Re: [NTLK] Re - viri

From: Paul Guyot (pguyot_at_kallisys.net)
Date: Mon Oct 14 2002 - 12:30:16 EDT


Let me repeat what Victor said. This virus didn't come from
Newtontalk mailing list server.

>3. the server strips attachments from submitted messages to the the list

Indeed.

>seems like the virus was on the server, because:

On the contrary. Because of your point 3, the message came from outside.

>4. the attachment bypassing the server's rules.

Héhé. You're kidding. The list server isn't running Windows. Of
course, we're concerned about security issues. The biggest risk is
that the list of e-mails could be a gold mine for spammers.

I can't say that no virus will ever take over the list server, but as
long as it runs NetBSD with 5 really active accounts, it's not very
likely.

>7. did *everyone* get the message? if not then it would seem that the vires
>came from someone's PC (not a mac... hehe) that had /those/ addresses that
>did get it

I didn't get it.

And if you got it, you can know somehow if it came from the list by
looking at the headers, and especially the Received headers. The
first ones might be forged (appearing at the bottom), but the last
ones (at the top) are probably not.

>8. is "a_newtonian_at_aol.com" on the mailer software's list of members, past
>or present?if not, the conclusion would be similar to #7

It's not a current list member.

Paul

-- 
NPDS: http://newton.kallisys.net:8080/
Apache: http://www.kallisys.com/

-- Read the List FAQ/Etiquette: http://www.newtontalk.net/faq.html Read the Newton FAQ: http://www.chuma.org/newton/faq/ This is the NewtonTalk mailing list - http://www.newtontalk.net/



This archive was generated by hypermail 2.1.2 : Thu Oct 31 2002 - 12:02:45 EST