over several days. Apparently they have not yet realized their computer is infected and I will probably get a few more copies. Not that I am worried at the prospect. I fetch incoming mail from the POP3 server with another Telnet script and I process it with my own software. I do not download any message over 10K, unless it comes from a trusted server, and even if I accidentally downloaded the virus, it could not possibly cause any harm. As an old programmer, I look on these recurring crises with some amusement. A "virus" is just a piece of perfectly harmless ASCII text: only the crass stupidity of some software designers could turn it into a global scourge causing billions of dollars of damage. -- Gianfranco Boggio-Togna Milano (Italy) .